OASIS Cyber Threat Intelligence (CTI) TC

 View Only
Expand all | Collapse all

Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,

  • 1.  Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,

    Posted 06-09-2015 13:45
    To all prospective members of the Cyber Threat Intelligence (CTI) TC: The first order of business at the first TC meeting is to elect a chair (or two co-chairs). If you are interested in serving as a Chair or in nominating another individual for the position of Chair, you are welcome to make that candidacy known prior to the first meeting by posting a note to the TC's e-mail list expressing your interest and/or intent along with a brief statement of your or their qualifications. The meeting will also accept nominations from any qualified persons before beginning the vote.  Please be aware that prospective members must join the TC no less than 7 days prior to the first meeting in order to be eligible to vote for TC Chair(s). To join the TC, go to the TC's web page at https://www.oasis-open.org/apps/org/workgroup/cti/ and click the "Join group" link under Roster.  -- /chet  ---------------- Chet Ensign Director of Standards Development and TC Administration  OASIS: Advancing open standards for the information society http://www.oasis-open.org Primary: +1 973-996-2298 Mobile: +1 201-341-1393 


  • 2.  Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,

    Posted 06-09-2015 16:42
    Hi Chet, For Yaana Technologies, I would be most pleased to nominate Richard Struse as Chair. His leadership and vision here are remarkable. He is apparently available to assume the position. The short RSA summary for Rich seems an appropriate articulation of this qualifications: Chief Advanced Technology Officer, Department of Homeland Security Mr. Struse serves as the Chief Advanced Technology Officer for the DHS National Cybersecurity and Communications Integration Center (NCCIC) where he is responsible for technology vision and strategy. Mr. Struse is the creator of the STIX and TAXII automated information sharing initiatives which have been widely adopted across the public and private sectors. In October 2014, Secretary of Homeland Security Jeh Johnson presented Mr. Struse with one of the department’s highest honors, the Secretary’s Award for Excellence, in recognition of his pioneering work on STIX and TAXII. Prior to joining DHS, Mr. Struse was Vice President of Research and Development at VOXEM, Inc., where he was the creator of a high-performance, extreme high-reliability communications software platform. --Tony Rutkowski On 2015-06-09 9:44 AM, Chet Ensign wrote: To all prospective members of the Cyber Threat Intelligence (CTI) TC: The first order of business at the first TC meeting is to elect a chair (or two co-chairs). If you are interested in serving as a Chair or in nominating another individual for the position of Chair, you are welcome to make that candidacy known prior to the first meeting by posting a note to the TC's e-mail list expressing your interest and/or intent along with a brief statement of your or their qualifications. The meeting will also accept nominations from any qualified persons before beginning the vote. Please be aware that prospective members must join the TC no less than 7 days prior to the first meeting in order to be eligible to vote for TC Chair(s). To join the TC, go to the TC's web page at https://www.oasis-open.org/apps/org/workgroup/cti/ and click the "Join group" link under Roster. -- /chet ---------------- Chet Ensign Director of Standards Development and TC Administration OASIS: Advancing open standards for the information society http://www.oasis-open.org Primary: +1 973-996-2298 Mobile: +1 201-341-1393


  • 3.  Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,

    Posted 06-09-2015 17:33
    Chet, I would be interested as a co-chair Thanks, Bret Bret Jordan CISSP Director of Security Architecture and Standards Office of the CTO Blue Coat Systems PGP Fingerprint: 62A6 5999 0F7D 0D61 4C66 D59C 2DB5 111D 63BC A303 Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg.   On Jun 9, 2015, at 07:44, Chet Ensign < chet.ensign@oasis-open.org > wrote: To all prospective members of the Cyber Threat Intelligence (CTI) TC: The first order of business at the first TC meeting is to elect a chair (or two co-chairs). If you are interested in serving as a Chair or in nominating another individual for the position of Chair, you are welcome to make that candidacy known prior to the first meeting by posting a note to the TC's e-mail list expressing your interest and/or intent along with a brief statement of your or their qualifications. The meeting will also accept nominations from any qualified persons before beginning the vote.  Please be aware that prospective members must join the TC no less than 7 days prior to the first meeting in order to be eligible to vote for TC Chair(s). To join the TC, go to the TC's web page at https://www.oasis-open.org/apps/org/workgroup/cti/ and click the Join group link under Roster.  -- /chet  ---------------- Chet Ensign Director of Standards Development and TC Administration  OASIS: Advancing open standards for the information society http://www.oasis-open.org Primary: +1 973-996-2298 Mobile: +1 201-341-1393  Attachment: signature.asc Description: Message signed with OpenPGP using GPGMail


  • 4.  Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,

    Posted 06-09-2015 21:26
    I second Bret as a co-chair. Cheers Terry MacDonald STIX, TAXII, CybOX Consultant M: +61-407-203-026 E:  terry.macdonald@threatloop.com W:  www.threatloop.com Disclaimer: The opinions expressed within this email do not represent the sentiment of any other party except my own. My views do not necessarily reflect those of my employers. On 10 June 2015 at 03:32, Jordan, Bret < bret.jordan@bluecoat.com > wrote: Chet, I would be interested as a co-chair Thanks, Bret Bret Jordan CISSP Director of Security Architecture and Standards Office of the CTO Blue Coat Systems PGP Fingerprint: 62A6 5999 0F7D 0D61 4C66 D59C 2DB5 111D 63BC A303 "Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg."  On Jun 9, 2015, at 07:44, Chet Ensign < chet.ensign@oasis-open.org > wrote: To all prospective members of the Cyber Threat Intelligence (CTI) TC: The first order of business at the first TC meeting is to elect a chair (or two co-chairs). If you are interested in serving as a Chair or in nominating another individual for the position of Chair, you are welcome to make that candidacy known prior to the first meeting by posting a note to the TC's e-mail list expressing your interest and/or intent along with a brief statement of your or their qualifications. The meeting will also accept nominations from any qualified persons before beginning the vote.  Please be aware that prospective members must join the TC no less than 7 days prior to the first meeting in order to be eligible to vote for TC Chair(s). To join the TC, go to the TC's web page at https://www.oasis-open.org/apps/org/workgroup/cti/ and click the "Join group" link under Roster.  -- /chet  ---------------- Chet Ensign Director of Standards Development and TC Administration  OASIS: Advancing open standards for the information society http://www.oasis-open.org Primary: +1 973-996-2298 Mobile: +1 201-341-1393  


  • 5.  Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,

    Posted 06-09-2015 22:54
    Question for Chet: are we nominating co-chairs now? Or just a single chair? I would think the decision for one or two chairs would be a topic of the first TC meeting. Also, +1 for Rich Struse as chair. Aharon From: cti@lists.oasis-open.org <cti@lists.oasis-open.org> on behalf of Terry MacDonald <terry.macdonald@threatloop.com> Sent: Tuesday, June 9, 2015 5:25:42 PM To: Jordan, Bret Cc: Chet Ensign; cti@lists.oasis-open.org; Richard Struse; Scott McGrath; Robin Cover; Carol Geyer Subject: Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,   I second Bret as a co-chair. Cheers Terry MacDonald STIX, TAXII, CybOX Consultant M: +61-407-203-026 E:  terry.macdonald@threatloop.com W:  www.threatloop.com Disclaimer: The opinions expressed within this email do not represent the sentiment of any other party except my own. My views do not necessarily reflect those of my employers. On 10 June 2015 at 03:32, Jordan, Bret < bret.jordan@bluecoat.com > wrote: Chet, I would be interested as a co-chair Thanks, Bret Bret Jordan CISSP Director of Security Architecture and Standards Office of the CTO Blue Coat Systems PGP Fingerprint: 62A6 5999 0F7D 0D61 4C66 D59C 2DB5 111D 63BC A303 "Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg."  On Jun 9, 2015, at 07:44, Chet Ensign < chet.ensign@oasis-open.org > wrote: To all prospective members of the Cyber Threat Intelligence (CTI) TC: The first order of business at the first TC meeting is to elect a chair (or two co-chairs). If you are interested in serving as a Chair or in nominating another individual for the position of Chair, you are welcome to make that candidacy known prior to the first meeting by posting a note to the TC's e-mail list expressing your interest and/or intent along with a brief statement of your or their qualifications. The meeting will also accept nominations from any qualified persons before beginning the vote.  Please be aware that prospective members must join the TC no less than 7 days prior to the first meeting in order to be eligible to vote for TC Chair(s). To join the TC, go to the TC's web page at https://www.oasis-open.org/apps/org/workgroup/cti/ and click the "Join group" link under Roster.  -- /chet  ---------------- Chet Ensign Director of Standards Development and TC Administration  OASIS: Advancing open standards for the information society http://www.oasis-open.org Primary: +1 973-996-2298 Mobile: +1 201-341-1393  


  • 6.  RE: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,

    Posted 06-10-2015 00:02
    +1 A chair straight away, yes. For the rest, no rush! Regards, Peter     Peter F Brown Independent Consultant CIPT, MIoD ”Using Information Technologies to Empower and Transform” 200 S Barrington Ave., #49719 Los Angeles , CA 90049, USA Tel: +1.310.694.2278 www.PeterFBrown.com                 From: cti@lists.oasis-open.org [mailto:cti@lists.oasis-open.org] On Behalf Of Aharon Chernin Sent: 09 June, 2015 15:53 To: Terry MacDonald; Jordan, Bret Cc: Chet Ensign; cti@lists.oasis-open.org; Richard Struse; Scott McGrath; Robin Cover; Carol Geyer Subject: Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,   Question for Chet: are we nominating co-chairs now? Or just a single chair? I would think the decision for one or two chairs would be a topic of the first TC meeting. Also, +1 for Rich Struse as chair. Aharon From: cti@lists.oasis-open.org < cti@lists.oasis-open.org > on behalf of Terry MacDonald < terry.macdonald@threatloop.com > Sent: Tuesday, June 9, 2015 5:25:42 PM To: Jordan, Bret Cc: Chet Ensign; cti@lists.oasis-open.org ; Richard Struse; Scott McGrath; Robin Cover; Carol Geyer Subject: Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,   I second Bret as a co-chair. Cheers Terry MacDonald STIX, TAXII, CybOX Consultant   M: +61-407-203-026 E:  terry.macdonald@threatloop.com W:  www.threatloop.com     Disclaimer: The opinions expressed within this email do not represent the sentiment of any other party except my own. My views do not necessarily reflect those of my employers.   On 10 June 2015 at 03:32, Jordan, Bret < bret.jordan@bluecoat.com > wrote: Chet,   I would be interested as a co-chair   Thanks,   Bret       Bret Jordan CISSP Director of Security Architecture and Standards Office of the CTO Blue Coat Systems PGP Fingerprint: 62A6 5999 0F7D 0D61 4C66 D59C 2DB5 111D 63BC A303 "Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg."    On Jun 9, 2015, at 07:44, Chet Ensign < chet.ensign@oasis-open.org > wrote:   To all prospective members of the Cyber Threat Intelligence (CTI) TC:   The first order of business at the first TC meeting is to elect a chair (or two co-chairs). If you are interested in serving as a Chair or in nominating another individual for the position of Chair, you are welcome to make that candidacy known prior to the first meeting by posting a note to the TC's e-mail list expressing your interest and/or intent along with a brief statement of your or their qualifications. The meeting will also accept nominations from any qualified persons before beginning the vote.    Please be aware that prospective members must join the TC no less than 7 days prior to the first meeting in order to be eligible to vote for TC Chair(s). To join the TC, go to the TC's web page at https://www.oasis-open.org/apps/org/workgroup/cti/ and click the "Join group" link under Roster.    -- /chet  ---------------- Chet Ensign Director of Standards Development and TC Administration  OASIS: Advancing open standards for the information society http://www.oasis-open.org Primary: +1 973-996-2298 Mobile: +1 201-341-1393      


  • 7.  Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,

    Posted 06-10-2015 12:46
    This was simply a call for nominations. As many people can be nominated as want to put themselves forward (or be put forward by others).  As a group, you can decide on one chair or two co-chairs at the first meeting.  On Tue, Jun 9, 2015 at 6:53 PM, Aharon Chernin < achernin@soltra.com > wrote: Question for Chet: are we nominating co-chairs now? Or just a single chair? I would think the decision for one or two chairs would be a topic of the first TC meeting. Also, +1 for Rich Struse as chair. Aharon From: cti@lists.oasis-open.org < cti@lists.oasis-open.org > on behalf of Terry MacDonald < terry.macdonald@threatloop.com > Sent: Tuesday, June 9, 2015 5:25:42 PM To: Jordan, Bret Cc: Chet Ensign; cti@lists.oasis-open.org ; Richard Struse; Scott McGrath; Robin Cover; Carol Geyer Subject: Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,   I second Bret as a co-chair. Cheers Terry MacDonald STIX, TAXII, CybOX Consultant M: +61-407-203-026 E:  terry.macdonald@threatloop.com W:  www.threatloop.com Disclaimer: The opinions expressed within this email do not represent the sentiment of any other party except my own. My views do not necessarily reflect those of my employers. On 10 June 2015 at 03:32, Jordan, Bret < bret.jordan@bluecoat.com > wrote: Chet, I would be interested as a co-chair Thanks, Bret Bret Jordan CISSP Director of Security Architecture and Standards Office of the CTO Blue Coat Systems PGP Fingerprint: 62A6 5999 0F7D 0D61 4C66 D59C 2DB5 111D 63BC A303 "Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg."  On Jun 9, 2015, at 07:44, Chet Ensign < chet.ensign@oasis-open.org > wrote: To all prospective members of the Cyber Threat Intelligence (CTI) TC: The first order of business at the first TC meeting is to elect a chair (or two co-chairs). If you are interested in serving as a Chair or in nominating another individual for the position of Chair, you are welcome to make that candidacy known prior to the first meeting by posting a note to the TC's e-mail list expressing your interest and/or intent along with a brief statement of your or their qualifications. The meeting will also accept nominations from any qualified persons before beginning the vote.  Please be aware that prospective members must join the TC no less than 7 days prior to the first meeting in order to be eligible to vote for TC Chair(s). To join the TC, go to the TC's web page at https://www.oasis-open.org/apps/org/workgroup/cti/ and click the "Join group" link under Roster.  -- /chet  ---------------- Chet Ensign Director of Standards Development and TC Administration  OASIS: Advancing open standards for the information society http://www.oasis-open.org Primary: +1 973-996-2298 Mobile: +1 201-341-1393   -- /chet  ---------------- Chet Ensign Director of Standards Development and TC Administration  OASIS: Advancing open standards for the information society http://www.oasis-open.org Primary: +1 973-996-2298 Mobile: +1 201-341-1393 


  • 8.  Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,

    Posted 06-10-2015 12:53
    Chet: should we be accepting nominations for a chair spot that may or may-not exist? Can we reopen nominations for co-chair if the TC decides one is needed? Aharon Chernin CTO SOLTRA An FS-ISAC & DTCC Company 18301 Bermuda green Dr Tampa, fl 33647 813.470.2173 achernin@soltra.com www.soltra.com From: Chet Ensign <chet.ensign@oasis-open.org> Sent: Wednesday, June 10, 2015 8:46 AM To: Aharon Chernin Cc: Terry MacDonald; Jordan, Bret; cti@lists.oasis-open.org; Richard Struse; Scott McGrath; Robin Cover; Carol Geyer Subject: Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,   This was simply a call for nominations. As many people can be nominated as want to put themselves forward (or be put forward by others).  As a group, you can decide on one chair or two co-chairs at the first meeting.  On Tue, Jun 9, 2015 at 6:53 PM, Aharon Chernin < achernin@soltra.com > wrote: Question for Chet: are we nominating co-chairs now? Or just a single chair? I would think the decision for one or two chairs would be a topic of the first TC meeting. Also, +1 for Rich Struse as chair. Aharon From: cti@lists.oasis-open.org < cti@lists.oasis-open.org > on behalf of Terry MacDonald < terry.macdonald@threatloop.com > Sent: Tuesday, June 9, 2015 5:25:42 PM To: Jordan, Bret Cc: Chet Ensign; cti@lists.oasis-open.org ; Richard Struse; Scott McGrath; Robin Cover; Carol Geyer Subject: Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,   I second Bret as a co-chair. Cheers Terry MacDonald STIX, TAXII, CybOX Consultant M: +61-407-203-026 E:  terry.macdonald@threatloop.com W:  www.threatloop.com Disclaimer: The opinions expressed within this email do not represent the sentiment of any other party except my own. My views do not necessarily reflect those of my employers. On 10 June 2015 at 03:32, Jordan, Bret < bret.jordan@bluecoat.com > wrote: Chet, I would be interested as a co-chair Thanks, Bret Bret Jordan CISSP Director of Security Architecture and Standards Office of the CTO Blue Coat Systems PGP Fingerprint: 62A6 5999 0F7D 0D61 4C66 D59C 2DB5 111D 63BC A303 "Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg."  On Jun 9, 2015, at 07:44, Chet Ensign < chet.ensign@oasis-open.org > wrote: To all prospective members of the Cyber Threat Intelligence (CTI) TC: The first order of business at the first TC meeting is to elect a chair (or two co-chairs). If you are interested in serving as a Chair or in nominating another individual for the position of Chair, you are welcome to make that candidacy known prior to the first meeting by posting a note to the TC's e-mail list expressing your interest and/or intent along with a brief statement of your or their qualifications. The meeting will also accept nominations from any qualified persons before beginning the vote.  Please be aware that prospective members must join the TC no less than 7 days prior to the first meeting in order to be eligible to vote for TC Chair(s). To join the TC, go to the TC's web page at https://www.oasis-open.org/apps/org/workgroup/cti/ and click the "Join group" link under Roster.  -- /chet  ---------------- Chet Ensign Director of Standards Development and TC Administration  OASIS: Advancing open standards for the information society http://www.oasis-open.org Primary: +1 973-996-2298 Mobile: +1 201-341-1393   -- /chet  ---------------- Chet Ensign Director of Standards Development and TC Administration  OASIS: Advancing open standards for the information society http://www.oasis-open.org Primary: +1 973-996-2298 Mobile: +1 201-341-1393 


  • 9.  Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,

    Posted 06-10-2015 13:03
    Yes, you can.  To be clear, the call was simply to give people a chance to nominate themselves or nominate someone else to stand for Chair at the first meeting. Since Rich, as the Convener, is also a nominee for Chair, I will be running the Chair election portion of the meeting. There will also be a call for any additional nominations from the floor before the vote.  If we have only one nominee, I will ask if there are objections to unanimous approval. If there is more than one nominee, then the first question before the eligible voters will be whether or not the TC wishes to have co-Chairs. Totally up to the group.  After that, it is a matter of seat(s) and name(s). If we have more nominees than seats, I will carry out a roll call vote.  So in other words, you could well have 10 nominees for Chair at the first meeting - our process doesn't preclude that. Plus, should the TC start with a single Chair and then you decide, 3 months from now, that it is a lot of work and a Co-Chair is needed, you can hold an election then.  Also, by the way, one other formal role you may want to consider nominations for is Secretary. I don't issue calls for those & leave it up to the TC to decide in as part of their work, but the Secretary role in our platform is one that can also help the Chair(s) with the details of day-to-day work - roster and calendar maintenance, taking minutes, etc.  /chet On Wed, Jun 10, 2015 at 8:53 AM, Aharon Chernin < achernin@soltra.com > wrote: Chet: should we be accepting nominations for a chair spot that may or may-not exist? Can we reopen nominations for co-chair if the TC decides one is needed? Aharon Chernin CTO SOLTRA An FS-ISAC & DTCC Company 18301 Bermuda green Dr Tampa, fl 33647 813.470.2173 achernin@soltra.com www.soltra.com From: Chet Ensign < chet.ensign@oasis-open.org > Sent: Wednesday, June 10, 2015 8:46 AM To: Aharon Chernin Cc: Terry MacDonald; Jordan, Bret; cti@lists.oasis-open.org ; Richard Struse; Scott McGrath; Robin Cover; Carol Geyer Subject: Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,   This was simply a call for nominations. As many people can be nominated as want to put themselves forward (or be put forward by others).  As a group, you can decide on one chair or two co-chairs at the first meeting.  On Tue, Jun 9, 2015 at 6:53 PM, Aharon Chernin < achernin@soltra.com > wrote: Question for Chet: are we nominating co-chairs now? Or just a single chair? I would think the decision for one or two chairs would be a topic of the first TC meeting. Also, +1 for Rich Struse as chair. Aharon From: cti@lists.oasis-open.org < cti@lists.oasis-open.org > on behalf of Terry MacDonald < terry.macdonald@threatloop.com > Sent: Tuesday, June 9, 2015 5:25:42 PM To: Jordan, Bret Cc: Chet Ensign; cti@lists.oasis-open.org ; Richard Struse; Scott McGrath; Robin Cover; Carol Geyer Subject: Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,   I second Bret as a co-chair. Cheers Terry MacDonald STIX, TAXII, CybOX Consultant M: +61-407-203-026 E:  terry.macdonald@threatloop.com W:  www.threatloop.com Disclaimer: The opinions expressed within this email do not represent the sentiment of any other party except my own. My views do not necessarily reflect those of my employers. On 10 June 2015 at 03:32, Jordan, Bret < bret.jordan@bluecoat.com > wrote: Chet, I would be interested as a co-chair Thanks, Bret Bret Jordan CISSP Director of Security Architecture and Standards Office of the CTO Blue Coat Systems PGP Fingerprint: 62A6 5999 0F7D 0D61 4C66 D59C 2DB5 111D 63BC A303 "Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg."  On Jun 9, 2015, at 07:44, Chet Ensign < chet.ensign@oasis-open.org > wrote: To all prospective members of the Cyber Threat Intelligence (CTI) TC: The first order of business at the first TC meeting is to elect a chair (or two co-chairs). If you are interested in serving as a Chair or in nominating another individual for the position of Chair, you are welcome to make that candidacy known prior to the first meeting by posting a note to the TC's e-mail list expressing your interest and/or intent along with a brief statement of your or their qualifications. The meeting will also accept nominations from any qualified persons before beginning the vote.  Please be aware that prospective members must join the TC no less than 7 days prior to the first meeting in order to be eligible to vote for TC Chair(s). To join the TC, go to the TC's web page at https://www.oasis-open.org/apps/org/workgroup/cti/ and click the "Join group" link under Roster.  -- /chet  ---------------- Chet Ensign Director of Standards Development and TC Administration  OASIS: Advancing open standards for the information society http://www.oasis-open.org Primary: +1 973-996-2298 Mobile: +1 201-341-1393   -- /chet  ---------------- Chet Ensign Director of Standards Development and TC Administration  OASIS: Advancing open standards for the information society http://www.oasis-open.org Primary: +1 973-996-2298 Mobile: +1 201-341-1393   -- /chet  ---------------- Chet Ensign Director of Standards Development and TC Administration  OASIS: Advancing open standards for the information society http://www.oasis-open.org Primary: +1 973-996-2298 Mobile: +1 201-341-1393 


  • 10.  RE: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,

    Posted 06-10-2015 15:34




    Chet,
    Thanks for the clarifications.
    If I may, a couple of suggestions:
    - it’s probably a good idea to have a single chair to kick things off. This doesn’t mean that even by the second meeting we establish that co-chairs are a good
    idea. The first meeting it is good to have some clarity, simplicity and a single person steering us through the call!
    - Secretary is useful, particularly for larger committees, like this one seems destined to be, can handle roll call, agenda, minutes, etc. and leave the Chair
    with hands free to actually concentrate on the meeting and its discussions.
    - We should also remember that every deliverable from a TC needs at least one editor: In my experience, the TC’s work is better served when the roles of chair
    and editor are separated. The editor’s job is to ensure that texts reflect agreement or consensus in the group; the chair’s role is to steer the group towards such agreement. Editors need to be known when the TC advances onto the first step of the formal process
    of creating any particular deliverable – although names can be added or changed any time up to publication.
     
