TOSCA Simple Profile in YAML v1.3 OASIS Standard published

OASIS is pleased to announce the publication of its newest OASIS Standard, approved by the members on 26 February 2020:

TOSCA Simple Profile in YAML Version 1.3
OASIS Standard
26 February 2020

The TOSCA TC works to enhance the portability and operational management of cloud applications and services across their entire lifecycle.

YAML is a human friendly data serialization standard with a syntax much easier to read and edit than XML. The TOSCA Simple Profile in YAML specifies a rendering of TOSCA which aims to provide a more accessible syntax as well as a more concise and incremental expressiveness of the TOSCA DSL (Domain Specific Language) in order to minimize the learning curve and speed the adoption of the use of TOSCA to portably describe cloud applications.

The prose specifications and related files are available here:

PDF (Authoritative):
https://docs.oasis-open.org/tosca/TOSCA-Simple-Profile-YAML/v1.3/os/TOSCA-Simple-Profile-YAML-v1.3-os.pdf

HTML:
https://docs.oasis-open.org/tosca/TOSCA-Simple-Profile-YAML/v1.3/os/TOSCA-Simple-Profile-YAML-v1.3-os.html

Editable source:
https://docs.oasis-open.org/tosca/TOSCA-Simple-Profile-YAML/v1.3/os/TOSCA-Simple-Profile-YAML-v1.3-os.docx

Distribution ZIP file

For your convenience, OASIS provides a complete package of the prose specification and related files in a ZIP distribution file. You can download the ZIP file here:

https://docs.oasis-open.org/tosca/TOSCA-Simple-Profile-YAML/v1.3/os/TOSCA-Simple-Profile-YAML-v1.3-os.zip

Our congratulations to the members of the OASIS Topology and Orchestration Specification for Cloud Applications (TOSCA) TC on achieving this milestone.

#TOSCA Simple Profile in YAML Version 1.3 is approved as an OASIS Standard

OASIS is pleased to announce that the call for consent has closed [1] and, effective 26 February 2020, TOSCA Simple Profile in YAML Version 1.3 is an OASIS Standard. TC Administration will now undertake the final tasks of preparing and loading the standard.

The ballot was held under the OASIS call for consent procedure [2]. In the ballot, the Candidate OASIS Standard received 7 affirmative consents and no objections.

Our congratulations to the members of the TC and to the community of implementers, developers and users who have brought the work successfully to this milestone

=== Additional information

[1] Ballot:
https://www.oasis-open.org/committees/ballot.php?id=3476

[2] https://www.oasis-open.org/policies-guidelines/tc-process-2017-05-26#OScallForConsent

Invitation to comment on STIX v2.1 from the CTI TC – ends March 11th

We are pleased to announce that STIX Version 2.1 CSPRD03 from the OASIS Cyber Threat Intelligence (CTI) TC [1] is now available for public review and comment.

Structured Threat Information Expression (STIX) is a language and serialization format used to exchange cyber threat intelligence. STIX enables organizations and tools to share threat intelligence with one another in a way that improves many different capabilities, such as collaborative threat analysis, automated threat exchange, automated detection and response, and more.

STIX v2.1 adds new objects and concepts and incorporates improvements based on experience implementing Version 2.0. The objects and features added for inclusion represent an iterative approach to fulfilling basic consumer and producer requirements for CTI sharing. Objects and properties not included in this version of STIX, but deemed necessary by the community, will be included in future releases.

The documents and related files are available here:

STIX Version 2.1
Committee Specification Draft 04 / Public Review Draft 03
20 February 2020

Editable source (Authoritative):
https://docs.oasis-open.org/cti/stix/v2.1/csprd03/stix-v2.1-csprd03.docx
HTML:
https://docs.oasis-open.org/cti/stix/v2.1/csprd03/stix-v2.1-csprd03.html
PDF:
https://docs.oasis-open.org/cti/stix/v2.1/csprd03/stix-v2.1-csprd03.pdf

For your convenience, OASIS provides a complete package of the prose specification and related files in a ZIP distribution file. You can download the ZIP file at:
https://docs.oasis-open.org/cti/stix/v2.1/csprd03/stix-v2.1-csprd03.zip

How to Provide Feedback

OASIS and the CTI TC value your feedback. We solicit feedback from potential users, developers and others, whether OASIS members or not, for the sake of improving the interoperability and quality of its technical work.

This public review starts 26 February 2020 at 00:00 UTC and ends 11 March 2020 at 11:59 UTC.

This specification was previously submitted for public review [2]. This 15-day review is limited in scope to changes made from the previous reviews. Changes are highlighted in a red-lined DIFF file included in the package [3].

Comments on the work may be submitted to the TC by following the instructions located at:
https://www.oasis-open.org/committees/comments/form.php?wg_abbrev=cti

Feedback submitted by TC non-members for this work and for other work of this TC is publicly archived and can be viewed at:
https://lists.oasis-open.org/archives/cti-comment/

All comments submitted to OASIS are subject to the OASIS Feedback License, which ensures that the feedback you provide carries the same obligations at least as the obligations of the TC members. In connection with the public review of these works, we call your attention to the OASIS IPR Policy [4] applicable especially [5] to the work of this technical committee. All members of the TC should be familiar with this document, which may create obligations regarding the disclosure and availability of a member’s patent, copyright, trademark and license rights that read on an approved OASIS specification.

