Subject: Re: [sacm] SWID and CPE: WAS - Re: SACM BoF Request

From: Adam Montville <[email-masked]>
Date: Wed, 26 Sep 2012 13:38:27 +0000

Thanks, Rich!  I have some additional comments/questions inline.

From: <Struse>, Richard <[email-masked]<mailto:[email-masked]>>
Date: Wednesday, September 26, 2012 6:32 AM
To: Adam Montville <[email-masked]<mailto:[email-masked]>>, Jan-Oliver Wagner <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Cc: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>, "Waltermire, David A." <[email-masked]<mailto:[email-masked]>>, Jon Baker <[email-masked]<mailto:[email-masked]>>
Subject: RE: [sacm] SWID and CPE: WAS - Re: SACM BoF Request

I think Jon Baker has already said some of this but I wanted to highlight the following:

1.       SWID’s and CPE’s have some overlap but are largely complementary specifications

2.       The SWID standard specifies tags that would allow automated verification of package integrity (through manifests of file hashes), an important capability that CPE does not provide

>From this perspective, our assessment capabilities would want to assess SWIDs when a test is created to ensure that installed software is valid (or some language like that).

3.       SWID’s have been carefully designed to accommodate suites (e.g. Office), patches and other complicating factors

Is the implication that CPE has not been proven to handle these things?

4.      The CPE language can represent patterns that map to multiple assets, SWID’s are a one-to-one sort of thing

OK.  I guess I was looking at this differently, as the SWID is certified and signed before installation.  In that way, a SWID for Microsoft's latest release of Windows 8 could reasonably serve as a classification mechanism could it not?  (Again, I'm not into the actual SWID standard yet – just what's available publicly).

5.       Microsoft announced their support for SWID tags earlier this year (http://www.microsoft.com/sam/en/us/softwareid.aspx)

Good to know.

Jon also mentioned efforts to harmonize CPE and SWID –it would be interesting to learn more about those efforts also.

Hope this helps…

Rich
From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]] On Behalf Of Adam Montville
Sent: Wednesday, September 26, 2012 9:23 AM
To: Jan-Oliver Wagner; [email-masked]<mailto:[email-masked]>
Cc: Moriarty, Kathleen; Waltermire, David A.; Baker, Jon
Subject: [sacm] SWID and CPE: WAS - Re: SACM BoF Request

This seems like an important discussion.  Asset management is, arguably, the most important foundational piece of an effective information security program, as our use case document [1] recognizes (asset management is the first recognized capability in support of Use Case 1).  Clearly, there are pros and cons to leveraging CPE and/or SWID, and after quickly reading through some of the information available at TagVault [2], it seems clear that SWIDs are roughly equivalent to CPE for operating systems and applications.

Before looking at the differences between CPE and SWID, it's probably a good idea to understand exactly what we need from a software asset classification scheme not only within our use cases, but also from a couple of control frameworks our use cases support (I prefer to look at the Critical Audit Guidelines (CAG) published by SANS and ISO 27002).

Both the CAG and 27002 make reference to managing assets, but only in terms of keeping an inventory.  The CAG goes further by explicitly stating (in Critical Control 2) that we need to have an inventory of all authorized and unauthorized software.  I don't believe either really mentions anything about corrective actions, except implicitly in sections related to incident response.

So, we have a clear need to look at an instance of software, classify it, and build or contribute to an identity profile for it for continued reference.  Can CPE handle this classification for for us?  Yes.  Can SWID handle this classification for us?  It seems so.  Note that we should not rely on either of these methods to identify software for targeted actions – that would be the domain of Asset Identification (we could use CPE or SWID to specify classes of targets for actions).

Distribution and operational identification seems important to consider as well.  CPEs aren't installed with the software and require some assessment action to derive.  SWIDs, on the other hand, appear to be distributed by the software publisher [3].  Moreover, SWIDs are certified and signed by TagVault.  I'm unsure of the details about how SWIDs become available on a given system (they still need to be actively collected from a target system at some point).

