Options for extending Data Markings

Hi All,

 

The attached document discusses the pros and cons of two options for extending data markings. There is no blocking issue here â just two alternatives that we would like to present before we finalize the spec. 
 Some tweaks to the spec would need to be made with either option.  

 

The first one is based on the extension type âproperties-extensionâ.  It necessitates making optional the two properties, definition and definition-type that were previously used for new marking definitions. 
 This option is what is currently suggested.  The second option continues to use those properties, introducing a new extension type, ânew-markingâ, to the extension facility of section 7.3.

 

Neither is ideal.  The first one makes extensions uniform across all STIX objects.  However, the second is consistent with existing TLP and statement marking definitions.

 

Please comment if you have a preference.  The editors will assume that if you donât comment, you would like to continue with option 1.

 

Thanks!

 

                Rich

 

--

Rich Piazza

Lead Cyber Security Engineer

The MITRE Corporation

781-271-3760

 

 

 

 

 

 

 

Attachment:
STIX Extensions on Marking Definition.docx

Description: STIX Extensions on Marking Definition.docx