OASIS OpenC2 Technical Committee 14 November October 2017 Meeting Minutes

Transcription

1 Call to Order and Introductions The OASIS OpenC2 Technical Committee (TC) Meeting was conducted 18 October 2017, 11:00 am Eastern Time (ET) via WebEx. A mirror OpenC2 TC meeting was also conducted at 21:00 pm ET via WebEx. The final presentation package is posted on the OpenC2 TC site OASIS OpenC2 TC 18 Oct 2017 Final Presentation. A combined total of twenty-six members attended the 1100 and the 2100 meeting. The list of attendees follows at the end of the minutes. There were twenty-one voting members in the morning meeting, allowing us to achieve quorum (17 needed) at the 1100 ET meeting. Six members attended the 2100 ET meeting, with two members unique to the 2100 ET meeting. A total of twenty-three voting members attended between the two split TC meetings. Meeting Agenda Time Topic Presenter 11:00 11:10 Call to Order and Roll Call Joe Brule Approve Minutes of Previous Joe Brule Meeting Announcement IACD Community Day 11:10 11:20 OpenC2 Subcommittee Reports Implementation Considerations Bret Jordan, David Lemire Actuator Profile Language Dave Kemp, Jyoti Verma Jason Romano, Duncan Sparrell 11:20 11:25 Face to Face Tiger Team Duncan Sparrell 11:25 11:50 New Business OpenC2 Language Community Specification Draft Duncan Sparrell 11:50 12:00 Wrap Up Query for Walk-on Items Action Item Review 12:00 Adjourn Joe Brule Joyce Fai Approve Minutes Announcements The motion to accept the minutes of the 20 September 2017 OpenC2 TC Meeting was carried with provisional approval and no objections at the 1100 meeting where we had reached quorum. The motion to approve the minutes at the 2100 meeting was also carried, with no objections. OASIS and First will be co-hosting Borderless Cyber Security in Prague 6-8 December An OpenC2 representative will be there. Use the OpenC2 discount code to save 100 euros. The OpenC2 breakout session at IACD Community was well received. There were 1

2 about twenty people at the breakout session. OpenC2 was mentioned in two key notes, with one Financial institution stating that OpenC2 is needed now. OpenC2 Subcommittee Reports Implementation Considerations SC (IC-SC) Each subcommittee provided a brief out on their activities, progress, plans and meeting schedules. We greatly appreciate the efforts of the subcommittee co-chairs and our members who have joined these efforts. Mr. Dave Lemire briefed that at the 4 October 2017 Implementation Consideration Subcommittee meeting, the subcommittee members held an in-depth discussion on the relationship of OpenC2 to the STIX Course of Action (COA). They reached a general agreement on the need for flow control (e.g., message sequencing, action triggers, serial/parallel execution, command ID/referencing). But they have not yet reached consensus on the division of responsibility. At the 2100 OpenC2 TC Meeting, a playbook was described as being comprised of one or more courses of actions. Within a COA, there are action steps that translate into atomic things like an OpenC2 command. The IC-SC is looking for input on use cases of complete end-to-end operational flows. There are three documents available for comment in the Implementation Considerations folder on the OpenC2 Google Drive: IA Considerations document, Relation To document, and Ecosystem Considerations document. Initial feedback on the IA Considerations is that it is useful, general IA but needs to be more focused for OpenC2. OpenC2 Code Repositories for prototype and reference implementations have been established on GitHub &type=&language=. Three repos have been populated but there remains four repos from the OpenC2 Forum that need to be ported. Owners/maintainers are encouraged to move their code to the OpenC2 GitHub repositories. Mr. Duncan Sparrell commented that he would like to see the IC-SC move at a faster tempo and perhaps meet more than once a month. The IC-SC typically meets the 1 st Wednesday of each month at 1300 ET/ 1700 UTC. IC- SC meetings will be announced via OASIS and on the #meetings and #implementation Slack channels. WebEx details can be found in the corresponding OpenC2 TC calendar events. Actuator Profile SC Mr. Dave Kemp provided the brief out of the Actuator Profile Subcommittee for the 1100 ET session and Mr. Joe Brule provided the brief out at the 2100 ET session. The Actuator Profile SC has determined that it will work on three common types of actuator profiles in the first release: generic, endpoint, and network. Further details on the product categories and functions OpenC2 Actuator Profiles will cover are captured in the Actuator Profile Roadmap in Google docs. 2