OASIS invites any persons who know of any such claims to disclose these if they may be essential to the implementation of the above specification, so that notice of them may be posted to the notice page for this TC’s work.

Additional information about this specification and the TC may be found on the TC’s public home page.

========== Additional references:

[1] OASIS Cyber Threat Intelligence (CTI) TC
https://www.oasis-open.org/committees/cti/

[2] Previous public reviews:
– 30-day public review, 14 August 2019:
https://lists.oasis-open.org/archives/members/201908/msg00008.html
– Comment resolution log:
https://docs.oasis-open.org/cti/stix/v2.1/csprd01/stix-v2.1-csprd01-comment-resolution-log.xlsx

– 15-day public review, 09 December 2019:
https://lists.oasis-open.org/archives/cti/201912/msg00001.html
– Comment resolution log:
https://docs.oasis-open.org/cti/stix/v2.1/csprd03/stix-v2.1-csprd03-comment-resolution-log.txt

[3] Red-lined version:
https://docs.oasis-open.org/cti/stix/v2.1/csprd03/stix-v2.1-csprd03-DIFF.pdf

[4] https://www.oasis-open.org/policies-guidelines/ipr

[5] https://www.oasis-open.org/committees/cti/ipr.php
https://www.oasis-open.org/policies-guidelines/ipr#Non-Assertion-Mode
Non-Assertion Mode

Open Cybersecurity Alliance Unveils First Open Source Language to Connect Security Tools

  • OpenDXL Ontology enables automatic integration and communication between disparate security technologies via open source standard and code
  • Leaders from AT&T, IBM, McAfee, Packet Clearinghouse, Tripwire join OCA’s Technical Steering Committee

February 24, 2020, San Francisco, CA – The Open Cybersecurity Alliance (OCA) today announced the availability of OpenDXL Ontology, the first open source language for connecting cybersecurity tools through a common messaging framework. With open source code freely available to the security community, OpenDXL Ontology enables any tool to automatically gain the ability to communicate and interoperate with all other technologies using this language. By eliminating the need for custom integrations between individual products, this release marks a major milestone in the OCA’s mission to drive greater interoperability across the security industry. The newly formed Open Cybersecurity Alliance was launched in October 2019 to connect the fragmented cybersecurity landscape with common, open source code and practices that allow companies to “integrate once, reuse everywhere.” Governed under the auspices of OASIS, the OCA now includes more than 25 member organizations and has brought two major interoperability projects into the open-source realm, with OpenDXL Ontology (contributed by McAfee) and STIX Shifter (contributed by IBM Security) now available for cross-industry collaboration and development on GitHub. In addition to the availability of OpenDXL Ontology, the OCA is also announcing the formation of its Technical Steering Committee, including leaders from AT&T, IBM Security, McAfee, Packet Clearinghouse, and Tripwire, who will drive the technical direction and development of the organization. “With the adoption of public cloud and explosion of connected devices, the ability for enterprises to quickly respond to threats across ever-changing technologies, and even beyond perimeters, is critical,” says Brian Rexroad, Vice President of Security Platforms at AT&T. “OCA is driving an industrial shift in interoperability with the OpenDXL Ontology to support security at scale.” Open Source Language Schema to Connect Security Tools The Open Data Exchange Layer (OpenDXL) is an open messaging framework that over 4,100 vendors and enterprises already utilize to develop and share integrations with other tools. The release of the OpenDXL Ontology now offers a single, common language for these notifications, information and actions across security products that any vendor can adopt in order to communicate in a standard way with all other tools under this umbrella. This provides companies with a set of tooling that can be applied once and automatically reused everywhere across all product categories, while also eliminating the need to update integrations as product versions and functionalities change. For example, if a certain tool detects a compromised device, it could automatically notify all other tools and even quarantine that device using a standard message format readable by all. While previously this was only possible with custom integrations between individual products, it will now be automatically enabled between all tools that adopt OpenDXL Ontology. Through continued development by the community, this common language will facilitate a wide variety of interoperability use cases, from sharing threat intelligence to triggering remediation between tools, such as isolating a device or updating a policy. The adoption of OpenDXL Ontology will help create a stronger, united front to defend and protect across all types of security tools, while reducing the burden of point integrations between individual products. OCA Momentum: 25+ Organizations Join Forces for Open Security Since launching five months ago, the OCA has expanded to include more than 25 partner organizations, with the following new members joining: Armis, Center for Internet Security, CyberNB, Cydarm, Gigamon, Raytheon, Recorded Future, sFractal Consulting, and Tripwire. The full list of members can be found here. The OCA community is currently collaborating on GitHub and Slack to further new open-source code and use-cases for cybersecurity industry interoperability. In addition to the development of OpenDXL Ontology for a common, open-source language between tools, the OCA is also continuing to build out capabilities for STIX-Shifter, a universal, out-of-the box search capability for security products of all types. Since bringing STIX Shifter to the open-source community, hundreds of visitors have accessed this technology on GitHub, with dozens of users initiating new project forks for development on top of the primary STIX Shifter code. The OCA will continue development for both STIX Shifter and OpenDXL Ontology, and is actively seeking additional contributors from across the security industry to help guide and drive innovative new use cases for these open source projects. Visit https://opencybersecurityalliance.org to learn more about the Open Security Alliance and get involved in the projects that are currently underway. About the Open Cybersecurity Alliance The Open Cybersecurity Alliance (OCA) brings together vendors and end users to create an open cybersecurity ecosystem where products can freely exchange information, insights, analytics, and orchestrated response. OCA supports commonly developed code and tooling and the use of mutually agreed upon technologies, data standards, and procedures. The OCA is governed under the auspices of OASIS, which offers projects a path to standardization and de jure approval for reference in international policy and procurement. Media Contact: Cathy Morley Foster Public Relations, Open Cybersecurity Alliance cathy.morleyfoster@gmail.com (925) 708-7893 Carol Geyer Chief Development Officer Open Source and Standards Communities OASIS carol.geyer@oasis-open.org (941) 284-0403

