9 December 2021 — The Open Cybersecurity Alliance (OCA), a global, ​standards-based initiative to simplify ​​integration across the threat lifecycle, announced today that it has accepted the Posture Attribute Collection and Evaluation (PACE) project contributed by the Center for Internet Security (CIS), the National Security Agency (NSA) and McAfee. PACE will focus on creating production-ready code that evaluates the posture assessment of computing resources using a communication fabric which will allow organizations to use this information in zero-trust architecture decisioning.

Based on an implementation effort from the IETF Security Automation and Continuous Monitoring (SACM) architecture, PACE will deliver community-maintained code that will arm operators with an interoperable out-of-the-box solution that monitors risk and threat exposure, reducing integration costs and redundancy while increasing resiliency. Providing comprehensive views into the endpoint, PACE will take advantage of existing standards such as SCAPv2 and leverage ongoing work in SBOM, to allow cybersecurity practitioners to fully utilize threat-informed defenses in their environment in an open and interoperable fashion.

The PACE project aligns with the OCA’s mission of integrating tools and solutions across security teams and will directly enable vendors and end users, advancing the OCA’s mission of building an open ecosystem where cybersecurity products interoperate without the need for customized integrations. 

“NSA Cybersecurity is proud to have supported the development of the OASIS standard OpenC2 language for command and control, which has been included in PACE. Additionally, PACE will leverage several of the cybersecurity standardization efforts NSA has been working on with industry partners to improve the cybersecurity of National Security Systems, the Department of Defense and the Defense Industrial Base.”
— Neal Ziring, Cybersecurity Technical Director, National Security Agency

PACE joins other OCA projects that include Kestrel, the threat hunting tool, the STIX Shifter patterning library, and the OCA Ontology.

The OCA is hosted by OASIS Open, one of the most respected, international bodies in the world for open source and standards. To learn more about the OCA, or other OCA technologies that are available to help security teams connect their security tools and data, please visit: https://github.com/opencybersecurityalliance.

SPONSOR QUOTES

Center for Internet Security
“Managing risk and addressing threat exposure are important facets of any security program. CIS is pleased to have introduced PACE as a new OCA project, we look forward to evaluating and integrating new posture assessment solutions as the cooperative ecosystem increases in participation and interest.”
– Adam Montville, Chief Product Architect, Center for Internet Security

CyberNB | CIPnet
“We applaud the work of OASIS and believe in the mission to create open, global standards that help strengthen digital resiliency. The new PACE project will help define standardized process to measure cybersecurity posture across computing resources. The team here at CyberNB and our Critical Infrastructure Protection Network (CIPnet) will benefit from the PACE project and its outcomes.”
– Tyson Johnson, CEO, CyberNB | CIPnet

Cydarm Technologies
“PACE is an important addition to the OCA project portfolio, as it enables faster gathering of context around intrusion alerts, enabling responders to more quickly triage possible incidents and reduce time wasted on repetitive queries across disconnected systems. Cydarm looks forward to integrating PACE, to further our goal of enabling better and faster security operations.”
– Dr. Vaughan Shanks, CEO, Cydarm Technologies

Cyware Labs
“Cybersecurity threats are rapidly evolving, making it essential for organizations to have complete visibility over their current security posture and the environment they are striving to protect. At Cyware, we facilitate the goal of collective defense for all organizations and communities through collaborative threat response and threat intelligence sharing. PACE, an OCA project will steer the community towards a collaborative framework, enabling them to have the right visibility over the security posture of any organization.”
– Avkash Kathiriya, VP – Research and Innovation, Cyware Labs

F5 Inc.
“Effectively sketching the cybersecurity posture of organizations to practically combat cyber threats requires the power of both enterprise and open-source tools to build a coherent and vigorous cyber defense platform. Fusion and integration of security products including information exchange with the PACE project in the OCA ecosystem not only helps the organizations to subvert cyber threats at scale by generating efficient threat intelligence but also helps to build a proactive and robust cybersecurity stance. In fact, that’s the need of the hour for organizations to provide a secure and safe digital transformation environment to customers.”
– Renuka Nadkarni, CTO Security, F5 Inc.

