[CSIRTs] TLP version 2.0 launched

[Omo Oaiya]

Dear Colleagues, 

Please see this update from TrustBroker Africa (TBA) <https://www.trustbroker.africa/>, an initiative of WACREN) which we would like you to spread in your communities.
 
TLP version 2.0 was launched on 2 August 2022. See:
https://www.first.org/tlp/ <https://urldefense.us/v3/__https:/www.first.org/tlp/__;!!BClRuOV5cvtbuNI!T5Q_u3_s0o2BEVKpW-itK7zuUSKZvL16h0Zse8WzexttUaNFcZwqZ5BdEPNBWPCgW126B2c$>
This is the outcome of 3 years of reviewing inside FIRST's TLP-SIG (50+ members worldwide) which we opened up to the world last November. That last, global, round of reviews led to significant improvements still. 

You can still use version 1.0 until the end of the year. It has been moved to https://www.first.org/tlp/v1/ <https://urldefense.us/v3/__https:/www.first.org/tlp/v1/__;!!BClRuOV5cvtbuNI!T5Q_u3_s0o2BEVKpW-itK7zuUSKZvL16h0Zse8WzexttUaNFcZwqZ5BdEPNBWPCg3n0fY-M$>.

TLP version 2.0 differs from the old version as follows:

TLP:CLEAR is the new label for what used to be TLP:WHITE.
TLP:AMBER has kept its meaning, which is in short: "Limited disclosure, recipients can only spread this on a need-to-know basis within their organization and its clients". Additionally, there is now an officially recognized TLP:AMBER+STRICT which restricts sharing to the recipient’s organization only.
Definitions have been added for three important "scoping words:" community, organization and clients.
Ergonomics: a table has been added with the RGB, CMYK and HEX colour codes for TLP:RED, TLP:AMBER, TLP:GREEN and TLP:CLEAR. The red of TLP:RED has been adjusted for better readability.
Language: we did our best to remove unnecessary synonyms, idiomatic language, and attempts at literary phrasing, to make sure we always use the same word for the same thing; various language simplifications have been implemented; ambiguities were removed; all to make this understandable to the widest possible audience worldwide (not just to people with top class English language skills).
Note that TLP version 2.0 is backwards compatible with the old version, with the exception of TLP:CLEAR (replacing TLP:WHITE).

The TLP-SIG is working on a few subsequent actions, to be delivered as soon as possible:

Reach out to the CSIRT/security community worldwide to "bring the news" and ask everyone to adopt version 2.0 before the end of the year.
Reach as many developers as possible to make sure that version 2.0 is implemented in the many tools worldwide that currently use older version(s) of TLP. This issue was especially raised by TF-CSIRT members in regard TLP:CLEAR and deserves/requires full attention.
Making the translations that were available for the old version also available for version 2.0. There are four of those translations: Brazilian Portuguese, Dutch, Japanese and Swedish.
Adding more translations, which is the result of a volunteer process inside the FIRST community. We already have volunteers for translations into French and Spanish. 
Adding training files about version 2.0 and the migration from the old version to 2.0.
Adding scenario-based use cases for version 2.0.
Reaching out to the ISO/IEC to ensure compatibility with ISO/IEC 27010.
Please help to "spread the word", and also to encourage the adoption of version 2.0 in relevant tools. Thank you in advance!

Kind Regards
Don Stikvoort, also on behalf of Tom Millar,
chairs of FIRST TLP-SIG




Omo OAIYA
Chief Strategy Officer/Directeur de la Stratégie | WACREN <http://www.wacren.net/>
m: +234 808 888 1571 , +233 205 228 693