Interoperability Between Leading Key Management Vendors Demonstrates Continued Strength of OASIS KMIP Standard at RSA 2020

24 Feb 2020 — Members of the OASIS international consortium are collaborating to provide live multi-vendor interoperability demonstrations featuring one of the industry’s most widely-adopted security standards, the Key Management Interoperability Protocol (KMIP).

“The OASIS KMIP Technical Committee is continuing to develop and release well tested versions of the standard to cater for new and changing requirements and this year’s demonstration event again showcases that effort,” said Tony Cox of Cryptsoft, co-chair of the OASIS KMIP Technical Committee and Lead for the KMIP Interop event.

“2019 saw the publication of KMIP v2.0, which provided a major update to KMIP capabilities, and the definition and the development of KMIP 2.1. Tested as part of this KMIP interop event, KMIP 2.1 brings a suite of new security object management features including many focused on enhancing administration of cloud and IoT security deployments,” said Judy Furlong of Dell, co-chair of the OASIS KMIP Technical Committee.

This year, five members of the OASIS KMIP TC are providing demonstrations of KMIP v2.0 and KMIP v2.1 during the RSA Conference 2020 Expo. This demonstration allows RSA visitors to the OASIS booth to interact with multiple vendors demonstrating interchange of security objects as well as provision of encryption keys and cryptographic services across a common interface. OASIS KMIP Technical Committee members, Cryptsoft, Fortanix, PrimeKey, QuintessenceLabs and Utimaco are demonstrating the full key management lifecycle including creating, registering, locating, retrieving, deleting, and transferring symmetric and asymmetric keys and certificates among vendor systems.

Support for KMIP

Cryptsoft CTO, Tim Hudson, said, “This year’s KMIP Interoperability Event has enabled demonstration of the latest capabilities added to the latest version of the standard. As a major OEM technology supplier, supplying standards-based solutions ensures interoperability is a reality for our customers and this event is the proof each year. KMIP 2.0 and KMIP 2.1 allow solutions for unified key management and hardware security modules that meet the demands of enterprise, financials, cloud and IoT deployments.”

IBM Product Management, Encryption and Key Management, Rick Robinson, said, “The development and adoption of standards, especially KMIP, are critical to customer success in pursuit of their data protection and security strategy. On behalf of our customers, IBM continues to bring our leadership in data protection and cryptography to the development of this important, global standard.”

Fortanix CTO, Anand Kashyap, said, “Digital business transformation is built on a foundation of digital trust. Cryptography and key management are critical to securing sensitive data in a world where data moves between cloud environments. Fortanix believes that open interoperability standards and REST APIs are critical to make data security pervasive. KMIP is a foundational standard that is essential to expanding the use of encryption and key management. Fortanix is proud to support and integrate with the OASIS KMIP standard.”

QuintessenceLabs CTO, John Leiseboer, said, “Interoperability greatly benefits our customers and empowers them in controlling their organization’s security. QuintessenceLabs has been involved with OASIS and the KMIP Technical Committee since the start, and we are proud to ensure that each of our products is fully compliant via rigorous testing.”

More information
https://www.oasis-open.org/committees/kmip

About OASIS

One of the most respected, member-driven standards bodies in the world, OASIS offers projects a path to standardization and de jure approval for reference in international policy and procurement. OASIS has a broad technical agenda encompassing cryptography, cybersecurity, privacy, cloud computing, IoT, blockchain, and other areas. OASIS members can be found in 100+ countries on virtually every continent. Major multinational companies, SMEs, government agencies, universities, research institutions, consulting groups, and individuals are represented.

Media inquiries: communications@oasis-open.org; +1.941.284.0403

XACML v3.0 Time Extensions Version 1.0 from XACML TC approved as a Committee Specification

OASIS is pleased to announce that XACML v3.0 Time Extensions Version 1.0 from the OASIS eXtensible Access Control Markup Language (XACML) TC [1] has been approved as an OASIS Committee Specification.

The time functions defined by the eXtensible Access Control Markup Language (XACML) Version 3.0 core specification have limited utility when used in widely distributed and replicated environments where times are presented with various, different time zones. In the most general case, the location of an XACML service that evaluates a request is unpredictable and uncontrollable by clients and changes from one request to the next.