    Hope this helps, regards,
    Peter
     
     











    Peter F Brown
    Independent Consultant
    CIPT, MIoD




    ”Using Information Technologies to Empower and Transform”
    www.PeterFBrown.com
     


     




     


















     
     
     
     
     
    From: cti@lists.oasis-open.org [mailto:cti@lists.oasis-open.org]
    On Behalf Of Chet Ensign
    Sent: 10 June, 2015 06:03
    To: Aharon Chernin
    Cc: Terry MacDonald; Jordan, Bret; cti@lists.oasis-open.org; Richard Struse; Scott McGrath; Robin Cover; Carol Geyer
    Subject: Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,
     

    Yes, you can. 

     


    To be clear, the call was simply to give people a chance to nominate themselves or nominate someone else to stand for Chair at the first meeting. Since Rich, as the Convener, is also a nominee for Chair, I will be running the Chair election
    portion of the meeting. There will also be a call for any additional nominations from the floor before the vote. 


     


    If we have only one nominee, I will ask if there are objections to unanimous approval. If there is more than one nominee, then the first question before the eligible voters will be whether or not the TC wishes to have co-Chairs. Totally
    up to the group. 


     


    After that, it is a matter of seat(s) and name(s). If we have more nominees than seats, I will carry out a roll call vote. 


     


    So in other words, you could well have 10 nominees for Chair at the first meeting - our process doesn't preclude that. Plus, should the TC start with a single Chair and then you decide, 3 months from now, that it is a lot of work and a
    Co-Chair is needed, you can hold an election then. 


     


    Also, by the way, one other formal role you may want to consider nominations for is Secretary. I don't issue calls for those & leave it up to the TC to decide in as part of their work, but the Secretary role in our platform is one that
    can also help the Chair(s) with the details of day-to-day work - roster and calendar maintenance, taking minutes, etc. 


     


    /chet



     

    On Wed, Jun 10, 2015 at 8:53 AM, Aharon Chernin < achernin@soltra.com > wrote:



    Chet: should we be accepting nominations for a chair spot that may or may-not exist? Can we reopen nominations for co-chair if the TC decides one is needed?

     




    Aharon Chernin
    CTO


    SOLTRA
    An FS-ISAC & DTCC Company


    18301 Bermuda green Dr


    Tampa, fl 33647


    813.470.2173
    achernin@soltra.com


    www.soltra.com










    From: Chet Ensign < chet.ensign@oasis-open.org >
    Sent: Wednesday, June 10, 2015 8:46 AM
    To: Aharon Chernin
    Cc: Terry MacDonald; Jordan, Bret;
    cti@lists.oasis-open.org ; Richard Struse; Scott McGrath; Robin Cover; Carol Geyer



    Subject: Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,



     






    This was simply a call for nominations. As many people can be nominated as want to put themselves forward (or be put forward by others). 


     


    As a group, you can decide on one chair or two co-chairs at the first meeting. 



     

    On Tue, Jun 9, 2015 at 6:53 PM, Aharon Chernin < achernin@soltra.com > wrote:


    Question for Chet: are we nominating co-chairs now? Or just a single chair? I would think the decision for one or two chairs would be a topic of the first
    TC meeting.

    Also, +1 for Rich Struse as chair.

    Aharon





    From:
    cti@lists.oasis-open.org < cti@lists.oasis-open.org > on behalf of Terry MacDonald < terry.macdonald@threatloop.com >
    Sent: Tuesday, June 9, 2015 5:25:42 PM
    To: Jordan, Bret
    Cc: Chet Ensign;
    cti@lists.oasis-open.org ; Richard Struse; Scott McGrath; Robin Cover; Carol Geyer
    Subject: Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,


     




    I second Bret as a co-chair.












    Cheers



    Terry MacDonald STIX, TAXII, CybOX Consultant


     


    M: +61-407-203-026


    E:  terry.macdonald@threatloop.com


    W:  www.threatloop.com


     





     


    Disclaimer: The opinions expressed within this email do not represent the sentiment of any other party except my own. My views do
    not necessarily reflect those of my employers.








     

    On 10 June 2015 at 03:32, Jordan, Bret < bret.jordan@bluecoat.com > wrote:



    Chet,


     

    I would be interested as a co-chair






     


    Thanks,


     


    Bret



     


     


     



    Bret Jordan CISSP


    Director of Security Architecture and Standards Office of the CTO


    Blue Coat Systems



    PGP Fingerprint: 62A6 5999 0F7D 0D61 4C66 D59C 2DB5 111D 63BC A303


    "Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg." 










     



    On Jun 9, 2015, at 07:44, Chet Ensign < chet.ensign@oasis-open.org > wrote:

     



    To all prospective members of the Cyber Threat Intelligence (CTI) TC:


     


    The first order of business at the first TC meeting is to elect a chair (or two co-chairs). If you are interested in serving as a Chair or in nominating
    another individual for the position of Chair, you are welcome to make that candidacy known prior to the first meeting by posting a note to the TC's e-mail list expressing your interest and/or intent along with a brief statement of your or their qualifications.
    The meeting will also accept nominations from any qualified persons before beginning the vote. 


     


    Please be aware that prospective members must join the TC no less than 7 days prior to the first meeting in order to be eligible to vote for TC Chair(s).
    To join the TC, go to the TC's web page at
    https://www.oasis-open.org/apps/org/workgroup/cti/ and click the "Join group" link under Roster. 


     

    --






    /chet 
    ----------------
    Chet Ensign
    Director of Standards Development and TC Administration 
    OASIS: Advancing open standards for the information society
    http://www.oasis-open.org

    Primary: +1 973-996-2298
    Mobile: +1 201-341-1393  








     





     










     

    --






    /chet 
    ----------------
    Chet Ensign
    Director of Standards Development and TC Administration 
    OASIS: Advancing open standards for the information society
    http://www.oasis-open.org

    Primary: +1 973-996-2298
    Mobile: +1 201-341-1393  

















     

    --





    /chet 
    ----------------
    Chet Ensign
    Director of Standards Development and TC Administration 
    OASIS: Advancing open standards for the information society
    http://www.oasis-open.org

    Primary: +1 973-996-2298
    Mobile: +1 201-341-1393 











  • 11.  Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,

    Posted 06-10-2015 15:40
    +1 On 2015-06-10 11:34 AM, Peter F Brown wrote: - it’s probably a good idea to have a single chair to kick things off. This doesn’t mean that even by the second meeting we establish that co-chairs are a good idea. The first meeting it is good to have some clarity, simplicity and a single person steering us through the call! - Secretary is useful, particularly for larger committees, like this one seems destined to be, can handle roll call, agenda, minutes, etc. and leave the Chair with hands free to actually concentrate on the meeting and its discussions. - We should also remember that every deliverable from a TC needs at least one editor: In my experience, the TC’s work is better served when the roles of chair and editor are separated. The editor’s job is to ensure that texts reflect agreement or consensus in the group; the chair’s role is to steer the group towards such agreement. Editors need to be known when the TC advances onto the first step of the formal process of creating any particular deliverable – although names can be added or changed any time up to publication. Attachment: smime.p7s Description: S/MIME Cryptographic Signature


  • 12.  RE: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,

    Posted 06-10-2015 15:44




    I would agree with Peter’s comments. 

    ·         
    One chair is probably better until we find a definitive use-case for a co-chair sort of setup.
    ·         
    Having separate roles of secretary and editor would be very effective in keeping us moving forward.
     
    An additional thought – Will this TC have any ‘non voting’ members?  In the past I’ve seen this useful for folks that have an interest in the outcomes but may
    not be committed enough to always attend, hence you would not want them to impact meeting quorum.
     


    From: cti@lists.oasis-open.org [mailto:cti@lists.oasis-open.org]
    On Behalf Of Peter F Brown
    Sent: Wednesday, June 10, 2015 11:34 AM
    To: Chet Ensign; Aharon Chernin
    Cc: Terry MacDonald; Jordan, Bret; cti@lists.oasis-open.org; Richard Struse; Scott McGrath; Robin Cover; Carol Geyer
    Subject: RE: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,


     
    Chet,
    Thanks for the clarifications.
    If I may, a couple of suggestions:
    - it’s probably a good idea to have a single chair to kick things off. This doesn’t mean that even by the second meeting we establish that co-chairs are a good
    idea. The first meeting it is good to have some clarity, simplicity and a single person steering us through the call!
    - Secretary is useful, particularly for larger committees, like this one seems destined to be, can handle roll call, agenda, minutes, etc. and leave the Chair
    with hands free to actually concentrate on the meeting and its discussions.
    - We should also remember that every deliverable from a TC needs at least one editor: In my experience, the TC’s work is better served when the roles of chair
    and editor are separated. The editor’s job is to ensure that texts reflect agreement or consensus in the group; the chair’s role is to steer the group towards such agreement. Editors need to be known when the TC advances onto the first step of the formal process
    of creating any particular deliverable – although names can be added or changed any time up to publication.
     
    Hope this helps, regards,
    Peter
     
     











    Peter F Brown
    Independent Consultant
    CIPT, MIoD




    ”Using Information Technologies to Empower and Transform”
    www.PeterFBrown.com
     


     




     


















     
     
     
     
     
    From:
    cti@lists.oasis-open.org [ mailto:cti@lists.oasis-open.org ]
    On Behalf Of Chet Ensign
    Sent: 10 June, 2015 06:03
    To: Aharon Chernin
    Cc: Terry MacDonald; Jordan, Bret;
    cti@lists.oasis-open.org ; Richard Struse; Scott McGrath; Robin Cover; Carol Geyer
    Subject: Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,
     

    Yes, you can. 

     


    To be clear, the call was simply to give people a chance to nominate themselves or nominate someone else to stand for Chair at the first meeting. Since Rich, as the Convener, is also a nominee for Chair, I will be running the Chair election
    portion of the meeting. There will also be a call for any additional nominations from the floor before the vote. 


     


    If we have only one nominee, I will ask if there are objections to unanimous approval. If there is more than one nominee, then the first question before the eligible voters will be whether or not the TC wishes to have co-Chairs. Totally
    up to the group. 


     


    After that, it is a matter of seat(s) and name(s). If we have more nominees than seats, I will carry out a roll call vote. 


     


    So in other words, you could well have 10 nominees for Chair at the first meeting - our process doesn't preclude that. Plus, should the TC start with a single Chair and then you decide, 3 months from now, that it is a lot of work and a
    Co-Chair is needed, you can hold an election then. 


     


    Also, by the way, one other formal role you may want to consider nominations for is Secretary. I don't issue calls for those & leave it up to the TC to decide in as part of their work, but the Secretary role in our platform is one that
    can also help the Chair(s) with the details of day-to-day work - roster and calendar maintenance, taking minutes, etc. 


     


    /chet



     

    On Wed, Jun 10, 2015 at 8:53 AM, Aharon Chernin < achernin@soltra.com > wrote:



    Chet: should we be accepting nominations for a chair spot that may or may-not exist? Can we reopen nominations for co-chair if the TC decides one is needed?

     




    Aharon Chernin
    CTO


    SOLTRA
    An FS-ISAC & DTCC Company


    18301 Bermuda green Dr


    Tampa, fl 33647


    813.470.2173
    achernin@soltra.com


    www.soltra.com










    From: Chet Ensign < chet.ensign@oasis-open.org >
    Sent: Wednesday, June 10, 2015 8:46 AM
    To: Aharon Chernin
    Cc: Terry MacDonald; Jordan, Bret;
    cti@lists.oasis-open.org ; Richard Struse; Scott McGrath; Robin Cover; Carol Geyer



    Subject: Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,



     






    This was simply a call for nominations. As many people can be nominated as want to put themselves forward (or be put forward by others). 


     


    As a group, you can decide on one chair or two co-chairs at the first meeting. 



     

    On Tue, Jun 9, 2015 at 6:53 PM, Aharon Chernin < achernin@soltra.com > wrote:


    Question for Chet: are we nominating co-chairs now? Or just a single chair? I would think the decision for one or two chairs would be a topic of the first
    TC meeting.

    Also, +1 for Rich Struse as chair.

    Aharon





    From:
    cti@lists.oasis-open.org < cti@lists.oasis-open.org > on behalf of Terry MacDonald < terry.macdonald@threatloop.com >
    Sent: Tuesday, June 9, 2015 5:25:42 PM
    To: Jordan, Bret
    Cc: Chet Ensign;
    cti@lists.oasis-open.org ; Richard Struse; Scott McGrath; Robin Cover; Carol Geyer
    Subject: Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,


     




    I second Bret as a co-chair.












    Cheers



    Terry MacDonald STIX, TAXII, CybOX Consultant


     


    M: +61-407-203-026


    E:  terry.macdonald@threatloop.com


    W:  www.threatloop.com


     





     


    Disclaimer: The opinions expressed within this email do not represent the sentiment of any other party except my own. My views do
    not necessarily reflect those of my employers.








     

    On 10 June 2015 at 03:32, Jordan, Bret < bret.jordan@bluecoat.com > wrote:



    Chet,


     

    I would be interested as a co-chair






     


    Thanks,


     


    Bret



     


     


     



    Bret Jordan CISSP


    Director of Security Architecture and Standards Office of the CTO


    Blue Coat Systems



    PGP Fingerprint: 62A6 5999 0F7D 0D61 4C66 D59C 2DB5 111D 63BC A303


    "Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg." 










     



    On Jun 9, 2015, at 07:44, Chet Ensign < chet.ensign@oasis-open.org > wrote:

     



    To all prospective members of the Cyber Threat Intelligence (CTI) TC:


     


    The first order of business at the first TC meeting is to elect a chair (or two co-chairs). If you are interested in serving as a Chair or in nominating
    another individual for the position of Chair, you are welcome to make that candidacy known prior to the first meeting by posting a note to the TC's e-mail list expressing your interest and/or intent along with a brief statement of your or their qualifications.
    The meeting will also accept nominations from any qualified persons before beginning the vote. 


     


    Please be aware that prospective members must join the TC no less than 7 days prior to the first meeting in order to be eligible to vote for TC Chair(s).
    To join the TC, go to the TC's web page at
    https://www.oasis-open.org/apps/org/workgroup/cti/ and click the "Join group" link under Roster. 


     

    --






    /chet 
    ----------------
    Chet Ensign
    Director of Standards Development and TC Administration 
    OASIS: Advancing open standards for the information society
    http://www.oasis-open.org

    Primary: +1 973-996-2298
    Mobile: +1 201-341-1393  








     





     










     

    --






    /chet 
    ----------------
    Chet Ensign
    Director of Standards Development and TC Administration 
    OASIS: Advancing open standards for the information society
    http://www.oasis-open.org

    Primary: +1 973-996-2298
    Mobile: +1 201-341-1393  

















     

    --





    /chet 
    ----------------
    Chet Ensign
    Director of Standards Development and TC Administration 
    OASIS: Advancing open standards for the information society
    http://www.oasis-open.org

    Primary: +1 973-996-2298
    Mobile: +1 201-341-1393 






    DTCC DISCLAIMER: This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error, please notify us immediately and delete the email and any attachments from your system. The recipient should check this email and any attachments for the presence of viruses.  The company accepts no liability for any damage caused by any virus transmitted by this email.




  • 13.  RE: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,

    Posted 06-10-2015 15:46




    Also, do we want to put a time limit on the chair designation?  Say, 2 or 3 years?  Or, is this an open ended assignment?
     


    From: Bush, Jonathan

    Sent: Wednesday, June 10, 2015 11:43 AM
    To: 'Peter F Brown'; Chet Ensign; Aharon Chernin
    Cc: Terry MacDonald; Jordan, Bret; cti@lists.oasis-open.org; Richard Struse; Scott McGrath; Robin Cover; Carol Geyer
    Subject: RE: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,


     
    I would agree with Peter’s comments. 

    ·         
    One chair is probably better until we find a definitive use-case for a co-chair sort of setup.
    ·         
    Having separate roles of secretary and editor would be very effective in keeping us moving forward.
     
    An additional thought – Will this TC have any ‘non voting’ members?  In the past I’ve seen this useful for folks that have an interest in the outcomes but may
    not be committed enough to always attend, hence you would not want them to impact meeting quorum.
     


    From:
    cti@lists.oasis-open.org [ mailto:cti@lists.oasis-open.org ]
    On Behalf Of Peter F Brown
    Sent: Wednesday, June 10, 2015 11:34 AM
    To: Chet Ensign; Aharon Chernin
    Cc: Terry MacDonald; Jordan, Bret;
    cti@lists.oasis-open.org ; Richard Struse; Scott McGrath; Robin Cover; Carol Geyer
    Subject: RE: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,


     
    Chet,
    Thanks for the clarifications.
    If I may, a couple of suggestions:
    - it’s probably a good idea to have a single chair to kick things off. This doesn’t mean that even by the second meeting we establish that co-chairs are a good
    idea. The first meeting it is good to have some clarity, simplicity and a single person steering us through the call!
    - Secretary is useful, particularly for larger committees, like this one seems destined to be, can handle roll call, agenda, minutes, etc. and leave the Chair
    with hands free to actually concentrate on the meeting and its discussions.
    - We should also remember that every deliverable from a TC needs at least one editor: In my experience, the TC’s work is better served when the roles of chair
    and editor are separated. The editor’s job is to ensure that texts reflect agreement or consensus in the group; the chair’s role is to steer the group towards such agreement. Editors need to be known when the TC advances onto the first step of the formal process
    of creating any particular deliverable – although names can be added or changed any time up to publication.
     
    Hope this helps, regards,
    Peter
     
     











    Peter F Brown
    Independent Consultant
    CIPT, MIoD




    ”Using Information Technologies to Empower and Transform”
    www.PeterFBrown.com
     


     




     


















     
     
     
     
     
    From:
    cti@lists.oasis-open.org [ mailto:cti@lists.oasis-open.org ]
    On Behalf Of Chet Ensign
    Sent: 10 June, 2015 06:03
    To: Aharon Chernin
    Cc: Terry MacDonald; Jordan, Bret;
    cti@lists.oasis-open.org ; Richard Struse; Scott McGrath; Robin Cover; Carol Geyer
    Subject: Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,
     

    Yes, you can. 

     


    To be clear, the call was simply to give people a chance to nominate themselves or nominate someone else to stand for Chair at the first meeting. Since Rich, as the Convener, is also a nominee for Chair, I will be running the Chair election
    portion of the meeting. There will also be a call for any additional nominations from the floor before the vote. 


     


    If we have only one nominee, I will ask if there are objections to unanimous approval. If there is more than one nominee, then the first question before the eligible voters will be whether or not the TC wishes to have co-Chairs. Totally
    up to the group. 


     


    After that, it is a matter of seat(s) and name(s). If we have more nominees than seats, I will carry out a roll call vote. 


     


    So in other words, you could well have 10 nominees for Chair at the first meeting - our process doesn't preclude that. Plus, should the TC start with a single Chair and then you decide, 3 months from now, that it is a lot of work and a
    Co-Chair is needed, you can hold an election then. 


     


    Also, by the way, one other formal role you may want to consider nominations for is Secretary. I don't issue calls for those & leave it up to the TC to decide in as part of their work, but the Secretary role in our platform is one that
    can also help the Chair(s) with the details of day-to-day work - roster and calendar maintenance, taking minutes, etc. 


     


    /chet



     

    On Wed, Jun 10, 2015 at 8:53 AM, Aharon Chernin < achernin@soltra.com > wrote:



    Chet: should we be accepting nominations for a chair spot that may or may-not exist? Can we reopen nominations for co-chair if the TC decides one is needed?

     




    Aharon Chernin
    CTO


    SOLTRA
    An FS-ISAC & DTCC Company


    18301 Bermuda green Dr


    Tampa, fl 33647


    813.470.2173
    achernin@soltra.com


    www.soltra.com










    From: Chet Ensign < chet.ensign@oasis-open.org >
    Sent: Wednesday, June 10, 2015 8:46 AM
    To: Aharon Chernin
    Cc: Terry MacDonald; Jordan, Bret;
    cti@lists.oasis-open.org ; Richard Struse; Scott McGrath; Robin Cover; Carol Geyer



    Subject: Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,



     






    This was simply a call for nominations. As many people can be nominated as want to put themselves forward (or be put forward by others). 


     


    As a group, you can decide on one chair or two co-chairs at the first meeting. 



     

    On Tue, Jun 9, 2015 at 6:53 PM, Aharon Chernin < achernin@soltra.com > wrote:


    Question for Chet: are we nominating co-chairs now? Or just a single chair? I would think the decision for one or two chairs would be a topic of the first
    TC meeting.

    Also, +1 for Rich Struse as chair.

    Aharon





    From:
    cti@lists.oasis-open.org < cti@lists.oasis-open.org > on behalf of Terry MacDonald < terry.macdonald@threatloop.com >
    Sent: Tuesday, June 9, 2015 5:25:42 PM
    To: Jordan, Bret
    Cc: Chet Ensign;
    cti@lists.oasis-open.org ; Richard Struse; Scott McGrath; Robin Cover; Carol Geyer
    Subject: Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,


     




    I second Bret as a co-chair.












    Cheers



    Terry MacDonald STIX, TAXII, CybOX Consultant


     


    M: +61-407-203-026


    E:  terry.macdonald@threatloop.com


    W:  www.threatloop.com


     





     


    Disclaimer: The opinions expressed within this email do not represent the sentiment of any other party except my own. My views do
    not necessarily reflect those of my employers.








     

    On 10 June 2015 at 03:32, Jordan, Bret < bret.jordan@bluecoat.com > wrote:



    Chet,


     

    I would be interested as a co-chair






     


    Thanks,


     


    Bret



     


     


     



    Bret Jordan CISSP


    Director of Security Architecture and Standards Office of the CTO


    Blue Coat Systems



    PGP Fingerprint: 62A6 5999 0F7D 0D61 4C66 D59C 2DB5 111D 63BC A303


    "Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg." 










     



    On Jun 9, 2015, at 07:44, Chet Ensign < chet.ensign@oasis-open.org > wrote:

     



    To all prospective members of the Cyber Threat Intelligence (CTI) TC:


     


    The first order of business at the first TC meeting is to elect a chair (or two co-chairs). If you are interested in serving as a Chair or in nominating
    another individual for the position of Chair, you are welcome to make that candidacy known prior to the first meeting by posting a note to the TC's e-mail list expressing your interest and/or intent along with a brief statement of your or their qualifications.
    The meeting will also accept nominations from any qualified persons before beginning the vote. 


     


    Please be aware that prospective members must join the TC no less than 7 days prior to the first meeting in order to be eligible to vote for TC Chair(s).
    To join the TC, go to the TC's web page at
    https://www.oasis-open.org/apps/org/workgroup/cti/ and click the "Join group" link under Roster. 


     

    --






    /chet 
    ----------------
    Chet Ensign
    Director of Standards Development and TC Administration 
    OASIS: Advancing open standards for the information society
    http://www.oasis-open.org

    Primary: +1 973-996-2298
    Mobile: +1 201-341-1393  








     





     










     

    --






    /chet 
    ----------------
    Chet Ensign
    Director of Standards Development and TC Administration 
    OASIS: Advancing open standards for the information society
    http://www.oasis-open.org

    Primary: +1 973-996-2298
    Mobile: +1 201-341-1393  

















     

    --





    /chet 
    ----------------
    Chet Ensign
    Director of Standards Development and TC Administration 
    OASIS: Advancing open standards for the information society
    http://www.oasis-open.org

    Primary: +1 973-996-2298
    Mobile: +1 201-341-1393 






    DTCC DISCLAIMER: This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error, please notify us immediately and delete the email and any attachments from your system. The recipient should check this email and any attachments for the presence of viruses.  The company accepts no liability for any damage caused by any virus transmitted by this email.