At this point, the difference between the two is really volume of available "tags" (we can reasonably call a CPE name a "tag" in this context), and this is where I see the rubber meeting the road – when an operational component is implicitly or explicitly required for a standard to work as intended at scale.

There seems to be very little information about SWID volumes available (at least in the limited time I've had to search around), so it's difficult to judge how well they've penetrated the market.  The last press release from TagVault is from 2010, which may suggest a dropping off of the effort or a satisfaction that they've done enough.  Information about CPE volume seems most readily available from NVD [5].

Can anyone on this list provide additional details about SWID?

I think it may be useful, from a  community perspective, to be able to handle both software identification types, provided both are operationally feasible and foreseeably sustainable.  For example, the ai:software element defined by the Asset Identification draft [4] has an optional CPE attribute that could just as easily be complemented by an optional SWID attribute.

[1] http://tools.ietf.org/html/waltermire-sacm-use-cases-02
[2] http://www.tagvault.org
[3] http://www.tagvault.org/swid-tag-lifecycle
[4] http://trac.tools.ietf.org/html/draft-montville-sacm-asset-identification-00
[5] http://nvd.nist.gov/cpe.cfm

On 9/26/12 3:28 AM, "Jan-Oliver Wagner" <[email-masked]<mailto:[email-masked]>> wrote:

On Mittwoch, 26. September 2012, Baker, Jon wrote:
I am a big fan of SWIDs and believe that we would really benefit from widespread SWID adoption. In my previous message, I was attempting to state that we need capabilities offer by both CPE and SWID.

I am a big fan of CPE and believe it is fully compatible with Open Source reference
implementation and widespread use/adoption in Open Source tools, especially also
in commercial environments.

Neglecting CPE in favour of SWID would IMHO be a drawback for widespread security
automation because, as to my understanding, SWID is not fully compatible with the vendor-independent
approaches. Convince me I am wrong and I'd be happy ;-)

(Sorry for jumping in here, it was just something I am worried about since some time already
so I spontaneously reacted on the keywords :-)

--
Dr. Jan-Oliver Wagner |  ++49-541-335084-0  |  http://www.greenbone.net/
Greenbone Networks GmbH, Neuer Graben 17, 49074 Osnabrück | AG Osnabrück, HR B 202460
Geschäftsführer: Lukas Grunwald, Dr. Jan-Oliver Wagner

---

From: "Moriarty, Kathleen" <[email-masked]>
Date: Wed, 26 Sep 2012 09:44:38 -0400

Thank you to all for the additional information!

As Adam pointed out earlier, how do we fulfill the use cases?  What is needed in a high-level charter description without naming a way to accomplish it.  Then how do either CPE and/or SWID fit into that need?

Thank you!
Kathleen

From: Adam Montville [mailto:[email-masked]]
Sent: Wednesday, September 26, 2012 9:38 AM
To: Struse, Richard; Jan-Oliver Wagner; [email-masked]
Cc: Moriarty, Kathleen; Waltermire, David A.; Baker, Jon
Subject: Re: [sacm] SWID and CPE: WAS - Re: SACM BoF Request

1.      SWID's and CPE's have some overlap but are largely complementary specifications

>From this perspective, our assessment capabilities would want to assess SWIDs when a test is created to ensure that installed software is valid (or some language like that).

3.      SWID's have been carefully designed to accommodate suites (e.g. Office), patches and other complicating factors

4.      The CPE language can represent patterns that map to multiple assets, SWID's are a one-to-one sort of thing

OK.  I guess I was looking at this differently, as the SWID is certified and signed before installation.  In that way, a SWID for Microsoft's latest release of Windows 8 could reasonably serve as a classification mechanism could it not?  (Again, I'm not into the actual SWID standard yet - just what's available publicly).

Good to know.

Jon also mentioned efforts to harmonize CPE and SWID -it would be interesting to learn more about those efforts also.