This profile defines XACML functions for comparing time values that are not sensitive to the time zone chosen for those values. It defines functions for performing arithmetic on date and time values and defines a data-type for representing the day of the week along with functions to operate on values of the data-type.

This Committee Specification is an OASIS deliverable, completed and approved by the TC and fully ready for testing and implementation.

The prose specifications and related files are available here:

XACML v3.0 Time Extensions Version 1.0
Committee Specification 01
13 February 2020

Editable source (Authoritative):
https://docs.oasis-open.org/xacml/xacml-3.0-time-extensions/v1.0/cs01/xacml-3.0-time-extensions-v1.0-cs01.docx
HTML:
https://docs.oasis-open.org/xacml/xacml-3.0-time-extensions/v1.0/cs01/xacml-3.0-time-extensions-v1.0-cs01.html
PDF:
https://docs.oasis-open.org/xacml/xacml-3.0-time-extensions/v1.0/cs01/xacml-3.0-time-extensions-v1.0-cs01.pdf

Distribution ZIP file
For your convenience, OASIS provides a complete package of the prose specification and related files in a ZIP distribution file. You can download the ZIP file here:
https://docs.oasis-open.org/xacml/xacml-3.0-time-extensions/v1.0/cs01/xacml-3.0-time-extensions-v1.0-cs01.zip

Members of the XACML TC [1] approved this specification by Special Majority Vote. The specification had been released for public review as required by the TC Process [2]. The vote to approve as a Committee Specification passed [3], and the document is now available online in the OASIS Library as referenced above.

Our congratulations to the TC on achieving this milestone and our thanks to the reviewers who provided feedback on the specification drafts to help improve the quality of the work.

========== Additional references:
[1] OASIS eXtensible Access Control Markup Language (XACML) TC
https://www.oasis-open.org/committees/xacml/

[2] Public review:
* 30-day public review, 04 December 2019:
https://lists.oasis-open.org/archives/xacml/201912/msg00000.html
– Comment resolution log:
https://docs.oasis-open.org/xacml/xacml-3.0-time-extensions/v1.0/csprd01/xacml-3.0-time-extensions-v1.0-csprd01-comment-resolution-log.docx

[3] Approval ballot:
https://www.oasis-open.org/committees/ballot.php?id=3475

U.S. Leaders Help Define International Standards for Sharing Economy

18 February 2020 — Whether it’s hailing a ride, booking a vacation house, buying new or used goods, contracting services, or downloading music, the sharing economy is redefining traditional business models. To support data exchange and trustworthiness in this expanding market, ISO–the International Organization for Standardization–has formed Technical Committee 324. This new group is defining a broad set of global standards for the sharing economy. The American National Standards Institute (ANSI) and the OASIS standards consortium have brought together leaders from the largest online platforms, innovative startups, technology companies, financial services providers, and nonprofits to represent American interests in this work as members of the U.S. Technical Advisory Group (TAG) to ISO/TC 324, Sharing Economy.

“We’re seeing a growing shift towards policy setting in the sharing economy. The ISO standards we’re defining now will play a key role in shaping those policies,” said Tim Hirsch of CaaStle, chair of the U.S. TAG. “Our work is going to have a profound impact across the market—on platform operators, service providers, and users.”

Focusing on five key market segments—transportation, staffing, lodging, retail, and media—ISO/TC 324 will address areas as varied as risk mitigation, asset protection, management, and resourcing. The initial phase of the work will focus on terminology and principles, and operationalizing sharing economy methodologies.

Microsoft‘s Stephanie Beers, vice chair of the U.S. TAG, observed, “The TAG has already effectively advocated for several issues important to our members. For example, we succeeded in changing ISO’s definition of the sharing economy to cover not only business-to-consumer but also business-to-business. We recognize the importance of not excluding groups that want guidance from these standards.”

“The majority of sharing economy pioneers are based in the U.S. We’re proud to have so many of these industry giants collaborating side-by-side with visionary technology and financial companies and providers of the latest platforms,” said Carol Geyer, chief development officer of OASIS. “All the U.S. TAG members should be applauded for their commitment to international collaboration, data safety, and the future of peer-to-peer computing.”

The next ISO/TC 324 plenary will be held in Saint-Denis, France, 22-24 June 2020.

Support from U.S. TAG members

eBay, in working with the U.S. TAG, is setting consistent practices and standards for sharing at a global ecommerce level which will result in even greater connected business opportunities and unprecedented benefits for consumers.” Sanjeev Katariya, Vice President and Chief Architect, eBay AI & Platforms

“The sharing economy will change every aspect of our lives from how we do business to how we interact with each other and our environment. The FinTech4Good team is looking forward to working with other TAG members to achieve Agenda 2030 through the sharing economy.” Xiaochen Zhang, President, FinTech4Good

Indiegogo is excited to partner with other industry leaders on this important initiative. Having international standards is key to collaborating globally, and we are excited to help progress a mutual understanding throughout the ecosystem.” Andy Yang, CEO, Indiegogo

“As the sharing economy is embraced by every demographic in the world, it is incumbent upon the sharing economy ecosystem to professionalize itself with standards that seek normalization, protections for workers and consumers, and encourage growth.” Jeremy Gottschalk, Founder and CEO, Marketplace Risk

