State of the Practice of Computer Security Incident Response Teams ...

According to the INCH WG Charter and Scope, “The purpose of the Incident Handling
Working Group is to define data formats for communication between
• a CSIRT and its constituency (e.g., users, customers, trusted reporters) which reports system
misuse;
• a CSIRT and parties involved in an incident investigation (e.g., law enforcement, attacking
site); and
• collaborating CSIRTs sharing information” [INCH 02].
Deliverables and outputs from the working group include:
• “A document describing the high-level functional requirements of a data format for collaboration
between CSIRTs and parties involved when handling computer security incidents.
• A specification of the extensible, incident data language that describes the data formats
that satisfy the requirements.
• Guidelines for implementing the WG data format (Output #2 of the WG).
• A set of sample incident reports and their associate representation in the incident data
language” [INCH 02].
For more information see:
http://www.ietf.org/html.charters/inch-charter.html
3.10.2.2 IETF Intrusion Detection Working Group (IDWG)
According to the charter of this working group, “The purpose of the Intrusion Detection
Working Group is to define data formats and exchange procedures for sharing information of
interest to intrusion detection and response systems, and to management systems which may
need to interact with them” [IDMEF 02].
The IDMEF data model and XML data definition document can be read at:
http://www.ietf.org/internet-drafts/draft-ietf-idwg-requirements-10.txt
For more information see:
http://www.ietf.org/html.charters/idwg-charter.html
3.10.2.3 Common Advisory Interchange Format (CAIF)
The purpose of this project is to design a standardized structure and format for creating and
exchanging security advisories [CAIF 02]. A subscriber mailing list and a description of the
CAIF requirements are available from the project’s web site.
CMU/SEI-2003-TR-001 123