Subject: Re: [sacm] [sacmwg/draft-ietf-sacm-information-model] Consider differentiating classes of software within Software Inventory (#10)

From: Danny Haynes <[email-masked]>
Date: Thu, 03 Nov 2016 12:47:58 -0700

There are currently OS-related IEs in the IM (e.g. osComponent, osLabel, osName, osType, osVersion) that came from the I-D IM.  Do we specifically want to call out OS-related information in this way?  Or, do we want to remove this OS-related information and expect that it will be covered by software-related IEs (e.g. softwareTitle, SoftwareCreator, softwareVersion, etc.)?

Thanks,

Danny

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-information-model/issues/10#issuecomment-258253698

---

From: adammontville <[email-masked]>
Date: Sat, 05 Nov 2016 12:47:47 -0700

I would like the ability to understand when software is an operating system, but beyond that, I think adding "osLabel" and the like would be redundant.  I would expect we'd have "label" for software name.  It'd be rad to have a solid software classification system though.

-- 
You are receiving this because you commented.
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-information-model/issues/10#issuecomment-258636249

---

From: Ira McDonald <[email-masked]>
Date: Sat, 5 Nov 2016 15:53:40 -0400

Hi Adam,

I agree that it's important to tell that software is an OS.  Host Resource
MIB
(RFC 2790) and many other interfaces also distinguish drivers from other
non-OS
software (I also think this is important).

What level of granularity (or whatever) did you mean by a "solid software
classification system" goal?

Cheers,
- Ira

Ira McDonald (Musician / Software Architect)
Co-Chair - TCG Trusted Mobility Solutions WG
Chair - Linux Foundation Open Printing WG
Secretary - IEEE-ISTO Printer Working Group
Co-Chair - IEEE-ISTO PWG Internet Printing Protocol WG
IETF Designated Expert - IPP & Printer MIB
Blue Roof Music / High North Inc
http://sites.google.com/site/blueroofmusic
http://sites.google.com/site/highnorthinc
mailto: [email-masked]
Jan-April: 579 Park Place  Saline, MI  48176  734-944-0094
May-Dec: PO Box 221  Grand Marais, MI 49839  906-494-2434

On Sat, Nov 5, 2016 at 3:47 PM, adammontville <[email-masked]>
wrote:

> I would like the ability to understand when software is an operating
> system, but beyond that, I think adding "osLabel" and the like would be
> redundant. I would expect we'd have "label" for software name. It'd be rad
> to have a solid software classification system though.
>
> —
> Reply to this email directly, view it on GitHub
> <https://github.com/sacmwg/draft-ietf-sacm-information-model/issues/10#issuecomment-258636249>,
> or mute the thread
> <https://github.com/notifications/unsubscribe-auth/AKbE0X8hsUR6dtJl9RH0ywLZmASpU2wIks5q7N1jgaJpZM4EC3sa>
> .
>
> _______________________________________________
> sacm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sacm
>
>

---

From: adammontville <[email-masked]>
Date: Sat, 05 Nov 2016 13:20:24 -0700

I don't know what one should look like, but if in the IM we have the notion of "software" with proper classification, it seems (I could be wrong) that we would need fewer one-off attribute names (i.e. "firmwareLabel", "osLabel", and so on.  We would in effect say, "this is a software instance of class 'operating system'".  We might take that classification system further to say, "this is a software instance of class 'Windows operating system'".   We might additionally be able to classify things like "RTOS" is-a "Operating System" and know that when we see "ChronOS" we're dealing with a real-time OS because "ChronOS" is-a "RTOS" is-a "Operating System".

I'm not sure that goes toward answering your question, though.

-- 
You are receiving this because you commented.
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-information-model/issues/10#issuecomment-258638089

---

From: Ira McDonald <[email-masked]>
Date: Sat, 5 Nov 2016 20:23:24 -0400

Hi Adam,

Very good answer.  I like this progressive refinement from OS to RTOS to
ChronOS.  And I like generic attributes like softwareLabel, softwareClass,
and so on.