IBM Security
“Posture assessment is foundational for any zero-trust based approach to security. Having open and interoperable implementation of existing posture standards is critical to ensuring that innovations in this space can be effectively implemented by the broader community, and bringing the PACE project into the OCA will help the industry realize that goal.”
– Jason Keirstead, Senior Technical Staff Member and the Chief Architect of Threat Management, IBM Security

McAfee
“The state of a system at the time of an event is of utmost importance in an event driven system, perhaps as important as the event itself. Without this context, we cannot determine if an event is of high or low critical importance or what the resulting action should be to a given event. Posture attributes that we can broadly agree on as well as open tooling for the collection and evaluation of those attributes is a great move forward in making open, interoperable and event-driven cybersecurity a reality.”
– Mark Mastrangeli, Lead Technology Architect, McAfee

Rapid7
“Visibility is the cornerstone of cybersecurity. Being able to measure and effectively communicate the posture/state of business process assets fosters better (and faster) decision making and can significantly improve enterprise safety and resilience. By creating and relying on open standards for data storage and interchange and removing the need for vendors to reinvent the wheel on commodity architecture components, PACE will help bring security automation and continuous monitoring (SACM) to the widest possible audience, arming organizations of any size with the core components necessary to maintain the health of their IT ecosystems.”
– Bob Rudis, Chief Security Data Scientist, Rapid7

SAIC
“As a leading systems integrator for the federal government, SAIC assesses cyber security postures of large customers with complex cyber environments. We have made significant progress in creating a holistic picture with a repeatable process, and the PACE project will enhance our solutions by allowing us to generate the posture and compliance picture in a more rapid and standardized fashion.”
– Forrest Hare, Solution Developer, Cyberspace Operations, SAIC

sFractal Consulting
“PACE is a great fit for OCA’s mission of standards-based, vendor-agnostic, interoperable cybersecurity. One timely PACE example is the Software Bill of Materials (SBOM) – collecting the SBOM of a device or cloud-service and comparing it with vulnerabilities found in the National Vulnerability Database, and using the results to inform your threat-hunting.”
– Duncan Sparrell, Chief Cyber Curmudgeon, sFractal Consulting

ThreatQuotient
“ThreatQuotient believes in a data-driven approach to security that improves efficiency, has an open architecture, and enables balanced automation. We are proud to be a part of the OCA and to support protocols and standards such as PACE that simplify the exchange of information between different teams and technologies, and enable threat-informed defenses. We are encouraged by continued efforts across the industry to meet the needs of security teams and ultimately help them improve the resiliency of their organizations.”
– Haig Colter, Director, Alliances, ThreatQuotient

VISUA
“VISUA recently joined the OCA specifically because we saw the valuable work the member companies were doing to not only find new and innovative ways to detect compromises and behaviours, but also to communicate threat intelligence in a more cohesive and open way. This kind of work is very exciting to us as we bring new technology discussions to the world of cyber security and begin to integrate the wonderful innovations developed and ratified by OASIS members. PACE is yet another example of this great work.”
– Alessandro Prest, CTO and Co-Founder, VISUA

About the Open Cybersecurity Alliance

The Open Cybersecurity Alliance brings together vendors and end-users to create an open cybersecurity ecosystem where products can freely exchange information, insights, analytics, and orchestrated response. OCA supports commonly developed code and tooling and the use of mutually agreed upon technologies, data standards, and procedures. The OCA is governed under the auspices of OASIS Open, which offers projects a path to standardization and de jure approval for reference in international policy and procurement.

The OCA is led by these organizations committed to solving the costly problem of siloed cyber tools and products: Center for Internet Security (CIS), Copado, Cybereason, CyberNB, Cydarm, Cyware, EclecticIQ, F5 Inc., IBM Security, McAfee, Prophecy International, Rapid7, sFractal Consulting, SafeBreach, SAIC, Tenable, ThreatQuotient, TruSTAR, VISUA and VMware.  

Contact information:
Dee Schur, Senior Manager, Development & Advocacy
OASIS Open
dee.schur@oasis-open.org
+1 941-321-6733

14 July 2021 – OASIS Open and the members of the Cyber Threat Intelligence (CTI) Technical Committee (TC) are pleased to announce that Structured Threat Information Expression (STIX) v2.1 and Trusted Automated Exchange of Intelligence Information (TAXII) v2.1 have been approved as OASIS Standards. STIX and TAXII are widely used to prevent and defend against cyberattacks by enabling threat intelligence to be analyzed and shared among trusted partners and communities. As full OASIS Standards, STIX and TAXII can now be recognized by other International Standards bodies and referenced in official government procurements and rules.