“Trust is the bedrock of any successful partnership. Bringing together both public and private organizational experience in Sharing Economy/Collaborative eCommerce, spear-headed by ANSI and OASIS is a step in the right direction to ensure TRUST is the foundation. To ensure the future of work and the marketplace driven economy is not hijacked by business or political interests, defining these ethical and technological standards now, will help guide all participants in this burgeoning business model.” Adam Broadway, CEO, Near Me

“While sharing economy, blockchain and fintech may be new terms, they are quickly becoming the foundation for how organizations and individuals will work in the future. These are the technologies and functions we use in our Media Exchange to leverage unused cloud time, equipment and manpower for distributed productions that lower costs and improve quality.”” Joseph Maar, CEO, NECF Corporation

“Setting fair sharing economy standards will have a huge impact moving forward. Mass inequity in society has led to the proliferation of sharing economy businesses, but we as a committee need to be the voice for all stakeholders — from businesses, providers and consumers of these platforms.” Anitha Beberg, CEO, Seva Exchange

“The formation of this committee is tremendous recognition of the long-term viability of the global sharing economy. This international collaboration will be vital to the continued expansion of major sharing economy segments in emerging markets where on-demand entrepreneurs and the companies they represent require stronger protection to ensure growth, profitability, and customer satisfaction.” Tim Attia, CEO, Slice Labs

“The Gig Economy Group is pleased to participate in the working group to explore the important impact of the sharing economy on how we create a framework of engagement that works for the different stakeholders in the market with the rapid growth of the sharing economy.” Dave Toole, CEO and Chairman, The Gig Economy

Visit ISO’s website for information on U.S. TAG to ISO/TC 324.

About ANSI
The American National Standards Institute (ANSI) is a private non-profit organization whose mission is to enhance U.S. global competitiveness and the American quality of life by promoting, facilitating, and safeguarding the integrity of the voluntary standardization and conformity assessment system. Its membership is comprised of businesses, professional societies and trade associations, standards developers, government agencies, and consumer and labor organizations. The Institute represents and serves the diverse interests of more than 270,000 companies and organizations and 30 million professionals worldwide. ANSI is the official U.S. representative to the International Organization for Standardization (ISO) and, via the U.S. National Committee, the International Electrotechnical Commission (IEC). For more information, visit www.ansi.org.

About OASIS OASIS is one of the most respected, member-driven standards bodies in the world. It offers standards and open source projects a path to recognition in international policy and procurement. OASIS has a broad technical agenda encompassing the sharing economy, cybersecurity, privacy, cryptography, cloud computing, IoT, legal, emergency management, augmented reality, and more. OASIS members can be found in 100+ countries on virtually every continent. Major multinational companies, SMEs, government agencies, universities, research institutions, consulting groups, and individuals are represented.

Call for Consent for TOSCA Simple Profile in YAML Version 1.3 as OASIS Standard

The OASIS Topology and Orchestration Specification for Cloud Applications (TOSCA) TC members [1] have approved submitting the following Candidate OASIS Standard to the OASIS Membership in a call for consent for OASIS Standard:

TOSCA Simple Profile in YAML Version 1.3
Candidate OASIS Standard 01
24 November 2019

This is a call to the primary or alternate representatives of OASIS Organizational Members to consent or object to this approval. You are welcome to register your consent explicitly on the ballot; however, your consent is assumed unless you register an objection [2]. To register an objection, you must:

1. Indicate your objection on this ballot, and

2. Provide a reason for your objection and/or a proposed remedy to the TC.

You may provide the reason in the comment box or by email to the Technical Committee on its comment mailing list or, if you are a member of the TC, to the TC’s mailing list [3]. If you provide your reason by email, please indicate in the subject line that this is in regard to the Call for Consent.

This Committee Specification was approved by the Technical Committee and was submitted for the required 60-day public review [4]. All requirements of the OASIS TC Process having been met [5][6], the Candidate OASIS Standard is now submitted to the voting representatives of OASIS Organizational Members.

— Details —

The Call for Consent opens on 13 February 2020 at 00:00 UTC and closes on 26 February 2020 at 23:59 pm timezone. You can access the ballot at:

Internal link for voting members: https://www.oasis-open.org/apps/org/workgroup/voting/ballot.php?id=3476

Publicly visible link: https://www.oasis-open.org/committees/ballot.php?id=3476

OASIS members should ensure that their organization’s voting representative responds according to the organization’s wishes. If you do not know the name of your organization’s voting representative is, go to the My Account page at

http://www.oasis-open.org/members/user_tools

then click the link for your Company (at the top of the page) and review the list of users for the name designated as “Primary”.

— Information about the Candidate OASIS Standard and the TOSCA TC —

The TOSCA TC works to enhance the portability and operational management of cloud applications and services across their entire lifecycle.

YAML is a human-friendly data serialization standard with a syntax much easier to read and edit than XML. The TOSCA Simple Profile in YAML specifies a rendering of TOSCA which aims to provide a more accessible syntax as well as a more concise and incremental expressiveness of the TOSCA DSL (Domain Specific Language) in order to minimize the learning curve and speed the adoption of the use of TOSCA to portably describe cloud applications.

