FIRST: Standard Development for Incident Response Teams

Summary

Through this project FIRST supported the development of standards and maintains four different cybersecurity standards (Common Vulnerability Scoring System (CVSS); Traffic Light Protocol (TLP); Information Exchange Policy (IEP); and Passive DNS exchange).

Details

Aims

This project supports the development of standards and maintains four different cybersecurity standards on the following issues:

• The Common Vulnerability Scoring System (CVSS): develops and maintains the CVSS standard, a robust and useful scoring system for IT vulnerabilities that allows organisations to prioritise them across their networks. CVSSv3 has also been published as an ITU recommendations in X.1521:2016. In the first half of 2017, FIRST released an interactive training “Mastering CVSSv3” through our learning platform.
• The Traffic Light Protocol (TLP), a set of designations used to ensure a common expectations in audience for (non-automated) interactive sharing of sensitive information between entities. The initial version of this standard, building on the original TLP, was released in September of 2016.
• The Information Exchange Policy (IEP), a framework for defining information exchange policy, and set of common definitions for the most common sharing restrictions. It addresses information exchange challenges and promotes information exchange more broadly, primarily for machine automated communications. The first version of the standard was released in September of 2016.
• Passive DNS exchange: a common output format for Passive DNS servers. Released in 2015, this standard is made available as part of an IETF RFC, and is seeing continued development within the FIRST community.

Outcomes

FIRST continues to be represented as a sector member in the ITU as a standards body.

FIRST signed a Memorandum of Understanding with standards organisation OASIS to permit closer cooperation on threat intelligence specifications such as STIX and TAXII.

Contact details

FIRST, via the FIRST secretariat at first-sec@first.org  or Maarten Van Horenbeeck, Director, Forum of Incident Response and Security Teams (FIRST), maarten@first.org

For more information see FIRST website.