ITU-T X 1541-2017 Incident object description exchange format version 2 (Study Group 17).pdf

1、 I n t e r n a t i o n a l T e l e c o m m u n i c a t i o n U n i o n ITU-T X.1541 TELECOMMUNICATION STANDARDIZATION SECTOR OF ITU (09/2017) SERIES X: DATA NETWORKS, OPEN SYSTEM COMMUNICATIONS AND SECURITY Cybersecurity information exchange Event/incident/heuristics exchange Incident object descrip

2、tion exchange format version 2 Recommendation ITU-T X.1541 ITU-T X-SERIES RECOMMENDATIONS DATA NETWORKS, OPEN SYSTEM COMMUNICATIONS AND SECURITY PUBLIC DATA NETWORKS X.1X.199 OPEN SYSTEMS INTERCONNECTION X.200X.299 INTERWORKING BETWEEN NETWORKS X.300X.399 MESSAGE HANDLING SYSTEMS X.400X.499 DIRECTOR

3、Y X.500X.599 OSI NETWORKING AND SYSTEM ASPECTS X.600X.699 OSI MANAGEMENT X.700X.799 SECURITY X.800X.849 OSI APPLICATIONS X.850X.899 OPEN DISTRIBUTED PROCESSING X.900X.999 INFORMATION AND NETWORK SECURITY General security aspects X.1000X.1029 Network security X.1030X.1049 Security management X.1050X.

4、1069 Telebiometrics X.1080X.1099 SECURE APPLICATIONS AND SERVICES (1) Multicast security X.1100X.1109 Home network security X.1110X.1119 Mobile security X.1120X.1139 Web security X.1140X.1149 Security protocols (1) X.1150X.1159 Peer-to-peer security X.1160X.1169 Networked ID security X.1170X.1179 IP

5、TV security X.1180X.1199 CYBERSPACE SECURITY Cybersecurity X.1200X.1229 Countering spam X.1230X.1249 Identity management X.1250X.1279 SECURE APPLICATIONS AND SERVICES (2) Emergency communications X.1300X.1309 Ubiquitous sensor network security X.1310X.1319 Smart grid security X.1330X.1339 Certified

6、mail X.1340X.1349 Internet of things (IoT) security X.1360X.1369 Intelligent transportation system (ITS) security X.1370X.1389 Distributed legder technology security X.1400X.1429 Security protocols (2) X.1450X.1459 CYBERSECURITY INFORMATION EXCHANGE Overview of cybersecurity X.1500X.1519 Vulnerabili

7、ty/state exchange X.1520X.1539 Event/incident/heuristics exchange X.1540X.1549 Exchange of policies X.1550X.1559 Heuristics and information request X.1560X.1569 Identification and discovery X.1570X.1579 Assured exchange X.1580X.1589 CLOUD COMPUTING SECURITY Overview of cloud computing security X.160

8、0X.1601 Cloud computing security design X.1602X.1639 Cloud computing security best practices and guidelines X.1640X.1659 Cloud computing security implementation X.1660X.1679 Other cloud computing security X.1680X.1699 For further details, please refer to the list of ITU-T Recommendations. Rec. ITU-T

9、 X.1541 (09/2017) i Recommendation ITU-T X.1541 Incident object description exchange format version 2 Summary Recommendation ITU-T X.1541 describes the information model for the incident object description exchange format (IODEF) version 2 and provides an associated data model specified with XML sch

10、ema. The IODEF specifies a data model representation for sharing commonly exchanged information about computer security or other incident types. This is achieved by listing the relevant clauses of IETF RFC 7970 and showing whether they are normative or informative. History Edition Recommendation App

11、roval Study Group Unique ID* 1.0 ITU-T X.1541 2012-09-07 17 11.1002/1000/11375 2.0 ITU-T X.1541 2017-09-06 17 11.1002/1000/13264 _ * To access the Recommendation, type the URL http:/handle.itu.int/ in the address field of your web browser, followed by the Recommendations unique ID. For example, http

12、:/handle.itu.int/11.1002/1000/11830-en. ii Rec. ITU-T X.1541 (09/2017) FOREWORD The International Telecommunication Union (ITU) is the United Nations specialized agency in the field of telecommunications, information and communication technologies (ICTs). The ITU Telecommunication Standardization Se

13、ctor (ITU-T) is a permanent organ of ITU. ITU-T is responsible for studying technical, operating and tariff questions and issuing Recommendations on them with a view to standardizing telecommunications on a worldwide basis. The World Telecommunication Standardization Assembly (WTSA), which meets eve

14、ry four years, establishes the topics for study by the ITU-T study groups which, in turn, produce Recommendations on these topics. The approval of ITU-T Recommendations is covered by the procedure laid down in WTSA Resolution 1. In some areas of information technology which fall within ITU-Ts purvie