  • 14.  Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,

    Posted 06-10-2015 15:54




    Naw, I think Rich should be chair for life, a la Python's BDFL [0].







    [0]: http://en.wikipedia.org/wiki/Benevolent_dictator_for_life






    Cheers,
    Trey
    --
    Trey Darley

    Senior Security Engineer
    Soltra An FS-ISAC & DTCC Company
    www.soltra.com






    From: cti@lists.oasis-open.org <cti@lists.oasis-open.org> on behalf of Bush, Jonathan <jbush@dtcc.com>
    Sent: Wednesday, June 10, 2015 17:45
    To: 'Peter F Brown'; 'Chet Ensign'; Aharon Chernin
    Cc: 'Terry MacDonald'; 'Jordan, Bret'; 'cti@lists.oasis-open.org'; 'Richard Struse'; 'Scott McGrath'; 'Robin Cover'; 'Carol Geyer'
    Subject: RE: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,
     




    Also, do we want to put a time limit on the chair designation?  Say, 2 or 3 years?  Or, is this an open ended assignment?

     



    From: Bush, Jonathan

    Sent: Wednesday, June 10, 2015 11:43 AM
    To: 'Peter F Brown'; Chet Ensign; Aharon Chernin
    Cc: Terry MacDonald; Jordan, Bret; cti@lists.oasis-open.org; Richard Struse; Scott McGrath; Robin Cover; Carol Geyer
    Subject: RE: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,



     

    I would agree with Peter’s comments. 


    ·         
    One chair is probably better until we find a definitive use-case for a co-chair sort of setup.

    ·         
    Having separate roles of secretary and editor would be very effective in keeping us moving forward.

     

    An additional thought – Will this TC have any ‘non voting’ members?  In the past I’ve seen this useful for folks that have an interest in the outcomes but may not be committed
    enough to always attend, hence you would not want them to impact meeting quorum.

     



    From:

    cti@lists.oasis-open.org [ mailto:cti@lists.oasis-open.org ]
    On Behalf Of Peter F Brown
    Sent: Wednesday, June 10, 2015 11:34 AM
    To: Chet Ensign; Aharon Chernin
    Cc: Terry MacDonald; Jordan, Bret;
    cti@lists.oasis-open.org ; Richard Struse; Scott McGrath; Robin Cover; Carol Geyer
    Subject: RE: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,



     

    Chet,

    Thanks for the clarifications.

    If I may, a couple of suggestions:

    - it’s probably a good idea to have a single chair to kick things off. This doesn’t mean that even by the second meeting we establish that co-chairs are a good idea. The first
    meeting it is good to have some clarity, simplicity and a single person steering us through the call!

    - Secretary is useful, particularly for larger committees, like this one seems destined to be, can handle roll call, agenda, minutes, etc. and leave the Chair with hands free
    to actually concentrate on the meeting and its discussions.

    - We should also remember that every deliverable from a TC needs at least one editor: In my experience, the TC’s work is better served when the roles of chair and editor are separated.
    The editor’s job is to ensure that texts reflect agreement or consensus in the group; the chair’s role is to steer the group towards such agreement. Editors need to be known when the TC advances onto the first step of the formal process of creating any particular
    deliverable – although names can be added or changed any time up to publication.

     

    Hope this helps, regards,

    Peter

     

     













    Peter F Brown

    Independent Consultant

    CIPT, MIoD





    ”Using Information Technologies to Empower and Transform”

    www.PeterFBrown.com

     



     





     























     

     

     

     

     

    From:

    cti@lists.oasis-open.org [ mailto:cti@lists.oasis-open.org ]
    On Behalf Of Chet Ensign
    Sent: 10 June, 2015 06:03
    To: Aharon Chernin
    Cc: Terry MacDonald; Jordan, Bret;
    cti@lists.oasis-open.org ; Richard Struse; Scott McGrath; Robin Cover; Carol Geyer
    Subject: Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,

     


    Yes, you can. 


     



    To be clear, the call was simply to give people a chance to nominate themselves or nominate someone else to stand for Chair at the first meeting. Since Rich, as the Convener, is also a nominee for Chair, I will be running the Chair election portion of the meeting.
    There will also be a call for any additional nominations from the floor before the vote. 



     



    If we have only one nominee, I will ask if there are objections to unanimous approval. If there is more than one nominee, then the first question before the eligible voters will be whether or not the TC wishes to have co-Chairs. Totally up to the group. 



     



    After that, it is a matter of seat(s) and name(s). If we have more nominees than seats, I will carry out a roll call vote. 



     



    So in other words, you could well have 10 nominees for Chair at the first meeting - our process doesn't preclude that. Plus, should the TC start with a single Chair and then you decide, 3 months from now, that it is a lot of work and a Co-Chair is needed, you
    can hold an election then. 



     



    Also, by the way, one other formal role you may want to consider nominations for is Secretary. I don't issue calls for those & leave it up to the TC to decide in as part of their work, but the Secretary role in our platform is one that can also help the Chair(s)
    with the details of day-to-day work - roster and calendar maintenance, taking minutes, etc. 



     



    /chet




     


    On Wed, Jun 10, 2015 at 8:53 AM, Aharon Chernin < achernin@soltra.com > wrote:



    Chet: should we be accepting nominations for a chair spot that may or may-not exist? Can we reopen nominations for co-chair if the TC decides one is needed?

     





    Aharon Chernin
    CTO



    SOLTRA An FS-ISAC & DTCC Company



    18301 Bermuda green Dr



    Tampa, fl 33647



    813.470.2173

    achernin@soltra.com



    www.soltra.com











    From: Chet Ensign < chet.ensign@oasis-open.org >
    Sent: Wednesday, June 10, 2015 8:46 AM
    To: Aharon Chernin
    Cc: Terry MacDonald; Jordan, Bret;
    cti@lists.oasis-open.org ; Richard Struse; Scott McGrath; Robin Cover; Carol Geyer




    Subject: Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,




     







    This was simply a call for nominations. As many people can be nominated as want to put themselves forward (or be put forward by others). 



     



    As a group, you can decide on one chair or two co-chairs at the first meeting. 




     


    On Tue, Jun 9, 2015 at 6:53 PM, Aharon Chernin < achernin@soltra.com > wrote:



    Question for Chet: are we nominating co-chairs now? Or just a single chair? I would think the decision for one or two chairs would be a topic of the first TC meeting.

    Also, +1 for Rich Struse as chair.

    Aharon






    From:

    cti@lists.oasis-open.org < cti@lists.oasis-open.org > on behalf of Terry MacDonald < terry.macdonald@threatloop.com >
    Sent: Tuesday, June 9, 2015 5:25:42 PM
    To: Jordan, Bret
    Cc: Chet Ensign;
    cti@lists.oasis-open.org ; Richard Struse; Scott McGrath; Robin Cover; Carol Geyer
    Subject: Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,



     





    I second Bret as a co-chair.














    Cheers




    Terry MacDonald STIX, TAXII, CybOX Consultant



     



    M: +61-407-203-026



    E:  terry.macdonald@threatloop.com



    W:  www.threatloop.com



     







     



    Disclaimer: The opinions expressed within this email do not represent the sentiment of any other party except my own. My views do not necessarily reflect those of my employers.









     


    On 10 June 2015 at 03:32, Jordan, Bret < bret.jordan@bluecoat.com > wrote:




    Chet,



     


    I would be interested as a co-chair







     



    Thanks,



     



    Bret




     



     



     




    Bret Jordan CISSP



    Director of Security Architecture and Standards Office of the CTO



    Blue Coat Systems




    PGP Fingerprint: 62A6 5999 0F7D 0D61 4C66 D59C 2DB5 111D 63BC A303



    "Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg." 











     




    On Jun 9, 2015, at 07:44, Chet Ensign < chet.ensign@oasis-open.org > wrote:


     




    To all prospective members of the Cyber Threat Intelligence (CTI) TC:



     



    The first order of business at the first TC meeting is to elect a chair (or two co-chairs). If you are interested in serving as a Chair or in nominating another individual for the position of Chair,
    you are welcome to make that candidacy known prior to the first meeting by posting a note to the TC's e-mail list expressing your interest and/or intent along with a brief statement of your or their qualifications. The meeting will also accept nominations
    from any qualified persons before beginning the vote. 



     



    Please be aware that prospective members must join the TC no less than 7 days prior to the first meeting in order to be eligible to vote for TC Chair(s). To join the TC, go to the TC's web page at

    https://www.oasis-open.org/apps/org/workgroup/cti/ and click the "Join group" link under Roster. 



     


    --






    /chet 
    ----------------
    Chet Ensign
    Director of Standards Development and TC Administration 
    OASIS: Advancing open standards for the information society
    http://www.oasis-open.org

    Primary:
    +1 973-996-2298
    Mobile:
    +1 201-341-1393  









     






     












     


    --






    /chet 
    ----------------
    Chet Ensign
    Director of Standards Development and TC Administration 
    OASIS: Advancing open standards for the information society
    http://www.oasis-open.org

    Primary:
    +1 973-996-2298
    Mobile:
    +1 201-341-1393  



















     


    --






    /chet 
    ----------------
    Chet Ensign
    Director of Standards Development and TC Administration 
    OASIS: Advancing open standards for the information society
    http://www.oasis-open.org

    Primary: +1 973-996-2298
    Mobile: +1 201-341-1393 







    DTCC DISCLAIMER: This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error, please notify us immediately and delete the email
    and any attachments from your system. The recipient should check this email and any attachments for the presence of viruses.  The company accepts no liability for any damage caused by any virus transmitted by this email.








  • 15.  RE: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,

    Posted 06-10-2015 15:44

    Peter,
    Some good thoughts there.

    I also endorse Rich as the chair for the first meeting, post election.

    However, I suggest the following, especially for us 'Americans' to consider.    We need to have another individual as a co-chair.    Simply put, to not be something that OASIS is adopting only for the US Department of Homeland Security (DHS).

    I say this as an US Person who holds a DHS Clearance and works with them but also as a Board member for FIRST, where I see this play out internationally.    We truly need a private sector person and preferably, one who is involved and not from the US.    This is both about adoption and perception, so please hear this reasoned thought out.    Many want to use / adopt STIX/TAXII and bringing it to OASIS to make a real standard is what they are asking for but also to have input beyond that of just DHS.   So while Rich has brought it this far, lets ensure we get everyone's support and push this forward.

    Thus I will, for now, refrain from suggesting anyone, but want this point to be fairly considered.

    Respectfully,
    Pete

    Peter Allor  
    Senior Security Strategist, Project Manager Disclosures
    Product Management and Strategy
    IBM Security
    6303 Barfield Rd NE
    Atlanta, GA 30328-4233
    Mobile: +1-404-643-9638    
    Fax:       +1-845-491-4204  
    pallor@us.ibm.com

    Peter F Brown ---06/10/2015 11:34:27 AM---Chet, Thanks for the clarifications.

    From: Peter F Brown <peter@peterfbrown.com>
    To: Chet Ensign <chet.ensign@oasis-open.org>, Aharon Chernin <achernin@soltra.com>
    Cc: Terry MacDonald <terry.macdonald@threatloop.com>, "Jordan, Bret" <bret.jordan@bluecoat.com>, "cti@lists.oasis-open.org" <cti@lists.oasis-open.org>, Richard Struse <Richard.Struse@hq.dhs.gov>, "Scott McGrath" <scott.mcgrath@oasis-open.org>, Robin Cover <robin@oasis-open.org>, Carol Geyer <carol.geyer@oasis-open.org>
    Date: 06/10/2015 11:34 AM
    Subject: RE: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,
    Sent by: <cti@lists.oasis-open.org>



    Chet,
    Thanks for the clarifications.
    If I may, a couple of suggestions:
    - it’s probably a good idea to have a single chair to kick things off. This doesn’t mean that even by the second meeting we establish that co-chairs are a good idea. The first meeting it is good to have some clarity, simplicity and a single person steering us through the call!
    - Secretary is useful, particularly for larger committees, like this one seems destined to be, can handle roll call, agenda, minutes, etc. and leave the Chair with hands free to actually concentrate on the meeting and its discussions.
    - We should also remember that every deliverable from a TC needs at least one editor: In my experience, the TC’s work is better served when the roles of chair and editor are separated. The editor’s job is to ensure that texts reflect agreement or consensus in the group; the chair’s role is to steer the group towards such agreement. Editors need to be known when the TC advances onto the first step of the formal process of creating any particular deliverable – although names can be added or changed any time up to publication.
     
    Hope this helps, regards,
    Peter
     
     




    Peter F Brown
    Independent Consultant
    CIPT, MIoD

    ”Using Information Technologies to Empower and Transform”
    www.PeterFBrown.com
       

     




     
     
     
     
     
    From:  cti@lists.oasis-open.org [ mailto:cti@lists.oasis-open.org ] On Behalf Of Chet Ensign
    Sent:  10 June, 2015 06:03
    To:  Aharon Chernin
    Cc:  Terry MacDonald; Jordan, Bret; cti@lists.oasis-open.org; Richard Struse; Scott McGrath; Robin Cover; Carol Geyer
    Subject:  Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,
     
    Yes, you can.
     
    To be clear, the call was simply to give people a chance to nominate themselves or nominate someone else to stand for Chair at the first meeting. Since Rich, as the Convener, is also a nominee for Chair, I will be running the Chair election portion of the meeting. There will also be a call for any additional nominations from the floor before the vote.
     
    If we have only one nominee, I will ask if there are objections to unanimous approval. If there is more than one nominee, then the first question before the eligible voters will be whether or not the TC wishes to have co-Chairs. Totally up to the group.
     
    After that, it is a matter of seat(s) and name(s). If we have more nominees than seats, I will carry out a roll call vote.
     
    So in other words, you could well have 10 nominees for Chair at the first meeting - our process doesn't preclude that. Plus, should the TC start with a single Chair and then you decide, 3 months from now, that it is a lot of work and a Co-Chair is needed, you can hold an election then.
     
    Also, by the way, one other formal role you may want to consider nominations for is Secretary. I don't issue calls for those & leave it up to the TC to decide in as part of their work, but the Secretary role in our platform is one that can also help the Chair(s) with the details of day-to-day work - roster and calendar maintenance, taking minutes, etc.
     
    /chet
     
    On Wed, Jun 10, 2015 at 8:53 AM, Aharon Chernin < achernin@soltra.com > wrote:

    Chet: should we be accepting nominations for a chair spot that may or may-not exist? Can we reopen nominations for co-chair if the TC decides one is needed?
     
    Aharon Chernin
    CTO
    SOLTRA   An FS-ISAC & DTCC Company
    18301 Bermuda green Dr
    Tampa, fl 33647
    813.470.2173   achernin@soltra.com
    www.soltra.com From:  Chet Ensign < chet.ensign@oasis-open.org >
    Sent:  Wednesday, June 10, 2015 8:46 AM
    To:  Aharon Chernin
    Cc:  Terry MacDonald; Jordan, Bret; cti@lists.oasis-open.org ; Richard Struse; Scott McGrath; Robin Cover; Carol Geyer

    Subject:  Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,
     
    This was simply a call for nominations. As many people can be nominated as want to put themselves forward (or be put forward by others).  
     
    As a group, you can decide on one chair or two co-chairs at the first meeting.
     
    On Tue, Jun 9, 2015 at 6:53 PM, Aharon Chernin < achernin@soltra.com > wrote:
    Question for Chet: are we nominating co-chairs now? Or just a single chair? I would think the decision for one or two chairs would be a topic of the first TC meeting.

    Also, +1 for Rich Struse as chair.

    Aharon From:   cti@lists.oasis-open.org  < cti@lists.oasis-open.org > on behalf of Terry MacDonald < terry.macdonald@threatloop.com >
    Sent:  Tuesday, June 9, 2015 5:25:42 PM
    To:  Jordan, Bret
    Cc:  Chet Ensign; cti@lists.oasis-open.org ; Richard Struse; Scott McGrath; Robin Cover; Carol Geyer
    Subject:  Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,  
     
    I second Bret as a co-chair.

    Cheers

    Terry MacDonald STIX, TAXII, CybOX Consultant
     
    M: +61-407-203-026
    E: terry.macdonald@threatloop.com
    W: www.threatloop.com
     

     
    Disclaimer: The opinions expressed within this email do not represent the sentiment of any other party except my own. My views do not necessarily reflect those of my employers.
     
    On 10 June 2015 at 03:32, Jordan, Bret < bret.jordan@bluecoat.com > wrote:
    Chet,
     
    I would be interested as a co-chair
     
    Thanks,
     
    Bret
     
     
     
    Bret Jordan CISSP  
    Director of Security Architecture and Standards Office of the CTO
    Blue Coat Systems
    PGP Fingerprint: 62A6 5999 0F7D 0D61 4C66 D59C 2DB5 111D 63BC A303
    "Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg."
     
    On Jun 9, 2015, at 07:44, Chet Ensign < chet.ensign@oasis-open.org > wrote:
     
    To all prospective members of the Cyber Threat Intelligence (CTI) TC:
     
    The first order of business at the first TC meeting is to elect a chair (or two co-chairs). If you are interested in serving as a Chair or in nominating another individual for the position of Chair, you are welcome to make that candidacy known prior to the first meeting by posting a note to the TC's e-mail list expressing your interest and/or intent along with a brief statement of your or their qualifications. The meeting will also accept nominations from any qualified persons before beginning the vote.
     
    Please be aware that prospective members must join the TC no less than 7 days prior to the first meeting in order to be eligible to vote for TC Chair(s). To join the TC, go to the TC's web page at https://www.oasis-open.org/apps/org/workgroup/cti/  and click the "Join group" link under Roster.
     
    --

    /chet
    ----------------
    Chet Ensign
    Director of Standards Development and TC Administration
    OASIS: Advancing open standards for the information society
    http://www.oasis-open.org

    Primary: +1 973-996-2298
    Mobile: +1 201-341-1393  
     
     


     
    --

    /chet
    ----------------
    Chet Ensign
    Director of Standards Development and TC Administration
    OASIS: Advancing open standards for the information society
    http://www.oasis-open.org

    Primary: +1 973-996-2298
    Mobile: +1 201-341-1393  


     
    --

    /chet
    ----------------
    Chet Ensign
    Director of Standards Development and TC Administration
    OASIS: Advancing open standards for the information society
    http://www.oasis-open.org

    Primary: +1 973-996-2298
    Mobile: +1 201-341-1393




  • 16.  RE: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,

    Posted 06-10-2015 15:53




    Pete,
    Excellent point (btw, despite my address, I hold a British passport, Belgian residency permit, and a US State Department driving license!)
     
    Jonathan,
    Indeed, it is possible to join as either an “Observer” (which means exactly that – follow meetings and threads, but no posting or speaking rights at meetings)
    or as a “Persistent Non-Voting Member” (which allows you to contribute, post, speak, etc. but not vote nor – most importantly – have your person count towards making quorum): this last is valuable for people who are irregular attendees and who do not want
    to affect the overall quorum and stability of the group. I use that status on a couple of TCs when I know that I can’t commit to regular participation but want to contribute when I can. An observer or voting member who wants to transition to PNVM has to request
    that or the chair or secretary, there is currently no mechanism to assign oneself this role from the get go.
     
    Cheers,
    Peter
     


    From: Peter Allor [mailto:pallor@us.ibm.com]

    Sent: 10 June, 2015 08:44
    To: Peter F Brown
    Cc: Chet Ensign; Aharon Chernin; Terry MacDonald; Jordan, Bret; cti@lists.oasis-open.org; Richard Struse; Scott McGrath; Robin Cover; Carol Geyer
    Subject: RE: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,


     
    Peter,
    Some good thoughts there.

    I also endorse Rich as the chair for the first meeting, post election.

    However, I suggest the following, especially for us 'Americans' to consider.    We need to have another individual as a co-chair.    Simply put, to not be something that OASIS is adopting only for
    the US Department of Homeland Security (DHS).

    I say this as an US Person who holds a DHS Clearance and works with them but also as a Board member for FIRST, where I see this play out internationally.    We truly need a private sector person
    and preferably, one who is involved and not from the US.    This is both about adoption and perception, so please hear this reasoned thought out.    Many want to use / adopt STIX/TAXII and bringing it to OASIS to make a real standard is what they are asking
    for but also to have input beyond that of just DHS.   So while Rich has brought it this far, lets ensure we get everyone's support and push this forward.

    Thus I will, for now, refrain from suggesting anyone, but want this point to be fairly considered.

    Respectfully,
    Pete

    Peter Allor  
    Senior Security Strategist, Project Manager Disclosures
    Product Management and Strategy
    IBM Security
    6303 Barfield Rd NE
    Atlanta, GA 30328-4233
    Mobile: +1-404-643-9638    
    Fax:       +1-845-491-4204  
    pallor@us.ibm.com

    Peter
    F Brown ---06/10/2015 11:34:27 AM---Chet, Thanks for the clarifications.

    From:
    Peter F Brown < peter@peterfbrown.com >
    To:
    Chet Ensign < chet.ensign@oasis-open.org >, Aharon Chernin < achernin@soltra.com >
    Cc:
    Terry MacDonald < terry.macdonald@threatloop.com >, "Jordan, Bret" < bret.jordan@bluecoat.com >, " cti@lists.oasis-open.org "
    < cti@lists.oasis-open.org >, Richard Struse < Richard.Struse@hq.dhs.gov >, "Scott McGrath" < scott.mcgrath@oasis-open.org >,
    Robin Cover < robin@oasis-open.org >, Carol Geyer < carol.geyer@oasis-open.org >
    Date:
    06/10/2015 11:34 AM
    Subject:
    RE: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,
    Sent by:
    < cti@lists.oasis-open.org >






    Chet,
    Thanks for the clarifications.
    If I may, a couple of suggestions:
    - it’s probably a good idea to have a single chair to kick things off. This doesn’t mean that even by the second meeting we establish that co-chairs are a good idea. The first meeting
    it is good to have some clarity, simplicity and a single person steering us through the call!
    - Secretary is useful, particularly for larger committees, like this one seems destined to be, can handle roll call, agenda, minutes, etc. and leave the Chair with hands free to actually
    concentrate on the meeting and its discussions.
    - We should also remember that every deliverable from a TC needs at least one editor: In my experience, the TC’s work is better served when the roles of chair and editor are separated.
    The editor’s job is to ensure that texts reflect agreement or consensus in the group; the chair’s role is to steer the group towards such agreement. Editors need to be known when the TC advances onto the first step of the formal process of creating any particular
    deliverable – although names can be added or changed any time up to publication.
     
    Hope this helps, regards,
    Peter
     
     












    Peter F Brown
    Independent Consultant
    CIPT, MIoD




    ”Using Information Technologies to Empower and Transform”
    www.PeterFBrown.com
     


     




     


















     
     
     
     
     
    From:   cti@lists.oasis-open.org [ mailto:cti@lists.oasis-open.org ]
    On Behalf Of Chet Ensign
    Sent:  10 June, 2015 06:03
    To:  Aharon Chernin
    Cc:  Terry MacDonald; Jordan, Bret;
    cti@lists.oasis-open.org ; Richard Struse; Scott McGrath; Robin Cover; Carol Geyer
    Subject:  Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,
     
    Yes, you can.
     
    To be clear, the call was simply to give people a chance to nominate themselves or nominate someone else to stand for Chair at the first meeting. Since Rich, as the Convener, is also a nominee for Chair, I will be running the Chair election portion of the meeting.
    There will also be a call for any additional nominations from the floor before the vote.

     
    If we have only one nominee, I will ask if there are objections to unanimous approval. If there is more than one nominee, then the first question before the eligible voters will be whether or not the TC wishes to have co-Chairs. Totally up to the group.

     
    After that, it is a matter of seat(s) and name(s). If we have more nominees than seats, I will carry out a roll call vote.

