Permissible Action Protocol

The Permissible Action Protocol, more commonly known as PAP, was first conceptualized in 2016 under the guidance of MISP (Malware Information Sharing Platform).

Unlike TLP, a framework that classifies how information is shared, PAP is a framework designed to classify actions based on the potential exposure of sensitive data to malicious entities. Just as with TLP, the PAP structure also relies upon a tiered system, each distinctly represented by a color code.

PAP Classifications

PAP Clear

Actions are relatively unrestricted at this level. There are no severe constraints and information can be handled as desired provided they align with legal and licensing frameworks. The primary goal is to ensure a seamless yet compliant handling of the data.

PAP Green

PAP at this level permits controlled, non intrusive actions with malicious sources.,

This would be likened to something like an organization blocking incoming threats at their firewall, especially if they can trace it back to a particular IP. Similarly, blocking outbound malicious traffic targeting specific web addresses via proxy servers is a standard protocol.

PAP Amber

Activities at this level are confined to passive data handling, ensuring actions remain undetected by malicious sources.

Example:

PAP:AMBER in this instance would be if organizations leverage open-source platforms or online knowledge repositories to further clarify and understand the provided data from an investigation or a breach.

In situations where infrastructure might already be compromised, this data proves pivotal to pinpoint possible IOCs.

Note, that direct or indirect communication with the threat actor is forbidden at this level.

PAP Red

PAP:RED at this level is centered exclusively around detection and investigation of the threat actor. Just like TLP:RED access is based on a "need-to-know" principle. The infrastructure at hand is typically protected from the public domain but also segregated from the organization's overall system to seclude the information and maintain integrity. In this instance, direct engagements with external services and devices are a strict off limits.

It is expected that permitted actions will be invisible to potential adversaries. A classic example would be searching non-production environments based on previously logged data.

Example:

Threat hunting and Incident Response teams are to be mentioned here as they typically have insight and capabilities to monitor infrastructures to confirm the absence or detect the appearance of a threat while maintaining the integrity of the isolated network their are monitoring.