The STIX standard defines a JSON-based language for sharing structured threat intelligence in a consistent, machine-readable manner, allowing organizations to better protect against, detect, and respond to cyber threats. STIX v2.1 adds new objects and capabilities, enabling it to better describe the cyber threats we confront today, as well as future-proofing STIX via STIX Extensions. As a result, STIX v2.1 creates a solid and stable foundation for vendors and consumers alike to exchange actionable CTI.

The TAXII standard defines a transport protocol which supports the exchange of STIX data over Hyper Text Transfer Protocol Secure (HTTPS). TAXII enables machine-to-machine sharing of CTI by defining an API that supports common sharing models used by industry and Information Sharing and Analysis Organizations (ISAOs).

“When I launched the STIX and TAXII initiatives at the US Department of Homeland Security over nine years ago, I always hoped that one day we would reach this milestone of full international standard status,” said OASIS CTI TC Co-chair Richard Struse of MITRE. “Since transitioning this work to OASIS six years ago, the members of the CTI TC have done a tremendous amount of work to give the global community practical standards that empower defenders to maximize their use of threat intelligence to protect their organizations. The community now should focus on using these standards to solve actual cybersecurity problems and to help thwart future cyber attacks.”

“OASIS has given us the ability to create a scalable and sustainable community where like-minded, passionate people come together to solve problems,” said Trey Darley of the Belgian National CERT, who co-chairs the OASIS CTI TC with Richard. “STIX v2.1 and TAXII v2.1 have reached full OASIS Standard status at a critical inflection point, when there’s such a need for more flexible and faster information sharing to enable defense against global cybersecurity threats. We have laid the foundation for cross-implementation interoperability, future-proofed STIX with the new extensions mechanism…I believe that these standards will enable the creation of new classes of security countermeasures…we’ve barely begun to scratch the surface.”

OASIS CTI Technical Committee: https://www.oasis-open.org/committees/cti

Watch Open Matters: Cybersecurity & The Evolution of STIX & TAXII:

Support for STIX AND TAXII v2.1

Accenture

“Publishing STIX and TAXII as full OASIS cyber threat intelligence sharing standards represents a huge milestone for the cybersecurity community. It is our mission to help businesses achieve cyber resilience through the standardized sharing of threat data to help companies more easily consume threat intelligence at speed with action. We are proud to be an OASIS sponsor and member of the CTI Technical Committee dedicated to developing better standards to secure the world.”

— Josh Ray, Managing Director – Cyber Defense Lead, Accenture Security

Anomali

“We recognized early on the importance of a standardized method for exchanging cyber threat intelligence within our platform and our customers’ security ecosystem. We are excited to further the adoption and support of the latest STIX and TAXII versions for our customers and integration partners, which will help them to conduct more precise threat detection, optimize their response, and establish greater cyber resiliency.”

— Mark Alba, Chief Product Officer, Anomali

Copado

“Copado congratulates the OASIS CyberThreat Intelligence Committee in STIX 2.1 and TAXII 2.1 reaching Full OASIS Standard. The continuing effort to build automated defense methods through the open sharing of intelligence in machine-readable format is critical to ongoing efforts in cybersecurity. As a leader in DevOps, Copado will continue to support these efforts to bring humans and machines together to help build a safer, more secure internet.”

—– Daniel Riedel, SVP, Copado

Cyware

“We are proud to support the continued refinement of this standard language. It further builds confidence with the threat intelligence community and enables a true collective defense. As a part of the community, Cyware understands how valuable the standard is, which is just one of the reasons we use it as a backbone for intel sharing and automation.”

— Avkash Kathiriya, Vice President of Research and Innovation, Cyware

EclecticIQ

“The rapidly evolving threat landscape makes it more important than ever to exchange and operationalise threat intelligence. We believe the new STIX & TAXII 2.1 standards bring great advancements that will help our customers detect threats earlier, remediate faster and run their cyber defense operations more efficiently. We applaud OASIS and everyone in the threat intelligence community that has contributed to this tremendous milestone.”

— Ciaran Bradley, CTO, EclecticIQ

IBM

“IBM has a long history of supporting industry standards to solve the world’s most pressing challenges. As cyberattacks have become one of the greatest threats facing modern society, defenders require a coordinated approach to succeed. To make this a reality, IBM has embraced an open, integrated approach to cybersecurity and is proud to support open standards such as STIX and TAXII to facilitate wide-ranging use cases across the entire threat management lifecycle – including intelligence, hunting, detection, and response.”