     
    So in other words, you could well have 10 nominees for Chair at the first meeting - our process doesn't preclude that. Plus, should the TC start with a single Chair and then you decide, 3 months from now, that it is a lot of work and a Co-Chair is needed, you
    can hold an election then.
     
    Also, by the way, one other formal role you may want to consider nominations for is Secretary. I don't issue calls for those & leave it up to the TC to decide in as part of their work, but the Secretary role in our platform is one that can also help the Chair(s)
    with the details of day-to-day work - roster and calendar maintenance, taking minutes, etc.

     
    /chet
     
    On Wed, Jun 10, 2015 at 8:53 AM, Aharon Chernin < achernin@soltra.com > wrote:


    Chet: should we be accepting nominations for a chair spot that may or may-not exist? Can we reopen nominations for co-chair if the TC decides one is needed?

     
    Aharon Chernin
    CTO
    SOLTRA   An FS-ISAC & DTCC Company
    18301 Bermuda green Dr
    Tampa, fl 33647
    813.470.2173  
    achernin@soltra.com
    www.soltra.com



    From:  Chet Ensign < chet.ensign@oasis-open.org >
    Sent:  Wednesday, June 10, 2015 8:46 AM
    To:  Aharon Chernin
    Cc:  Terry MacDonald; Jordan, Bret; cti@lists.oasis-open.org ;
    Richard Struse; Scott McGrath; Robin Cover; Carol Geyer

    Subject:  Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,
     
    This was simply a call for nominations. As many people can be nominated as want to put themselves forward (or be put forward by others).  
     
    As a group, you can decide on one chair or two co-chairs at the first meeting.

     
    On Tue, Jun 9, 2015 at 6:53 PM, Aharon Chernin < achernin@soltra.com >
    wrote:
    Question for Chet: are we nominating co-chairs now? Or just a single chair? I would think the decision for one or two chairs would be a topic of the first TC meeting.

    Also, +1 for Rich Struse as chair.

    Aharon



    From:   cti@lists.oasis-open.org  < cti@lists.oasis-open.org >
    on behalf of Terry MacDonald < terry.macdonald@threatloop.com >
    Sent:  Tuesday, June 9, 2015 5:25:42 PM
    To:  Jordan, Bret
    Cc:  Chet Ensign; cti@lists.oasis-open.org ; Richard
    Struse; Scott McGrath; Robin Cover; Carol Geyer
    Subject:  Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,  
     
    I second Bret as a co-chair.


    Cheers

    Terry MacDonald STIX, TAXII, CybOX Consultant
     
    M: +61-407-203-026
    E: terry.macdonald@threatloop.com
    W: www.threatloop.com
     

     
    Disclaimer: The opinions expressed within this email do not represent the sentiment of any other party except my own. My views do not necessarily reflect those of my employers.
     
    On 10 June 2015 at 03:32, Jordan, Bret < bret.jordan@bluecoat.com >
    wrote:
    Chet,
     
    I would be interested as a co-chair
     
    Thanks,
     
    Bret
     
     
     
    Bret Jordan CISSP  
    Director of Security Architecture and Standards Office of the CTO
    Blue Coat Systems
    PGP Fingerprint: 62A6 5999 0F7D 0D61 4C66 D59C 2DB5 111D 63BC A303
    "Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg."

     
    On Jun 9, 2015, at 07:44, Chet Ensign < chet.ensign@oasis-open.org >
    wrote:
     
    To all prospective members of the Cyber Threat Intelligence (CTI) TC:
     
    The first order of business at the first TC meeting is to elect a chair (or two co-chairs). If you are interested in serving as a Chair or in nominating another individual for the position of Chair, you are welcome
    to make that candidacy known prior to the first meeting by posting a note to the TC's e-mail list expressing your interest and/or intent along with a brief statement of your or their qualifications. The meeting will also accept nominations from any qualified
    persons before beginning the vote.
     
    Please be aware that prospective members must join the TC no less than 7 days prior to the first meeting in order to be eligible to vote for TC Chair(s). To join the TC, go to the TC's web page at
    https://www.oasis-open.org/apps/org/workgroup/cti/  and click the "Join
    group" link under Roster.
     
    --

    /chet
    ----------------
    Chet Ensign
    Director of Standards Development and TC Administration
    OASIS: Advancing open standards for the information society
    http://www.oasis-open.org

    Primary: +1 973-996-2298
    Mobile: +1 201-341-1393  
     
     


     
    --

    /chet
    ----------------
    Chet Ensign
    Director of Standards Development and TC Administration
    OASIS: Advancing open standards for the information society
    http://www.oasis-open.org

    Primary: +1 973-996-2298
    Mobile: +1 201-341-1393  


     
    --

    /chet
    ----------------
    Chet Ensign
    Director of Standards Development and TC Administration
    OASIS: Advancing open standards for the information society
    http://www.oasis-open.org

    Primary: +1 973-996-2298
    Mobile: +1 201-341-1393






  • 17.  Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,

    Posted 06-11-2015 14:46
    <snip> However, I suggest the following, especially for us 'Americans' to consider.    We need to have another individual as a co-chair.    Simply put, to not be something that OASIS is adopting only for the US Department of Homeland Security (DHS).  </snip> This, so much this! Hadn't considered this angle vis-a-vis the question of co-chair. Despite my joke yesterday about making Rich BDFL, Pete makes an _excellent_ point. /me removes Soltra hat...voices personal opinion... In the interest of promoting international adoption of STIX, TAXII, et al, we should _definitely_ see about a non-US co-chair. I don't see a clear-cut argument for a private-sector person in this role, could go either way, but (again, my personal opinion) preferably _not_ a vendor. Maybe an academic-cum-actual security researcher with dirt under their fingernails? (Such creatures, while rare, can be found.) Cheers, Trey -- Trey Darley Senior Security Engineer Soltra An FS-ISAC & DTCC Company www.soltra.c om From: cti@lists.oasis-open.org <cti@lists.oasis-open.org> on behalf of Peter Allor <pallor@us.ibm.com> Sent: Wednesday, June 10, 2015 17:44 To: Peter F Brown Cc: Chet Ensign; Aharon Chernin; Terry MacDonald; Jordan, Bret; cti@lists.oasis-open.org; Richard Struse; Scott McGrath; Robin Cover; Carol Geyer Subject: RE: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,   Peter, Some good thoughts there. I also endorse Rich as the chair for the first meeting, post election. However, I suggest the following, especially for us 'Americans' to consider.    We need to have another individual as a co-chair.    Simply put, to not be something that OASIS is adopting only for the US Department of Homeland Security (DHS). I say this as an US Person who holds a DHS Clearance and works with them but also as a Board member for FIRST, where I see this play out internationally.    We truly need a private sector person and preferably, one who is involved and not from the US.    This is both about adoption and perception, so please hear this reasoned thought out.    Many want to use / adopt STIX/TAXII and bringing it to OASIS to make a real standard is what they are asking for but also to have input beyond that of just DHS.   So while Rich has brought it this far, lets ensure we get everyone's support and push this forward. Thus I will, for now, refrain from suggesting anyone, but want this point to be fairly considered. Respectfully, Pete Peter Allor   Senior Security Strategist, Project Manager Disclosures Product Management and Strategy IBM Security 6303 Barfield Rd NE Atlanta, GA 30328-4233 Mobile: +1-404-643-9638     Fax:       +1-845-491-4204   pallor@us.ibm.com


  • 18.  Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,

    Posted 06-11-2015 15:11
    The world of international technical committees in this sector contains numerous examples of chairs from government agencies.  Furthermore, Rich is rather more than an agency representative in this context.  From both a substantive perspective as well as effective leadership and messaging, his chair position is important. As someone who leads the ETSI equivalent activity, (and formerly led the equivalent in ITU-T) Rich's chair position probably enhances the global assimilation of the CTI suite. --tony On 2015-06-11 10:45 AM, Trey Darley wrote: <snip> However, I suggest the following, especially for us 'Americans' to consider.    We need to have another individual as a co-chair.    Simply put, to not be something that OASIS is adopting only for the US Department of Homeland Security (DHS).  </snip> -- ________________________________ Anthony Michael Rutkowski EVP, Industry Standards & Regulatory Affairs tony@yaanatech.com +1 703 999 8270 ________________________________ Yaana Technologies LLC 542 Gibraltar Drive Milpitas CA 95035 USA


  • 19.  Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,

    Posted 06-11-2015 15:16
    Don't get me wrong, I support Rich for *chair* 110%. I'm merely supporting the argument Pete put forward for a non-US co-chair. Cheers, Trey -- Trey Darley Senior Security Engineer Soltra An FS-ISAC & DTCC Company www.soltra.com ++----------------------------------------------------------------------------++ Sent from my CRM-114 Discriminator On Jun 11, 2015 5:11 PM, Tony Rutkowski <tony@yaanatech.com> wrote: The world of international technical committees in this sector contains numerous examples of chairs from government agencies.  Furthermore, Rich is rather more than an agency representative in this context.  From both a substantive perspective as well as effective leadership and "messaging," his chair position is important. As someone who leads the ETSI equivalent activity, (and formerly led the equivalent in ITU-T) Rich's chair position probably enhances the global assimilation of the CTI suite. --tony On 2015-06-11 10:45 AM, Trey Darley wrote: <snip> However, I suggest the following, especially for us 'Americans' to consider.    We need to have another individual as a co-chair.    Simply put, to not be something that OASIS is adopting only for the US Department of Homeland Security (DHS).  </snip> -- ________________________________ Anthony Michael Rutkowski EVP, Industry Standards & Regulatory Affairs tony@yaanatech.com +1 703 999 8270 ________________________________ Yaana Technologies LLC 542 Gibraltar Drive Milpitas CA 95035 USA


  • 20.  RE: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,

    Posted 06-11-2015 15:24
    +1 The significance only means something if we * make * it mean something. I understand that there might be concern about an OASIS TC being seen just to do DHS’s bidding. However, expanding on what Tony rightly says, there are many TCs where there are initial worries that one party (public, private, research, not-for-profit) is set to run the show – but the nature of the open process, transparency, and engagement from all sides will do more to “disappear” that myth than any “fix”. This is not an argument against co-chair(s) per se: just that, if we need such a role, it will become apparent quickly enough. All the best, Peter   From: Tony Rutkowski [mailto:tony@yaanatech.com] Sent: 11 June, 2015 08:11 To: Trey Darley; Peter Allor; Peter F Brown Cc: Chet Ensign; Aharon Chernin; Terry MacDonald; Jordan, Bret; cti@lists.oasis-open.org; Richard Struse; Scott McGrath; Robin Cover; Carol Geyer Subject: Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,   The world of international technical committees in this sector contains numerous examples of chairs from government agencies.  Furthermore, Rich is rather more than an agency representative in this context.  From both a substantive perspective as well as effective leadership and "messaging," his chair position is important. As someone who leads the ETSI equivalent activity, (and formerly led the equivalent in ITU-T) Rich's chair position probably enhances the global assimilation of the CTI suite. --tony On 2015-06-11 10:45 AM, Trey Darley wrote: <snip> However, I suggest the following, especially for us 'Americans' to consider.    We need to have another individual as a co-chair.    Simply put, to not be something that OASIS is adopting only for the US Department of Homeland Security (DHS).  </snip>     -- ________________________________ Anthony Michael Rutkowski EVP, Industry Standards & Regulatory Affairs tony@yaanatech.com +1 703 999 8270 ________________________________ Yaana Technologies LLC 542 Gibraltar Drive Milpitas CA 95035 USA


  • 21.  RE: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,

    Posted 06-11-2015 16:02

    As a data point, in discussing adoption of STIX/TAXII with National Government CSIRTs and other large corporate international organizations, a US/DHS only way forward, has / is an inhibitor to formally using STIX/TAXII in the recent past.

    I am aware of some USG elements liking that we demonstrate a broad representation.

    So, I endorse and support Rich, both for his leadership and technical passion as well as vision for this effort.     And will bow to what the group decides.

    But would heavily suggest that we have someone else assist Rich in his chair duties as his co-chair.   This is more about perception and adoption than about substance/content.   And no, I am not soliciting an academic.    We really need and want 'industry' (across the board) to use this.  

    Pete

    Peter F Brown ---06/11/2015 11:25:01 AM---+1 The significance only means something if we *make* it mean something.

    From: Peter F Brown <peter@peterfbrown.com>
    To: "tony@yaanatech.com" <tony@yaanatech.com>, Trey Darley <trey@soltra.com>, Peter Allor/Atlanta/IBM@IBMUS
    Cc: Chet Ensign <chet.ensign@oasis-open.org>, Aharon Chernin <achernin@soltra.com>, Terry MacDonald <terry.macdonald@threatloop.com>, "Jordan, Bret" <bret.jordan@bluecoat.com>, "cti@lists.oasis-open.org" <cti@lists.oasis-open.org>, Richard Struse <Richard.Struse@hq.dhs.gov>, "Scott McGrath" <scott.mcgrath@oasis-open.org>, Robin Cover <robin@oasis-open.org>, Carol Geyer <carol.geyer@oasis-open.org>
    Date: 06/11/2015 11:25 AM
    Subject: RE: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,



    +1
    The significance only means something if we * make * it mean something.
    I understand that there might be concern about an OASIS TC being seen just to do DHS’s bidding. However, expanding on what Tony rightly says, there are many TCs where there are initial worries that one party (public, private, research, not-for-profit) is set to run the show – but the nature of the open process, transparency, and engagement from all sides will do more to “disappear” that myth than any “fix”.
    This is not an argument against co-chair(s) per se: just that, if we need such a role, it will become apparent quickly enough.
    All the best,
    Peter
     
    From:  Tony Rutkowski [ mailto:tony@yaanatech.com ]
    Sent:  11 June, 2015 08:11
    To:  Trey Darley; Peter Allor; Peter F Brown
    Cc:  Chet Ensign; Aharon Chernin; Terry MacDonald; Jordan, Bret; cti@lists.oasis-open.org; Richard Struse; Scott McGrath; Robin Cover; Carol Geyer
    Subject:  Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,
     
    The world of international technical committees in
    this sector contains numerous examples of chairs
    from government agencies.  Furthermore, Rich
    is rather more than an agency representative in
    this context.  From both a substantive perspective
    as well as effective leadership and "messaging,"
    his chair position is important.

    As someone who leads the ETSI equivalent activity,
    (and formerly led the equivalent in ITU-T) Rich's
    chair position probably enhances the global
    assimilation of the CTI suite.

    --tony
    On 2015-06-11 10:45 AM, Trey Darley wrote:
    <snip>
    However, I suggest the following, especially for us 'Americans' to consider.    We need to have another individual as a co-chair.    Simply put, to not be something that OASIS is adopting only for the US Department of Homeland Security (DHS).
    </snip>
     
     
    --
    ________________________________
    Anthony Michael Rutkowski  
    EVP, Industry Standards & Regulatory Affairs
    tony@yaanatech.com
    +1 703 999 8270
    ________________________________
    Yaana Technologies LLC
    542 Gibraltar Drive
    Milpitas CA 95035 USA




  • 22.  Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,

    Posted 06-11-2015 17:57
    Great discussion folks.  Thanks Peter et al  for bringing our focus away from tactical to strategic issues/opportunities.  This response started earlier today does not counter the suggestions by Peter below, but does argue that we can consider filling the TC Chair to move forward on tactical objectives, and then focus on a broader strategic objectives in filling the key Co-Chair positions (unless such candidates are already available). (Note that I make the following assertions as a neophyte in well established ISO processes and understand many of you are well aware of what's required for success.  I welcome any guidance on ISO/OASIS processes and critical thinking on the suggestions submitted below for consideration) Strategic Objectives The OASIS CTI TC needs many diverse sets of skills, at many levels, to move our collaborative technical, organizational, and stakeholder engagement agendas forward.  Identifying and removing impediments to adoption is as important as the technical aspects of this initiative.  Our success and agility will rely on engaging as many talented people as we can in each of these key domains and skill sets.  The process of recruitment and selection of Chairs, Co-Chairs of the TC, SCs, and Team leads for any Working Groups should include a specific long term strategy for defining the scope, internal/external focus, and primary objectives for each of these key roles.  It should also identify any gaps in key Stakeholder Communities required for success and target outreach and engagement (in terms of OASIS CTI TC leadership roles, participating members, external partnerships, or as liaison to other standards based initiatives). Tactical Objectives If we agree with the proposition that our first tactical  priority is establishing the teams to engage and complete the technical efforts required to transform the existing body of work into formal OASIS Standards, then suggest that we focus on this objective now. As currently defined in the CTI TC Charter, a majority of these technical tasks will fall under each of the three OASIS CTI TC SCs  (with overall coordination though the CTI TC).  Therefore, would suggest that recruitment, nomination, and selection of these SC Chairs should be started ASAP so we can get these Teams organized and started on execution of tasks required to meet known near-term objectives.  I don't know if anything prevents us from engaging in these deliberations now given the Charter was ratified(?). By definition these teams will be initially composed of the SMEs from MITRE and the community members who have been actively engaged to bring CTI where it is today.  Integrating people knowledgable in the OASIS processes required to provide normative specifications and the requirements for any related deliverables is equally important to success as is the overall leadership required to coordinate activities and empower these teams.  We have key people already in leadership roles for each of the areas and their nomination to continue in these existing roles at least through the initial transition period would seem to be an effective strategy to help ensure continuity and momentum. In parallel to these "internal" efforts to bring the CTI specifications to an OASIS baseline, we can then focus on the strategic objectives (internally and externally facing) as outlined above and look to ensuring diversity and representation as we enter the next phase of moving the  OASIS CTI v1 baseline Standards forward. In summary: If not a violation of OASIS process, propose that we: 1) Engage now in discourse on nominations for each of the OASIS CTI TC Sub-Committee Chair/Co-Chairs as currently defined in the OASIS CTI TC Charter. 2) Add OASIS CTI TC Sub-Committess Chair/Co-Chair deliberation and Election(s) to the agenda of the initial  OASIS CTI TC establishment meeting and CTI TC Chair/Co-Chair deliberations and Election(s). Patrick Maroney Office: (856)983-0001 Cell: (609)841-5104 pmaroney@specere.org From: cti@lists.oasis-open.org <cti@lists.oasis-open.org> on behalf of Peter Allor <pallor@us.ibm.com> Sent: Thursday, June 11, 2015 12:01:28 PM To: Peter F Brown Cc: Aharon Chernin; Jordan, Bret; Carol Geyer; Chet Ensign; cti@lists.oasis-open.org; Richard Struse; Robin Cover; Scott McGrath; Terry MacDonald; tony@yaanatech.com; Trey Darley Subject: RE: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,   As a data point, in discussing adoption of STIX/TAXII with National Government CSIRTs and other large corporate international organizations, a US/DHS only way forward, has / is an inhibitor to formally using STIX/TAXII in the recent past. I am aware of some USG elements liking that we demonstrate a broad representation. So, I endorse and support Rich, both for his leadership and technical passion as well as vision for this effort.     And will bow to what the group decides. But would heavily suggest that we have someone else assist Rich in his chair duties as his co-chair.   This is more about perception and adoption than about substance/content.   And no, I am not soliciting an academic.    We really need and want 'industry' (across the board) to use this.   Pete Peter F Brown ---06/11/2015 11:25:01 AM---+1 The significance only means something if we *make* it mean something. From: Peter F Brown <peter@peterfbrown.com> To: "tony@yaanatech.com" <tony@yaanatech.com>, Trey Darley <trey@soltra.com>, Peter Allor/Atlanta/IBM@IBMUS Cc: Chet Ensign <chet.ensign@oasis-open.org>, Aharon Chernin <achernin@soltra.com>, Terry MacDonald <terry.macdonald@threatloop.com>, "Jordan, Bret" <bret.jordan@bluecoat.com>, "cti@lists.oasis-open.org" <cti@lists.oasis-open.org>, Richard Struse <Richard.Struse@hq.dhs.gov>, "Scott McGrath" <scott.mcgrath@oasis-open.org>, Robin Cover <robin@oasis-open.org>, Carol Geyer <carol.geyer@oasis-open.org> Date: 06/11/2015 11:25 AM Subject: RE: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC, +1 The significance only means something if we * make * it mean something. I understand that there might be concern about an OASIS TC being seen just to do DHS’s bidding. However, expanding on what Tony rightly says, there are many TCs where there are initial worries that one party (public, private, research, not-for-profit) is set to run the show – but the nature of the open process, transparency, and engagement from all sides will do more to “disappear” that myth than any “fix”. This is not an argument against co-chair(s) per se: just that, if we need such a role, it will become apparent quickly enough. All the best, Peter   From:  Tony Rutkowski [ mailto:tony@yaanatech.com ] Sent:  11 June, 2015 08:11 To:  Trey Darley; Peter Allor; Peter F Brown Cc:  Chet Ensign; Aharon Chernin; Terry MacDonald; Jordan, Bret; cti@lists.oasis-open.org; Richard Struse; Scott McGrath; Robin Cover; Carol Geyer Subject:  Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,   The world of international technical committees in this sector contains numerous examples of chairs from government agencies.  Furthermore, Rich is rather more than an agency representative in this context.  From both a substantive perspective as well as effective leadership and "messaging," his chair position is important. As someone who leads the ETSI equivalent activity, (and formerly led the equivalent in ITU-T) Rich's chair position probably enhances the global assimilation of the CTI suite. --tony On 2015-06-11 10:45 AM, Trey Darley wrote: <snip> However, I suggest the following, especially for us 'Americans' to consider.    We need to have another individual as a co-chair.    Simply put, to not be something that OASIS is adopting only for the US Department of Homeland Security (DHS). </snip>     -- ________________________________ Anthony Michael Rutkowski   EVP, Industry Standards & Regulatory Affairs tony@yaanatech.com +1 703 999 8270 ________________________________ Yaana Technologies LLC 542 Gibraltar Drive Milpitas CA 95035 USA


  • 23.  Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,

    Posted 06-11-2015 19:24
    Don't know about the various ages here, but historically, one could point out that what is occurring here is similar to when Vint started evolving tcp/ip protocols in the IETF - where you have a visionary USG program head shepherding the evolution of the platform he helped create and champion. --tony


  • 24.  Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,

    Posted 06-11-2015 22:52
      |   view attached
    I think Rich was at the same hotel in 1973 where Vint Cerf first sketched the Internet Gateway Architecture extending Bob Kahn¹s NCP concept on the back of an envelope. Rich was at the same conference presenting his revolutionary concept for a protocol call Kermit (coinciding nicely with the introduction of the V.22/Bell 212 modem.... (picture of the prototype attached). With well deserved confidence, rumor has it Rich allegedly told Vint "it [the Internet] would never fly". Rich cited how he can now play Adventure on his university's $10M DecSystem-10 remotely from home. To which Ken Olsen blurted out (much to loudly), ³There is no reason anyone would want a computer in their home!!!². Everyone was so busy ribbing Ken, no one even noticed Al Gore as he cleaned their table (working as a waiter in the hotel bar) and deftly pocketed the envelope with Vint¹s drawing. Patrick Maroney Office: (856)983-0001 Cell: (609)841-5104 Email: pmaroney@specere.org On 6/11/15, 3:24 PM, "Tony Rutkowski" <tony@yaanatech.com> wrote: >Don't know about the various ages here, but >historically, one could point out that what is >occurring here is similar to when Vint started >evolving tcp/ip protocols in the IETF - where >you have a visionary USG program head >shepherding the evolution of the platform > >he helped create and champion. > >--tony > Attachment: default.png Description: default.png


