>> Now, let's move to the third type of standards,
which is transport standards and protocol.
We will start with the first standard, which is TLP.
TLP stands for traffic light protocol,
and it is a simple protocol used to label
sensitive information to ensure that
only the correct audience is given access to it.
Shared information is tagged
>> with one of the four colors,
>> red, amber, green, or white.
Red means that only to be used by you and
not to be spread to other people,
>> even within your own organization.
>> Amber means that this information is to
be used and shared with your coworkers
within your organization on a need-to-know basis
>> and with your clients or
>> customers who need to know this information to
protect themselves and prevent further damage.
Green means that this information is not very sensitive
>> and can be shared with your partners or peers,
>> but not via publicly accessible channels;
>> example, websites.
>> White means that this information
is public and can be shared freely,
taking into account standard copyright rules.
The second standard from the same category is TAXII.
TAXII stands for
Trusted Automated Exchange of Indicator Information.
The first draft was proposed in 2012
>> and the current version is 2.0.
>> TAXII is also introduced by MITRE and now,
>> maintained by OASIS.
TAXII is an application protocol for
exchanging threat intelligence over HTTPS.
It defines a RESTful API and
a set of requirements for TAXII clients and servers.
TAXII was specifically designed to support
exchange of threat intelligence
represented in STIX format,
and support of exchanging STIX 2.0 content
>> is mandatory to implement.
>> TAXII design principles include
minimizing operational changes needed for adoption,
easy integration with existing sharing agreements,
and support for all widely used threat sharing models,
including hub-and-spoke,
peer-to-peer, and source-subscriber.
We've seen previously two examples
of threat feeds aggregators,
Limo and Anomali TAXII.
These are also called free TAXII servers.
In this slide, we took the example of Limo,
which is compatible with TAXII 2 and STIX 2.
You can directly enable it through implementing
STAXX machine in your environment
or use it over a TAXII client.
The list of standards that we've learned in this video
doesn't include all the standards
available on the market.
There are others that were not mentioned here.
My choice was based on my experience,
>> and to my opinion, the MITRE pile,
>> including Cybox, STIX, and TAXII,
is widely supported by
several free and paid security products.
Let me ask you this question.
Can you survive without these standards?
My answer is, of course you can.
Applying these standards is nice to have,
but you can survive with just sorting your intelligence
in flat files and sharing it by email
>> or any other mean.
>> However, if you are thinking about
long-term usage of indicators,
then using these standards will make your life easier,
especially for indexing, querying, and sharing.
I hope you enjoyed this lesson.
In the next video, we will see
together important part of data processing phase,
which is integration and storage.