[cti] Slides, legislation and BoF (was) Re: [cti] F2F Update & Call for agenda

Dear all,

    

    The objective of the Friday morning BOF

    slot is to make is as interactive and useful

    to CTI work as possible within the 30 minute

    timeframe.  In BOF tradition, it will also be

    informal and off the record.

    

    Towards that end, the following blog article

    may be helpful to provide an understanding

    of the larger context and why TC CTI work

    has a newly enhanced importance.  See

https://www.yaanatech.com/implementing-the-cybersecurity-act-of-2015-a-public-private-specifications-approach/

    Note also that the entity diagram at

    the end of the blog that is derived

    from another analysis denominated

    the "entity ontology" deconstruction

    of the Act.

    

    The BOF focus will necessarily be on the

    slide 8 challenge questions (or more as

    appropriate).   The idea is really to frame

    the questions.  The answers are complex

    and not going to be found in a few minute

    discussion.

    

    1. Is the deconstructed architecture

    accurate, useful?

    

    2. What information exchange requirements 

    exist at the three identified NCCIC interfaces?

    

    3. What assumptions should be made about 

    the capabilities and architectures within these 

    three domains (federal, non-federal, international)?

    

    4. What other other information exchange

    interfaces among the enumerated entities?

    Are there sector-specific interface sub-types 

    and what are they?

    

    5. What are the required information sharing 

    expressions and other capabilities at these

    interfaces, and to what extent can existing and

    planned TC CTI specifications be mapped to 

    these requirements?

    

    6. What entities transform threat intelligence 

    into defensive measures, e.g., to the Twenty 

    Controls?  How does the SACM work mate 

    with the CTI work?

    

    7. What are the algorithms for the “personal 

    information of a specific individual or 

    information that identifies a specific individual” 

    filter function, and how/where is this work

    going to occur?

    

    8. Is it feasible to create an ad-hoc TC CTI 

    or OASIS group to assist in the Act’s implementation 

    similar to other compliance obligations?

    

    --tony

    

    ps. I'm also on the hook as the rapporteur for

    ETSI TC CYBER's CTI work item to recommend

    at its formal meeting in four weeks, how to sync

    with CTI.  Appreciate any ideas for globalisation

    of this work.