Real-time Inter-network Defense (RID)

Abstract

Security incidents, such as system compromises, worms, viruses, phishing incidents, and denial of service, typically result in the loss of service, data, and resources both human and system. Service providers and Computer Security Incident Response Teams need to be equipped and ready to assist in communicating and tracing security incidents with tools and procedures in place before the occurrence of an attack. Real-time Inter-network Defense (RID) outlines a proactive inter-network communication method to facilitate sharing incident-handling data while integrating existing detection, tracing, source identification, and mitigation mechanisms for a complete incident-handling solution. Combining these capabilities in a communication system provides a way to achieve higher security levels on networks. Policy guidelines for handling incidents are recommended and can be agreed upon by a consortium using the security recommendations and considerations. This document obsoletes RFC 6045. Status of This Memo This is an Internet Standards Track document. This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). Further information on Internet Standards is available in Section 2 of RFC 5741. Information about the current status of this document, any errata, and how to provide feedback on it may be obtained at http://www.rfc-editor.org/info/rfc6545.

Coordinating Attack Response at Internet Scale (CARIS) Workshop Report

“…Real-time Inter-network Defense (RID) [RFC6545] was published 5 years ago. While the patterns established in RID still show promise, there are updated solutions being worked on.…”

The Incident Object Description Exchange Format Version 2

“…The use of a standardized security protocol is encouraged. The Real-time Internetwork Defense (RID) protocol [RFC6545] and its associated transport binding IODEF/RID over HTTP/TLS [RFC6546] provide such security.…”

Transport of Real-time Inter-network Defense (RID) Messages over HTTP/TLS

“…This section specifies the details of the transport of RID messages [RFC6545] over HTTP/TLS. In this arrangement, each RID server is both an HTTP/TLS server and an HTTP/TLS client.…”

“…Additional general information on the use of PKI with RID systems is detailed in Section 9.3 of [RFC6545].…”

“…However, Real-time Inter-network Defense (RID) [RFC6545] does require a specification of a protocol to ensure interoperability among members in a RID consortium. This document specifies the transport of RID messages within HTTP [RFC2616] Request and Response messages over TLS [RFC5246] (herein, HTTP/TLS).…”