OASIS OpenC2 Technical Committee 17 September August 2017 Meeting Minutes

Transcription

1 Call to Order and Introductions The OASIS OpenC2 Technical Committee (TC) Meeting was conducted 16 August 2017, 11:00 am Eastern Time (ET). A mirror OpenC2 TC meeting was also conducted at 21:00 pm ET via WebEx. The presentation package is posted on the OpenC2 TC site OpenC2 TC 16 August 2017 Presentation. Twenty seven members attended the 1100 meeting. Seven members attended the 2100 meeting, with three members unique to the 2100 meeting. The list of attendees follows at the end of the minutes. With the split TC meetings, motions were provisionally accepted. There was a total 24 voting members across the two calls, which was not enough to achieve quorum. Electronic ballots were subsequently generated post TC meeting to officially pass motions. Meeting Agenda Time Topic Presenter 11:00 11:02 Call to Order and Roll Call Joe Brule 11:02 11:04 Approve Minutes of Previous Joe Brule Meeting OpenC2 Subcommittee Reports 11:04 11:09 Implementation Considerations Bret Jordan, David Lemire 11:09 11:13 Actuator Profile Dave Kemp, Jyoti Verma 11:13 11:15 Language Jason Romano, Duncan Sparrell 11:15 11:19 Face to Face Tiger Team Bret Jordan New Business 11:19-11:24 Formation of GitHub Repositories Joe Brule 11:24 11:49 OpenC2 Assumptions and Design Joe Brule, Jason Romano Considerations 11:49 11:53 Proposed APAC WebEx Joe Brule 11:53-11:57 Query for New Business Joe Brule 11:57 11:59 Action Item Review Joyce Fai 12:00 Adjourn Approve Minutes OpenC2 Subcommittee Reports Implementation Considerations SC The minutes of the 13 July OpenC2 TC Meeting were provisionally approved with no objections. However, since we were unable to achieve quorum during the split TC meeting sessions, an electronic ballot was generated to approve the minutes. Each subcommittee provided a brief out on their activities, progress, plans and meeting schedules. We greatly appreciate the efforts of the subcommittee chairs and our members who have joined these efforts. Mr. Bret Jordan provided the brief out of the Implementation Considerations SC at the 1100 ET session. Mr. Dave Lemire provided the Implementation Considerations Subcommittee (IC-SC) brief out at the 2100 ET session. The initial IC-SC meeting was held on 2 August 2017 with nineteen participants. The subcommittee discussed the 1

2 scope, work tempo, and collaboration tools. Two candidate work topics were introduced: IA Implementation Considerations and Transport Specification. Subcommittee members were invited to propose work items and make contributions to reference implementations and use cases. The two suggestions from the 2 August meeting were: a non-normative guidance document for new OpenC2 implementers and use case development. Mr. Duncan Sparrell contributed implementation use cases as a starting point for the use case development effort. OASIS GitHub repositories will be set up by OASIS for use by the OpenC2 TC members. The IC-SC plans to review and develop use cases; review the IA Implementation Considerations document and use it as starting point to convert it into a committee note; identify candidate transport protocols; and incorporate member suggestions. The IS-SC will work closely with the Language and Actuator Profile subcommittees to manage dependencies. The IC-SC meets the 1 st Wednesday of each month at 1300 ET/ 1700 UTC. IC-SC meetings will be announced via OASIS and on the #meetings and #implementation Slack channels. The next meeting is 6 September 1300 ET followed by a meeting on 4 October. WebEx details can be found in the corresponding OpenC2 TC calendar events. Actuator Profile SC Ms. Jyoti Verma provided the brief out of Actuator Profile Subcommittee for both the 1100 and 2100 ET sessions. The initial Actuator Profile SC meeting was held on 26 July 2017 with eleven participants. The subcommittee discussed the scope, work tempo, and collaboration tools. The Actuator Profile SC plans to conduct a data call to products vendors for the set of applicable actions and targets they will support. The goal is to identify common ( foundation ) fields. The OpenC2 Forum developed a number of artifacts that can serve as a starting point for the Actuator Profile SC: generic Actuator Profile template, Router Profile, Firewall Profile, and Software Defined Network Profile. The Actuator Profile SC will transform the current draft actuator profiles into OASIS specifications. The Actuator Profile subcommittee meets on the 2 nd and 4 th Wednesday of each month at 1300 ET/ 1700 UTC. Subcommittee meetings will be announced via OASIS and on the #meetings and #actuator profile Slack channels. The next meeting is 23 August 1300 ET followed by meetings on 13 and 27 September. WebEx details can be found in the corresponding OpenC2 TC calendar events. 2

