One document matched: draft-trammell-mile-template-01.xml
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE rfc SYSTEM "rfc2629.dtd">
<rfc ipr="trust200902" category="info" docName="draft-trammell-mile-template-01.txt">
<?rfc compact="yes"?>
<?rfc subcompact="no"?>
<?rfc toc="yes"?>
<?rfc symrefs="yes"?>
<front>
<title abbrev="MILE Template">
Guidelines for Extensions to IODEF for Managed Incident Lightweight Exchange
</title>
<author initials="B." surname="Trammell" fullname="Brian Trammell">
<organization abbrev="ETH Zurich">
Swiss Federal Institute of Technology Zurich
</organization>
<address>
<postal>
<street>Gloriastrasse 35</street>
<city>8092 Zurich</city>
<country>Switzerland</country>
</postal>
<phone>+41 44 632 70 13</phone>
<email>trammell@tik.ee.ethz.ch</email>
</address>
</author>
<date month='July' day='26' year='2011' />
<area>Security</area>
<workgroup>Individual Submission</workgroup>
<abstract>
<t>This document provides guidelines for extensions to <xref target="RFC5070">IODEF</xref> for lightweight exchange of incident management data, and contains a template for Internet-Drafts describing those extensions, in order to ease the work and improve the quality of extension descriptions.</t>
</abstract>
</front>
<middle>
<section title="Introduction" anchor="sec-intro">
<t>Since the specification of <xref target="RFC5070">IODEF</xref>, the
evolution of the threat environment and the practice of cooperative network
defense, along with continued implementation and deployment, has indicated
the need for guidelines for the implementation and extension of IODEF. This
document provides these guidelines. It starts by describing the
applicability of IODEF extensions, and the IODEF extension mechanisms,
before providing a section <xref target="sec-template"/> that is itself
designed to be copied out and filled in as the starting point of an
Internet-Draft about an IODEF extension.</t>
</section>
<section title="Applicability of Extensions to IODEF">
<t>Before deciding to extend IODEF, the first step is to determine whether an IODEF extension is a good fit for a given problem. There are two sides to this question:</t>
<list style="numbers">
<t>Does the problem involve the reporting or sharing of information about an incident? "Incident" is not defined in the terminology for IODEF, but for purposes of IODEF can be loosely described as "something that happened that has some impact on the information security situation of an entity", with quite a bit of leeway for interpretation. If the answer to this question is unequivocally "No", then IODEF is probably not a good choice as a base technology for the application area.</t>
<t>Can IODEF adequately represent information about the incident without extension? IODEF has a reasonably rich set of incident-relevant classes. If, after examination of the problem area and the IODEF specification, the answer to this question is "Yes", then extension is not necessary.</t>
</list>
<t>A non-exhaustive list of good candidate extensions to IODEF includes:</t>
<list style="numbers">
<t>Allowing standardized reference to external information bases about incidents and incident-relevant information: leveraging existing work in describing aspects of incidents to make IODEF more expressive</t>
<t>Allowing the description of new types of entities (e.g., related actors) or new types of characteristics of entities (e.g., financial services-related information) involved in an IODEF incident report</t>
<t>Allowing additional semantic or metadata labeling of IODEF Documents (e.g., for handling or disposition instructions, or compliance with data protection and data retention regulations)</t>
</list>
</section>
<section title="Selecting a Mechanism for IODEF Extension" anchor="sec-mechanisms">
<t>IODEF was designed to be extended through any combination of:</t>
<list style="numbers">
<t>extending the enumerated values of Attributes, as per section 5.1 of <xref target="RFC5070"/>;</t>
<t>class extension through AdditionalData and RecordItem elements, as per section 5.2 of <xref target="RFC5070"/>; and/or</t>
<t>containment of the IODEF-Document element within an external XML Document, itself containing extension data.</t>