Hope this helps...

Rich

So, we have a clear need to look at an instance of software, classify it, and build or contribute to an identity profile for it for continued reference.  Can CPE handle this classification for for us?  Yes.  Can SWID handle this classification for us?  It seems so.  Note that we should not rely on either of these methods to identify software for targeted actions - that would be the domain of Asset Identification (we could use CPE or SWID to specify classes of targets for actions).

At this point, the difference between the two is really volume of available "tags" (we can reasonably call a CPE name a "tag" in this context), and this is where I see the rubber meeting the road - when an operational component is implicitly or explicitly required for a standard to work as intended at scale.

---

From: Adam Montville <[email-masked]>
Date: Wed, 26 Sep 2012 13:53:54 +0000

Sent from my iPhone

On Sep 26, 2012, at 6:46 AM, "Moriarty, Kathleen" <[email-masked]<mailto:[email-masked]>> wrote:

As Adam pointed out earlier, how do we fulfill the use cases?  What is needed in a high-level charter description without naming a way to accomplish it.

I'm reading this as a call for more detailed discussion on the use case draft (I agree that we should do this).

As written, the use cases are just described with some required capabilities included.  We would benefit from diving deeper to enumerate all of the functionality (including data exchange formats and protocols/interfaces) we need to accomplish our goals.

Then how do either CPE and/or SWID fit into that need?

Thank you!
Kathleen

To: Struse, Richard; Jan-Oliver Wagner; [email-masked]<mailto:[email-masked]>

Good to know.

Hope this helps…

Rich

---

From: "Waltermire, David A." <[email-masked]>
Date: Wed, 26 Sep 2012 11:51:13 -0400

In my mind, we need to work through the software identification, inventory, applicability, and querying use cases considering what CPE and SWID provide to make sure we have a complete, acceptable solution.  Both CPE and SWID do some things well, but both also fall short in specific areas.  We need to insure that the body of software/asset management specifications fully address these use cases, while providing a needed level of backwards compatibility to current CPE use.

SWIDs are complementary with CPE.  It is possible to map between them in part using the current revision of SWID (ISO/IEC 19770-2:2009).  The mapping is partial since currently SWID does not have all of the fields we need.  This is being addressed in the next revision of 19770-2.  Early work for this can be found here: http://tagvault.org/Automating_CPE_name_creation.  This approach lays a foundation to enable automated creation of CPEs using SWID metadata.

In my personal opinion, this also enables the beginning of a longer-term transition to using SWID for software asset management in the security automation space.  To fully enable a transition, we will need additional specifications to fill in use case gaps.  The following specifications would address some of these gaps:

·        A document describing how to map from SWID to CPE to provide backwards compatibility.  The TagVault document referenced above is a good start for this.

·        An update to the CPE Applicability Language 2.3 specification that describes how to use SWID metadata for applicability statements.  This would need to address requirements similar to what is described in the CPE Matching 2.3 specification.

Additional comments inline.

Sincerely,
Dave

>From this perspective, our assessment capabilities would want to assess SWIDs when a test is created to ensure that installed software is valid (or some language like that).

[DAW: Yes.  SWID is based around this use case.  One possible point of concern might be around how tags are managed on the device to insure that if portions of the software remain (e.g. DLLs, executables), that the assessment mechanism will report that the software is still installed.  This is especially important if a security flaw exists in the residual software component.  This has been an ongoing challenge for the vulnerability use case and has not exactly been handled by CPE per se.]

[DAW: Yes.  This has been a challenge for CPE.]

[DAW: Yes.  A SWID tag contains both identifiers and metadata.  The CPE Applicability Language can be thought of as a mechanism to query against the set of metadata described in a CPE.  While SWIDs are generally more specific relative to a released product than a CPE, the SWID contains the same metadata.  This means that with additional specification, that the CPE Language can be adjusted to allow searching against the SWID metadata as well.]

Good to know.

[DAW: See link above.]

Hope this helps...

Rich