The challenge of creating productive collaborating information assurance communities via Internet research and standards

Abstract

Overviews the challenging 5-year process leading to the design, specification, and implementation of the Internet, Engineering Task Force (IETF) Intrusion Detection Working Group (IDWQ) Intrusion Exchange Protocol (IDXP). IDXP seeks to facilitate the ubiquitous interoperability of intrusion detection components across Internet enterprises. This capability is a critical enabler of successful intrusion detection for large networks. The IETF IDWG was inspired by the DARPA CIDF activity. IDXP was developed and demonstrated in recent IETF meetings and in the IEEE DISCEX (DARPA Information Survivability Conference and EXposition). In the future, we intend to incorporate event correlation into IDXP. The process of achieving technical and organizational consensus among the segmented communities that comprise the information assurance community has been exceedingly challenging. The paper addresses the driving factors for this situation, and analyses the reasons for the ultimate community success in getting the process on the road. It is hoped that this experience would be useful in other technical disciplines facing large collaborative challenges within large secure distributed environments.