By adroit cherry picking from DMTF CIM (WMI, etc.) software schema,
I think we could achieve a fair amount of this and perhaps also benefit by
the very large number of DMTF-registered values for various attributes
rather than trying to use the several poorly maintained equivalent IANA
registries.

Cheers,
- Ira

On Sat, Nov 5, 2016 at 4:20 PM, adammontville <[email-masked]>
wrote:

> I don't know what one should look like, but if in the IM we have the
> notion of "software" with proper classification, it seems (I could be
> wrong) that we would need fewer one-off attribute names (i.e.
> "firmwareLabel", "osLabel", and so on. We would in effect say, "this is a
> software instance of class 'operating system'". We might take that
> classification system further to say, "this is a software instance of class
> 'Windows operating system'". We might additionally be able to classify
> things like "RTOS" is-a "Operating System" and know that when we see
> "ChronOS" we're dealing with a real-time OS because "ChronOS" is-a "RTOS"
> is-a "Operating System".
>
> <https://github.com/sacmwg/draft-ietf-sacm-information-model/issues/10#issuecomment-258638089>,
> or mute the thread
> <https://github.com/notifications/unsubscribe-auth/AKbE0YXSfKkVlze3MpL-51PG8cRPehHMks5q7OUIgaJpZM4EC3sa>
> .
>

---

From: Danny Haynes <[email-masked]>
Date: Mon, 07 Nov 2016 03:10:17 -0800

Here's a link to the DMTF SoftwareIdentity model (http://schemas.dmtf.org/wbem/cim-html/2.41.0+/CIM_SoftwareIdentity.html).  It contains a "classifications" attribute that distinguishes between operating systems, applications, firmware, etc.

So, it sounds like if we have a way to distinguish between operating systems, applications, firmware, etc., we could remove these OS-related attributes?

As a side note, I also came across a DMTF CIM profile for SWID tags (https://www.dmtf.org/sites/default/files/standards/documents/DSP1067_1.0.0.pdf) which may be of interest to the WG.

-- 
You are receiving this because you commented.
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-information-model/issues/10#issuecomment-258808649

---

From: "Wolfkiel, Joseph L CIV DISA ID (US)" <[email-masked]>
Date: Mon, 7 Nov 2016 13:16:07 +0000

We have had to worry about *where* an application is installed.  For example, in our software inventory tool-for Windows devices, we have to look in the uninstall registry, in the windows application store, and in the Windows "features" to find installed software.    We will also begin collecting executables that are mapped to file extensions which act as installed software, but aren't formally "installed."  We also want to find browser plugins and extensions since they are software installed in software--and commonly have vulnerabilities.

It seems like a classification system may need to be able to differentiate between the "types" of software, to some extent.

The other issue we recently ran up against is trying to identify web sites and pages and database instances.  Not so much because we really think web pages and database instances are "software" per se, but they behave a lot like software with respect to needing to be securely configured and being able to contain vulnerabilities based on running vulnerable code.

Joseph L. Wolfkiel
SCM Engineering Lead
DISA ID52
Fort Meade DISA Acquisiton Bldg Cube A4A58E
Work: (301) 225-8820
Gov Cell: (571) 814-8231
[email-masked]

-----Original Message-----
From: sacm [mailto:[email-masked]] On Behalf Of Danny Haynes
Sent: Monday, November 07, 2016 6:10 AM
To: sacmwg/draft-ietf-sacm-information-model
Cc: Comment; sacm
Subject: [Non-DoD Source] Re: [sacm] [sacmwg/draft-ietf-sacm-information-model] Consider differentiating classes of software within Software Inventory (#10)

All active links contained in this email were disabled. Please verify the identity of the sender, and confirm the authenticity of all links contained within the message prior to copying and pasting the address to a Web browser. 

________________________________

Here's a link to the DMTF SoftwareIdentity model (Caution-http://schemas.dmtf.org/wbem/cim-html/2.41.0+/CIM_SoftwareIdentity.html < Caution-http://schemas.dmtf.org/wbem/cim-html/2.41.0+/CIM_SoftwareIdentity.html > ). It contains a "classifications" attribute that distinguishes between operating systems, applications, firmware, etc.