3 Language SC Mr. Jason Romano provided the Language Subcommittee (SC) brief out at the 1100 ET session. Mr. Duncan Sparrell provided the brief out at the 2100 ET session. The Language Subcommittee has adopted an operating tempo of weekly meetings on Tuesdays, 13:00 ET. Language SC meetings were held on 18 and 25 July and 1, 8, and 15 August. The OpenC2 design principles were reviewed in the Language Subcommittee. The update of the Language Specification is underway on Googledocs. The OpenC2 Glossary has been established in GitHub and a Wiki has been established to capture the decisions made. Future agenda items include getting agreed to changes into the working draft, adding content to the Glossary and making use cases. The Language Subcommittee meets every Tuesday of each month at 1300 ET/ 1700 UTC. Subcommittee meetings will be announced via OASIS and on the #meetings and #language Slack channels. The upcoming meetings are on 22, 29 August and 5, 12, and 19 September at 1300 ET. WebEx details can be found in the corresponding OpenC2 TC calendar events. Face to Face Tiger Team New Business Formation of GitHub Repositories Mr. Bret Jordan provided an update on the Face to Face Tiger Team. Face to face meetings provide a means of having high bandwidth discussions to talk through complicated and detailed topics. No decisions are made at a face to face meeting. They will typically occur 2-3 times a year. We will need people / organizations willing to host and provide remote access via a phone bridge. The motion was made for Duncan Sparrell to chair the Face to Face Tiger Team. The motion was seconded by Mr. Chris Ricard. The motion was carried. The team will work to understand the demographics of the participants and setting up a Face to Face early next year. Mr. Joe Brule detailed the establishment of eight OASIS GitHub repositories to house the prototype reference implementation code and tools. The maintainer for each GitHub repository is an OASIS member. For four of the repositories, the proposed technical leads are non-oasis members. The technical leads will sign the CLA that covers all the IPR. The motion to approve Josh Brule as the technical lead for the yuuki GitHub repository was seconded by Mr. Duncan Sparrell. The motion was carried with provisional approval and no objections at the 1100 TC session. The motion to approve Adam Bradbury as the technical lead for the OrchID, ReactorRelay, and ReactorMaster, was seconded by Duncan Sparrell. The motion was carried with provisional approval and no objections at the 1100 TC session. Because we did not achieve quorum, electronic ballots will be issued for the approval of the eight GitHub repositories. 3

4 OpenC2 Assumptions and Design Considerations Mr. Joe Brule briefed OpenC2 Assumptions and Design Considerations. The previous week, the Language Subcommittee had a similar briefing and had agreed in principle to the assumptions and design considerations. The assumptions and design considerations are used as guidelines to make decisions in the definition of the OpenC2 language. They were used by the OpenC2 Forum prior to the transition to OASIS. First and foremost, the end goal of OpenC2 is interoperability. OpenC2 defined a scope, stays within that scope, and ensures that there are hooks into the external dependencies. OpenC2 leverages, to the greatest extent practical, pre-existing standards (e.g., transport, information assurance, integrity). We will not create a complex OpenC2 command structure to address all the external dependencies. The intent is to re-use what is already out there. A language has to have the ability and agility to adapt to future technologies and capabilities. The OpenC2 language will need the means to accommodate the future and extend as necessary. OpenC2 focuses on one part of cyber defense, the action portion. OpenC2 assumes that the analytics has been done and decision making has determined what type of action is to be taken. OpenC2 assumes the transmission link is assured and the authorization is in place. What kind of characteristics can we assume about a command and control language? What we are doing (action) has been largely the same. What we are protecting ourselves against has remained the same and is relatively stable. Cyber defense vendors are creating new products and new means to perform cyber defense. Actuators represent the more dynamic area of research and development. The Design Principles for the machine to machine exchange of command and control messages are lightweight, abstract, extensible and agnostic. OpenC2 can be a lightweight protocol because it is agnostic of external dependencies (e.g., transport, information assurance). But it is recognized that they are absolutely necessary for any successful implementation. Mr. Bret Jordan re-iterated that transport and authentication will be handled in the Implementation Considerations Subcommittee. The IC-SC will look for the right balance where classes of systems use the same type of transport (e.g., IOT, intranetworking, connected cars). Within certain classes of systems, we need to use the same transport for interoperability. Mr. Duncan Sparrell noted that there was a Design Principle that has been part of OpenC2 discussions but was not quite captured. For interoperability purposes, there is one way to do something. The recommendation was made to add unambiguous in front of machine to machine exchanges. One way to do things allows us to maintain fidelity of the information. Mr. Bret Jordan pointed out that we don t want products to interpret the same action differently. OpenC2 decouples the actions and targets, treating actuators as separate entities. 4