15、w, the necessary standards are prepared on a collaborative basis with ISO and IEC. NOTE In this Recommendation, the expression “Administration“ is used for conciseness to indicate both a telecommunication administration and a recognized operating agency. Compliance with this Recommendation is volunt

16、ary. However, the Recommendation may contain certain mandatory provisions (to ensure, e.g., interoperability or applicability) and compliance with the Recommendation is achieved when all of these mandatory provisions are met. The words “shall“ or some other obligatory language such as “must“ and the

17、 negative equivalents are used to express requirements. The use of such words does not suggest that compliance with the Recommendation is required of any party. INTELLECTUAL PROPERTY RIGHTSITU draws attention to the possibility that the practice or implementation of this Recommendation may involve t

18、he use of a claimed Intellectual Property Right. ITU takes no position concerning the evidence, validity or applicability of claimed Intellectual Property Rights, whether asserted by ITU members or others outside of the Recommendation development process. As of the date of approval of this Recommend

19、ation, ITU had not received notice of intellectual property, protected by patents, which may be required to implement this Recommendation. However, implementers are cautioned that this may not represent the latest information and are therefore strongly urged to consult the TSB patent database at htt

20、p:/www.itu.int/ITU-T/ipr/. ITU 2017 All rights reserved. No part of this publication may be reproduced, by any means whatsoever, without the prior written permission of ITU. Rec. ITU-T X.1541 (09/2017) iii Table of Contents Page 1 Scope . 1 2 References . 1 3 Definitions 1 3.1 Terms defined elsewher

21、e 1 3.2 Terms defined in this Recommendation . 1 4 Abbreviations and acronyms 1 5 Conventions 1 6 Incident object description and exchange format . 2 6.1 Introduction 2 6.2 IODEF data types . 2 6.3 The IODEF information model 3 6.4 Processing Considerations 4 6.5 Extending the IODEF . 5 6.6 Internat

22、ionalization issues 5 6.7 Examples 5 6.8 The IODEF data model (XML schema) . 5 6.9 Security considerations . 5 6.10 IANA considerations 5 6.11 References 5 Bibliography. 6 iv Rec. ITU-T X.1541 (09/2017) Introduction Recommendation ITU-T X.1500, Overview of cybersecurity information exchange, provide

23、s guidance for the exchange of cybersecurity information including that for incidents and indicators as provided through this Recommendation. The incident object description exchange format (IODEF) is a data model for representing commonly exchanged information regarding computer security. It specif

24、ies an XML data model representation for conveying incident information between entities that have an operational responsibility for instituting proactive defences, remediation activities, or a watch-and-warning over a defined constituency. The data model provides a method to encode information abou

25、t hosts, networks and the services running on these systems; exploitation methodology and associated data; impact of the incident; and limited approaches for documenting workflow. The overriding purpose of the IODEF is to enhance operational capabilities and improve situational awareness. Community

26、adoption of the IODEF provides an improved ability to resolve incidents and convey situational awareness of the threat landscape by simplifying collaboration and information sharing. The IODEF structured format allows for: increased automation in the processing of incident information through the ex

27、change of structure incident information, eliminating the need for security analysts to parse free-form textual documents; decreased effort in correlating similar data (even when highly structured) from different sources enhancing situational awareness; a common format on which to provide interopera

28、bility between tools for incident handling and analysis, specifically when information comes from multiple entities. Numerous procedural, trust, policy and legal considerations may restrict or prevent the exchange of information. The IODEF is a technical specification and does not attempt to address

29、 these issues. However, operational implementations of the IODEF and associated formats and protocols should consider this broader context when forming information sharing agreements. Rec. ITU-T X.1541 (09/2017) 1 Recommendation ITU-T X.1541 Incident object description exchange format version 2 1 Sc

30、ope The incident object description exchange format (IODEF) specifies a data model representation for sharing commonly exchanged information about computer security or other incident types. This Recommendation describes the information model for IODEF and provides an associated data model specified

31、with XML schema. A data model representation or framework enabling the sharing of information about computer security or other incident types must provide the capabilities to comply with all applicable national and regional laws, regulations and policies. Implementers and users of all ITU-T Recommen

32、dations, including this Recommendation and the underlying techniques, shall comply with all applicable national and regional laws, regulations and policies. 2 References The following ITU-T Recommendations and other references contain provisions which, through reference in this text, constitute prov

33、isions of this Recommendation. At the time of publication, the editions indicated were valid. All Recommendations and other references are subject to revision; users of this Recommendation are therefore encouraged to investigate the possibility of applying the most recent edition of the Recommendati

34、ons and other references listed below. A list of the currently valid ITU-T Recommendations is regularly published. The reference to a document within this Recommendation does not give it, as a stand-alone document, the status of a Recommendation. IETF RFC 7970 IETF RFC 7970 (2016), The Incident Obje