As a side note, I also came across a DMTF CIM profile for SWID tags (Caution-https://www.dmtf.org/sites/default/files/standards/documents/DSP1067_1.0.0.pdf < Caution-https://www.dmtf.org/sites/default/files/standards/documents/DSP1067_1.0.0.pdf > ) which may be of interest to the WG.

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub < Caution-https://github.com/sacmwg/draft-ietf-sacm-information-model/issues/10#issuecomment-258808649 > , or mute the thread < Caution-https://github.com/notifications/unsubscribe-auth/AKbE0WSjAk8-xss3b39USuCxOjzYIDmMks5q7wcZgaJpZM4EC3sa > . <Caution-https://github.com/notifications/beacon/AKbE0ZGJE9PXUselNoG2obY7YfWJzrxUks5q7wcZgaJpZM4EC3sa.gif>

---

From: cliffordk <[email-masked]>
Date: Mon, 07 Nov 2016 09:25:32 -0800

At the risk of coming from left field …

It may be worthwhile to model what privileges the software runs with. Software that runs with elevated privileges (higher than the user invoking it or giving it input) is subject to more vulnerabilities. Conversely, software that runs in a sandbox or container, with less privilege than the user, is subject to fewer vulnerabilities.

This privilege question is often an attribute of the software, but sometimes it is a matter of how the software is run.

Best,
                                                Cliff

From: sacm <[email-masked]>
Reply-To: sacmwg/draft-ietf-sacm-information-model <[email-masked]>
Date: Monday, November 7, 2016 at 8:16 AM
To: sacmwg/draft-ietf-sacm-information-model <[email-masked]>
Subject: Re: [sacmwg/draft-ietf-sacm-information-model] Consider differentiating classes of software within Software Inventory (#10)

Joseph L. Wolfkiel
SCM Engineering Lead
DISA ID52

-----Original Message-----
From: sacm [mailto:[email-masked]] On Behalf Of Danny Haynes
Sent: Monday, November 07, 2016 6:10 AM
To: sacmwg/draft-ietf-sacm-information-model
Cc: Comment; sacm
Subject: [Non-DoD Source] Re: [sacm] [sacmwg/draft-ietf-sacm-information-model] Consider differentiating classes of software within Software Inventory (#10)

—

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub<https://github.com/sacmwg/draft-ietf-sacm-information-model/issues/10#issuecomment-258832514>, or mute the thread<https://github.com/notifications/unsubscribe-auth/AMcywgJCPQXwAv8r7TCtjWszg5Wi3cs4ks5q7ySjgaJpZM4EC3sa>.

-- 
You are receiving this because you commented.
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-information-model/issues/10#issuecomment-258901866

---

From: Ira McDonald <[email-masked]>
Date: Mon, 7 Nov 2016 12:59:57 -0500

Hi Cliff,

Good point about the execution privileges of software.  Usually not
collected,
but very important info for assessing the actual risk to the monitored
system.

Cheers,
- Ira

On Mon, Nov 7, 2016 at 12:25 PM, cliffordk <[email-masked]> wrote:

