4 ms·

I've always found TLP confusing: it's not really clear (despite definition) what a community or organization is, which means that there's no clear decision proc

I've always found TLP confusing: it's not really clear (despite definition) what a community or organization is, which means that there's no clear decision procedure for determining whether a degree of access has been violated. In my experience doing security embargos/disclosures, it's a lot easier to just explicitly enumerate the set of people/organizational entities who should be given access to non-public information.

yohannparis 1y ago
From the protocol the community and organization needs to be defined by the source of the information. If not, then it cannot be shared without request from the source. They even have example for those situations.
- woodruffw 1y ago
  It's not clear to me that I'm not able to meaningfully define these things, or that I'm even remotely unique in being unable to!
  - MattSayar 1y ago
    In practice, "organization" usually means your company or business. "The community" usually means an Information Sharing and Analysis Center (ISAC) aka a group of similar orgs that share information with each other; think financial services companies in the US, or energy companies in Japan.
    - woodruffw 1y ago
      Okay, maybe I'm just not the target audience for this. I didn't know what an ISAC was, but I've seen plenty of TLP markers on open source disclosures where it was exceedingly unclear what a "community" meant w/r/t appropriate sharing.
      - MattSayar 1y ago
        Yeah, in the cybersecurity space it's a lot more prevalent. TLP:CLEAR, if you will.
        tptacek 1y ago
        He's a security practitioner.
      - tptacek 1y ago
        You know what an ISAC is. It's a meetup of beardy mid-level security managers from huge companies.
        woodruffw 1y ago
        I'll save myself some embarrassment and say that I just didn't know that ISAC was the collective noun for that :-)
      - integralid 1y ago
        If you see something publicly it's TLP:White (or clear, since it was changed for weird readons) by definition. But yeah it's a term specific to it security, where it's usually well understood what TLP:Amber and TLP:Red means. I agree TLP:Green is a bit more fuzzy, and the intention is often basically "share with trusted parties but don't post publicly".
  - sxzygz 1y ago
    Since you’re being abstruse, consider information by definition is in possession by an entity (or rephrased a property of a system). For that information to move the system needs to be brought into contact with another system, and it is the nature of this contact that is being policed. If information doesn’t have an ambient system that is discernible then there is no distinction to be made if its sensitivity—it may as well be noise.
    - woodruffw 1y ago
      ...what?
    - MeetingsBrowser 1y ago
      using the word abstruse is abstruse
seanhunter 1y ago
> it's not really clear (despite definition) what a community or organization is To make the parent’s point more obvious for people who are not used to a large enterprise context, concretely for example, at my workplace (which I would consider typical of a large organization) there are: 1) Regular employees and contractors who are employed by the main employer. 2) Employees who work for different legal entities from the main employer, have different sso domains handling their auth (and email domains for systems that do sharing protections via email) but are “really” part of the same company for security purposes. Think say people who came in as part of a merger but for various reasons their legal entity and brand needs to stick around so they have different auth, email etc. 3) People who work for actually different companies, have the same sso domains handling handling their auth and the same email domain as people in bucket 1 because we’ve given them logins and are working on sensitive security stuff (think: vendors and vendor contractors in the security or legal space) 4) People who work for actually different companies, have the same sso domains etc as bucket 1 and are not working on sensitive security stuff (think: vendors and vendor contractors everywhere else) …and people sometimes move between groups 3 and 4 on a project by project basis. Notice all of these are “bound by common policies set by the organization” so all of them are in the “organization” for TLP at least by the second part of the definition, but 2,3 and 4 but don’t share a common affiliation by formal membership so are not part of the “organization” for the first half of the TLP definition. So if I get a TLP:Amber document, who am I allowed to share it to? I should be sharing it to some of 1, 2 and 3 on a need to know basis. Most automated permission systems will allow me only to share it easily only with people in 1 and 3 or 4, and since people can move between 3 & 4 based on assignment it’s hard to know (and pretty much impossible to tell automatically) if some degree of access violation has occurred. People in 2 are generally sool if we’re trying to share things and I’m not prepared to handwave through the scary-looking “are you sure you want to share this with person x who isn’t from our org?” Boxes. Basically explicit enumeration is just going to be way better any time you want to be doing this type of thing in the real world.