— Jason Keirstead, CTO, IBM Security Threat Management

SEKOIA

“SEKOIA.IO is a XDR platform leveraging threat intel at the highest level. This CTI is used for detection, context enrichment and reaction strategies. To do so, we aligned our solution with STIX2.1/TAXII2.1 since the beginning. Every day, we produce our exclusive technical and strategic CTI but we also ingest the worldwide cybersecurity news. This is a cornerstone for our XDR and this is done using STIX. Customers can also access this CTI using TAXII, TIPs, API or Web.”

— David Bizeul, CTO, SEKOIA

Sopra Steria

“We are pleased to welcome the new STIX standard release. It’s a step further into operational interaction between Cyber Threat Intelligence and Cyber Defense for detection and analysis. Straight relation between Indicators and Observed Data is a good example of the progress made. Sighting is a key to make global knowledge growth. Therefore, we set STIX 2 as the core standard of our services.”

— Alexandre Cabrol Perales, Head of Managed Detection and Response, Sopra Steria Group 

ThreatQuotient

“We believe that supporting open standards is essential to help organizations leverage the tools they are using and facilitates the exchange of information across those tools regardless of vendor. We are proud to support the approval of STIX v2.1 and TAXII v2.1 as OASIS Standards.”

— Haig Colter, Director of Alliances, ThreatQuotient

Media inquiries: 
Carol Geyer
communications@oasis-open.org
+1.941.284.0403

BOSTON, MA, USA, June 29, 2021 – Open Cybersecurity Alliance (OCA), an OASIS Open Project, today announced it has accepted IBM’s contribution of Kestrel, an open-source programming language for threat hunting that is used by Security Operations Center (SOC) analysts and other cybersecurity professionals. Kestrel streamlines cyber reasoning and threat discovery, which can help analysts complete this process more quickly and effectively.

Threat hunting is a proactive way to find hidden threats in an organization before an attack is executed. This methodology follows the scientific process of establishing a hypothesis for threats likely to be found and then creates detection procedures to confirm or deny the threat’s existence – helping security professionals respond to indicators of compromise with increased speed.

While threat hunting has been successful as a technique, its success unfortunately has been limited due to the high human bandwidth required. Existing threat hunting approaches are primarily manually driven and require deep technical skills that are in short supply. Instead of benefiting from the threat hunting community’s collective knowledge and sharing code, threat hunters often end up working in isolation rewriting the same programs following each attack. IBM Research and IBM Security jointly developed Kestrel to enable threat hunters to express hunts in an open, composable threat hunting language. Kestrel leverages automation to execute tedious hunting tasks, allowing threat hunters to focus on higher priority tasks. Its combination of human ingenuity coupled with machine-based automation helps accelerate threat hunting. The composable hunting flows enable the reuse of best practices and helps reduce the time to create new hunts. Because IBM Security has open-sourced this project, threat hunters across the globe are now able to collaborate, share and use the knowledge curated continuously by threat hunters using Kestrel.

This contribution from IBM marks a major milestone in OCA’s mission to drive greater interoperability across the security industry. The work of the OCA connects the fragmented cybersecurity landscape and enables disparate security products to freely exchange information, out of the box, using mutually agreed upon technologies, standards, and procedures that make it possible for companies to “integrate once, reuse everywhere.”

“Kestrel is designed to take advantage of the collective learned experience of the threat hunting community – and enable that to be combined with the power of machine learning and automation to speed response to threats,” said Jason Keirstead, CTO of Threat Management for IBM Security and Co-Chair – Open Cybersecurity Alliance. “By sharing new threat hunting patterns as they emerge via code that can be easily customized, Kestrel lets threat hunters devote more time to figuring out what to hunt, as opposed to how to hunt.”

