Subject: Re: [sacm] I-D Action: draft-ietf-sacm-information-model-01.txt

From: Tony Rutkowski <[email-masked]>
Date: Mon, 09 Mar 2015 18:28:42 -0400

Hi Dan, Adam,

This draft still has all the SWID exclusivity provisions
in it. Wasn't this supposed to be changed so that
SWIDs were not the singularity for software identification?
Does anyone really believe the entire world will
be SWIDified, and bet the SACM farm on it?
That this is occurring in the IETF is all the more
inappropriate.

Even now, the mobile industry is adopting an
OS vendor app software ID friendly specification.
Reference the GSMA IARU spec for T-API & N-API.

--tony

On 2015-02-20 9:36 AM, [email-masked] wrote:
> A New Internet-Draft is available from the on-line Internet-Drafts directories.
>   This draft is a work item of the Security Automation and Continuous Monitoring Working Group of the IETF.
>
>          Title           : SACM Information Model
>          Authors         : David Waltermire
>                            Kim Watson
>                            Clifford Kahn
>                            Lisa Lorenzin
> 	Filename        : draft-ietf-sacm-information-model-01.txt
> 	Pages           : 81
> 	Date            : 2015-02-20
>
> Abstract:
>     This document proposes an information model for SACM.
>

---

From: "Cheikes, Brant A." <[email-masked]>
Date: Wed, 11 Mar 2015 16:04:49 +0000

I just reviewed the latest information model document. I do not see any "SWID exclusivity provisions." I only see "MAY" and "recommended".

/Brant

Brant A. Cheikes
The MITRE Corporation
202 Burlington Road, M/S M300
Bedford, MA 01730-1420
Tel. 781-271-7505; Cell. 617-694-8180; Fax. 781-271-2352

From: sacm [mailto:[email-masked]] On Behalf Of Tony Rutkowski
Sent: Monday, March 09, 2015 6:29 PM
To: [email-masked]; [email-masked]
Cc: [email-masked]
Subject: Re: [sacm] I-D Action: draft-ietf-sacm-information-model-01.txt

Hi Dan, Adam,

--tony
On 2015-02-20 9:36 AM, [email-masked]<mailto:[email-masked]> wrote:

                          Kim Watson

                          Clifford Kahn

                          Lisa Lorenzin

  Pages           : 81

  Date            : 2015-02-20

Abstract:

---

From: Tony Rutkowski <[email-masked]>
Date: Wed, 11 Mar 2015 13:58:28 -0400

Hi Brant,

While it is true that ISO SWIDs for identifying software
is not mandated in the SACM model with a MUST, they are
mentioned 19 times and have entire sections devoted
to evangelizing them.  Perhaps most importantly, the
model fails to describe any other software identification
mechanisms, or provide for them.

Numerous other industry bodies and OS developer
communities have treated this same need, and
developed flexible, extensible models that allow
for the diversity of how software is identified.  The
draft here needs to evolve in the same direction.

The SWID approach that relies on a single global
registration scheme based on a private standard that
costs $200 to look at, may suit a few vendors, but it
hardly scales or reflects in any realistic way, the
world that exists today.  It seems a "fail by design"
approach that SACM does not need.

Perhaps the -02 version can improve on these
matters.

--t

On 2015-03-11 12:04 PM, Cheikes, Brant A. wrote:
>
> I just reviewed the latest information model document. I do not see 
> any “SWID exclusivity provisions.” I only see “MAY” and “recommended”.
>

---

From: "Lorenzin, Lisa" <[email-masked]>
Date: Wed, 11 Mar 2015 18:09:39 +0000

Hi Tony,

As an editor of the information model draft - and speaking only for myself - I believe the current draft's focus on SWIDs is a reflection of the knowledge base of the current editors and contributors, not an intentional exclusion of other approaches. 

I further believe that the -02 version is only likely to "improve on these matters" if those desiring the improvement contribute content towards that goal.  If you are interested in providing draft text reflecting some of these other models, I will personally be very happy to incorporate that text for discussion in the -02 draft.

