Subject: [sacm] DRAFT Guidelines for the Creation of Interoperable Software Identification (SWID) Tags

From: Jerome Athias <[email-masked]>
Date: Mon, 1 Jun 2015 19:22:38 +0300

In case it could be useful.

May 29, 2015

NIST IR 8060

DRAFT Guidelines for the Creation of Interoperable Software
Identification (SWID) Tags

This report provides an overview of the capabilities and usage of
Software Identification (SWID) tags as part of a comprehensive
software life cycle. As defined by the ISO/IEC 19770-2 standard, SWID
tags support numerous applications for software asset management (SAM)
and information security management. This publication introduces SWID
tags in an operational context, provides guidance for the creation of
interoperable SWID tags, and highlights key usage scenarios for which
SWID tags are applicable. The application of this guidance supports
reliable, standardized software inventory and discovery methods that
help organizations achieve cybersecurity and SAM objectives.
Application of SWID tags also supports automation for accurate and
timely SAM reporting.

Ref.: http://csrc.nist.gov/publications/PubsDrafts.html#NIST-IR-8060

Best regards

---

From: Tony Rutkowski <[email-masked]>
Date: Tue, 02 Jun 2015 11:33:32 +0200

Hi Jerome,

The following might also be useful:
http://www.doi.org/tools.html

As we have previously discussed, the
world is filled with different approaches
to identifying software.  For some odd
reason, NIST seems wedded to SWIDs -
probably the least used outlier among
the software tagging platforms.  For
better or worse, among the structured
approaches, DOIs are relatively widely
used and have benefits that SWIDs do
not.

Perhaps Bob Kahn will be illuminating
NIST.

--tony

---

From: "Waltermire, David A." <[email-masked]>
Date: Tue, 2 Jun 2015 11:27:58 +0000

Tony,

I agree that there are a multitude of approaches to identifying software. The SWID tag standard does not require that a single method be used in lieu of the rest. Yes a GUID is a SHOULD statement, but that is different than a MUST.

Are you referencing the Digital Object Identifier System?

If so, the tagId in a SWID tag allows any arbitrary string to be used to identify a software release. A DOI can be used here instead of a GUID (or any other string that uniquely identifies the software release.) These are not mutually exclusive efforts. I find the DOI option interesting.

We like SWID tags for a number of reasons including:

1) it's an industry developed international consensus standard.
2) in addition to software identification, a SWID tag provides a means of structuring a robust set of of metadata about software that supports a number of operational and cybersecurity use cases that an identifier alone does not.

Because of the above we are implementing SWID tags within the National Vulnerabilty Database and the National Software Reference Library efforts here at NIST. The referenced report was written to maximize the degree of interoperability of the metadata provided within a SWID tag to ensure that the information is useful in addressing a number of use cases. You can read more about this in the report.

We welcome any comments that you or anyone else involved in SACM have on the report.

Sincerely,
Dave

Sent from my iPhone

> On Jun 2, 2015, at 5:33 AM, "Tony Rutkowski" <[email-masked]> wrote:
> 
> Hi Jerome,
> 
> _______________________________________________
> sacm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sacm

---

From: Tony Rutkowski <[email-masked]>
Date: Tue, 02 Jun 2015 14:03:02 +0200

Hi Dave,

Being an ISO "non-public" spec is probably a dubious
attribute in this sector. :-)

Perhaps Bob Kahn will engage here, but DOIs have
greater flexibility, many orders of magnitude greater
uptake, and an ability to do distributed real-time
resolution of "state."  Even NIST now uses them for
tagging its objects.  DOIs also have the benefit
of being able to point to SWIDs!

--tony

---

From: Robert Kahn <[email-masked]>
Date: Tue, 02 Jun 2015 18:43:44 -0400

Tony, et al

I'm still on travel but should be back tomorrow.

Bob

On 6/2/15 8:03 AM, Tony Rutkowski wrote:
>> 2) in addition to software identification, a SWID tag provides a 
>> means of structuring a robust set of of metadata about software that 
>> supports a number of operational and cybersecurity use cases that an 
>> identifier alone does not.
>
>
>

---

From: "Adam W. Montville" <[email-masked]>
Date: Wed, 3 Jun 2015 06:39:17 -0500

Hi,

This discussion might be timed quite well.  We are working on wrapping up our endpoint identification design team and as that work concludes I expect we will consider shifting focus to determining some of the more important details supporting endpoint identification and our overall use cases.  In my opinion, software identification is one of the first things we should consider working on next from an information model perspective.

I would then propose that the endpoint identity design team consider reforming under a new “mission” to tackle software identity to start immediately after the endpoint identity information has made its way into the information model.

Thoughts?

Adam

> On Jun 2, 2015, at 7:03 AM, Tony Rutkowski <[email-masked]> wrote:
> 
> Hi Dave,
>

---

From: Jerome Athias <[email-masked]>
Date: Wed, 3 Jun 2015 14:51:45 +0300

That seems like a plan for me Adam. Thanks.
Meantime, as it was suggested to me, we would have at some point to
consider supporting "endpoint characterization" with, or, in place of
endpoint identification.
Happy to review any information model when the mission is launched.

Cheers