“This is a really exciting contribution from IBM, a founding member of the Open Cybersecurity Alliance. Kestrel is a fully open-source threat hunting language that leverages the federated data service capabilities of STIX Shifter which were previously contributed to the OCA by IBM. I cannot wait to see how OCA member organizations and the community of like-minded people, pursuing open interoperability of security solutions, leverage these tools to further enhance their security operations across heterogeneous solutions.”
— Mark Mastrangeli, Lead Architect, McAfee, and Co-Chair – Open Cybersecurity Alliance

“The future of cybersecurity automation is in analyst augmentation and platform interoperability. Kestrel embodies both of these traits, enabling SOC analysts to hunt threats at scale using a standardized language. Cydarm is pleased to see this project included as an OCA capability.”
— Dr. Vaughan Shanks, CEO, Cydarm Technologies

“We are proud to support the continued refinement of this standard language. It further builds confidence with the threat intelligence community and enables a true collective defense,” said Avkash Kathiriya, Vice President of Research and Innovation at Cyware. “As a part of the community, Cyware understands how valuable the standard is, which is just one of the reasons we use it as a backbone for intel sharing and automation.”

“It’s good to see additional capabilities being built upon STIX. The Kestrel project is a great example of how the community can develop normalised methods, in this case, a threat hunting language, to easily interact with the growing security technology landscape.“
— Tyler Oliver, XDR Product Manager at EclecticIQ

“Robust threat hunting is a function of data correlation and contextual analysis. For transforming threat discoveries into actionable threat intelligence at-scale, the organizations need a powerful language to communicate the threat hunting tasks and operations, and we believe that Kestrel is an answer to that.”
— Renuka Nadkarni, VP and CTO Security, F5 Inc.

“To meet today’s increasing threats requires tools to help defenders share both between people/organizations and between products. OCA helps with vendor-agnostic, machine-speed cyber-defense automation. The new Kestrel project is a welcome addition to that toolset to assist with sharing in threat hunting.”
— Duncan Sparrell, Chief Cyber Curmudgeon, sFractal Consulting

“ThreatQuotient is pleased to continue its partnership with the Open Cybersecurity Alliance to help drive standards to encourage interoperability between security vendors to benefit network defenders,” said Haig Colter, Director of Alliances. “Our continued participation in the OCA demonstrates our commitment to follow established standards that encourage the communication of security information in ways that benefit a broader audience.”

The OCA is led by organizations committed to solving the costly problem of siloed cyber tools and products that create integration nightmares for cybersecurity professionals in every environment. CyberNB, Rapid7, SafeBreach, and Tenable have recently joined the governing board working alongside Center for Internet Security (CIS), Cybereason, Cydarm, Cyware, EclecticIQ, EPRI, F5, IBM Security, McAfee, NewContext, S-Fractal Consulting, SAIC, ThreatQuotient, Tripwire, and TruSTAR.

OCA technologies work together to deliver more value and improve product interoperability across security tools and teams – for example, Kestrel utilizes STIX-Shifter to unify threat hunting experience across different security tools. To learn more about the other OCA technologies that are available to help security teams connect their security tools and data, please visit: https://github.com/opencybersecurityalliance.

More Support for OCA

“Kestrel is about to change the way we approach threat hunting, instead of continuously rebuilding our analysis Kestrel allows us to ask what patterns or what behaviours are present during an investigation. Instead of dissecting indicators of compromise, we will be dissecting playbooks of entire hunt logic and across data sources. As adoption of the language continues to roll out, our collective hunt teams will be able to collaborate and approach cyber investigations differently – as a leader in bringing cyber collectives together to solve problems CyberNB welcomes the innovative thinking of IBM Security.”
— Sheldon Shaw, Vice President, Innovation & Infrastructure, CyberNB

“For threat hunting, Kestrel fills a critical need of a common language to express data and share insights. Combining Kestrel with predictive data sources will make threat hunting far more powerful and empower security teams to drive down the risks that matter. SafeBreach is excited to be the first predictive data source that will enable querying future threats”.
— Valeriy Leykin, Director Product Management at SafeBreach

The OCA is actively seeking additional contributors from across the security industry to help guide and drive innovative new use cases for these open-source projects.

About the Open Cybersecurity Alliance

The Open Cybersecurity Alliance brings together vendors and end-users to create an open cybersecurity ecosystem where products can freely exchange information, insights, analytics, and orchestrated response. OCA supports commonly developed code and tooling and the use of mutually agreed upon technologies, data standards, and procedures. The OCA is governed under the auspices of OASIS, which offers projects a path to standardization and de jure approval for reference in international policy and procurement.

Contact information:
Dee Schur,
Senior Manager, Development & Advocacy, OASIS Open
dee.schur@oasis-open.org
+1 941-321-6733