1. INCH Requirements (2) IETF INCH-WG, March.2003 Glenn M. Keeni/Yuri Demchenko

2. ISSUES (1) We need an operational model … A simple one ….

3. Target A document describing the high-level functional requirements of a data format for collaboration between CSIRTs and parties involved…

4. CSIRT Incident Data Standard Format for Incident Data Operational Model Other CSIRTs Format #!? Format ##!!??

5. Enable categorization and statistical analysis Ensure integrity, authenticity and privacy Intent of the IR Data Model Enable controlled exchange and sharing between CSIRT and CSIRT

6. The CSIRT operations – information processing and archiving We do not intend to define The exchange protocol, process The usage, analysis,......

7. Issues from Uppsala: Primarily generated by humans ? Explain Internationalization: insufficient explanation The IR should carry information whereby its authenticity,.. can be guaranteed ? Explain

8. TO BE Done Edit and revise