</list>
<t>Note that in this final case, the extension will not be directly
interoperable with IODEF implementations, and must "unwrap" the IODEF
document from its container; nevertheless, this may be appropriate for
certain use cases involving integration with IODEF within external
schemas. Extensions using containment of an IODEF-Document are not further
treated in this document, though the document template in <xref
target="sec-template"/> may be of some use in defining them.</t>
<t>Certain attributes containing enumerated values within certain IODEF
elements may be extended. For an attribute named "foo", this is achieved
by giving the value of "foo" as "ext-value", and adding a new attribute
named "ext-foo" containing the extended value. The attributes which can be
extended in this way are defined in <xref target="RFC5070"/>, and limited
to only these:</t>
<list style="symbols">
<t>Incident@purpose</t>
<t>Contact@role</t>
<t>Contact@type</t>
<t>RegistryHandle@registry</t>
<t>Impact@type</t>
<t>TimeImpact@metric</t>
<t>TimeImpact@duration</t>
<t>HistoryItem@action</t>
<t>Expectation@action</t>
<t>System@category</t>
<t>Counter@type</t>
<t>Counter@duration</t>
<t>Address@category</t>
<t>NodeRole@category</t>
<t>RecordPattern@type</t>
<t>RecordPattern@offsetunit</t>
<t>AdditionalData@dtype</t>
<t>RecordItem@dtype</t>
</list>
<t>An example definition of an attribute extension is given in <xref
target="ext-defenum"/>.</t>
<t>IODEF documents can contain extended scalar or XML data using an
AdditionalData element or a RecordItem element. Scalar data extensions
MUST set the "dtype" attribute of the containing element to the data type
to reference one of the IODEF data types as enumerated in <xref
target="sec-types"/>, and SHOULD define the use the "meaning" and
"formatid" attributes to explain the content of the element.</t>
<t>XML extensions within an AdditionalData or RecordItem element use a
dtype of "xml", and SHOULD define a schema for the root element within the
AdditionalData or RecordItem attribute. An example definition of an
element definition is given in <xref target="ext-defelem"/>.</t>
</section>
<section title="Document Template" anchor="sec-template">
<t>Documents describing an IODEF extension should follow the document
template given in this section.</t>
<section title="Introduction" anchor="ext-intro">
<t>The introduction section introduces the problem being solved by the
extension, and motivates the development and deployment of the
extension.</t>
</section>
<section title="Terminology" anchor="ext-terminology">
<t>The terminology section introduces and defines terms specific to the
document. Terminology from <xref target="RFC5070"/> or <xref
target="RFC6045"/> should be referenced in this section, but not redefined
or copied. If <xref target="RFC2119"/> terms are used in the document,
this should be noted in the terminology section.</t>
</section>
<section title="Applicability" anchor="ext-applicability">
<t>The applicability section defines the use cases to which the extension
is applicable, and details any requirements analysis done during the
development of the extension. The primary goal of this section is to allow
readers to see if an extension is indeed intended to solve a particular
problem. This should also the scope of the extension, as appropriate, by
pointing out any non-obvious situations to which it is not intended to
apply.</t>
<t>In addition to defining the applicability, this section may also
present example situations, which should then be detailed in the examples
section, below.</t>
</section>
<section title="Extension Definition" anchor="ext-definition">
<t>This section defines the extension.</t>
<t>Extensions to enumerated types are defined in one subsection for each
attribute to be extended, enumerating the new values with an explanation
of the meaning of the new value. An example enumeration extension is shown
in <xref target="ext-defenum"/>, below.</t>
<t>Element extensions are defined in one subsection for each element, in
top-down order, from the element contained within AdditionalData or
