Implementers' Workshop : Automated Information Sharing with TAXII and STIXReturn to TOC

No ratings

Presented at FIRST 2014 by

Thomas Millar

Richard Struse

Since early 2012, the US Department of Homeland Security has been working in close collaboration with US-CERT team members and partners from critical infrastructure organizations to standardize automated information sharing between diverse trust communities, platforms and services. This workshop will begin by presenting a brief overview of the origins and objectives of the Trusted Automated eXchange of Indicator Information (TAXII) and Structured Threat Information eXpression (STIX) standardization initiatives followed by a deep dive into the technical details of each specification along with an introduction to the utilities, samples and libraries that are already available. Participants are actively encouraged to raise questions, propose requirements, and become active contributors to these community-driven efforts. Truly interoperable, automated information sharing is a key capability for our shared success as cybersecurity responders and defenders. While each organization's circumstances will drive different implementations with unique features and restrictions, a common message exchange and representation language will allow every CSIRT and SOC to realize new opportunities for more advanced analysis, faster response, and most importantly, more chances to deploy preventative measures before new attacks affect your constituency. This workshop is an opportunity to learn more about how to begin integrating STIX and TAXII into your team's environment and for current adopters to interact in person with the chief architect and engineering team supporting the effort.