URIs
The prose specification document and related files are available here:

PDF (Authoritative):
https://docs.oasis-open.org/tosca/TOSCA-Simple-Profile-YAML/v1.3/cos01/TOSCA-Simple-Profile-YAML-v1.3-cos01.pdf

HTML:
https://docs.oasis-open.org/tosca/TOSCA-Simple-Profile-YAML/v1.3/cos01/TOSCA-Simple-Profile-YAML-v1.3-cos01.html

Editable source:
https://docs.oasis-open.org/tosca/TOSCA-Simple-Profile-YAML/v1.3/cos01/TOSCA-Simple-Profile-YAML-v1.3-cos01.docx

Distribution ZIP files:

For your convenience, OASIS provides a complete package of the prose specifications and related files in a ZIP distribution file. You can download the ZIP file here:

https://docs.oasis-open.org/tosca/TOSCA-Simple-Profile-YAML/v1.3/cos01/TOSCA-Simple-Profile-YAML-v1.3-cos01.zip

— Additional information —

[1] OASIS Topology and Orchestration Specification for Cloud Applications (TOSCA) TC
https://www.oasis-open.org/committees/tosca/

TC IPR page
https://www.oasis-open.org/committees/tosca/ipr.php

[2] https://www.oasis-open.org/policies-guidelines/tc-process-2017-05-26#OScallForConsent

[3] TOSCA comment mailing list: tosca-comment@lists.oasis-open.org
(You must be subscribed to send to this list. To subscribe, see https://www.oasis-open.org/committees/comments/index.php?wg_abbrev=tosca.)

TOSCA main mailing list: tosca@lists.oasis-open.org

[4] Candidate OASIS Standard Special Majority Vote:
https://www.oasis-open.org/committees/ballot.php?id=3443

[5] Public reviews:

* 30-day public review, 22 May 2019:
https://lists.oasis-open.org/archives/tosca/201905/msg00010.html
– Comment resolution log:
https://docs.oasis-open.org/tosca/TOSCA-Simple-Profile-YAML/v1.3/csprd01/TOSCA-Simplel-Profile-YAML-v1.3-csprd01-comment-resolution-log.xlsx

* 60-day public review, 13 December 2019:
https://lists.oasis-open.org/archives/members/201912/msg00009.html
– Comment resolution log:
https://docs.oasis-open.org/tosca/TOSCA-Simple-Profile-YAML/v1.3/cos01/TOSCA-Simple-Profile-YAML-v1.3-cos01-comment-resolution-log.txt

[6] Statements of Use:

– Jheronimus Academy of Data Sciences – https://lists.oasis-open.org/archives/tosca/201910/msg00026.html

– Ubicity Corp. – https://lists.oasis-open.org/archives/tosca/201910/msg00031.html

– XLAB d.o.o. – https://lists.oasis-open.org/archives/tosca/201910/msg00032.html

– Tal Liron – https://lists.oasis-open.org/archives/tosca/201910/msg00039.html

Invitation to comment on KMIP Specification v2.1 and KMIP Profiles v2.1 – ends March 13th

OASIS and the OASIS Key Management Interoperability Protocol (KMIP) TC are pleased to announce that two KMIP specifications are now available for public review and comment:
– Key Management Interoperability Protocol Specification Version 2.1
– Key Management Interoperability Protocol Profiles Version 2.1

What is KMIP and why is it important?

The Key Management Interoperability Protocol (KMIP) is a single, comprehensive protocol for communication between clients that request any of a wide range of encryption keys and servers that store and manage those keys. By replacing redundant, incompatible key management protocols, KMIP provides better data security while at the same time reducing expenditures on multiple products.

The KMIP Specification v2.1 is intended for developers and architects who wish to design systems and applications that interoperate using the Key Management Interoperability Protocol Specification.

KMIP Profiles v2.1 specifies conformance clauses that define the use of objects, attributes, operations, message elements and authentication methods within specific contexts of KMIP server and client interaction.

The documents and related files are available here:

Key Management Interoperability Protocol Specification Version 2.1
Committee Specification Draft 02 / Public Review Draft 01
06 February 2020

Editable source (Authoritative):
https://docs.oasis-open.org/kmip/kmip-spec/v2.1/csprd01/kmip-spec-v2.1-csprd01.docx
HTML:
https://docs.oasis-open.org/kmip/kmip-spec/v2.1/csprd01/kmip-spec-v2.1-csprd01.html
PDF:
https://docs.oasis-open.org/kmip/kmip-spec/v2.1/csprd01/kmip-spec-v2.1-csprd01.pdf
For your convenience, OASIS provides a complete package of the prose document and related files in a ZIP distribution file. You can download the ZIP file here:
https://docs.oasis-open.org/kmip/kmip-spec/v2.1/csprd01/kmip-spec-v2.1-csprd01.zip

Key Management Interoperability Protocol Profiles Version 2.1
Committee Specification Draft 02 / Public Review Draft 01
06 February 2020

Editable source (Authoritative):
https://docs.oasis-open.org/kmip/kmip-profiles/v2.1/csprd01/kmip-profiles-v2.1-csprd01.docx
HTML:
https://docs.oasis-open.org/kmip/kmip-profiles/v2.1/csprd01/kmip-profiles-v2.1-csprd01.html
PDF:
https://docs.oasis-open.org/kmip/kmip-profiles/v2.1/csprd01/kmip-profiles-v2.1-csprd01.pdf
Test cases:
https://docs.oasis-open.org/kmip/kmip-profiles/v2.1/csprd01/test-cases/
ZIP file:
https://docs.oasis-open.org/kmip/kmip-profiles/v2.1/csprd01/kmip-profiles-v2.1-csprd01.zip

How to Provide Feedback

OASIS and the KMIP TC value your feedback. We solicit input from developers, users and others, whether OASIS members or not, for the sake of improving the interoperability and quality of its technical work.

