Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

The use of both object and granular markings on the same object is ambiguous in the spec #302

Open
rpiazza opened this issue Dec 16, 2022 · 0 comments

Comments

@rpiazza
Copy link
Contributor

rpiazza commented Dec 16, 2022

When granular markings are provided, does the object marking represent:

  • The "high level" marking for the object. This would be similar to saying a document is "secret", but it also contains paragraphs that are unclassified. For a STIX object, it would be the highest level of the available granular markings
  • The default marking for the object. All properties have the default marking, except ones mentioned in the granular markings, which could be at a higher (or lower) level.

Whichever is chosen, it would probably make sense to have an object marking for every type of marking definition used in the object (i.e., a SHOULD). If one is not provided, the it should be interpreted as the non-granular marking properties are unmarked within that marking definition type.

The "levels" are only significant for the same data marking type. For instance, an object marking could be TLP:GREEN, and a granular marking for a property could be a statement about terms of use. In that case, the markings are independent. However, we should probably make it clear whether a TLP object marking applies to all properties, if any granular marking for a property does not also specify a TLP marking.

Also using different marking types for the same object/property - do all apply (AND) or just the one the consumer cares about (OR). If it can be either or both, how to do it would need to be added to the spec.

But in general, how to interpret a set of markings of different data marking types will remain beyond the scope of the spec.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants