cti-taxii — archive

[Bret Jordan <mdavidson@mitre.org>]

Well said Mark. Mark and I are in complete alignment on this. The future of TAXII is going to be exciting and we are going to do a lot of great things in this SC.  The caution I would give is keep your hands and feet inside the vehicle at all times, hold on tight, and have fun .  The fact that we are nearly done with the Phase 1 copy-n-paste should be an indication of our focus and what we will get done going forward. Thanks, Bret Bret Jordan CISSP Director of Security Architecture and Standards Office of the CTO Blue Coat Systems PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050 Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg. On Jul 14, 2015, at 13:06, Davidson II, Mark S < mdavidson@MITRE.ORG > wrote: I used this phrasing the other day, and I'll say it here as well: Lately, I've been on my own personal pilgrimage to the mecca of Message Queues. The messaging and message queue (aka MQ) landscape is littered with messaging standards, both official (released by OASIS or similar) and unofficial [1]. The standards are all different in their own ways, and therefore any feature comparison that considers the whole landscape is difficult to create. Perhaps as an exemplar, AMQP 1.0 and AMQP 0.9.1 have entirely discontinuous scopes [2]. Increasing the difficulty of learning the messaging / MQ space is that there is no shortage of vested interests willing to bend an ear. All over the place there are well worded posts that could equally be the work of an interested, passionate individual, a corporate interest, or an astroturfer. Partly owing to my skepticism of these well-crafted messages, and partly because of my background, I don't feel that I truly know a standard until I've actually used it to solve a problem. To date, however, I've seen more messaging solutions than I've had messaging problems; so my discovery of the space is incomplete. How does TAXII compare? There are similarities: TAXII moves information according to semantics it deems useful, people are using it, and there is a strong community around it; there's also a quasi-MQ structure (Data Feeds). There are also differences: TAXII has been designed specifically for threat information exchange (as noted earlier), and I'm not personally aware of other information sharing specs that have seen the same level of adoption. That said, I've saved TAXII's biggest asset for last: The Future. TAXII will improve under the stewardship of this committee. TAXII will adapt to the knowledge we have gained over the past few years of implementation, interoperability, and growth, and TAXII will be better off for it. In fact, sustained success critically depends on these positive changes; otherwise some other upstart will take our place while we rest on our laurels congratulating ourselves for past successes. Thank you. -Mark [1] An inexhaustive list: AMQP 1.0, AMQP 0.91, MQTT, XMPP, STOMP, WebSockets, SMTP, SOAP, ZeroMQ/ZMTP, Java Message Service (JMS). There are more! [1] http://kellabyte.com/2012/10/20/clarifying-amqp/