  • 25.  Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,

    Posted 06-12-2015 08:27
    Hi, Tony - 1) While I admire Vint Cerf greatly (I have an autographed copy of of RFC4838 framed and hanging above my monitor as I compose this mail), his role in the creation of TCP/IP has been somewhat mythologized, in no small part due to the fact that he managed to outlive so many of his collaborators. 2) The fallacy in your line of argument is in overlooking the passing of time. TCP/IP was created in a polarized (Cold War) world. In a (comparatively) globalized world such as we inhabit today, do you _really_ believe TCP/IP would have been adopted as a global standard without a plurality of multinational leadership? I doubt it. Times, my friend, have changed, and profit we may by noting the fact. Cheers, Trey -- Trey Darley Senior Security Engineer Soltra An FS-ISAC & DTCC Company www.soltra.com ________________________________________ From: Tony Rutkowski <tony@yaanatech.com> Sent: Thursday, June 11, 2015 21:24 To: Patrick Maroney; Peter Allor; Peter F Brown Cc: Aharon Chernin; Jordan, Bret; Carol Geyer; Chet Ensign; cti@lists.oasis-open.org; Richard Struse; Robin Cover; Scott McGrath; Terry MacDonald; Trey Darley Subject: Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC, Don't know about the various ages here, but historically, one could point out that what is occurring here is similar to when Vint started evolving tcp/ip protocols in the IETF - where you have a visionary USG program head shepherding the evolution of the platform he helped create and champion. --tony


  • 26.  Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,

    Posted 06-12-2015 11:33
    The myth is rampant to be sure.  Indeed, if you want an interesting alternative perspective on what occurred, check out the testimony and articles recently produced by their boss - DARPA Director Steve Lukasik. Furthermore, in the historical myth, neither the competition with French researchers like Louis Pouzin, nor the massive OSI CLNP Internet efforts get mentioned.  Congress' coughing up 5 billion dollars at the right moment in the development cycle to enable free everything also did not hurt. With that said, Vint and others on the team put a lot of effort into working the standards scenes in adroit ways to facilitate development and evangelization of tcp/ip based platforms that is arguably similar to what Rich is undertaking today.  MITRE to give them credit, has also been quite effective. --tony On 2015-06-12 4:26 AM, Trey Darley wrote: Hi, Tony - 1) While I admire Vint Cerf greatly (I have an autographed copy of of RFC4838 framed and hanging above my monitor as I compose this mail), his role in the creation of TCP/IP has been somewhat mythologized, in no small part due to the fact that he managed to outlive so many of his collaborators. 2) The fallacy in your line of argument is in overlooking the passing of time. TCP/IP was created in a polarized (Cold War) world. In a (comparatively) globalized world such as we inhabit today, do you _ really _ believe TCP/IP would have been adopted as a global standard without a plurality of multinational leadership? I doubt it. Times, my friend, have changed, and profit we may by noting the fact. -- ________________________________ Anthony Michael Rutkowski EVP, Industry Standards & Regulatory Affairs tony@yaanatech.com +1 703 999 8270 ________________________________ Yaana Technologies LLC 542 Gibraltar Drive Milpitas CA 95035 USA


  • 27.  Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,

    Posted 06-11-2015 17:59
    I support Rich as well.  But to your points, this is why I offered to run as a co-chair. Most importantly, I have the time to put in to this effort and I can do so with out a vendor agenda. I have been around the US and across the pond talking about STIX and TAXII and NOT what my company is doing with it. Those of you that were at the ENISA conference in Belgium can attest to that. In fact at that conference I was the only vendor that did not talk about my company. I talked about STIX and TAXII, what it means and why it is important. Further, I have past experience in standards work (IEEE and IETF), managing large projects, and driving them to completion and adoption.  Thanks, Bret Bret Jordan CISSP Director of Security Architecture and Standards Office of the CTO Blue Coat Systems PGP Fingerprint: 62A6 5999 0F7D 0D61 4C66 D59C 2DB5 111D 63BC A303 Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg.   On Jun 11, 2015, at 10:01, Peter Allor < pallor@us.ibm.com > wrote: As a data point, in discussing adoption of STIX/TAXII with National Government CSIRTs and other large corporate international organizations, a US/DHS only way forward, has / is an inhibitor to formally using STIX/TAXII in the recent past. I am aware of some USG elements liking that we demonstrate a broad representation. So, I endorse and support Rich, both for his leadership and technical passion as well as vision for this effort.     And will bow to what the group decides. But would heavily suggest that we have someone else assist Rich in his chair duties as his co-chair.   This is more about perception and adoption than about substance/content.   And no, I am not soliciting an academic.    We really need and want 'industry' (across the board) to use this.   Pete <graycol.gif> Peter F Brown ---06/11/2015 11:25:01 AM---+1 The significance only means something if we *make* it mean something. From: Peter F Brown < peter@peterfbrown.com > To: tony@yaanatech.com < tony@yaanatech.com >, Trey Darley < trey@soltra.com >, Peter Allor/Atlanta/IBM@IBMUS Cc: Chet Ensign < chet.ensign@oasis-open.org >, Aharon Chernin < achernin@soltra.com >, Terry MacDonald < terry.macdonald@threatloop.com >, Jordan, Bret < bret.jordan@bluecoat.com >, cti@lists.oasis-open.org < cti@lists.oasis-open.org >, Richard Struse < Richard.Struse@hq.dhs.gov >, Scott McGrath < scott.mcgrath@oasis-open.org >, Robin Cover < robin@oasis-open.org >, Carol Geyer < carol.geyer@oasis-open.org > Date: 06/11/2015 11:25 AM Subject: RE: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC, +1 The significance only means something if we * make * it mean something. I understand that there might be concern about an OASIS TC being seen just to do DHS’s bidding. However, expanding on what Tony rightly says, there are many TCs where there are initial worries that one party (public, private, research, not-for-profit) is set to run the show – but the nature of the open process, transparency, and engagement from all sides will do more to “disappear” that myth than any “fix”. This is not an argument against co-chair(s) per se: just that, if we need such a role, it will become apparent quickly enough. All the best, Peter   From:  Tony Rutkowski [ mailto:tony@yaanatech.com ] Sent:  11 June, 2015 08:11 To:  Trey Darley; Peter Allor; Peter F Brown Cc:  Chet Ensign; Aharon Chernin; Terry MacDonald; Jordan, Bret; cti@lists.oasis-open.org ; Richard Struse; Scott McGrath; Robin Cover; Carol Geyer Subject:  Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,   The world of international technical committees in this sector contains numerous examples of chairs from government agencies.  Furthermore, Rich is rather more than an agency representative in this context.  From both a substantive perspective as well as effective leadership and messaging, his chair position is important. As someone who leads the ETSI equivalent activity, (and formerly led the equivalent in ITU-T) Rich's chair position probably enhances the global assimilation of the CTI suite. --tony On 2015-06-11 10:45 AM, Trey Darley wrote: <snip> However, I suggest the following, especially for us 'Americans' to consider.    We need to have another individual as a co-chair.    Simply put, to not be something that OASIS is adopting only for the US Department of Homeland Security (DHS). </snip>     -- ________________________________ Anthony Michael Rutkowski   EVP, Industry Standards & Regulatory Affairs tony@yaanatech.com +1 703 999 8270 ________________________________ Yaana Technologies LLC 542 Gibraltar Drive Milpitas CA 95035 USA Attachment: signature.asc Description: Message signed with OpenPGP using GPGMail


  • 28.  Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,

    Posted 06-11-2015 18:14
    My 0.02c:  +1 for Rich on chair. We could def use industry as co-chair minimally. Although the work so far has been fantastic, it does often lack some real world application to market (which is different as real world implementation, which also needs attention). Having European involvement for example chairing subgroups would help keep it alive and kicking. Even though we're basically road showing around Europe on behalf of STIX and TAXII, the implementors out here are pushing back hard due to implementation complexity. Having extra goodwill out here will make allot of difference. Lastly we need a chair or cochair with significant time investment, Bret has shown he can invest this time and I like the no nonesence and lets go attitude. +1 there J Sent from my iPhone On 11 Jun 2015, at 18:01, Peter Allor < pallor@us.ibm.com > wrote: As a data point, in discussing adoption of STIX/TAXII with National Government CSIRTs and other large corporate international organizations, a US/DHS only way forward, has / is an inhibitor to formally using STIX/TAXII in the recent past. I am aware of some USG elements liking that we demonstrate a broad representation. So, I endorse and support Rich, both for his leadership and technical passion as well as vision for this effort.     And will bow to what the group decides. But would heavily suggest that we have someone else assist Rich in his chair duties as his co-chair.   This is more about perception and adoption than about substance/content.   And no, I am not soliciting an academic.    We really need and want 'industry' (across the board) to use this.   Pete <graycol.gif> Peter F Brown ---06/11/2015 11:25:01 AM---+1 The significance only means something if we *make* it mean something. From: Peter F Brown < peter@peterfbrown.com > To: " tony@yaanatech.com " < tony@yaanatech.com >, Trey Darley < trey@soltra.com >, Peter Allor/Atlanta/IBM@IBMUS Cc: Chet Ensign < chet.ensign@oasis-open.org >, Aharon Chernin < achernin@soltra.com >, Terry MacDonald < terry.macdonald@threatloop.com >, "Jordan, Bret" < bret.jordan@bluecoat.com >, " cti@lists.oasis-open.org " < cti@lists.oasis-open.org >, Richard Struse < Richard.Struse@hq.dhs.gov >, "Scott McGrath" < scott.mcgrath@oasis-open.org >, Robin Cover < robin@oasis-open.org >, Carol Geyer < carol.geyer@oasis-open.org > Date: 06/11/2015 11:25 AM Subject: RE: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC, +1 The significance only means something if we * make * it mean something. I understand that there might be concern about an OASIS TC being seen just to do DHS’s bidding. However, expanding on what Tony rightly says, there are many TCs where there are initial worries that one party (public, private, research, not-for-profit) is set to run the show – but the nature of the open process, transparency, and engagement from all sides will do more to “disappear” that myth than any “fix”. This is not an argument against co-chair(s) per se: just that, if we need such a role, it will become apparent quickly enough. All the best, Peter   From:  Tony Rutkowski [ mailto:tony@yaanatech.com ] Sent:  11 June, 2015 08:11 To:  Trey Darley; Peter Allor; Peter F Brown Cc:  Chet Ensign; Aharon Chernin; Terry MacDonald; Jordan, Bret; cti@lists.oasis-open.org ; Richard Struse; Scott McGrath; Robin Cover; Carol Geyer Subject:  Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,   The world of international technical committees in this sector contains numerous examples of chairs from government agencies.  Furthermore, Rich is rather more than an agency representative in this context.  From both a substantive perspective as well as effective leadership and "messaging," his chair position is important. As someone who leads the ETSI equivalent activity, (and formerly led the equivalent in ITU-T) Rich's chair position probably enhances the global assimilation of the CTI suite. --tony On 2015-06-11 10:45 AM, Trey Darley wrote: <snip> However, I suggest the following, especially for us 'Americans' to consider.    We need to have another individual as a co-chair.    Simply put, to not be something that OASIS is adopting only for the US Department of Homeland Security (DHS). </snip>     -- ________________________________ Anthony Michael Rutkowski   EVP, Industry Standards & Regulatory Affairs tony@yaanatech.com +1 703 999 8270 ________________________________ Yaana Technologies LLC 542 Gibraltar Drive Milpitas CA 95035 USA


  • 29.  RE: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,

    Posted 06-12-2015 16:35
    All - +1 for Rich on Chair for 1 year term.   Jon Salwen Enterprise Architect jsalwen@mitre.org The MITRE Corp. 202 Burlington Rd                                                      Bedford MA 01730 (781) 271-7172       From: cti@lists.oasis-open.org [mailto:cti@lists.oasis-open.org] On Behalf Of Joep Gommers Sent: Thursday, June 11, 2015 2:14 PM To: Peter Allor Cc: Peter F Brown; Aharon Chernin; Jordan, Bret; Carol Geyer; Chet Ensign; cti@lists.oasis-open.org; Richard Struse; Robin Cover; Scott McGrath; Terry MacDonald; tony@yaanatech.com; Trey Darley Subject: Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,   My 0.02c:    +1 for Rich on chair. We could def use industry as co-chair minimally. Although the work so far has been fantastic, it does often lack some real world application to market (which is different as real world implementation, which also needs attention). Having European involvement for example chairing subgroups would help keep it alive and kicking. Even though we're basically road showing around Europe on behalf of STIX and TAXII, the implementors out here are pushing back hard due to implementation complexity. Having extra goodwill out here will make allot of difference.   Lastly we need a chair or cochair with significant time investment, Bret has shown he can invest this time and I like the no nonesence and lets go attitude. +1 there   J       Sent from my iPhone On 11 Jun 2015, at 18:01, Peter Allor < pallor@us.ibm.com > wrote: As a data point, in discussing adoption of STIX/TAXII with National Government CSIRTs and other large corporate international organizations, a US/DHS only way forward, has / is an inhibitor to formally using STIX/TAXII in the recent past. I am aware of some USG elements liking that we demonstrate a broad representation. So, I endorse and support Rich, both for his leadership and technical passion as well as vision for this effort.     And will bow to what the group decides. But would heavily suggest that we have someone else assist Rich in his chair duties as his co-chair.   This is more about perception and adoption than about substance/content.   And no, I am not soliciting an academic.    We really need and want 'industry' (across the board) to use this.   Pete <graycol.gif> Peter F Brown ---06/11/2015 11:25:01 AM---+1 The significance only means something if we *make* it mean something. From: Peter F Brown < peter@peterfbrown.com > To: " tony@yaanatech.com " < tony@yaanatech.com >, Trey Darley < trey@soltra.com >, Peter Allor/Atlanta/IBM@IBMUS Cc: Chet Ensign < chet.ensign@oasis-open.org >, Aharon Chernin < achernin@soltra.com >, Terry MacDonald < terry.macdonald@threatloop.com >, "Jordan, Bret" < bret.jordan@bluecoat.com >, " cti@lists.oasis-open.org " < cti@lists.oasis-open.org >, Richard Struse < Richard.Struse@hq.dhs.gov >, "Scott McGrath" < scott.mcgrath@oasis-open.org >, Robin Cover < robin@oasis-open.org >, Carol Geyer < carol.geyer@oasis-open.org > Date: 06/11/2015 11:25 AM Subject: RE: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC, +1 The significance only means something if we * make * it mean something. I understand that there might be concern about an OASIS TC being seen just to do DHS’s bidding. However, expanding on what Tony rightly says, there are many TCs where there are initial worries that one party (public, private, research, not-for-profit) is set to run the show – but the nature of the open process, transparency, and engagement from all sides will do more to “disappear” that myth than any “fix”. This is not an argument against co-chair(s) per se: just that, if we need such a role, it will become apparent quickly enough. All the best, Peter   From:  Tony Rutkowski [ mailto:tony@yaanatech.com ] Sent:  11 June, 2015 08:11 To:  Trey Darley; Peter Allor; Peter F Brown Cc:  Chet Ensign; Aharon Chernin; Terry MacDonald; Jordan, Bret; cti@lists.oasis-open.org ; Richard Struse; Scott McGrath; Robin Cover; Carol Geyer Subject:  Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,   The world of international technical committees in this sector contains numerous examples of chairs from government agencies.  Furthermore, Rich is rather more than an agency representative in this context.  From both a substantive perspective as well as effective leadership and "messaging," his chair position is important. As someone who leads the ETSI equivalent activity, (and formerly led the equivalent in ITU-T) Rich's chair position probably enhances the global assimilation of the CTI suite. --tony On 2015-06-11 10:45 AM, Trey Darley wrote: <snip> However, I suggest the following, especially for us 'Americans' to consider.    We need to have another individual as a co-chair.    Simply put, to not be something that OASIS is adopting only for the US Department of Homeland Security (DHS). </snip>     -- ________________________________ Anthony Michael Rutkowski   EVP, Industry Standards & Regulatory Affairs tony@yaanatech.com +1 703 999 8270 ________________________________ Yaana Technologies LLC 542 Gibraltar Drive Milpitas CA 95035 USA


  • 30.  RE: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,

    Posted 06-12-2015 16:49
    All, Late to this discussion (and recent member addition), but I endorse Pete’s views.  Perceptions about alliances and agendas would be counter-productive.  I agree there’s a need for a private sector co-leader, as well as global leadership representation.   Governance and Chatham House-type rules would help, as transparency really matters.  But additionally, ‘who’ is equally important to ‘how’ in building trust.  And, sometimes the Who can either be someone who’s established a reputation for trustworthiness and fair dealing, and/or someone who is not perceived as threatening because he/she is not affiliated with a large, multinational corporation.    My 2 cents.  Looking forward to contributing and getting to know everyone. Doug     Douglas M. DePeppe Cyberlaw Attorney LLM, JD EosEdge Legal A Cyberlaw and Services Firm Cyberlaw at Catalyst Campus 559 E. Pikes Peak Ave. Suite 101 Colorado Springs, CO 80903 Direct 719.357.8025 c 703.283.2349 Skype ID: doug.depeppe  www.eosedgelegal.com Conferencing: https://join.me/cybercloak My Homepage www.cyberjurist.net   This electronic mail transmission and any attachments contain information belonging to the sender which may be confidential and legally privileged. This information is intended only for the use of the individual or entity to whom this electronic mail transmission was sent as indicated above. If you are not the intended recipient, any disclosure, copy, distribution, or action taken in reliance on the contents of the information contained in this transmission is strictly prohibited. If you have received this transmission in error, please immediately inform me by email and delete the message. Thank you.   From: cti@lists.oasis-open.org [mailto:cti@lists.oasis-open.org] On Behalf Of Salwen, Jonathan E. Sent: Friday, June 12, 2015 10:35 AM To: Joep Gommers; Peter Allor Cc: Peter F Brown; Aharon Chernin; Jordan, Bret; Carol Geyer; Chet Ensign; cti@lists.oasis-open.org; Richard Struse; Robin Cover; Scott McGrath; Terry MacDonald; tony@yaanatech.com; Trey Darley Subject: RE: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,   All - +1 for Rich on Chair for 1 year term.   Jon Salwen Enterprise Architect jsalwen@mitre.org The MITRE Corp. 202 Burlington Rd                                                      Bedford MA 01730 (781) 271-7172       From: cti@lists.oasis-open.org [ mailto:cti@lists.oasis-open.org ] On Behalf Of Joep Gommers Sent: Thursday, June 11, 2015 2:14 PM To: Peter Allor Cc: Peter F Brown; Aharon Chernin; Jordan, Bret; Carol Geyer; Chet Ensign; cti@lists.oasis-open.org ; Richard Struse; Robin Cover; Scott McGrath; Terry MacDonald; tony@yaanatech.com ; Trey Darley Subject: Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,   My 0.02c:    +1 for Rich on chair. We could def use industry as co-chair minimally. Although the work so far has been fantastic, it does often lack some real world application to market (which is different as real world implementation, which also needs attention). Having European involvement for example chairing subgroups would help keep it alive and kicking. Even though we're basically road showing around Europe on behalf of STIX and TAXII, the implementors out here are pushing back hard due to implementation complexity. Having extra goodwill out here will make allot of difference.   Lastly we need a chair or cochair with significant time investment, Bret has shown he can invest this time and I like the no nonesence and lets go attitude. +1 there   J       Sent from my iPhone On 11 Jun 2015, at 18:01, Peter Allor < pallor@us.ibm.com > wrote: As a data point, in discussing adoption of STIX/TAXII with National Government CSIRTs and other large corporate international organizations, a US/DHS only way forward, has / is an inhibitor to formally using STIX/TAXII in the recent past. I am aware of some USG elements liking that we demonstrate a broad representation. So, I endorse and support Rich, both for his leadership and technical passion as well as vision for this effort.     And will bow to what the group decides. But would heavily suggest that we have someone else assist Rich in his chair duties as his co-chair.   This is more about perception and adoption than about substance/content.   And no, I am not soliciting an academic.    We really need and want 'industry' (across the board) to use this.   Pete <graycol.gif> Peter F Brown ---06/11/2015 11:25:01 AM---+1 The significance only means something if we *make* it mean something. From: Peter F Brown < peter@peterfbrown.com > To: " tony@yaanatech.com " < tony@yaanatech.com >, Trey Darley < trey@soltra.com >, Peter Allor/Atlanta/IBM@IBMUS Cc: Chet Ensign < chet.ensign@oasis-open.org >, Aharon Chernin < achernin@soltra.com >, Terry MacDonald < terry.macdonald@threatloop.com >, "Jordan, Bret" < bret.jordan@bluecoat.com >, " cti@lists.oasis-open.org " < cti@lists.oasis-open.org >, Richard Struse < Richard.Struse@hq.dhs.gov >, "Scott McGrath" < scott.mcgrath@oasis-open.org >, Robin Cover < robin@oasis-open.org >, Carol Geyer < carol.geyer@oasis-open.org > Date: 06/11/2015 11:25 AM Subject: RE: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC, +1 The significance only means something if we * make * it mean something. I understand that there might be concern about an OASIS TC being seen just to do DHS’s bidding. However, expanding on what Tony rightly says, there are many TCs where there are initial worries that one party (public, private, research, not-for-profit) is set to run the show – but the nature of the open process, transparency, and engagement from all sides will do more to “disappear” that myth than any “fix”. This is not an argument against co-chair(s) per se: just that, if we need such a role, it will become apparent quickly enough. All the best, Peter   From:  Tony Rutkowski [ mailto:tony@yaanatech.com ] Sent:  11 June, 2015 08:11 To:  Trey Darley; Peter Allor; Peter F Brown Cc:  Chet Ensign; Aharon Chernin; Terry MacDonald; Jordan, Bret; cti@lists.oasis-open.org ; Richard Struse; Scott McGrath; Robin Cover; Carol Geyer Subject:  Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,   The world of international technical committees in this sector contains numerous examples of chairs from government agencies.  Furthermore, Rich is rather more than an agency representative in this context.  From both a substantive perspective as well as effective leadership and "messaging," his chair position is important. As someone who leads the ETSI equivalent activity, (and formerly led the equivalent in ITU-T) Rich's chair position probably enhances the global assimilation of the CTI suite. --tony On 2015-06-11 10:45 AM, Trey Darley wrote: <snip> However, I suggest the following, especially for us 'Americans' to consider.    We need to have another individual as a co-chair.    Simply put, to not be something that OASIS is adopting only for the US Department of Homeland Security (DHS). </snip>     -- ________________________________ Anthony Michael Rutkowski   EVP, Industry Standards & Regulatory Affairs tony@yaanatech.com +1 703 999 8270 ________________________________ Yaana Technologies LLC 542 Gibraltar Drive Milpitas CA 95035 USA