The public review starts 13 February 2020 at 00:00 UTC and ends 13 March 2020 at 23:59 UTC.

Comments may be submitted to the TC by any person through the use of the OASIS TC Comment Facility which can be used by following the instructions on the TC’s “Send A Comment” page (https://www.oasis-open.org/committees/comments/index.php?wg_abbrev=kmip)

Comments submitted by TC non-members for this work and for other work of this TC are publicly archived and can be viewed at:
https://lists.oasis-open.org/archives/kmip-comment/

All comments submitted to OASIS are subject to the OASIS Feedback License, which ensures that the feedback you provide carries the same obligations at least as the obligations of the TC members. In connection with this public review, we call your attention to the OASIS IPR Policy [1] applicable especially [2] to the work of this technical committee. All members of the TC should be familiar with this document, which may create obligations regarding the disclosure and availability of a member’s patent, copyright, trademark and license rights that read on an approved OASIS specification.

OASIS invites any persons who know of any such claims to disclose these if they may be essential to the implementation of the above specifications, so that notice of them may be posted to the notice page for this TC’s work.

Additional information about the specifications and the KMIP TC can be found at the TC’s public home page:
https://www.oasis-open.org/committees/kmip/

========== Additional references:
[1] https://www.oasis-open.org/policies-guidelines/ipr
[2] https://www.oasis-open.org/committees/kmip/ipr.php
https://www.oasis-open.org/policies-guidelines/ipr#RF-on-RAND-Mode
RF on RAND Mode

60-day Public Review for four #OData Candidate OASIS Standards – ends April 7th 2020

Members of the OASIS Open Data Protocol (OData) TC [1] have recently approved a Special Majority Ballot [2] to advance OData v4.01, OData Common Schema Definition Language (CSDL) XML Representation v4.01, OData Common Schema Definition Language (CSDL) JSON Representation v4.01, and OData JSON Format v4.01 as Candidate OASIS Standards (COS). These COS now enter a 60-day public review period in preparation for a member ballot to consider their approval as OASIS Standards.

OData Overview:
The Open Data Protocol (OData) enables the creation of REST-based data services, which allow resources, identified using Uniform Resource Locators (URLs) and defined in an Entity Data Model (EDM), to be published and edited by Web clients using simple HTTP messages.
The Candidate OASIS Standards announced today are:

– OData Version 4.01
This two-part specification defines the core semantics and facilities of the protocol.

– OData Common Schema Definition Language (CSDL) XML Representation Version 4.01
OData services are described by an Entity Model (EDM). The Common Schema Definition Language (CSDL) defines specific representations of the entity data model exposed by an OData service using, XML, JSON, and other formats. This document specifically defines the XML representation of CSDL.

– OData Common Schema Definition Language (CSDL) JSON Representation Version 4.01
This document specifically defines the JSON representation of CSDL.

– OData JSON Format Version 4.01
This document extends the core specification by defining representations for OData requests and responses using a JSON format.

Three Statements of Use were received from IBM, Microsoft, and SAP [3].

Public Review Period:
The 60-day public review starts 08 February 2020 at 00:00 UTC and ends 07 April 2020 at 23:59 UTC.

This is an open invitation to comment. OASIS solicits feedback from potential users, developers and others, whether OASIS members or not, for the sake of improving the interoperability and quality of its technical work.

The prose specification documents and related files are available here:

– OData Version 4.01
Candidate OASIS Standard 01
28 January 2020

OData Version 4.01. Part 1: Protocol
Editable source (Authoritative):
https://docs.oasis-open.org/odata/odata/v4.01/cos01/part1-protocol/odata-v4.01-cos01-part1-protocol.docx
HTML:
https://docs.oasis-open.org/odata/odata/v4.01/cos01/part1-protocol/odata-v4.01-cos01-part1-protocol.html
PDF:
https://docs.oasis-open.org/odata/odata/v4.01/cos01/part1-protocol/odata-v4.01-cos01-part1-protocol.pdf

OData Version 4.01. Part 2: URL Conventions
Editable source (Authoritative):
https://docs.oasis-open.org/odata/odata/v4.01/cos01/part2-url-conventions/odata-v4.01-cos01-part2-url-conventions.docx
HTML:
https://docs.oasis-open.org/odata/odata/v4.01/cos01/part2-url-conventions/odata-v4.01-cos01-part2-url-conventions.html
PDF:
https://docs.oasis-open.org/odata/odata/v4.01/cos01/part2-url-conventions/odata-v4.01-cos01-part2-url-conventions.pdf
ABNF components:
https://docs.oasis-open.org/odata/odata/v4.01/cos01/abnf/

