1. INCH Requirements IETF Interim meeting, Uppsala, Feb.2003

2. Review of RFC3067 IDWG requirements CERT Processes Based on

3. Standard Format CSIRT Incident Report Database Operational Model Other CSIRTs

4. CSIRT Incident Report Database Operational Model-2 Alerts, Reports Statistics Other CSIRTs

5. Enable categorization and statistical analysis Ensure integrity, authenticity and privacy Intent of the IR Data Model Enable controlled exchange and sharing

6. Requirements: General Format Communication Contents Process

7. IR Format Requirements: Support Internationalization Localization Have a standard structure Record time development Support unambiguous and reducible time references Support Access control (who will have to access what ) for different components, users Have Globally unique identification (for IR ) Be Extensible Well defined semantics for the components MUST:

8. IR Communication Requirements: Must have no effect on integrity, authenticity

9. IR Content Requirements: Globally unique identifier (LDAP-type name) Objective wherever possible: Classification scheme (enumerated) Units of quantities Originator, Owner, Contacts, History, Reference to advisories Description of the incident

10. IR Content Requirements: Additional references/pointers Impact Actions taken Indication of “original” vs “translated copies” (Guidelines for uniform description) Authenticity, Integrity verification info Multiple versions (in different languages)

11. ISSUES (1) We need a name: IRF: Incident Report Format IREF: Incident Report Exchange Format FIRE: Format for Incident Report Exchange FIR: Format for Incident Report

12. ISSUES (2) We need a some definitions: Incident: Reporter: Owner Contact Recorder Investigator

13. ISSUES (3) We need a some definitions… Attack: Attacker: (person, organization,..) Attack Target: (machine, network,… ) Contact: (person, organization) Attack Source: (machine, network,…) Investigator Victim: (person, organization,.. ) Impact Damage

14. ISSUES (4) We need an operational model … A detailed one is in the draft A simpler one is in this powerpoint

15. TO BE Done Edit and revise Explanation of rationale in some places