RecordItem; an example element extension is shown in <xref
target="ext-defelem"/>, below. Each element should be described by a UML
diagram as in <xref target="fig-element"/>, followed by a description of
each of the attributes, and a short description of each of the child
elements. Child elements should then be defined in a subsequent
subsection, if not already defined in the IODEF document itself, or in
another referenced MILE extension document.</t>
<figure title="Example UML Element Diagram" anchor="fig-element">
<artwork><![CDATA[
+---------------------+
| Element |
+---------------------+
| TYPE attribute0 |<>----------[ChildExactlyOne]
| TYPE attribute1 |<>--{0..1}--[ChildZeroOrOne]
| |<>--{0..*}--[ChildZeroOrMore]
| |<>--{1..*}--[ChildOneOrMore]
+---------------------+
]]></artwork>
</figure>
<t>Elements containing child elements should indicate the multiplicity of those child elements, as shown in the figure above. Allowable TYPEs are discussed in the following subsection.</t>
<section title="IODEF Data Types" anchor="sec-types">
<t>The allowable TYPEs for attributes within IODEF are enumerated in section 2 of <xref target="RFC5070"/>, and consist of:</t>
<list style="symbols">
<t>INTEGER</t>
<t>REAL</t>
<t>CHARACTER</t>
<t>STRING</t>
<t>ML_STRING (for strings in encodings other than that of the enclosing document)</t>
<t>BYTE for bytes or byte vectors in Base 64 encoding</t>
<t>HEXBIN for bytes in ascii-hexadecimal encoding</t>
<t>ENUM for enumerated types; allowable values of the enumeration must be defined in the attribute definition</t>
<t>DATETIME for <xref target="RFC3339">ISO 8601:2000</xref> encoded timestamps</t>
<t>TIMEZONE for timezones as encoded in section 2.9 of <xref target="RFC5070"/>.</t>
<t>PORTLIST for port lists as encoded in section 2.10 of <xref target="RFC5070"/>.</t>
<t>POSTAL for postal addresses as defined in section 2.23 of <xref target="RFC4519"/>.</t>
<t>NAME for names of natural or legal persons as defined in section 2.3 of <xref target="RFC4519"/>.</t>
<t>PHONE for telephone numbers as defined in section 2.35 of <xref target="RFC4519"/>.</t>
<t>EMAIL for email addresses as defined in section 3.4.1. of <xref target="RFC2822"/>.</t>
<t>URL for URLs as in <xref target="RFC2396"/>.</t>
</list>
<t>In addition to these simple data types, IODEF provides a compound
data type for representing network address information. Addresses
included within an extension element should be represented by containing
an IODEF:Address element, which supports IPv4 and <xref
target="RFC2373"/> IPv6 addresses, as well as MAC, ATM, and BGP
autonomous system numbers. Application-layer addresses should be
represented with the URL simple attribute type, instead.</t>
</section>
<section title="Example Enumerated Type Extension Definition: E.164 Address" anchor="ext-defenum">
<t>This example extends the IODEF Address element to support the encoding of ENUM-mapped telephone numbers <xref target="RFC6116"/>.</t>
<t>Attribute: Address@category</t>
<t>Extended value(s): enum-e164</t>
<t>Content format: An E.164 telephone number encoded as a domain name in the e164.int space, e.g. "2.1.2.1.5.5.5.2.1.2.1.e164.int." for +1 212 555 1212, as per section 3.2 of <xref target="RFC6116"/>.</t>
<t>Additional considerations: none.</t>
</section>
<section title="Example Element Definition: Test" anchor="ext-defelem">
<t>This example defines the Test class for labeling IODEF test data.</t>
<t>The Test class is intended to be included within an AdditionalData element in an IODEF Document. If a Test element is present, it indicates that an IODEF Document contains test data, not a reference to a real incident.</t>
<t>The Test class contains information about how the test data was generated.</t>
<figure title="The Test class" anchor="fig-test">
<artwork><![CDATA[
+---------------------+
| Test |
+---------------------+
| ENUM category |
| STRING generator |
| |
| |
+---------------------+
]]></artwork>
</figure>
<t>The Test class has two attributes:</t>
<list style="hanging">
<t hangText="category: ">Required. ENUM. The type of test data. The permitted values for this attribute are shown below. The default value is "unspecified".
