Re: [cti] EUROPE adopts STIX and TAXII

Tony,

 

Thank you for your work to advance CTI and STIX/TAXII within ETSI and the larger community!

 

Regards,

Rich

 

 

Richard J. Struse

 

Chair, OASIS Cyber Threat Intelligence Technical Committee

Chief Strategist for Cyber Threat Intelligence

The MITRE Corporation

+1-703-983-7049 (office) 

+1-703-342-8368 (mobile)

 

 

From: <> on behalf of Tony Rutkowski <>

Organization: Yaana Limited

Reply-To: "" <>

Date: Wednesday, January 10, 2018 at 7:02 AM

To: Jason Keirstead <>, Chet Ensign <>

Cc: Carol Cosgrove-Sacks <>, OASIS CTI TC Discussion List <>

Subject: Re: [cti] EUROPE adopts STIX and TAXII

 

Jason,

This occurred because those platforms were introduced at their inception into the ETSI Technical Committee on Cyber Security (TC CYBER) via the OASIS-ETSI MoU.  TC CYBER took several steps.  It included the platforms within a Technical Report on structured
 information sharing.  See TR 103331.  It then explicitly included the platforms in a published Technical Report that the platforms are essential to the EU implementation of the Network Information Security (NIS) Directive.  See TR 103456.   This was an especially
 significant step because of ETSI's formal relationship with the EU.  Within the EU governance system, ETSI enjoys special status somewhat unique special status as (along with CEN/CENELEC) the designated standards body for sector standards among EU Member countries.

It also published the specifications within two other published works (TR 103303 on critical infrastructure protection and TR103303, the Global Cyber Security Ecosystem encyclopedic work, worked jointly with ENISA to make a similar recommendation.  Lastly,
 it also highlighted the platforms at the annual ETSI Security Week workshops over the past three years which include representatives from the EC and most EU Members.   The work also continues.  At the next plenary meeting in February, TR 103333 is being updated
 to include the latest OASIS CTI specification developments.

All the documents are publicly, freely available and well-versioned with persistent identifiers at ETSI's document site.  See
https://portal.etsi.org/webapp/WorkProgram/SimpleSearch/QueryForm.asp

The portal for all technical committee groups, including the massive ensemble of 3GPP which develops the world's mobile communication standards, and for NFV, among others, is at
https://portal.etsi.org/

--tony (ETSI-OASIS liaison, work item rapporteur, and ENISA expert at work)

 

On 09-Jan-18 3:16 PM, Jason Keirstead wrote:

I don't know anything at all about this process - but I noticed it specifically mentions the STIX 1.2 and TAXII 1.1 versions.

        ‘Structured Threat Information _expression_’ (‘STIX 1.2’) and ‘Trusted Automated Exchange of Indicator Information’ (‘TAXII 1.1’) developed by the Organization for the Advancement of Structured Information Standards (‘OASIS’).

How would we get STIX 2.0 and TAXII 2.0 added to this? Anyone have any ideas? Or does it matter? Anyone have insights?

-

Jason Keirstead

STSM, Product Architect, Security Intelligence, IBM Security Systems

www.ibm.com/security

"Things may come to those who wait, but only the things left by those who hustle." - Unknown

From:        Chet Ensign
<>

To:        Carol Cosgrove-Sacks
<>

Cc:        OASIS CTI TC Discussion List
<>

Date:        01/09/2018 03:59 PM

Subject:        Re: [cti] EUROPE adopts STIX and TAXII

Sent by:        <>

Let me add my congratulations folks. You've worked hard these past years. Seeing you get this recognition is a great start to 2018! 

Good work! 

/chet

On Tue, Jan 9, 2018 at 2:56 PM, Carol Cosgrove-Sacks <>
 wrote:

Dear Members of the CTI TC,

I have just been informed  that the EU has made a formal Decision to recognize the use of STIX 1.2 and TAXII 1.1 for use in public procurement.

Please see Commission Implementing Decision (EU) 2017/2288 of 11 December 2017:  http://eur-lex.europa.eu/legal-content/EN/TXT/?qid=1515520575463&uri=CELEX:32017D2288

Congratulations! This Decision covers all 28 EU countries and is also applied by the 4 EFTA countries.*

I am delighted that your excellent work has received such high level recognition.

Dr Carol Cosgrove-Sacks

Senior Advisor on International Standards Policy

OASIS

 

*(EU: Austria, Belgium,  Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland,  France, Germany, Greece, Hungary, Ireland,  Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands,
 Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden and United Kingdom;

EFTA: Iceland, Liechtenstein, Norway and Switzerland.)

-- 

-- 

/chet 

----------------

Chet Ensign

Director of Standards Development and TC Administration 

OASIS: Advancing open standards for the information society

http://www.oasis-open.org

Primary: +1 973-996-2298

Mobile: +1 201-341-1393