Extended Incident Handling (INCH) – Scope

INCH BOF to be held at the next IETF52



• http://www.terena.nl/tech/task-forces/tf-csirt/iodef/docs/inch-bof-ietf52.txt
• Participation from CERT/CC, FIRST, Symantec, Para-Protect, etc.

Main components/elements of Extended Incident Handling Architecture

• Incident Object Description
• Incident Information Exchange
• Evidence collection and custody
  • Capable/eligible to be used in law enforcement procedures
• Using/Incorporating Vulnerabilities and Exposures Databases
  • Incident and Vulnerability/Exposure formats compatibility
• Reporting about Vulnerabilities to Software and Hardware vendors
• High level statistics and reporting to constituency and sponsors

Previous slide

Next slide

Back to first slide

View graphic version