Mission
Automating the exchange of security information is imperative to the effectiveness of the security response community. The timely distribution of such information can only thrive in an environment where trust is sustained. A fundamental component of trust is a clear understanding of how shared information can and cannot be used, with very clear expectations and minimal room for misinterpretation. This level of clarity is essential to both providers and consumers, as all parties need to ensure the information is handled properly. Trust is not a matter of technology, but of language, policy, and structured understanding.
The general lack of adequate policy that supports information exchange is increasingly becoming an impediment to timely information exchange that will only intensify as more organizations start actively participating in information exchange groups and the volume of security information being shared continues to grow. One of the main challenges today is the lack of clarity when defining and interpreting the permitted actions, uses, and redistribution of information shared between organizations.
The goals of this Special Interest Group are to collaboratively develop a framework for defining information exchange policy and a set of common definitions for the most common policy aspects. The intent is for this framework to address some of the information exchange policy challenges and to promote information exchange more broadly.
Goals/Deliverables:
The initial goals of the Information Exchange Policy SIG are to collaboratively develop an extensible framework for defining information exchange policy and a set of standard definitions for most common aspects of information exchange.
The deliverables of this SIG include:
- Develop and publish an information exchange policy framework
- Develop and publish a set of common definitions for both use in the IEP framework and use in related IEP policies and sharing agreements
Automating the exchange of security and threat information is imperative to the future success and effectiveness of the security response community.
The latest version of the Information Exchange Policy framework is available at first.org/iep
Chairs
- Paul McKitrick, ICEBRG
- Terry MacDonald, Cosive
- Tom Millar, CISA
Request to Join