<list style="numbers">
<t>unspecified. The document contains test data, but no further information is available.</t>
<t>internal. The test data is intended for the internal use of an implementor, and should not be distributed or used outside the context in which it was generated.</t>
<t>unit. The test data is intended for unit testing of an implementation, and may be included with the implementation to support this as part of the build and deployment process.</t>
<t>interoperability. The test data is intended for interoperability testing of an implementation, and may be freely shared to support this purpose.</t>
</list>
</t>
<t hangText="generator: ">Optional. STRING. A free-form string identifying the person, entity, or program which generated the test data.</t>
</list>
</section>
</section>
<section title="Examples" anchor="ext-examples">
<t>This section contains example IODEF-Documents illustrating the
extension. If example situations are outlined in the applicability
section, documents for those examples should be provided in the same order
as in the applicability section. Example documents should be tested to
validate against the schema given in the appendix.</t>
</section>
<section title="Security Considerations" anchor="ext-security">
<t>[SECDIR and RFC-EDITOR NOTE: Despite the title, this section is NOT a
Security Considerations section, rather a template Security Considerations
section for future extension documents to be built from this template. See
<xref target="sec-security"/> for Security Considerations for this
document.]</t>
<t>Any <xref target="RFC3552">security considerations</xref> raised by
this extension or its deployment should be detailed in this section.
Guidance should focus on ensuring the users of this extension do so in a
secure fashion, with special attention to non-obvious implications of the
transmission or storage of the information represented by an
extension.</t>
</section>
<section title="IANA Considerations" anchor="ext-iana">
<t>[IANA and RFC-EDITOR NOTE: Despite the title, this section is NOT an
IANA Considerations section, rather a template IANA Considerations section
for future extension documents to be built from this template. See <xref
target="sec-iana"/> for IANA Considerations for this document.]</t>
<t>Any <xref target="RFC5226">IANA considerations</xref> for the document
should be detailed in this section; if none, the section should exist and
contain the text "this document has no actions for IANA".</t>
<t>IODEF Extensions adding elements to the AdditionalData section of an
IODEF document should register their own namespaces and schemas for
extensions with IANA; therefore, this section should contain at least a
registration request for the namespace and the schema, as follows,
modified as appropriate for the extension:</t>
<t>Registration request for the IODEF My-Extension namespace:</t>
<t> URI: urn:ietf:params:xml:ns:iodef-myextension-1.0 </t>
<t> Registrant Contact: Refer here to the authors' addresses section of the document, or to an organizational contact in the case of an extension supported by an external organization.</t>
<t> XML: None </t>
<t>Registration request for the IODEF My-Extension XML schema:</t>
<t> URI: urn:ietf:params:xml:schema:iodef-myextension-1.0 </t>
<t> Registrant Contact: Refer here to the authors' addresses section of the document, or to an organizational contact in the case of an extension supported by an external organization.</t>
<t> XML: Refer here to the XML Schema in the appendix of the document, or to a well-known external reference in the case of an extension with an externally-defined schema.</t>
</section>
<section title="Appendix: XML Schema Definition for Extension" anchor="ext-schema">
<t>The XML Schema describing the elements defined in the Extension Defintion section is given here. Each of the examples in section <xref target="ext-examples"/> should be verified to validate against this schema by automated tools.</t>
</section>
</section>
<section title="Security Considerations" anchor="sec-security">
<t>This document defines a template for MILE extensions to the IODEF and RID
documents; as such, it has no security considerations on its own.</t>
</section>
<section title="IANA Considerations" anchor="sec-iana">
<t>This document has no actions for IANA.</t>
</section>
</middle>
<back>
<references title="Normative References">
<?rfc include="reference.RFC.5070" ?>
<?rfc include="reference.RFC.6045" ?>
</references>
<references title="Informative References">
<?rfc include="reference.RFC.2119" ?>
<?rfc include="reference.RFC.2373" ?>
<?rfc include="reference.RFC.2396" ?>
<?rfc include="reference.RFC.2822" ?>
<?rfc include="reference.RFC.3339" ?>
<?rfc include="reference.RFC.3552" ?>
<?rfc include="reference.RFC.4519" ?>
<?rfc include="reference.RFC.5226" ?>
<?rfc include="reference.RFC.6116" ?>
</references>
</back>
</rfc>| PAFTECH AB 2003-2026 | 2026-04-24 05:41:51 |