  • 31.  RE: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,

    Posted 06-12-2015 17:24
    Hi all, Good discussions regarding leadership, very healthy. A couple of points regarding OASIS processes and transparency. There is one set of rules for all TCs, posted online on the OASIS website , and I’d draw attention particularly to the IPR Policy and TC Process. “Chatham House” rules don’t apply. Every person is responsible for what they say and bring to the table; no exceptions. Also, be careful with those automated signature lines at bottom of messages with confidentiality or other disclaimers. ALL mail sent to any OASIS TC list is publicly accessible and archived; again, no exceptions. I’m not a lawyer but everyone needs to be aware of the (excellent) processes within which OASIS work proceeds. All the best, Peter     Peter F Brown Independent Consultant CIPT, MIoD ”Using Information Technologies to Empower and Transform” 200 S Barrington Ave., #49719 Los Angeles , CA 90049, USA www.PeterFBrown.com               From: Doug DePeppe [mailto:doug@eosedgelegal.com] Sent: 12 June, 2015 09:49 To: 'Salwen, Jonathan E.'; 'Joep Gommers'; 'Peter Allor' Cc: Peter F Brown; 'Aharon Chernin'; 'Jordan, Bret'; 'Carol Geyer'; 'Chet Ensign'; cti@lists.oasis-open.org; 'Richard Struse'; 'Robin Cover'; 'Scott McGrath'; 'Terry MacDonald'; tony@yaanatech.com; 'Trey Darley' Subject: RE: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,   All, Late to this discussion (and recent member addition), but I endorse Pete’s views.  Perceptions about alliances and agendas would be counter-productive.  I agree there’s a need for a private sector co-leader, as well as global leadership representation.   Governance and Chatham House-type rules would help, as transparency really matters.  But additionally, ‘who’ is equally important to ‘how’ in building trust.  And, sometimes the Who can either be someone who’s established a reputation for trustworthiness and fair dealing, and/or someone who is not perceived as threatening because he/she is not affiliated with a large, multinational corporation.    My 2 cents.  Looking forward to contributing and getting to know everyone. Doug     Douglas M. DePeppe Cyberlaw Attorney LLM, JD EosEdge Legal A Cyberlaw and Services Firm Cyberlaw at Catalyst Campus 559 E. Pikes Peak Ave. Suite 101 Colorado Springs, CO 80903 Direct 719.357.8025 c 703.283.2349 Skype ID: doug.depeppe  www.eosedgelegal.com Conferencing: https://join.me/cybercloak My Homepage www.cyberjurist.net   This electronic mail transmission and any attachments contain information belonging to the sender which may be confidential and legally privileged. This information is intended only for the use of the individual or entity to whom this electronic mail transmission was sent as indicated above. If you are not the intended recipient, any disclosure, copy, distribution, or action taken in reliance on the contents of the information contained in this transmission is strictly prohibited. If you have received this transmission in error, please immediately inform me by email and delete the message. Thank you.   From: cti@lists.oasis-open.org [ mailto:cti@lists.oasis-open.org ] On Behalf Of Salwen, Jonathan E. Sent: Friday, June 12, 2015 10:35 AM To: Joep Gommers; Peter Allor Cc: Peter F Brown; Aharon Chernin; Jordan, Bret; Carol Geyer; Chet Ensign; cti@lists.oasis-open.org ; Richard Struse; Robin Cover; Scott McGrath; Terry MacDonald; tony@yaanatech.com ; Trey Darley Subject: RE: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,   All - +1 for Rich on Chair for 1 year term.   Jon Salwen Enterprise Architect jsalwen@mitre.org The MITRE Corp. 202 Burlington Rd                                                      Bedford MA 01730 (781) 271-7172       From: cti@lists.oasis-open.org [ mailto:cti@lists.oasis-open.org ] On Behalf Of Joep Gommers Sent: Thursday, June 11, 2015 2:14 PM To: Peter Allor Cc: Peter F Brown; Aharon Chernin; Jordan, Bret; Carol Geyer; Chet Ensign; cti@lists.oasis-open.org ; Richard Struse; Robin Cover; Scott McGrath; Terry MacDonald; tony@yaanatech.com ; Trey Darley Subject: Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,   My 0.02c:    +1 for Rich on chair. We could def use industry as co-chair minimally. Although the work so far has been fantastic, it does often lack some real world application to market (which is different as real world implementation, which also needs attention). Having European involvement for example chairing subgroups would help keep it alive and kicking. Even though we're basically road showing around Europe on behalf of STIX and TAXII, the implementors out here are pushing back hard due to implementation complexity. Having extra goodwill out here will make allot of difference.   Lastly we need a chair or cochair with significant time investment, Bret has shown he can invest this time and I like the no nonesence and lets go attitude. +1 there   J       Sent from my iPhone On 11 Jun 2015, at 18:01, Peter Allor < pallor@us.ibm.com > wrote: As a data point, in discussing adoption of STIX/TAXII with National Government CSIRTs and other large corporate international organizations, a US/DHS only way forward, has / is an inhibitor to formally using STIX/TAXII in the recent past. I am aware of some USG elements liking that we demonstrate a broad representation. So, I endorse and support Rich, both for his leadership and technical passion as well as vision for this effort.     And will bow to what the group decides. But would heavily suggest that we have someone else assist Rich in his chair duties as his co-chair.   This is more about perception and adoption than about substance/content.   And no, I am not soliciting an academic.    We really need and want 'industry' (across the board) to use this.   Pete <graycol.gif> Peter F Brown ---06/11/2015 11:25:01 AM---+1 The significance only means something if we *make* it mean something. From: Peter F Brown < peter@peterfbrown.com > To: " tony@yaanatech.com " < tony@yaanatech.com >, Trey Darley < trey@soltra.com >, Peter Allor/Atlanta/IBM@IBMUS Cc: Chet Ensign < chet.ensign@oasis-open.org >, Aharon Chernin < achernin@soltra.com >, Terry MacDonald < terry.macdonald@threatloop.com >, "Jordan, Bret" < bret.jordan@bluecoat.com >, " cti@lists.oasis-open.org " < cti@lists.oasis-open.org >, Richard Struse < Richard.Struse@hq.dhs.gov >, "Scott McGrath" < scott.mcgrath@oasis-open.org >, Robin Cover < robin@oasis-open.org >, Carol Geyer < carol.geyer@oasis-open.org > Date: 06/11/2015 11:25 AM Subject: RE: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC, +1 The significance only means something if we * make * it mean something. I understand that there might be concern about an OASIS TC being seen just to do DHS’s bidding. However, expanding on what Tony rightly says, there are many TCs where there are initial worries that one party (public, private, research, not-for-profit) is set to run the show – but the nature of the open process, transparency, and engagement from all sides will do more to “disappear” that myth than any “fix”. This is not an argument against co-chair(s) per se: just that, if we need such a role, it will become apparent quickly enough. All the best, Peter   From:  Tony Rutkowski [ mailto:tony@yaanatech.com ] Sent:  11 June, 2015 08:11 To:  Trey Darley; Peter Allor; Peter F Brown Cc:  Chet Ensign; Aharon Chernin; Terry MacDonald; Jordan, Bret; cti@lists.oasis-open.org ; Richard Struse; Scott McGrath; Robin Cover; Carol Geyer Subject:  Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,   The world of international technical committees in this sector contains numerous examples of chairs from government agencies.  Furthermore, Rich is rather more than an agency representative in this context.  From both a substantive perspective as well as effective leadership and "messaging," his chair position is important. As someone who leads the ETSI equivalent activity, (and formerly led the equivalent in ITU-T) Rich's chair position probably enhances the global assimilation of the CTI suite. --tony On 2015-06-11 10:45 AM, Trey Darley wrote: <snip> However, I suggest the following, especially for us 'Americans' to consider.    We need to have another individual as a co-chair.    Simply put, to not be something that OASIS is adopting only for the US Department of Homeland Security (DHS). </snip>     -- ________________________________ Anthony Michael Rutkowski   EVP, Industry Standards & Regulatory Affairs tony@yaanatech.com +1 703 999 8270 ________________________________ Yaana Technologies LLC 542 Gibraltar Drive Milpitas CA 95035 USA


  • 32.  Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,

    Posted 06-12-2015 08:35
    Hey, Pete - Note that I specified " an academic-cum-actual security researcher with dirt under their fingernails", not merely an academic. Nor am I against a private-sector co-chair, but " preferably _not_ a vendor".  The point is, if we agree on the need for a co-chair, here are the essential qualifications: 0) someone practical 1) someone neutral 2) someone non-US 3) someone that isn't going to drive Rich crazy (ie, compatible personalities == enhanced collaboration) Cheers, Trey -- Trey Darley Senior Security Engineer Soltra An FS-ISAC & DTCC Company www.soltra.com From: cti@lists.oasis-open.org <cti@lists.oasis-open.org> on behalf of Peter Allor <pallor@us.ibm.com> Sent: Thursday, June 11, 2015 18:01 To: Peter F Brown Cc: Aharon Chernin; Jordan, Bret; Carol Geyer; Chet Ensign; cti@lists.oasis-open.org; Richard Struse; Robin Cover; Scott McGrath; Terry MacDonald; tony@yaanatech.com; Trey Darley Subject: RE: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,   As a data point, in discussing adoption of STIX/TAXII with National Government CSIRTs and other large corporate international organizations, a US/DHS only way forward, has / is an inhibitor to formally using STIX/TAXII in the recent past. I am aware of some USG elements liking that we demonstrate a broad representation. So, I endorse and support Rich, both for his leadership and technical passion as well as vision for this effort.     And will bow to what the group decides. But would heavily suggest that we have someone else assist Rich in his chair duties as his co-chair.   This is more about perception and adoption than about substance/content.   And no, I am not soliciting an academic.    We really need and want 'industry' (across the board) to use this.   Pete Peter F Brown ---06/11/2015 11:25:01 AM---+1 The significance only means something if we *make* it mean something. From: Peter F Brown <peter@peterfbrown.com> To: "tony@yaanatech.com" <tony@yaanatech.com>, Trey Darley <trey@soltra.com>, Peter Allor/Atlanta/IBM@IBMUS Cc: Chet Ensign <chet.ensign@oasis-open.org>, Aharon Chernin <achernin@soltra.com>, Terry MacDonald <terry.macdonald@threatloop.com>, "Jordan, Bret" <bret.jordan@bluecoat.com>, "cti@lists.oasis-open.org" <cti@lists.oasis-open.org>, Richard Struse <Richard.Struse@hq.dhs.gov>, "Scott McGrath" <scott.mcgrath@oasis-open.org>, Robin Cover <robin@oasis-open.org>, Carol Geyer <carol.geyer@oasis-open.org> Date: 06/11/2015 11:25 AM Subject: RE: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC, +1 The significance only means something if we * make * it mean something. I understand that there might be concern about an OASIS TC being seen just to do DHS’s bidding. However, expanding on what Tony rightly says, there are many TCs where there are initial worries that one party (public, private, research, not-for-profit) is set to run the show – but the nature of the open process, transparency, and engagement from all sides will do more to “disappear” that myth than any “fix”. This is not an argument against co-chair(s) per se: just that, if we need such a role, it will become apparent quickly enough. All the best, Peter   From:  Tony Rutkowski [ mailto:tony@yaanatech.com ] Sent:  11 June, 2015 08:11 To:  Trey Darley; Peter Allor; Peter F Brown Cc:  Chet Ensign; Aharon Chernin; Terry MacDonald; Jordan, Bret; cti@lists.oasis-open.org; Richard Struse; Scott McGrath; Robin Cover; Carol Geyer Subject:  Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,   The world of international technical committees in this sector contains numerous examples of chairs from government agencies.  Furthermore, Rich is rather more than an agency representative in this context.  From both a substantive perspective as well as effective leadership and "messaging," his chair position is important. As someone who leads the ETSI equivalent activity, (and formerly led the equivalent in ITU-T) Rich's chair position probably enhances the global assimilation of the CTI suite. --tony On 2015-06-11 10:45 AM, Trey Darley wrote: <snip> However, I suggest the following, especially for us 'Americans' to consider.    We need to have another individual as a co-chair.    Simply put, to not be something that OASIS is adopting only for the US Department of Homeland Security (DHS). </snip>     -- ________________________________ Anthony Michael Rutkowski   EVP, Industry Standards & Regulatory Affairs tony@yaanatech.com +1 703 999 8270 ________________________________ Yaana Technologies LLC 542 Gibraltar Drive Milpitas CA 95035 USA


  • 33.  Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,

    Posted 06-12-2015 08:43

    Trey,
    I think you and I are really close.

    Point:
    0)  YES
    1)  Yes
    2)  Preferred, not mandatory
    3)  ABSOLUTELY

    Pete
    (best for me to be 'Pete' and Peter Brown to be "Peter")

    Trey Darley ---06/12/2015 04:35:30 AM---Hey, Pete - Note that I specified "an academic-cum-actual security researcher with dirt under their

    From: Trey Darley <trey@soltra.com>
    To: Peter Allor/Atlanta/IBM@IBMUS, Peter F Brown <peter@peterfbrown.com>
    Cc: Aharon Chernin <achernin@soltra.com>, "Jordan, Bret" <bret.jordan@bluecoat.com>, Carol Geyer <carol.geyer@oasis-open.org>, "Chet Ensign" <chet.ensign@oasis-open.org>, "cti@lists.oasis-open.org" <cti@lists.oasis-open.org>, Richard Struse <Richard.Struse@hq.dhs.gov>, "Robin Cover" <robin@oasis-open.org>, Scott McGrath <scott.mcgrath@oasis-open.org>, Terry MacDonald <terry.macdonald@threatloop.com>, "tony@yaanatech.com" <tony@yaanatech.com>
    Date: 06/12/2015 04:35 AM
    Subject: Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,



    Hey, Pete -

    Note that I specified "an academic-cum-actual security researcher with dirt under their fingernails", not merely an academic. Nor am I against a private-sector co-chair, but "preferably _not_ a vendor".

    The point is, if we agree on the need for a co-chair, here are the essential qualifications:

    0) someone practical
    1) someone neutral
    2) someone non-US
    3) someone that isn't going to drive Rich crazy (ie, compatible personalities == enhanced collaboration)

    Cheers,
    Trey
    --
    Trey Darley
    Senior Security Engineer
    Soltra An FS-ISAC & DTCC Company
    www.soltra.com

    From:  cti@lists.oasis-open.org <cti@lists.oasis-open.org> on behalf of Peter Allor <pallor@us.ibm.com>
    Sent:  Thursday, June 11, 2015 18:01
    To:  Peter F Brown
    Cc:  Aharon Chernin; Jordan, Bret; Carol Geyer; Chet Ensign; cti@lists.oasis-open.org; Richard Struse; Robin Cover; Scott McGrath; Terry MacDonald; tony@yaanatech.com; Trey Darley
    Subject:  RE: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,  
     
    As a data point, in discussing adoption of STIX/TAXII with National Government CSIRTs and other large corporate international organizations, a US/DHS only way forward, has / is an inhibitor to formally using STIX/TAXII in the recent past.

    I am aware of some USG elements liking that we demonstrate a broad representation.

    So, I endorse and support Rich, both for his leadership and technical passion as well as vision for this effort.     And will bow to what the group decides.

    But would heavily suggest that we have someone else assist Rich in his chair duties as his co-chair.   This is more about perception and adoption than about substance/content.   And no, I am not soliciting an academic.    We really need and want 'industry' (across the board) to use this.  

    Pete

    Peter F Brown ---06/11/2015 11:25:01 AM---+1 The significance only means something if we *make* it mean something.

    From: Peter F Brown <peter@peterfbrown.com>
    To: "tony@yaanatech.com" <tony@yaanatech.com>, Trey Darley <trey@soltra.com>, Peter Allor/Atlanta/IBM@IBMUS
    Cc: Chet Ensign <chet.ensign@oasis-open.org>, Aharon Chernin <achernin@soltra.com>, Terry MacDonald <terry.macdonald@threatloop.com>, "Jordan, Bret" <bret.jordan@bluecoat.com>, "cti@lists.oasis-open.org" <cti@lists.oasis-open.org>, Richard Struse <Richard.Struse@hq.dhs.gov>, "Scott McGrath" <scott.mcgrath@oasis-open.org>, Robin Cover <robin@oasis-open.org>, Carol Geyer <carol.geyer@oasis-open.org>
    Date: 06/11/2015 11:25 AM
    Subject: RE: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,



    +1
    The significance only means something if we * make * it mean something.
    I understand that there might be concern about an OASIS TC being seen just to do DHS’s bidding. However, expanding on what Tony rightly says, there are many TCs where there are initial worries that one party (public, private, research, not-for-profit) is set to run the show – but the nature of the open process, transparency, and engagement from all sides will do more to “disappear” that myth than any “fix”.
    This is not an argument against co-chair(s) per se: just that, if we need such a role, it will become apparent quickly enough.
    All the best,
    Peter

    From:  Tony Rutkowski [ mailto:tony@yaanatech.com ]
    Sent:  11 June, 2015 08:11
    To:  Trey Darley; Peter Allor; Peter F Brown
    Cc:  Chet Ensign; Aharon Chernin; Terry MacDonald; Jordan, Bret; cti@lists.oasis-open.org; Richard Struse; Scott McGrath; Robin Cover; Carol Geyer
    Subject:  Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,

    The world of international technical committees in
    this sector contains numerous examples of chairs
    from government agencies.  Furthermore, Rich
    is rather more than an agency representative in
    this context.  From both a substantive perspective
    as well as effective leadership and "messaging,"
    his chair position is important.

    As someone who leads the ETSI equivalent activity,
    (and formerly led the equivalent in ITU-T) Rich's
    chair position probably enhances the global
    assimilation of the CTI suite.

    --tony
    On 2015-06-11 10:45 AM, Trey Darley wrote:  
    <snip>  
    However, I suggest the following, especially for us 'Americans' to consider.    We need to have another individual as a co-chair.    Simply put, to not be something that OASIS is adopting only for the US Department of Homeland Security (DHS).
    </snip>  
     

     
    --
    ________________________________
    Anthony Michael Rutkowski    
    EVP, Industry Standards & Regulatory Affairs
    tony@yaanatech.com
    +1 703 999 8270
    ________________________________
    Yaana Technologies LLC
    542 Gibraltar Drive
    Milpitas CA 95035 USA




  • 34.  Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,

    Posted 06-12-2015 12:12
    Sounds like a description of Bret.....except 2 :). Cheers Terry MacDonald STIX, TAXII, CybOX Consultant M: +61-407-203-026 E:  terry.macdonald@threatloop.com W:  www.threatloop.com Disclaimer: The opinions expressed within this email do not represent the sentiment of any other party except my own. My views do not necessarily reflect those of my employers. On 12 June 2015 at 18:43, Peter Allor < pallor@us.ibm.com > wrote: Trey, I think you and I are really close. Point: 0)  YES 1)  Yes 2)  Preferred, not mandatory 3)  ABSOLUTELY Pete (best for me to be 'Pete' and Peter Brown to be "Peter") Trey Darley ---06/12/2015 04:35:30 AM---Hey, Pete - Note that I specified "an academic-cum-actual security researcher with dirt under their From: Trey Darley < trey@soltra.com > To: Peter Allor/Atlanta/IBM@IBMUS, Peter F Brown < peter@peterfbrown.com > Cc: Aharon Chernin < achernin@soltra.com >, "Jordan, Bret" < bret.jordan@bluecoat.com >, Carol Geyer < carol.geyer@oasis-open.org >, "Chet Ensign" < chet.ensign@oasis-open.org >, " cti@lists.oasis-open.org " < cti@lists.oasis-open.org >, Richard Struse < Richard.Struse@hq.dhs.gov >, "Robin Cover" < robin@oasis-open.org >, Scott McGrath < scott.mcgrath@oasis-open.org >, Terry MacDonald < terry.macdonald@threatloop.com >, " tony@yaanatech.com " < tony@yaanatech.com > Date: 06/12/2015 04:35 AM Subject: Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC, Hey, Pete - Note that I specified "an academic-cum-actual security researcher with dirt under their fingernails", not merely an academic. Nor am I against a private-sector co-chair, but "preferably _not_ a vendor". The point is, if we agree on the need for a co-chair, here are the essential qualifications: 0) someone practical 1) someone neutral 2) someone non-US 3) someone that isn't going to drive Rich crazy (ie, compatible personalities == enhanced collaboration) Cheers, Trey -- Trey Darley Senior Security Engineer Soltra An FS-ISAC & DTCC Company www.soltra.com From:   cti@lists.oasis-open.org < cti@lists.oasis-open.org > on behalf of Peter Allor < pallor@us.ibm.com > Sent:  Thursday, June 11, 2015 18:01 To:  Peter F Brown Cc:  Aharon Chernin; Jordan, Bret; Carol Geyer; Chet Ensign; cti@lists.oasis-open.org ; Richard Struse; Robin Cover; Scott McGrath; Terry MacDonald; tony@yaanatech.com ; Trey Darley Subject:  RE: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,     As a data point, in discussing adoption of STIX/TAXII with National Government CSIRTs and other large corporate international organizations, a US/DHS only way forward, has / is an inhibitor to formally using STIX/TAXII in the recent past. I am aware of some USG elements liking that we demonstrate a broad representation. So, I endorse and support Rich, both for his leadership and technical passion as well as vision for this effort.     And will bow to what the group decides. But would heavily suggest that we have someone else assist Rich in his chair duties as his co-chair.   This is more about perception and adoption than about substance/content.   And no, I am not soliciting an academic.    We really need and want 'industry' (across the board) to use this.   Pete Peter F Brown ---06/11/2015 11:25:01 AM---+1 The significance only means something if we *make* it mean something. From: Peter F Brown < peter@peterfbrown.com > To: " tony@yaanatech.com " < tony@yaanatech.com >, Trey Darley < trey@soltra.com >, Peter Allor/Atlanta/IBM@IBMUS Cc: Chet Ensign < chet.ensign@oasis-open.org >, Aharon Chernin < achernin@soltra.com >, Terry MacDonald < terry.macdonald@threatloop.com >, "Jordan, Bret" < bret.jordan@bluecoat.com >, " cti@lists.oasis-open.org " < cti@lists.oasis-open.org >, Richard Struse < Richard.Struse@hq.dhs.gov >, "Scott McGrath" < scott.mcgrath@oasis-open.org >, Robin Cover < robin@oasis-open.org >, Carol Geyer < carol.geyer@oasis-open.org > Date: 06/11/2015 11:25 AM Subject: RE: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC, +1 The significance only means something if we * make * it mean something. I understand that there might be concern about an OASIS TC being seen just to do DHS’s bidding. However, expanding on what Tony rightly says, there are many TCs where there are initial worries that one party (public, private, research, not-for-profit) is set to run the show – but the nature of the open process, transparency, and engagement from all sides will do more to “disappear” that myth than any “fix”. This is not an argument against co-chair(s) per se: just that, if we need such a role, it will become apparent quickly enough. All the best, Peter From:  Tony Rutkowski [ mailto:tony@yaanatech.com ] Sent:  11 June, 2015 08:11 To:  Trey Darley; Peter Allor; Peter F Brown Cc:  Chet Ensign; Aharon Chernin; Terry MacDonald; Jordan, Bret; cti@lists.oasis-open.org ; Richard Struse; Scott McGrath; Robin Cover; Carol Geyer Subject:  Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC, The world of international technical committees in this sector contains numerous examples of chairs from government agencies.  Furthermore, Rich is rather more than an agency representative in this context.  From both a substantive perspective as well as effective leadership and "messaging," his chair position is important. As someone who leads the ETSI equivalent activity, (and formerly led the equivalent in ITU-T) Rich's chair position probably enhances the global assimilation of the CTI suite. --tony On 2015-06-11 10:45 AM, Trey Darley wrote:   <snip>   However, I suggest the following, especially for us 'Americans' to consider.    We need to have another individual as a co-chair.    Simply put, to not be something that OASIS is adopting only for the US Department of Homeland Security (DHS). </snip>       -- ________________________________ Anthony Michael Rutkowski     EVP, Industry Standards & Regulatory Affairs tony@yaanatech.com +1 703 999 8270 ________________________________ Yaana Technologies LLC 542 Gibraltar Drive Milpitas CA 95035 USA