> It may be worthwhile to model what privileges the software runs with.
> Software that runs with elevated privileges (higher than the user invoking
> it or giving it input) is subject to more vulnerabilities. Conversely,
> software that runs in a sandbox or container, with less privilege than the
> user, is subject to fewer vulnerabilities.
>
> This privilege question is often an attribute of the software, but
> sometimes it is a matter of how the software is run.
>
> Best,
> Cliff
>
> Subject: Re: [sacmwg/draft-ietf-sacm-information-model] Consider
> differentiating classes of software within Software Inventory (#10)
>
> We have had to worry about *where* an application is installed. For
> example, in our software inventory tool-for Windows devices, we have to
> look in the uninstall registry, in the windows application store, and in
> the Windows "features" to find installed software. We will also begin
> collecting executables that are mapped to file extensions which act as
> installed software, but aren't formally "installed." We also want to find
> browser plugins and extensions since they are software installed in
> software--and commonly have vulnerabilities.
>
> It seems like a classification system may need to be able to differentiate
> between the "types" of software, to some extent.
>
> The other issue we recently ran up against is trying to identify web sites
> and pages and database instances. Not so much because we really think web
> pages and database instances are "software" per se, but they behave a lot
> like software with respect to needing to be securely configured and being
> able to contain vulnerabilities based on running vulnerable code.
>
> Joseph L. Wolfkiel
> SCM Engineering Lead
> DISA ID52
> Subject: [Non-DoD Source] Re: [sacm] [sacmwg/draft-ietf-sacm-information-model]
> Consider differentiating classes of software within Software Inventory
> (#10)
>
> All active links contained in this email were disabled. Please verify the
> identity of the sender, and confirm the authenticity of all links contained
> within the message prior to copying and pasting the address to a Web
> browser.
>
>
> Here's a link to the DMTF SoftwareIdentity model (Caution-
> http://schemas.dmtf.org/wbem/cim-html/2.41.0+/CIM_SoftwareIdentity.html <
> Caution-http://schemas.dmtf.org/wbem/cim-html/2.41.0+/CIM_
> SoftwareIdentity.html > ). It contains a "classifications" attribute that
> distinguishes between operating systems, applications, firmware, etc.
>
> So, it sounds like if we have a way to distinguish between operating
> systems, applications, firmware, etc., we could remove these OS-related
> attributes?
>
> As a side note, I also came across a DMTF CIM profile for SWID tags
> (Caution-https://www.dmtf.org/sites/default/files/standards/
> documents/DSP1067_1.0.0.pdf < Caution-https://www.dmtf.org/
> sites/default/files/standards/documents/DSP1067_1.0.0.pdf > ) which may
> be of interest to the WG.
>
> —
> Reply to this email directly, view it on GitHub < Caution-
> https://github.com/sacmwg/draft-ietf-sacm-information-model/issues/10#
> issuecomment-258808649 > , or mute the thread < Caution-
> https://github.com/notifications/unsubscribe-auth/AKbE0WSjAk8-
> xss3b39USuCxOjzYIDmMks5q7wcZgaJpZM4EC3sa > . <Caution-https://github.com/
> notifications/beacon/AKbE0ZGJE9PXUselNoG2obY7YfWJzr
> xUks5q7wcZgaJpZM4EC3sa.gif>
>
>
>
> —
> Reply to this email directly, view it on GitHub<https://github.com/
> sacmwg/draft-ietf-sacm-information-model/issues/10#issuecomment-258832514>,
> or mute the thread<https://github.com/notifications/unsubscribe-auth/
> AMcywgJCPQXwAv8r7TCtjWszg5Wi3cs4ks5q7ySjgaJpZM4EC3sa>.
>
> —
> <https://github.com/sacmwg/draft-ietf-sacm-information-model/issues/10#issuecomment-258901866>,
> or mute the thread
> <https://github.com/notifications/unsubscribe-auth/AKbE0WGusk0Usy9DA73_d2efhcgVfJS_ks5q718MgaJpZM4EC3sa>
> .
>

---

From: Danny Haynes <[email-masked]>
Date: Mon, 07 Nov 2016 10:20:47 -0800

Hi Cliff,

I agree privilege is definitely something we want to consider. However, I think we may want to separate it out from software inventory. For example, one approach might be to cover it under the configuration of that software on an endpoint (e.g. looking at how a service is configured, or how a process is running, etc.).

Thanks,

Danny

-- 
You are receiving this because you commented.
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-information-model/issues/10#issuecomment-258917486

---

From: Danny Haynes <[email-masked]>
Date: Tue, 15 Nov 2016 18:35:25 -0800

During the IETF 97 SACM session, one member gave a +1 for the generic software subject with a class attribute and another member said just pick one and go.  Given that feedback and the feedback in the GitHub issue, I will go ahead and add a class attribute to the generic software instance subject (using values from CIM software identity and RFC2790) as well as remove the attributes specific to a type of software.

-- 
You are receiving this because you commented.
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-information-model/issues/10#issuecomment-260836778