5 For high level effects based command, inter domain, communicate the idea, action and target may be sufficient. You can take the same high level command and add precision by adding specifier and options.you can add specifiers and options to the target and actuator for additional precision. What vendor products do and how they do it can be captured in actuator options which can carry the additional detail. The approach is to keep high level assumptions and design in principles in the Language Specification. The Language Specification would contain the universe of actions and targets, how to build a command, and how to build an actuator profile. Each actuator profile contains the action target pairs for a set of cyber defense specific functions. Status/Resolution of Actions All actions items are closed. The working tempo of the OpenC2 TC and subcommittees has been settled. The TC discussed the approach for reaching resolutions across two separate TC meetings. Mr. Trey Darley wanted to ensure that if we are taking decisions across two meetings that any objections were properly debated across the two TC sessions. He wanted to ensure that if objections were raised in either session that there was a democratic process which would allow interested members to participate in substantive debate. Ultimately, we would need to reach resolutions through electronic ballots. Mr. Joe Brule proposed that if we have not reached quorum in the first TC session but have provisional acceptance (i.e., no objections) to a motion, and complete quorum in the second TC session with no objections, then the motion can carry. With that clarification, Mr. Trey Darley withdrew his objection. If we are unable to reach quorum across the split TC meetings, we will do an electronic ballot. Mr. Bret Jordan recommended that we inform our members of decisions and discussions through to see if there are any objections. An action was taken to send out an to the OpenC2 TC members in the event of provisional acceptances and objections to any motions to see if anyone else has comments. Poll for New Business Motion to Adjourn Ms. Dee Schur announced that OASIS and First will be co-hosting Borderless Cyber Security in Prague 6-8 December They would like to extend an invitation to the OpenC2 TC to have a face to face meeting on 4-5 of December. The main program will be conducted 6-7 December with a tentative training program on December 8 th. OASIS and First will provide the space and support. Dee Schur will set up an electronic ballot to see who is interested in attending. A motion to adjourn the meeting was made and seconded. 5

6 OpenC2 TC Attendees August 16, 2017 Name Company Brown, Iain GDS Brule, Joe ~ Cover, Robin OASIS Darley, Trey Everett, Alex University of North Carolina at Chapel Hill Fai, Joyce ~ Hagen, Stefan Individual Humphrey, Nick Huntsman Security Hunt, Christian Jordan, Bret Symantec Corp. Kakumaru, Takahiro * NEC Corporation Kemp, David Kirillov, Ivan Mitre Corporation Lemire, David ~ G2 Martinez, Danny G2 Meck, James FireEye, Inc. Moore, Sean Centripetal Networks Ortiz, Efrain Symantec Corp. Patrick, Paul FireEye, Inc. Ricard, Chris Financial Services Information Sharing and... Riedel, Daniel Romano, Jason Royer, Philip Phantom Schur, Dee OASIS Skeen, Duane Northrop Grumman Sparrell, Duncan ~ sfractal Consulting LLC Storms, Andrew * Stueve, Gerald * Fornetix Verma, Jyoti ~ Cisco Systems Westerberg, Glen Centripetal Networks *Attended 2100 ET ~ Attended both 1100 and 2100 ET 6