Quick other note: in that first example, you ARE marking the marking-definition, with itself. Using object_marking_refs at the package level means it applies to all objects in the package, including any information sources (identities), marking definitions,
etc.
From: <> on behalf of "Jordan, Bret" <>
Date: Thursday, February 25, 2016 at 6:39 PM
To: Sean Barnum <>
Cc: Terry MacDonald <>, "Modlin, Julie K." <>, ""
<>, "Moss, Mark B." <>
Subject: Re: [cti] Use case for data markings
So here is a real example that is formatted so you can read it, to help illustrate the issue I think Terry is trying to bring up. NOTE: I left some required fields off for brevity. In this first example, the marking-definition
file is not marked... So that is pretty simple stuff.
{
"type": "package",
"object_marking_refs": ["marking-definition--089a6ecb-cc15-43cc-9494-767639779124"],
"indicators": [
{
"type": "indicator",
"id": "indicator--089a6ecb-cc15-43cc-9494-767639779235"
}
],
"marking_definitions": [
{
"type": "marking-definition",
"id": "marking-definition--089a6ecb-cc15-43cc-9494-767639779124",
"spec_version": "2.0",
"created_at": "2016-02-19T09:11:01Z",
"defintion_type": "isa",
"definition": {
"classification": "CLASSIFIED",
"caveats": []
}
]
}
Now if I want to mark the marking-definition file, it would be done like (note red text).....
{
"type": "package",
"object_marking_refs": ["marking-definition--089a6ecb-cc15-43cc-9494-767639779124"],
"indicators": [
{
"type": "indicator",
"id": "indicator--089a6ecb-cc15-43cc-9494-767639779235"
}
],
"marking_definitions": [
{
"type": "marking-definition",
"id": "marking-definition--089a6ecb-cc15-43cc-9494-767639779124",
"spec_version": "2.0",
"created_at": "2016-02-19T09:11:01Z",
"object_marking_refs": ["marking-definition--089a6ecb-cc15-43cc-9494-767639779121"]
"defintion_type": "isa",
"definition": {
"classification": "CLASSIFIED",
"caveats": []
}
]
}
Now that UUID "...121" points to what? And how do you share that? If the indicator is shared but not marking-definitions UUID "...124", then how do assert what you need to know about the indicator.
I fully get the need to mark a "marking-definition", however, how is that supposed to be done? And what will work for you?
Thanks,
Bret
Bret Jordan CISSP
Director of Security Architecture and Standards | Office of the CTO
Blue Coat Systems
PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050
"Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg."