yohannparis 1y ago

From the protocol the community and organization needs to be defined by the source of the information. If not, then it cannot be shared without request from the source. They even have example for those situations.

woodruffw 1y ago
It's not clear to me that I'm not able to meaningfully define these things, or that I'm even remotely unique in being unable to!
- MattSayar 1y ago
  In practice, "organization" usually means your company or business. "The community" usually means an Information Sharing and Analysis Center (ISAC) aka a group of similar orgs that share information with each other; think financial services companies in the US, or energy companies in Japan.
  - woodruffw 1y ago
    Okay, maybe I'm just not the target audience for this. I didn't know what an ISAC was, but I've seen plenty of TLP markers on open source disclosures where it was exceedingly unclear what a "community" meant w/r/t appropriate sharing.
    - MattSayar 1y ago
      Yeah, in the cybersecurity space it's a lot more prevalent. TLP:CLEAR, if you will.
      - tptacek 1y ago
        He's a security practitioner.
    - tptacek 1y ago
      You know what an ISAC is. It's a meetup of beardy mid-level security managers from huge companies.
      - woodruffw 1y ago
        I'll save myself some embarrassment and say that I just didn't know that ISAC was the collective noun for that :-)
    - integralid 1y ago
      If you see something publicly it's TLP:White (or clear, since it was changed for weird readons) by definition. But yeah it's a term specific to it security, where it's usually well understood what TLP:Amber and TLP:Red means. I agree TLP:Green is a bit more fuzzy, and the intention is often basically "share with trusted parties but don't post publicly".
- sxzygz 1y ago
  Since you’re being abstruse, consider information by definition is in possession by an entity (or rephrased a property of a system). For that information to move the system needs to be brought into contact with another system, and it is the nature of this contact that is being policed. If information doesn’t have an ambient system that is discernible then there is no distinction to be made if its sensitivity—it may as well be noise.
  - woodruffw 1y ago
    ...what?
  - MeetingsBrowser 1y ago
    using the word abstruse is abstruse

seanhunter 1y ago

> it's not really clear (despite definition) what a community or organization is To make the parent’s point more obvious for people who are not used to a large enterprise context, concretely for example, at my workplace (which I would consider typical of a large organization) there are: 1) Regular employees and contractors who are employed by the main employer. 2) Employees who work for different legal entities from the main employer, have different sso domains handling their auth (and email domains for systems that do sharing protections via email) but are “really” part of the same company for security purposes. Think say people who came in as part of a merger but for various reasons their legal entity and brand needs to stick around so they have different auth, email etc. 3) People who work for actually different companies, have the same sso domains handling handling their auth and the same email domain as people in bucket 1 because we’ve given them logins and are working on sensitive security stuff (think: vendors and vendor contractors in the security or legal space) 4) People who work for actually different companies, have the same sso domains etc as bucket 1 and are not working on sensitive security stuff (think: vendors and vendor contractors everywhere else) …and people sometimes move between groups 3 and 4 on a project by project basis. Notice all of these are “bound by common policies set by the organization” so all of them are in the “organization” for TLP at least by the second part of the definition, but 2,3 and 4 but don’t share a common affiliation by formal membership so are not part of the “organization” for the first half of the TLP definition. So if I get a TLP:Amber document, who am I allowed to share it to? I should be sharing it to some of 1, 2 and 3 on a need to know basis. Most automated permission systems will allow me only to share it easily only with people in 1 and 3 or 4, and since people can move between 3 & 4 based on assignment it’s hard to know (and pretty much impossible to tell automatically) if some degree of access violation has occurred. People in 2 are generally sool if we’re trying to share things and I’m not prepared to handwave through the scary-looking “are you sure you want to share this with person x who isn’t from our org?” Boxes. Basically explicit enumeration is just going to be way better any time you want to be doing this type of thing in the real world.