3 At the September TC, the Actuator Profile SC announced a data call to product vendors and users for the set of applicable actions and targets they will support using OpenC2. There has been limited response to the action item as the Actuator Profile SC would like to use an agreed to target list in their action item response. The action item will remain open at this juncture. The Actuator Profile subcommittee meets on the 2 nd and 4 th Wednesday of each month at 1300 ET/ 1700 UTC. Subcommittee meetings will be announced via OASIS and on the #meetings and #actuator profile Slack channels. The next meeting is 25 October 1300 ET followed by meetings on 8 and 22 November. WebEx details can be found in the corresponding OpenC2 TC calendar events. Language SC Mr. Duncan Sparrell and Mr. Jason Romano spearheaded the Language Subcommittee (SC) brief outs. The Language Subcommittee has adopted an operating tempo of weekly meetings on Tuesdays, 13:00 ET. Language SC meetings were held on 26 September and 3, 10, and 17 October. Since the September OpenC2 TC meeting, the bulk of the Language Subcommittee meetings have been devoted to the review of the first 13 pages of the Language Specification Draft. These first 13 pages contain boilerplate material and the list and definitions of OpenC2 actions. The Language Subcommittee had deleted two actions (augment and distill) and added one action (create). In addition, the Language Subcommittee has established an agile approach for a work plan to incrementally develop and review the Language Specification in a set of manageable chunks. The work plan is below. The Language Subcommittee has completed its first chunk, the boilerplate and actions. Next month the Language Subcommittee will be working on the property tables, targets, and JSON structure. Oct TC Committee Draft Spec v0.1.0 Get the process going Boilerplate and Actions Nov TC Committee Draft Spec v0.2.0 Property tables, Targets, JSON structure Skip if v0.1.0 hung in process, go right to v Dec TC Committee Draft Spec v0.3.0 Conformance Section, Responses, Alerts, Modifiers and all details left open in.1,.2 fixed Jan TC Committee Spec v1.0.0 Actuator Info (what in LS) The Language Subcommittee is now using Google Docs for interactive issues resolution instead and added a playground area. Effort on the OpenC2 Glossary has progressed. The Language Subcommittee is tackling terms like orchestration. Use cases are an important aspect of strengthening the language. 3

4 Subcommittee meetings will be announced via OASIS and on the #meetings and #language Slack channels. The upcoming meetings are 24 and 31 October and 7, 14, and 21 November at 1300 ET. WebEx details can be found in the corresponding OpenC2 TC calendar events. Face to Face Tiger Team Mr. Duncan Sparrell reported that the survey is still open. The survey results are in Slack. Most members want to meet face to face 2-3x a year. Four individuals volunteered to host an OpenC2 Face to Face. Contact Mr. Duncan Sparrell for the first crack of setting a date for the inaugural face to face. New Business OpenC2 Language Community Specification Draft On Wednesday, 11 October, Mr. Duncan Sparrell, sent an to the OASIS OpenC2 Members, stating his intent to make a motion at the October 18 OpenC2 TC to approve the first increment of the OpenC2 Language Specification. At the TC, Mr. Duncan Sparrell made the following motion: I move that the TC approve the OpenC2 Language Specification V1.0 Working Draft 01 and all associated artifacts packaged together in as a Committee Specification Draft 01 and designate the PDF version of the specification as authoritative. This motion was seconded by Mr. Sounil Yu. Mr. Allan Thomson objected to calling for a vote during the TC meeting. He proposed postponing the vote to an electronic ballot to give members more time to review the draft and allow people who were unable to attend the TC meeting due to the conflicting CTI TC meeting to participate in the vote on the Committee Specification Draft. A motion was made to postpone consideration on accepting OpenC2 Language Specification V1.0 Working Draft 01 as CSD Draft 01 to an electronic ballot. Mr. Duane Skeen seconded the motion. The TC Co-chair, Mr. Joe Brule, indicated that the OpenC2 TC was formed so that its subcommittees were set up to do the hard work and deliberation and then make their recommendations to the TC. It appeared that we may need to clarify the standing rules and further socialize the incremental, agile approach for developing the Language Specification. Given these circumstances, Mr. Joe Brule, requested that we proceed with an electronic ballot using agreed to and appropriate wording of the electronic ballot. It was noted by Mr. Duncan Sparrell that he did not think the right procedure was being followed. The voting members at the TC were not given the opportunity to vote on the original motion. It was acknowledged at the 2100 TC Meeting that there should have been further deliberation on the motions before going ahead with the approach for an electronic ballot. 4

5 Status/Resolution of Actions The Actuator Profile Data Call will remain open as an action item to allow product vendors and users more time. The OASIS Users Council briefing will be posted when completed. An action was taken to create an electronic ballot posing the question as a Do You Approve? Poll for New Business Motion to Adjourn There was no new business. Upcoming TC meetings are scheduled for: November 15 at 11:00 and 21:00 Eastern (15:00 and 01:00 UTC) December 20 at 11:00 and 21:00 Eastern (15:00 and 01:00 UTC) January 17 at 11:00 and 21:00 Eastern (15:00 and 01:00 UTC) Mr. Duncan Sparrell made a motion to adjourn the meeting and Mr. Dave Lemire seconded the motion. 5

6 Name Andrenacci, Andrea Brule, Joe ~ De Bernardi, Andrea Fai, Joyce ~ Farral, Travis Hagen, Stefan Humphrey, Nick Jordan, Bret * Kakumaru, Takahiro * Kemp, David Lemire, David ~ Liu, Jason MacGregor, Scott Martinez, Danny Meck, James Ortiz, Efrain Patrick, Paul Romano, Jason Royer, Philip Skeen, Duane Sparrell, Duncan ~ Stueve, Gerald Thomson, Allan Webb, Jason Young, Dennis Moviri SPA OpenC2 TC Attendees October 18, 2017 Moviri SPA Anomali Individual Huntsman Security Symantec Corp. NEC Corporation G2 Northrop Grumman McAfee G2 FireEye, Inc. Symantec Corp FireEye, Inc. Phantom Northrop Grumman sfractal Consulting LLC Fornetix LookingGlass LookingGlass FireEye, Inc. Yu, Sounil Bank of America *Attended 2100 ET ~ Attended both 1100 and 2100 ET Company 6