OData Common Schema Definition Language (CSDL) XML Representation Version 4.01
Candidate OASIS Standard 01
28 January 2020

Editable source (Authoritative):
https://docs.oasis-open.org/odata/odata-csdl-xml/v4.01/cos01/odata-csdl-xml-v4.01-cos01.docx
HTML:
https://docs.oasis-open.org/odata/odata-csdl-xml/v4.01/cos01/odata-csdl-xml-v4.01-cos01.html
PDF:
https://docs.oasis-open.org/odata/odata-csdl-xml/v4.01/cos01/odata-csdl-xml-v4.01-cos01.pdf
XML schemas:
https://docs.oasis-open.org/odata/odata-csdl-xml/v4.01/cos01/schemas/

OData Common Schema Definition Language (CSDL) JSON Representation Version 4.01
Candidate OASIS Standard 01
28 January 2020

Editable source (Authoritative):
https://docs.oasis-open.org/odata/odata-csdl-json/v4.01/cos01/odata-csdl-json-v4.01-cos01.docx
HTML:
https://docs.oasis-open.org/odata/odata-csdl-json/v4.01/cos01/odata-csdl-json-v4.01-cos01.html
PDF:
https://docs.oasis-open.org/odata/odata-csdl-json/v4.01/cos01/odata-csdl-json-v4.01-cos01.pdf
JSON schemas:
https://docs.oasis-open.org/odata/odata-csdl-json/v4.01/cos01/schemas/

OData JSON Format Version 4.01
Candidate OASIS Standard 01
28 January 2020

Editable source (Authoritative):
https://docs.oasis-open.org/odata/odata-json-format/v4.01/cos01/odata-json-format-v4.01-cos01.docx
HTML:
https://docs.oasis-open.org/odata/odata-json-format/v4.01/cos01/odata-json-format-v4.01-cos01.html
PDF:
https://docs.oasis-open.org/odata/odata-json-format/v4.01/cos01/odata-json-format-v4.01-cos01.pdf

Distribution ZIP files:
For your convenience, OASIS provides a complete package of the prose specification and related files in a ZIP distribution file. You can download the ZIP files here:
– OData Version 4.01:
https://docs.oasis-open.org/odata/odata/v4.01/cos01/odata-v4.01-cos01.zip
– OData Common Schema Definition Language (CSDL) XML Representation Version 4.01:
https://docs.oasis-open.org/odata/odata-csdl-xml/v4.01/cos01/odata-csdl-xml-v4.01-cos01.zip
– OData Common Schema Definition Language (CSDL) JSON Representation Version 4.01:
https://docs.oasis-open.org/odata/odata-csdl-json/v4.01/cos01/odata-csdl-json-v4.01-cos01.zip
– OData JSON Format Version 4.01:
https://docs.oasis-open.org/odata/odata-json-format/v4.01/cos01/odata-json-format-v4.01-cos01.zip

Additional information about the specifications and the OData TC may be found at the TC’s public home page:
https://www.oasis-open.org/committees/odata/

Comments may be submitted to the TC by any person through the use of the OASIS TC Comment Facility as explained in the instructions located via the button labeled “Send A Comment” at the top of the TC public home page, or directly at:
https://www.oasis-open.org/committees/comments/index.php?wg_abbrev=odata

Comments submitted by TC non-members for these works and for other work of this TC are publicly archived and can be viewed at:
http://lists.oasis-open.org/archives/odata-comment/

All comments submitted to OASIS are subject to the OASIS Feedback License, which ensures that the feedback you provide carries the same obligations at least as the obligations of the TC members. In connection with this public review of OData v4.01, OData Common Schema Definition Language (CSDL) XML Representation v4.01, OData Common Schema Definition Language (CSDL) JSON Representation v4.01, and OData JSON Format v4.01, we call your attention to the OASIS IPR Policy [4] applicable especially [5] to the work of this technical committee. All members of the TC should be familiar with this document, which may create obligations regarding the disclosure and availability of a member’s patent, copyright, trademark and license rights that read on an approved OASIS specification.

OASIS invites any persons who know of any such claims to disclose these if they may be essential to the implementation of the above specifications, so that notice of them may be posted to the notice page for this TC’s work.

============== Additional references:

[1] OASIS Open Data Protocol (OData) TC
https://www.oasis-open.org/committees/odata/

[2] Approval ballot:
https://www.oasis-open.org/committees/ballot.php?id=3469

[3] Statements of Use:
– IBM:
https://www.oasis-open.org/apps/org/workgroup/odata/email/archives/202001/msg00005.html
– Microsoft:
https://www.oasis-open.org/apps/org/workgroup/odata/email/archives/201911/msg00044.html
– SAP:
https://www.oasis-open.org/apps/org/workgroup/odata/email/archives/201911/msg00037.html

[4] https://www.oasis-open.org/policies-guidelines/ipr

[5] https://www.oasis-open.org/committees/odata/ipr.php
https://www.oasis-open.org/policies-guidelines/ipr#RF-on-RAND-Mode
RF on RAND Mode

Attend the Open Cybersecurity Alliance Luncheon during RSA 2020

Wed, 26 Feb / 12:00 Noon / San Francisco, CA

No results with the selected filters