4 ms·
From the protocol the community and organization needs to be defined by the source of the information. If not, then it cannot be shared without request from the
by yohannparis 1y ago
From the protocol the community and organization needs to be defined by the source of the information. If not, then it cannot be shared without request from the source. They even have example for those situations.
- woodruffw 1y agoIt's not clear to me that I'm not able to meaningfully define these things, or that I'm even remotely unique in being unable to!
- MattSayar 1y agoIn practice, "organization" usually means your company or business. "The community" usually means an Information Sharing and Analysis Center (ISAC) aka a group of similar orgs that share information with each other; think financial services companies in the US, or energy companies in Japan.
- woodruffw 1y agoOkay, maybe I'm just not the target audience for this. I didn't know what an ISAC was, but I've seen plenty of TLP markers on open source disclosures where it was exceedingly unclear what a "community" meant w/r/t appropriate sharing.
- MattSayar 1y agoYeah, in the cybersecurity space it's a lot more prevalent. TLP:CLEAR, if you will.
- tptacek 1y agoHe's a security practitioner.
- tptacek 1y agoYou know what an ISAC is. It's a meetup of beardy mid-level security managers from huge companies.
- woodruffw 1y agoI'll save myself some embarrassment and say that I just didn't know that ISAC was the collective noun for that :-)
- integralid 1y agoIf you see something publicly it's TLP:White (or clear, since it was changed for weird readons) by definition. But yeah it's a term specific to it security, where it's usually well understood what TLP:Amber and TLP:Red means. I agree TLP:Green is a bit more fuzzy, and the intention is often basically "share with trusted parties but don't post publicly".
- sxzygz 1y agoSince you’re being abstruse, consider information by definition is in possession by an entity (or rephrased a property of a system). For that information to move the system needs to be brought into contact with another system, and it is the nature of this contact that is being policed. If information doesn’t have an ambient system that is discernible then there is no distinction to be made if its sensitivity—it may as well be noise.
- woodruffw 1y ago...what?
- MeetingsBrowser 1y agousing the word abstruse is abstruse