35、ct Description Exchange Format Version 2. 3 Definitions 3.1 Terms defined elsewhere None. 3.2 Terms defined in this Recommendation None. 4 Abbreviations and acronyms This Recommendation uses the following abbreviations and acronyms: IANA Internet Assigned Numbers Authority IODEF Incident Object Desc

36、ription Exchange Format 5 Conventions The following terms are considered equivalent: In ITU, the use of the word shall and must, and their negatives, are considered equivalent. In ITU, the use of the word shall is equivalent to the IETF use of the word MUST. 2 Rec. ITU-T X.1541 (09/2017) In ITU, the

37、 use of the phrase shall not is equivalent to the IETF use of the term MUST NOT. NOTE In the IETF use of the words shall and must (in lower case) are used for informative text. 6 Incident object description and exchange format Clause 6 defines the incident object description exchange format (IODEF)

38、version 2 as, with direct references to IETF RFC 7970 sections, with alignment of the clauses with the section numbers. Thus, for example, clause 6.x aligns with IETF RFC 7970 section x, including with matching titles. 6.1 Introduction IETF RFC 7970 section 1 is informative. 6.1.1 Terminology IETF R

39、FC 7970 section 1.1 is informative. 6.1.2 Notations IETF RFC 7970 section 1.2 is informative. 6.1.3 About the IODEF data model IETF RFC 7970 section 1.3 is informative. 6.1.4 Changes from RFC 5070 IETF RFC 7970 section 1.4 is informative. 6.2 IODEF data types IETF RFC 7970 section 2 is informative,

40、but its subsections, i.e., sections 2.1-2.15 are normative. They define the following data types: Integers (IETF RFC 7970 section 2.1 defines this) Real numbers (IETF RFC 7970 section 2.2 defines this) Characters and strings (IETF RFC 7970 section 2.3 defines this) Multilingual strings (IETF RFC 797

41、0 section 2.4 defines this) Binary strings (IETF RFC 7970 section 2.5 defines this) Base64 bytes (IETF RFC 7970 section 2.5.1 defines this) Hexadecimal bytes (IETF RFC 7970 section 2.5.2 defines this) Enumerated types (IETF RFC 7970 section 2.6 defines this) Date-Time string (IETF RFC 7970 section 2

42、.7 defines this) Timezone string (IETF RFC 7970 section 2.8 defines this) Port lists (IETF RFC 7970 section 2.9 defines this) Postal address (IETF RFC 7970 section 2.10 defines this) Telephone number (IETF RFC 7970 section 2.11 defines this) Email string (IETF RFC 7970 section 2.12 defines this) Uni

43、form resource locator strings (IETF RFC 7970 section 2.13 defines this) Identifiers and identifier references (IETF RFC 7970 section 2.14 defines this) Software (IETF RFC 7970 section 2.15 defines this) Rec. ITU-T X.1541 (09/2017) 3 SoftwareReference class (IETF RFC 7970 section 2.15.1 defines this)

44、 Extension (IETF RFC 7970 section 2.16 defines this) 6.3 The IODEF information model IETF RFC 7970 section 3 is informative, but its subsections, i.e., sections 3.1-3.29 are normative. They define the following data models IODEF-Document class (IETF RFC 7970 section 3.1 defines this) Incident class

45、(IETF RFC 7970 section 3.2 defines this) Common attributes (IETF RFC 7970 section 3.3 defines this) restriction attribute (IETF RFC 7970 section 3.3.1 defines this) observable-id attribute (IETF RFC 7970 section 3.3.2 defines this) IncidentID class (IETF RFC 7970 section 3.4 defines this) Alternativ

46、eID class (IETF RFC 7970 section 3.5 defines this) RelatedActivity class (IETF RFC 7970 section 3.6 defines this) ThreatActor class (IETF RFC 7970 section 3.7 defines this) Campaign class (IETF RFC 7970 section 3.8 defines this) Contact class (IETF RFC 7970 section 3.9 defines this) RegistryHandle c

47、lass (IETF RFC 7970 section 3.9.1 defines this) PostalAddress class (IETF RFC 7970 section 3.9.2 defines this) Email class (IETF RFC 7970 section 3.9.3 defines this) Telephone class (IETF RFC 7970 section 3.9.4 defines this) Discovery class (IETF RFC 7970 section 3.10 defines this) DetectionPattern

48、class (IETF RFC 7970 section 3.10.1 defines this) Method class (IETF RFC 7970 section 3.11 defines this) Reference class (IETF RFC 7970 section 3.11.1 defines this) Assessment class (IETF RFC 7970 section 3.12 defines this) SystemImpact class (IETF RFC 7970 section 3.12.1 defines this) BusinessImpact class (IETF RFC 7970 section 3.12.2 defines this) TimeImpact class (IETF RFC 7970 section 3.12.3 defines this) MonetaryImpact class (IETF RFC 7970 section 3.12.4 defines this) Confidence class (IETF RFC 7970 section 3.12.5 defines this) History class (IETF RFC 7970 section 3.13 d