  • 35.  Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,

    Posted 06-12-2015 13:59
    I’ll sponsor a hut with wifi for Bret, maybe others can pitch in some bread, water, magazines and a plane ticket to Europe? From: Terry MacDonald < terry.macdonald@threatloop.com > Date: Friday, June 12, 2015 at 2:11 PM To: Peter Allor < pallor@us.ibm.com > Cc: Trey Darley < trey@soltra.com >, Aharon Chernin < achernin@soltra.com >, "Jordan, Bret" < bret.jordan@bluecoat.com >, Carol Geyer < carol.geyer@oasis-open.org >, Chet Ensign < chet.ensign@oasis-open.org >, " cti@lists.oasis-open.org " < cti@lists.oasis-open.org >, Peter F Brown < peter@peterfbrown.com >, Richard Struse < Richard.Struse@hq.dhs.gov >, Robin Cover < robin@oasis-open.org >, Scott McGrath < scott.mcgrath@oasis-open.org >, Terry MacDonald < terry.macdonald@threatloop.com >, " tony@yaanatech.com " < tony@yaanatech.com > Subject: Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC, Sounds like a description of Bret.....except 2 :). Cheers Terry MacDonald STIX, TAXII, CybOX Consultant M: +61-407-203-026 E:  terry.macdonald@threatloop.com W:  www.threatloop.com Disclaimer: The opinions expressed within this email do not represent the sentiment of any other party except my own. My views do not necessarily reflect those of my employers. On 12 June 2015 at 18:43, Peter Allor < pallor@us.ibm.com > wrote: Trey, I think you and I are really close. Point: 0)  YES 1)  Yes 2)  Preferred, not mandatory 3)  ABSOLUTELY Pete (best for me to be 'Pete' and Peter Brown to be "Peter") Trey Darley ---06/12/2015 04:35:30 AM---Hey, Pete - Note that I specified "an academic-cum-actual security researcher with dirt under their From: Trey Darley < trey@soltra.com > To: Peter Allor/Atlanta/IBM@IBMUS, Peter F Brown < peter@peterfbrown.com > Cc: Aharon Chernin < achernin@soltra.com >, "Jordan, Bret" < bret.jordan@bluecoat.com >, Carol Geyer < carol.geyer@oasis-open.org >, "Chet Ensign" < chet.ensign@oasis-open.org >, " cti@lists.oasis-open.org " < cti@lists.oasis-open.org >, Richard Struse < Richard.Struse@hq.dhs.gov >, "Robin Cover" < robin@oasis-open.org >, Scott McGrath < scott.mcgrath@oasis-open.org >, Terry MacDonald < terry.macdonald@threatloop.com >, " tony@yaanatech.com " < tony@yaanatech.com > Date: 06/12/2015 04:35 AM Subject: Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC, Hey, Pete - Note that I specified "an academic-cum-actual security researcher with dirt under their fingernails", not merely an academic. Nor am I against a private-sector co-chair, but "preferably _not_ a vendor". The point is, if we agree on the need for a co-chair, here are the essential qualifications: 0) someone practical 1) someone neutral 2) someone non-US 3) someone that isn't going to drive Rich crazy (ie, compatible personalities == enhanced collaboration) Cheers, Trey -- Trey Darley Senior Security Engineer Soltra An FS-ISAC & DTCC Company www.soltra.com From:   cti@lists.oasis-open.org < cti@lists.oasis-open.org > on behalf of Peter Allor < pallor@us.ibm.com > Sent:  Thursday, June 11, 2015 18:01 To:  Peter F Brown Cc:  Aharon Chernin; Jordan, Bret; Carol Geyer; Chet Ensign; cti@lists.oasis-open.org ; Richard Struse; Robin Cover; Scott McGrath; Terry MacDonald; tony@yaanatech.com ; Trey Darley Subject:  RE: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,     As a data point, in discussing adoption of STIX/TAXII with National Government CSIRTs and other large corporate international organizations, a US/DHS only way forward, has / is an inhibitor to formally using STIX/TAXII in the recent past. I am aware of some USG elements liking that we demonstrate a broad representation. So, I endorse and support Rich, both for his leadership and technical passion as well as vision for this effort.     And will bow to what the group decides. But would heavily suggest that we have someone else assist Rich in his chair duties as his co-chair.   This is more about perception and adoption than about substance/content.   And no, I am not soliciting an academic.    We really need and want 'industry' (across the board) to use this.   Pete Peter F Brown ---06/11/2015 11:25:01 AM---+1 The significance only means something if we *make* it mean something. From: Peter F Brown < peter@peterfbrown.com > To: " tony@yaanatech.com " < tony@yaanatech.com >, Trey Darley < trey@soltra.com >, Peter Allor/Atlanta/IBM@IBMUS Cc: Chet Ensign < chet.ensign@oasis-open.org >, Aharon Chernin < achernin@soltra.com >, Terry MacDonald < terry.macdonald@threatloop.com >, "Jordan, Bret" < bret.jordan@bluecoat.com >, " cti@lists.oasis-open.org " < cti@lists.oasis-open.org >, Richard Struse < Richard.Struse@hq.dhs.gov >, "Scott McGrath" < scott.mcgrath@oasis-open.org >, Robin Cover < robin@oasis-open.org >, Carol Geyer < carol.geyer@oasis-open.org > Date: 06/11/2015 11:25 AM Subject: RE: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC, +1 The significance only means something if we * make * it mean something. I understand that there might be concern about an OASIS TC being seen just to do DHS’s bidding. However, expanding on what Tony rightly says, there are many TCs where there are initial worries that one party (public, private, research, not-for-profit) is set to run the show – but the nature of the open process, transparency, and engagement from all sides will do more to “disappear” that myth than any “fix”. This is not an argument against co-chair(s) per se: just that, if we need such a role, it will become apparent quickly enough. All the best, Peter From:  Tony Rutkowski [ mailto:tony@yaanatech.com ] Sent:  11 June, 2015 08:11 To:  Trey Darley; Peter Allor; Peter F Brown Cc:  Chet Ensign; Aharon Chernin; Terry MacDonald; Jordan, Bret; cti@lists.oasis-open.org ; Richard Struse; Scott McGrath; Robin Cover; Carol Geyer Subject:  Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC, The world of international technical committees in this sector contains numerous examples of chairs from government agencies.  Furthermore, Rich is rather more than an agency representative in this context.  From both a substantive perspective as well as effective leadership and "messaging," his chair position is important. As someone who leads the ETSI equivalent activity, (and formerly led the equivalent in ITU-T) Rich's chair position probably enhances the global assimilation of the CTI suite. --tony On 2015-06-11 10:45 AM, Trey Darley wrote:   <snip>   However, I suggest the following, especially for us 'Americans' to consider.    We need to have another individual as a co-chair.    Simply put, to not be something that OASIS is adopting only for the US Department of Homeland Security (DHS). </snip>       -- ________________________________ Anthony Michael Rutkowski     EVP, Industry Standards & Regulatory Affairs tony@yaanatech.com +1 703 999 8270 ________________________________ Yaana Technologies LLC 542 Gibraltar Drive Milpitas CA 95035 USA


  • 36.  Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,

    Posted 06-12-2015 15:51
    I like the hut idea, and I would love to sit down with our European and other geo partners in this effort and understand their struggles, use-cases, and things they would like to see.  I believe it is vitally important to understand - completely - what everyone would like to do, what they are doing, and the roadblocks that are preventing them from being successful. We are still very much in the early adopter and initial hype phase for this technology.  We have a lot of work ahead of us to get across the chasm, and the team really needs leaders at the TC level and the working groups level that can allocate enormous amounts of time and that represent a broad collection of the community.  If we want this effort to truly be successful, then individual organizations and entities that are trying to use it, need to be successful. Sometimes this means helping them to see and compute the ROI and long term benefits from using it and sometimes it means making the standard easier to use or do more things. We as a TC need to take the time to understand their pain points and then take that feedback and drive solutions within the standard.   In addition to my community and customer outreach and consulting in regard to STIX and TAXII, I have been investigating what other vendors are trying to do with it, and have started writing my own open source implementation (I am doing this to get a feel for what integrators are dealing with).  These three efforts have give me a very interesting perspective on the issues people are facing and things we need to do to help make them successful.  Things I would love to see come out of our standards work within 18-24 months: * at least 30 major vendors using STIX and TAXII in their main product lines * at least 10 new startups become highly successful because of STIX and TAXII * hundreds of apps on the various App Stores that can interact with STIX and TAXII data * sharing outside of niche eco-systems that works with data-marking and handling restrictions * at least 10 of the major OSI repos delivering their feeds via STIX and TAXII  * desperate products in the network communicating with each other over STIX and TAXII * solutions to prevent repo poisoning and source verification of intel * API support in more programming languages * database examples and prototypes to aid rapid development and solutions by startups and open source developers Thanks, Bret Bret Jordan CISSP Director of Security Architecture and Standards Office of the CTO Blue Coat Systems PGP Fingerprint: 62A6 5999 0F7D 0D61 4C66 D59C 2DB5 111D 63BC A303 Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg.   On Jun 12, 2015, at 07:58, Joep Gommers < joep@intelworks.com > wrote: I’ll sponsor a hut with wifi for Bret, maybe others can pitch in some bread, water, magazines and a plane ticket to Europe? From: Terry MacDonald < terry.macdonald@threatloop.com > Date: Friday, June 12, 2015 at 2:11 PM To: Peter Allor < pallor@us.ibm.com > Cc: Trey Darley < trey@soltra.com >, Aharon Chernin < achernin@soltra.com >, Jordan, Bret < bret.jordan@bluecoat.com >, Carol Geyer < carol.geyer@oasis-open.org >, Chet Ensign < chet.ensign@oasis-open.org >, cti@lists.oasis-open.org < cti@lists.oasis-open.org >, Peter F Brown < peter@peterfbrown.com >, Richard Struse < Richard.Struse@hq.dhs.gov >, Robin Cover < robin@oasis-open.org >, Scott McGrath < scott.mcgrath@oasis-open.org >, Terry MacDonald < terry.macdonald@threatloop.com >, tony@yaanatech.com < tony@yaanatech.com > Subject: Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC, Sounds like a description of Bret.....except 2 :). Cheers Terry MacDonald STIX, TAXII, CybOX Consultant M: +61-407-203-026 E:  terry.macdonald@threatloop.com W:  www.threatloop.com Disclaimer: The opinions expressed within this email do not represent the sentiment of any other party except my own. My views do not necessarily reflect those of my employers. On 12 June 2015 at 18:43, Peter Allor < pallor@us.ibm.com > wrote: Trey, I think you and I are really close. Point: 0)  YES 1)  Yes 2)  Preferred, not mandatory 3)  ABSOLUTELY Pete (best for me to be 'Pete' and Peter Brown to be Peter ) <graycol.gif> Trey Darley ---06/12/2015 04:35:30 AM---Hey, Pete - Note that I specified an academic-cum-actual security researcher with dirt under their From: Trey Darley < trey@soltra.com > To: Peter Allor/Atlanta/IBM@IBMUS, Peter F Brown < peter@peterfbrown.com > Cc: Aharon Chernin < achernin@soltra.com >, Jordan, Bret < bret.jordan@bluecoat.com >, Carol Geyer < carol.geyer@oasis-open.org >, Chet Ensign < chet.ensign@oasis-open.org >, cti@lists.oasis-open.org < cti@lists.oasis-open.org >, Richard Struse < Richard.Struse@hq.dhs.gov >, Robin Cover < robin@oasis-open.org >, Scott McGrath < scott.mcgrath@oasis-open.org >, Terry MacDonald < terry.macdonald@threatloop.com >, tony@yaanatech.com < tony@yaanatech.com > Date: 06/12/2015 04:35 AM Subject: Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC, Hey, Pete - Note that I specified an academic-cum-actual security researcher with dirt under their fingernails , not merely an academic. Nor am I against a private-sector co-chair, but preferably _not_ a vendor . The point is, if we agree on the need for a co-chair, here are the essential qualifications: 0) someone practical 1) someone neutral 2) someone non-US 3) someone that isn't going to drive Rich crazy (ie, compatible personalities == enhanced collaboration) Cheers, Trey -- Trey Darley Senior Security Engineer Soltra An FS-ISAC & DTCC Company www.soltra.com From:   cti@lists.oasis-open.org < cti@lists.oasis-open.org > on behalf of Peter Allor < pallor@us.ibm.com > Sent:  Thursday, June 11, 2015 18:01 To:  Peter F Brown Cc:  Aharon Chernin; Jordan, Bret; Carol Geyer; Chet Ensign; cti@lists.oasis-open.org ; Richard Struse; Robin Cover; Scott McGrath; Terry MacDonald; tony@yaanatech.com ; Trey Darley Subject:  RE: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,     As a data point, in discussing adoption of STIX/TAXII with National Government CSIRTs and other large corporate international organizations, a US/DHS only way forward, has / is an inhibitor to formally using STIX/TAXII in the recent past. I am aware of some USG elements liking that we demonstrate a broad representation. So, I endorse and support Rich, both for his leadership and technical passion as well as vision for this effort.     And will bow to what the group decides. But would heavily suggest that we have someone else assist Rich in his chair duties as his co-chair.   This is more about perception and adoption than about substance/content.   And no, I am not soliciting an academic.    We really need and want 'industry' (across the board) to use this.   Pete Peter F Brown ---06/11/2015 11:25:01 AM---+1 The significance only means something if we *make* it mean something. From: Peter F Brown < peter@peterfbrown.com > To: tony@yaanatech.com < tony@yaanatech.com >, Trey Darley < trey@soltra.com >, Peter Allor/Atlanta/IBM@IBMUS Cc: Chet Ensign < chet.ensign@oasis-open.org >, Aharon Chernin < achernin@soltra.com >, Terry MacDonald < terry.macdonald@threatloop.com >, Jordan, Bret < bret.jordan@bluecoat.com >, cti@lists.oasis-open.org < cti@lists.oasis-open.org >, Richard Struse < Richard.Struse@hq.dhs.gov >, Scott McGrath < scott.mcgrath@oasis-open.org >, Robin Cover < robin@oasis-open.org >, Carol Geyer < carol.geyer@oasis-open.org > Date: 06/11/2015 11:25 AM Subject: RE: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC, +1 The significance only means something if we * make * it mean something. I understand that there might be concern about an OASIS TC being seen just to do DHS’s bidding. However, expanding on what Tony rightly says, there are many TCs where there are initial worries that one party (public, private, research, not-for-profit) is set to run the show – but the nature of the open process, transparency, and engagement from all sides will do more to “disappear” that myth than any “fix”. This is not an argument against co-chair(s) per se: just that, if we need such a role, it will become apparent quickly enough. All the best, Peter From:  Tony Rutkowski [ mailto:tony@yaanatech.com ] Sent:  11 June, 2015 08:11 To:  Trey Darley; Peter Allor; Peter F Brown Cc:  Chet Ensign; Aharon Chernin; Terry MacDonald; Jordan, Bret; cti@lists.oasis-open.org ; Richard Struse; Scott McGrath; Robin Cover; Carol Geyer Subject:  Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC, The world of international technical committees in this sector contains numerous examples of chairs from government agencies.  Furthermore, Rich is rather more than an agency representative in this context.  From both a substantive perspective as well as effective leadership and messaging, his chair position is important. As someone who leads the ETSI equivalent activity, (and formerly led the equivalent in ITU-T) Rich's chair position probably enhances the global assimilation of the CTI suite. --tony On 2015-06-11 10:45 AM, Trey Darley wrote:   <snip>   However, I suggest the following, especially for us 'Americans' to consider.    We need to have another individual as a co-chair.    Simply put, to not be something that OASIS is adopting only for the US Department of Homeland Security (DHS). </snip>       -- ________________________________ Anthony Michael Rutkowski     EVP, Industry Standards & Regulatory Affairs tony@yaanatech.com +1 703 999 8270 ________________________________ Yaana Technologies LLC 542 Gibraltar Drive Milpitas CA 95035 USA <graycol.gif> Attachment: signature.asc Description: Message signed with OpenPGP using GPGMail


  • 37.  Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,

    Posted 06-12-2015 13:30
    Hey, y'all - There's seems to be clear consensus on Rich for CTI chair. I think everyone agrees that Rich has done yeoman’s work overseeing and nurturing the development of these emerging standards over the past several years. The shift to OASIS is pretty huge. We don't want too much change all at once.  I've been participating in these discussions for a couple of years now. Just in the past couple of weeks, it's been remarkable all the new names popping up on the mailing lists. Based on what I've seen since the transition to OASIS was announced, I'm willing to bet that the CTI community _doubles_ over the course of the next six months. I propose the following compromise: 0) We have Rich act as sole chair during the six month period immediately following the initial round of voting. 1) We institute a one-year term on all chair positions. 2) We give the chair a veto on co-chair candidates and require a 60% majority to override the chair's veto. Beyond that, I think the four essential criteria already spelled out are valuable considerations but needn't be formalized. Cheers, Trey -- Trey Darley Senior Security Engineer Soltra An FS-ISAC & DTCC Company +32/494.766.080 trey@soltra.com www.soltra.com From: Peter Allor <pallor@us.ibm.com> Sent: Friday, June 12, 2015 10:43 To: Trey Darley Cc: Aharon Chernin; Jordan, Bret; Carol Geyer; Chet Ensign; cti@lists.oasis-open.org; Peter F Brown; Richard Struse; Robin Cover; Scott McGrath; Terry MacDonald; tony@yaanatech.com Subject: Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,   Trey, I think you and I are really close. Point: 0)  YES 1)  Yes 2)  Preferred, not mandatory 3)  ABSOLUTELY Pete (best for me to be 'Pete' and Peter Brown to be "Peter") Trey Darley ---06/12/2015 04:35:30 AM---Hey, Pete - Note that I specified "an academic-cum-actual security researcher with dirt under their From: Trey Darley <trey@soltra.com> To: Peter Allor/Atlanta/IBM@IBMUS, Peter F Brown <peter@peterfbrown.com> Cc: Aharon Chernin <achernin@soltra.com>, "Jordan, Bret" <bret.jordan@bluecoat.com>, Carol Geyer <carol.geyer@oasis-open.org>, "Chet Ensign" <chet.ensign@oasis-open.org>, "cti@lists.oasis-open.org" <cti@lists.oasis-open.org>, Richard Struse <Richard.Struse@hq.dhs.gov>, "Robin Cover" <robin@oasis-open.org>, Scott McGrath <scott.mcgrath@oasis-open.org>, Terry MacDonald <terry.macdonald@threatloop.com>, "tony@yaanatech.com" <tony@yaanatech.com> Date: 06/12/2015 04:35 AM Subject: Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC, Hey, Pete - Note that I specified "an academic-cum-actual security researcher with dirt under their fingernails", not merely an academic. Nor am I against a private-sector co-chair, but "preferably _not_ a vendor". The point is, if we agree on the need for a co-chair, here are the essential qualifications: 0) someone practical 1) someone neutral 2) someone non-US 3) someone that isn't going to drive Rich crazy (ie, compatible personalities == enhanced collaboration) Cheers, Trey -- Trey Darley Senior Security Engineer Soltra An FS-ISAC & DTCC Company www.soltra.com From:  cti@lists.oasis-open.org <cti@lists.oasis-open.org> on behalf of Peter Allor <pallor@us.ibm.com> Sent:  Thursday, June 11, 2015 18:01 To:  Peter F Brown Cc:  Aharon Chernin; Jordan, Bret; Carol Geyer; Chet Ensign; cti@lists.oasis-open.org; Richard Struse; Robin Cover; Scott McGrath; Terry MacDonald; tony@yaanatech.com; Trey Darley Subject:  RE: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,     As a data point, in discussing adoption of STIX/TAXII with National Government CSIRTs and other large corporate international organizations, a US/DHS only way forward, has / is an inhibitor to formally using STIX/TAXII in the recent past. I am aware of some USG elements liking that we demonstrate a broad representation. So, I endorse and support Rich, both for his leadership and technical passion as well as vision for this effort.     And will bow to what the group decides. But would heavily suggest that we have someone else assist Rich in his chair duties as his co-chair.   This is more about perception and adoption than about substance/content.   And no, I am not soliciting an academic.    We really need and want 'industry' (across the board) to use this.   Pete Peter F Brown ---06/11/2015 11:25:01 AM---+1 The significance only means something if we *make* it mean something. From: Peter F Brown <peter@peterfbrown.com> To: "tony@yaanatech.com" <tony@yaanatech.com>, Trey Darley <trey@soltra.com>, Peter Allor/Atlanta/IBM@IBMUS Cc: Chet Ensign <chet.ensign@oasis-open.org>, Aharon Chernin <achernin@soltra.com>, Terry MacDonald <terry.macdonald@threatloop.com>, "Jordan, Bret" <bret.jordan@bluecoat.com>, "cti@lists.oasis-open.org" <cti@lists.oasis-open.org>, Richard Struse <Richard.Struse@hq.dhs.gov>, "Scott McGrath" <scott.mcgrath@oasis-open.org>, Robin Cover <robin@oasis-open.org>, Carol Geyer <carol.geyer@oasis-open.org> Date: 06/11/2015 11:25 AM Subject: RE: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC, +1 The significance only means something if we * make * it mean something. I understand that there might be concern about an OASIS TC being seen just to do DHS’s bidding. However, expanding on what Tony rightly says, there are many TCs where there are initial worries that one party (public, private, research, not-for-profit) is set to run the show – but the nature of the open process, transparency, and engagement from all sides will do more to “disappear” that myth than any “fix”. This is not an argument against co-chair(s) per se: just that, if we need such a role, it will become apparent quickly enough. All the best, Peter From:  Tony Rutkowski [ mailto:tony@yaanatech.com ] Sent:  11 June, 2015 08:11 To:  Trey Darley; Peter Allor; Peter F Brown Cc:  Chet Ensign; Aharon Chernin; Terry MacDonald; Jordan, Bret; cti@lists.oasis-open.org; Richard Struse; Scott McGrath; Robin Cover; Carol Geyer Subject:  Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC, The world of international technical committees in this sector contains numerous examples of chairs from government agencies.  Furthermore, Rich is rather more than an agency representative in this context.  From both a substantive perspective as well as effective leadership and "messaging," his chair position is important. As someone who leads the ETSI equivalent activity, (and formerly led the equivalent in ITU-T) Rich's chair position probably enhances the global assimilation of the CTI suite. --tony On 2015-06-11 10:45 AM, Trey Darley wrote:   <snip>   However, I suggest the following, especially for us 'Americans' to consider.    We need to have another individual as a co-chair.    Simply put, to not be something that OASIS is adopting only for the US Department of Homeland Security (DHS). </snip>       -- ________________________________ Anthony Michael Rutkowski     EVP, Industry Standards & Regulatory Affairs tony@yaanatech.com +1 703 999 8270 ________________________________ Yaana Technologies LLC 542 Gibraltar Drive Milpitas CA 95035 USA


  • 38.  Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,

    Posted 06-12-2015 13:48
    Hi Trey,  In my official role as OASIS TC Administrator (aka Process Referee) I'll have to throw a flag on item #2. The TC Process (see  https://www.oasis-open.org/policies-guidelines/tc-process#chairs ) explains how Chair(s) can be elected and removed. Co-Chairs are equal parties and there is no way one Chair can be allowed to veto another. The TC can adopt a 1 year term-limit if it wishes, that doesn't conflict with anything in our process. But I have to veto the veto - so to speak.  Best,  /chet  On Fri, Jun 12, 2015 at 9:29 AM, Trey Darley < trey@soltra.com > wrote: Hey, y'all - There's seems to be clear consensus on Rich for CTI chair. I think everyone agrees that Rich has done yeoman’s work overseeing and nurturing the development of these emerging standards over the past several years. The shift to OASIS is pretty huge. We don't want too much change all at once.  I've been participating in these discussions for a couple of years now. Just in the past couple of weeks, it's been remarkable all the new names popping up on the mailing lists. Based on what I've seen since the transition to OASIS was announced, I'm willing to bet that the CTI community _doubles_ over the course of the next six months. I propose the following compromise: 0) We have Rich act as sole chair during the six month period immediately following the initial round of voting. 1) We institute a one-year term on all chair positions. 2) We give the chair a veto on co-chair candidates and require a 60% majority to override the chair's veto. Beyond that, I think the four essential criteria already spelled out are valuable considerations but needn't be formalized. Cheers, Trey -- Trey Darley Senior Security Engineer Soltra An FS-ISAC & DTCC Company +32/494.766.080 trey@soltra.com www.soltra.com From: Peter Allor < pallor@us.ibm.com > Sent: Friday, June 12, 2015 10:43 To: Trey Darley Cc: Aharon Chernin; Jordan, Bret; Carol Geyer; Chet Ensign; cti@lists.oasis-open.org ; Peter F Brown; Richard Struse; Robin Cover; Scott McGrath; Terry MacDonald; tony@yaanatech.com Subject: Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,   Trey, I think you and I are really close. Point: 0)  YES 1)  Yes 2)  Preferred, not mandatory 3)  ABSOLUTELY Pete (best for me to be 'Pete' and Peter Brown to be "Peter") Trey Darley ---06/12/2015 04:35:30 AM---Hey, Pete - Note that I specified "an academic-cum-actual security researcher with dirt under their From: Trey Darley < trey@soltra.com > To: Peter Allor/Atlanta/IBM@IBMUS, Peter F Brown < peter@peterfbrown.com > Cc: Aharon Chernin < achernin@soltra.com >, "Jordan, Bret" < bret.jordan@bluecoat.com >, Carol Geyer < carol.geyer@oasis-open.org >, "Chet Ensign" < chet.ensign@oasis-open.org >, " cti@lists.oasis-open.org " < cti@lists.oasis-open.org >, Richard Struse < Richard.Struse@hq.dhs.gov >, "Robin Cover" < robin@oasis-open.org >, Scott McGrath < scott.mcgrath@oasis-open.org >, Terry MacDonald < terry.macdonald@threatloop.com >, " tony@yaanatech.com " < tony@yaanatech.com > Date: 06/12/2015 04:35 AM Subject: Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC, Hey, Pete - Note that I specified "an academic-cum-actual security researcher with dirt under their fingernails", not merely an academic. Nor am I against a private-sector co-chair, but "preferably _not_ a vendor". The point is, if we agree on the need for a co-chair, here are the essential qualifications: 0) someone practical 1) someone neutral 2) someone non-US 3) someone that isn't going to drive Rich crazy (ie, compatible personalities == enhanced collaboration) Cheers, Trey -- Trey Darley Senior Security Engineer Soltra An FS-ISAC & DTCC Company www.soltra.com From:   cti@lists.oasis-open.org < cti@lists.oasis-open.org > on behalf of Peter Allor < pallor@us.ibm.com > Sent:  Thursday, June 11, 2015 18:01 To:  Peter F Brown Cc:  Aharon Chernin; Jordan, Bret; Carol Geyer; Chet Ensign; cti@lists.oasis-open.org ; Richard Struse; Robin Cover; Scott McGrath; Terry MacDonald; tony@yaanatech.com ; Trey Darley Subject:  RE: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,     As a data point, in discussing adoption of STIX/TAXII with National Government CSIRTs and other large corporate international organizations, a US/DHS only way forward, has / is an inhibitor to formally using STIX/TAXII in the recent past. I am aware of some USG elements liking that we demonstrate a broad representation. So, I endorse and support Rich, both for his leadership and technical passion as well as vision for this effort.     And will bow to what the group decides. But would heavily suggest that we have someone else assist Rich in his chair duties as his co-chair.   This is more about perception and adoption than about substance/content.   And no, I am not soliciting an academic.    We really need and want 'industry' (across the board) to use this.   Pete Peter F Brown ---06/11/2015 11:25:01 AM---+1 The significance only means something if we *make* it mean something. From: Peter F Brown < peter@peterfbrown.com > To: " tony@yaanatech.com " < tony@yaanatech.com >, Trey Darley < trey@soltra.com >, Peter Allor/Atlanta/IBM@IBMUS Cc: Chet Ensign < chet.ensign@oasis-open.org >, Aharon Chernin < achernin@soltra.com >, Terry MacDonald < terry.macdonald@threatloop.com >, "Jordan, Bret" < bret.jordan@bluecoat.com >, " cti@lists.oasis-open.org " < cti@lists.oasis-open.org >, Richard Struse < Richard.Struse@hq.dhs.gov >, "Scott McGrath" < scott.mcgrath@oasis-open.org >, Robin Cover < robin@oasis-open.org >, Carol Geyer < carol.geyer@oasis-open.org > Date: 06/11/2015 11:25 AM Subject: RE: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC, +1 The significance only means something if we * make * it mean something. I understand that there might be concern about an OASIS TC being seen just to do DHS’s bidding. However, expanding on what Tony rightly says, there are many TCs where there are initial worries that one party (public, private, research, not-for-profit) is set to run the show – but the nature of the open process, transparency, and engagement from all sides will do more to “disappear” that myth than any “fix”. This is not an argument against co-chair(s) per se: just that, if we need such a role, it will become apparent quickly enough. All the best, Peter From:  Tony Rutkowski [ mailto:tony@yaanatech.com ] Sent:  11 June, 2015 08:11 To:  Trey Darley; Peter Allor; Peter F Brown Cc:  Chet Ensign; Aharon Chernin; Terry MacDonald; Jordan, Bret; cti@lists.oasis-open.org ; Richard Struse; Scott McGrath; Robin Cover; Carol Geyer Subject:  Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC, The world of international technical committees in this sector contains numerous examples of chairs from government agencies.  Furthermore, Rich is rather more than an agency representative in this context.  From both a substantive perspective as well as effective leadership and "messaging," his chair position is important. As someone who leads the ETSI equivalent activity, (and formerly led the equivalent in ITU-T) Rich's chair position probably enhances the global assimilation of the CTI suite. --tony On 2015-06-11 10:45 AM, Trey Darley wrote:   <snip>   However, I suggest the following, especially for us 'Americans' to consider.    We need to have another individual as a co-chair.    Simply put, to not be something that OASIS is adopting only for the US Department of Homeland Security (DHS). </snip>       -- ________________________________ Anthony Michael Rutkowski     EVP, Industry Standards & Regulatory Affairs tony@yaanatech.com +1 703 999 8270 ________________________________ Yaana Technologies LLC 542 Gibraltar Drive Milpitas CA 95035 USA -- /chet  ---------------- Chet Ensign Director of Standards Development and TC Administration  OASIS: Advancing open standards for the information society http://www.oasis-open.org Primary: +1 973-996-2298 Mobile: +1 201-341-1393 


  • 39.  Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,

    Posted 06-12-2015 13:50




    Hi, Chet -



    I see this isn't your _first_ goat rodeo!



    /me scurries off to read OASIS policies...






    Cheers,
    Trey
    --
    Trey Darley

    Senior Security Engineer
    Soltra An FS-ISAC & DTCC Company
    www.soltra.com






    From: Chet Ensign <chet.ensign@oasis-open.org>
    Sent: Friday, June 12, 2015 15:47
    To: Trey Darley
    Cc: Peter Allor; Aharon Chernin; Jordan, Bret; Carol Geyer; cti@lists.oasis-open.org; Peter F Brown; Richard Struse; Robin Cover; Scott McGrath; Terry MacDonald; tony@yaanatech.com
    Subject: Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,
     


    Hi Trey, 


    In my official role as OASIS TC Administrator (aka Process Referee) I'll have to throw a flag on item #2. The TC Process (see  https://www.oasis-open.org/policies-guidelines/tc-process#chairs )
    explains how Chair(s) can be elected and removed. Co-Chairs are equal parties and there is no way one Chair can be allowed to veto another. The TC can adopt a 1 year term-limit if it wishes, that doesn't conflict with anything in our process. But I have to
    veto the veto - so to speak. 


    Best, 


    /chet 


    On Fri, Jun 12, 2015 at 9:29 AM, Trey Darley
    < trey@soltra.com > wrote:




    Hey, y'all -


    There's seems to be clear consensus on Rich for CTI chair. I think everyone agrees that Rich has done yeoman’s work overseeing and nurturing the development of these emerging standards over the past several years.


    The shift to OASIS is pretty huge. We don't want too much change all at once. 


    I've been participating in these discussions for a couple of years now. Just in the past couple of weeks, it's been remarkable all the new names popping up on the mailing lists. Based on what I've seen since the transition to OASIS was announced, I'm willing
    to bet that the CTI community _doubles_ over the course of the next six months.


    I propose the following compromise:


    0) We have Rich act as sole chair during the six month period immediately following the initial round of voting.
    1) We institute a one-year term on all chair positions.
    2) We give the chair a veto on co-chair candidates and require a 60% majority to override the chair's veto.


    Beyond that, I think the four essential criteria already spelled out are valuable considerations but needn't be formalized.






    Cheers,

    Trey
    --
    Trey Darley

    Senior Security Engineer
    Soltra An FS-ISAC & DTCC Company

    +32/494.766.080
    trey@soltra.com
    www.soltra.com





    From: Peter Allor < pallor@us.ibm.com >
    Sent: Friday, June 12, 2015 10:43
    To: Trey Darley
    Cc: Aharon Chernin; Jordan, Bret; Carol Geyer; Chet Ensign;
    cti@lists.oasis-open.org ; Peter F Brown; Richard Struse; Robin Cover; Scott McGrath; Terry MacDonald;
    tony@yaanatech.com


    Subject: Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,


     




    Trey,
    I think you and I are really close.

    Point:
    0)  YES
    1)  Yes
    2)  Preferred, not mandatory
    3)  ABSOLUTELY

    Pete
    (best for me to be 'Pete' and Peter Brown to be "Peter")

    Trey
    Darley ---06/12/2015 04:35:30 AM---Hey, Pete - Note that I specified "an academic-cum-actual security researcher with dirt under their

    From: Trey Darley < trey@soltra.com >
    To: Peter Allor/Atlanta/IBM@IBMUS, Peter F Brown < peter@peterfbrown.com >
    Cc: Aharon Chernin < achernin@soltra.com >, "Jordan, Bret" < bret.jordan@bluecoat.com >,
    Carol Geyer < carol.geyer@oasis-open.org >, "Chet Ensign" < chet.ensign@oasis-open.org >, " cti@lists.oasis-open.org "
    < cti@lists.oasis-open.org >, Richard Struse < Richard.Struse@hq.dhs.gov >, "Robin Cover" < robin@oasis-open.org >,
    Scott McGrath < scott.mcgrath@oasis-open.org >, Terry MacDonald < terry.macdonald@threatloop.com >, " tony@yaanatech.com "
    < tony@yaanatech.com >
    Date: 06/12/2015 04:35 AM
    Subject: Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,





    Hey, Pete -

    Note that I specified "an academic-cum-actual security researcher with dirt under their fingernails", not merely an academic. Nor am I against a private-sector co-chair, but "preferably _not_ a vendor".


    The point is, if we agree on the need for a co-chair, here are the essential qualifications:

    0) someone practical
    1) someone neutral
    2) someone non-US
    3) someone that isn't going to drive Rich crazy (ie, compatible personalities == enhanced collaboration)

    Cheers,
    Trey
    --
    Trey Darley
    Senior Security Engineer
    Soltra An FS-ISAC & DTCC Company
    www.soltra.com


    From:   cti@lists.oasis-open.org < cti@lists.oasis-open.org > on
    behalf of Peter Allor < pallor@us.ibm.com >
    Sent:  Thursday, June 11, 2015 18:01
    To:  Peter F Brown
    Cc:  Aharon Chernin; Jordan, Bret; Carol Geyer; Chet Ensign;
    cti@lists.oasis-open.org ; Richard Struse; Robin Cover; Scott McGrath; Terry MacDonald;
    tony@yaanatech.com ; Trey Darley
    Subject:  RE: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,  
     
    As a data point, in discussing adoption of STIX/TAXII with National Government CSIRTs and other large corporate international organizations, a US/DHS only way forward, has / is an inhibitor to formally using STIX/TAXII in the
    recent past.

    I am aware of some USG elements liking that we demonstrate a broad representation.

    So, I endorse and support Rich, both for his leadership and technical passion as well as vision for this effort.     And will bow to what the group decides.

    But would heavily suggest that we have someone else assist Rich in his chair duties as his co-chair.   This is more about perception and adoption than about substance/content.   And no, I am not soliciting an academic.    We really need and want 'industry'
    (across the board) to use this.  

    Pete

    Peter F Brown ---06/11/2015 11:25:01 AM---+1 The significance only means something if we *make* it mean something.

    From: Peter F Brown < peter@peterfbrown.com >
    To: " tony@yaanatech.com " < tony@yaanatech.com >, Trey Darley < trey@soltra.com >,
    Peter Allor/Atlanta/IBM@IBMUS
    Cc: Chet Ensign < chet.ensign@oasis-open.org >, Aharon Chernin < achernin@soltra.com >, Terry MacDonald
    < terry.macdonald@threatloop.com >, "Jordan, Bret" < bret.jordan@bluecoat.com >, " cti@lists.oasis-open.org "
    < cti@lists.oasis-open.org >, Richard Struse < Richard.Struse@hq.dhs.gov >, "Scott McGrath" < scott.mcgrath@oasis-open.org >,
    Robin Cover < robin@oasis-open.org >, Carol Geyer < carol.geyer@oasis-open.org >
    Date: 06/11/2015 11:25 AM
    Subject: RE: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,





    +1
    The significance only means something if we * make * it mean something.
    I understand that there might be concern about an OASIS TC being seen just to do DHS’s bidding. However, expanding on what Tony rightly says, there are many TCs where there are initial worries that one party (public, private, research, not-for-profit) is set
    to run the show – but the nature of the open process, transparency, and engagement from all sides will do more to “disappear” that myth than any “fix”.
    This is not an argument against co-chair(s) per se: just that, if we need such a role, it will become apparent quickly enough.
    All the best,
    Peter

    From:  Tony Rutkowski [ mailto:tony@yaanatech.com ]

    Sent:  11 June, 2015 08:11
    To:  Trey Darley; Peter Allor; Peter F Brown
    Cc:  Chet Ensign; Aharon Chernin; Terry MacDonald; Jordan, Bret;
    cti@lists.oasis-open.org ; Richard Struse; Scott McGrath; Robin Cover; Carol Geyer
    Subject:  Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,

    The world of international technical committees in
    this sector contains numerous examples of chairs
    from government agencies.  Furthermore, Rich
    is rather more than an agency representative in
    this context.  From both a substantive perspective
    as well as effective leadership and "messaging,"
    his chair position is important.

    As someone who leads the ETSI equivalent activity,
    (and formerly led the equivalent in ITU-T) Rich's
    chair position probably enhances the global
    assimilation of the CTI suite.

    --tony
    On 2015-06-11 10:45 AM, Trey Darley wrote:  

    <snip>  
    However, I suggest the following, especially for us 'Americans' to consider.    We need to have another individual as a co-chair.    Simply put, to not be something that OASIS is adopting only for the US Department of Homeland
    Security (DHS).
    </snip>  
     

     
    --
    ________________________________
    Anthony Michael Rutkowski    
    EVP, Industry Standards & Regulatory Affairs

    tony@yaanatech.com

    +1 703 999 8270

    ________________________________
    Yaana Technologies LLC
    542 Gibraltar Drive
    Milpitas CA 95035 USA













    --




    /chet 
    ----------------
    Chet Ensign
    Director of Standards Development and TC Administration 
    OASIS: Advancing open standards for the information society
    http://www.oasis-open.org

    Primary: +1 973-996-2298
    Mobile: +1 201-341-1393 












  • 40.  RE: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,

    Posted 06-12-2015 13:59
    I like how this proposal balances the desire of some in the community to have Rich continue his role as shepherd along with a term limit on the role of chair.  The six month time period where we have a chair alone seems prudent too – we may need even a year to figure out the right organizational roles and responsibilities.   == down in the weeds ==   I support the idea of a co-chair, because I like the idea of a permanent succession plan in the event that x, y or z thing happens involving the Chair.  However, I am not sure whether or not the co-chair should automatically be the chair in such an event.   I support the criteria Trey came up with below, understanding why #3 should be optional.  I must admit that personally I hope for the emergence of strong non-US leaders to champion the standards.   I think we would be wise, before we vote for such a person or persons, to figure out exactly what the co-chair(s) will be responsible for as it relates to the structure of the organization, our committees and our decision making process.  We might be just as successful having a small group of individuals to counter the power of the chair.   However, I defer to others on the veto / override function, hopefully there are existing best practices for such a situation.   Thanks,   Alex   From: cti@lists.oasis-open.org [mailto:cti@lists.oasis-open.org] On Behalf Of Trey Darley Sent: Friday, June 12, 2015 9:30 AM To: Peter Allor Cc: Aharon Chernin; Jordan, Bret; Carol Geyer; Chet Ensign; cti@lists.oasis-open.org; Peter F Brown; Richard Struse; Robin Cover; Scott McGrath; Terry MacDonald; tony@yaanatech.com Subject: Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,   Hey, y'all -   There's seems to be clear consensus on Rich for CTI chair. I think everyone agrees that Rich has done yeoman’s work overseeing and nurturing the development of these emerging standards over the past several years.   The shift to OASIS is pretty huge. We don't want too much change all at once.    I've been participating in these discussions for a couple of years now. Just in the past couple of weeks, it's been remarkable all the new names popping up on the mailing lists. Based on what I've seen since the transition to OASIS was announced, I'm willing to bet that the CTI community _doubles_ over the course of the next six months.   I propose the following compromise:   0) We have Rich act as sole chair during the six month period immediately following the initial round of voting. 1) We institute a one-year term on all chair positions. 2) We give the chair a veto on co-chair candidates and require a 60% majority to override the chair's veto.   Beyond that, I think the four essential criteria already spelled out are valuable considerations but needn't be formalized.   Cheers, Trey -- Trey Darley Senior Security Engineer Soltra An FS-ISAC & DTCC Company +32/494.766.080 trey@soltra.com www.soltra.com From: Peter Allor <pallor@us.ibm.com> Sent: Friday, June 12, 2015 10:43 To: Trey Darley Cc: Aharon Chernin; Jordan, Bret; Carol Geyer; Chet Ensign; cti@lists.oasis-open.org; Peter F Brown; Richard Struse; Robin Cover; Scott McGrath; Terry MacDonald; tony@yaanatech.com Subject: Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,   Trey, I think you and I are really close. Point: 0)  YES 1)  Yes 2)  Preferred, not mandatory 3)  ABSOLUTELY Pete (best for me to be 'Pete' and Peter Brown to be "Peter") Trey Darley ---06/12/2015 04:35:30 AM---Hey, Pete - Note that I specified "an academic-cum-actual security researcher with dirt under their From: Trey Darley <trey@soltra.com> To: Peter Allor/Atlanta/IBM@IBMUS, Peter F Brown <peter@peterfbrown.com> Cc: Aharon Chernin <achernin@soltra.com>, "Jordan, Bret" <bret.jordan@bluecoat.com>, Carol Geyer <carol.geyer@oasis-open.org>, "Chet Ensign" <chet.ensign@oasis-open.org>, "cti@lists.oasis-open.org" <cti@lists.oasis-open.org>, Richard Struse <Richard.Struse@hq.dhs.gov>, "Robin Cover" <robin@oasis-open.org>, Scott McGrath <scott.mcgrath@oasis-open.org>, Terry MacDonald <terry.macdonald@threatloop.com>, "tony@yaanatech.com" <tony@yaanatech.com> Date: 06/12/2015 04:35 AM Subject: Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC, Hey, Pete - Note that I specified "an academic-cum-actual security researcher with dirt under their fingernails", not merely an academic. Nor am I against a private-sector co-chair, but "preferably _not_ a vendor". The point is, if we agree on the need for a co-chair, here are the essential qualifications: 0) someone practical 1) someone neutral 2) someone non-US 3) someone that isn't going to drive Rich crazy (ie, compatible personalities == enhanced collaboration) Cheers, Trey -- Trey Darley Senior Security Engineer Soltra An FS-ISAC & DTCC Company www.soltra.com From:  cti@lists.oasis-open.org <cti@lists.oasis-open.org> on behalf of Peter Allor <pallor@us.ibm.com> Sent:  Thursday, June 11, 2015 18:01 To:  Peter F Brown Cc:  Aharon Chernin; Jordan, Bret; Carol Geyer; Chet Ensign; cti@lists.oasis-open.org; Richard Struse; Robin Cover; Scott McGrath; Terry MacDonald; tony@yaanatech.com; Trey Darley Subject:  RE: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC,     As a data point, in discussing adoption of STIX/TAXII with National Government CSIRTs and other large corporate international organizations, a US/DHS only way forward, has / is an inhibitor to formally using STIX/TAXII in the recent past. I am aware of some USG elements liking that we demonstrate a broad representation. So, I endorse and support Rich, both for his leadership and technical passion as well as vision for this effort.     And will bow to what the group decides. But would heavily suggest that we have someone else assist Rich in his chair duties as his co-chair.   This is more about perception and adoption than about substance/content.   And no, I am not soliciting an academic.    We really need and want 'industry' (across the board) to use this.   Pete Peter F Brown ---06/11/2015 11:25:01 AM---+1 The significance only means something if we *make* it mean something. From: Peter F Brown <peter@peterfbrown.com> To: "tony@yaanatech.com" <tony@yaanatech.com>, Trey Darley <trey@soltra.com>, Peter Allor/Atlanta/IBM@IBMUS Cc: Chet Ensign <chet.ensign@oasis-open.org>, Aharon Chernin <achernin@soltra.com>, Terry MacDonald <terry.macdonald@threatloop.com>, "Jordan, Bret" <bret.jordan@bluecoat.com>, "cti@lists.oasis-open.org" <cti@lists.oasis-open.org>, Richard Struse <Richard.Struse@hq.dhs.gov>, "Scott McGrath" <scott.mcgrath@oasis-open.org>, Robin Cover <robin@oasis-open.org>, Carol Geyer <carol.geyer@oasis-open.org> Date: 06/11/2015 11:25 AM Subject: RE: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC, +1 The significance only means something if we * make * it mean something. I understand that there might be concern about an OASIS TC being seen just to do DHS’s bidding. However, expanding on what Tony rightly says, there are many TCs where there are initial worries that one party (public, private, research, not-for-profit) is set to run the show – but the nature of the open process, transparency, and engagement from all sides will do more to “disappear” that myth than any “fix”. This is not an argument against co-chair(s) per se: just that, if we need such a role, it will become apparent quickly enough. All the best, Peter From:  Tony Rutkowski [ mailto:tony@yaanatech.com ] Sent:  11 June, 2015 08:11 To:  Trey Darley; Peter Allor; Peter F Brown Cc:  Chet Ensign; Aharon Chernin; Terry MacDonald; Jordan, Bret; cti@lists.oasis-open.org; Richard Struse; Scott McGrath; Robin Cover; Carol Geyer Subject:  Re: [cti] Inviting nominations for Chair of Cyber Threat Intelligence (CTI) TC, The world of international technical committees in this sector contains numerous examples of chairs from government agencies.  Furthermore, Rich is rather more than an agency representative in this context.  From both a substantive perspective as well as effective leadership and "messaging," his chair position is important. As someone who leads the ETSI equivalent activity, (and formerly led the equivalent in ITU-T) Rich's chair position probably enhances the global assimilation of the CTI suite. --tony On 2015-06-11 10:45 AM, Trey Darley wrote:   <snip>   However, I suggest the following, especially for us 'Americans' to consider.    We need to have another individual as a co-chair.    Simply put, to not be something that OASIS is adopting only for the US Department of Homeland Security (DHS). </snip>       -- ________________________________ Anthony Michael Rutkowski     EVP, Industry Standards & Regulatory Affairs tony@yaanatech.com +1 703 999 8270 ________________________________ Yaana Technologies LLC 542 Gibraltar Drive Milpitas CA 95035 USA This message, and any attachments, is for the intended recipient(s) only, may contain information that is privileged, confidential and/or proprietary and subject to important terms and conditions available at http://www.bankofamerica.com/emaildisclaimer. If you are not the intended recipient, please delete this message.