Regards,
Lisa

-----Original Message-----
From: sacm [mailto:[email-masked]] On Behalf Of Tony Rutkowski
Sent: Wednesday, March 11, 2015 1:58 PM
To: Cheikes, Brant A.; [email-masked]
Subject: Re: [sacm] I-D Action: draft-ietf-sacm-information-model-01.txt

Hi Brant,

While it is true that ISO SWIDs for identifying software is not mandated in the SACM model with a MUST, they are mentioned 19 times and have entire sections devoted to evangelizing them.  Perhaps most importantly, the model fails to describe any other software identification mechanisms, or provide for them.

Numerous other industry bodies and OS developer communities have treated this same need, and developed flexible, extensible models that allow for the diversity of how software is identified.  The draft here needs to evolve in the same direction.

The SWID approach that relies on a single global registration scheme based on a private standard that costs $200 to look at, may suit a few vendors, but it hardly scales or reflects in any realistic way, the world that exists today.  It seems a "fail by design"
approach that SACM does not need.

Perhaps the -02 version can improve on these matters.

--t

---

From: "Waltermire, David A." <[email-masked]>
Date: Wed, 11 Mar 2015 18:16:27 +0000

+1

Thanks,
Dave

-----Original Message-----
From: sacm [mailto:[email-masked]] On Behalf Of Lorenzin, Lisa
Sent: Wednesday, March 11, 2015 2:10 PM
To: [email-masked]; Cheikes, Brant A.; [email-masked]
Subject: Re: [sacm] I-D Action: draft-ietf-sacm-information-model-01.txt

Hi Tony,

Regards,
Lisa

-----Original Message-----
From: sacm [mailto:[email-masked]] On Behalf Of Tony Rutkowski
Sent: Wednesday, March 11, 2015 1:58 PM
To: Cheikes, Brant A.; [email-masked]
Subject: Re: [sacm] I-D Action: draft-ietf-sacm-information-model-01.txt

Hi Brant,

--t

_______________________________________________
sacm mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/sacm

---

From: Tony Rutkowski <[email-masked]>
Date: Wed, 11 Mar 2015 14:35:04 -0400

Hi Lisa,

Will be pleased to help do that.  I expect there
will be other volunteers as well. When the SWID
approach was vetted at the annual security assurance
conference a couple of years ago, some of the
major OS vendors present promised to step up
to the plate after vociferously rejecting SWIDs,
but didn't further engage.

This same requirement was vetted across 3GPP
SA3, SA2, and CT over a recent 18 month period
they started with a global registration like solution,
and after interactions with major vendors,
developed a more accommodating and extensible
approach that's embedded in a structured expression
in Rel. 12 of the global infrastructure.  The GSMA
standards working group FASG also recently
emulated that approach for it's attempt to identify
mobile software for security assurance purposes.
3GPP SA3 is now pursuing work rather similar
to SACM (known as SCAS) and developing a software
identifier expression.  [For some reason, all these
stovepipes in this business seem to favor four letter
acronym names beginning with S and using almost
the same letter set.]

So it looks like we have a useful go-forward plan here.

thanks,
tony

---

From: Kathleen Moriarty <[email-masked]>
Date: Wed, 11 Mar 2015 15:38:44 -0400

Tony,

You will be providing text suitable for the draft that includes other
methods then?

Thank you,
Kathleen

On Wed, Mar 11, 2015 at 2:35 PM, Tony Rutkowski <[email-masked]> wrote:

>> As an editor of the information model draft - and speaking only for
>> myself - I believe the current draft's focus on SWIDs is a reflection of
>> the knowledge base of the current editors and contributors, not an
>> intentional exclusion of other approaches.
>>
>> I further believe that the -02 version is only likely to "improve on
>> these matters" if those desiring the improvement contribute content towards
>> that goal.  If you are interested in providing draft text reflecting some
>> of these other models, I will personally be very happy to incorporate that
>> text for discussion in the -02 draft.
>>
>> Regards,
>> Lisa
>>
>

-- 

Best regards,
Kathleen

---

From: Tony Rutkowski <[email-masked]>
Date: Wed, 11 Mar 2015 15:52:37 -0400

Kathleen,

I'll gather existing specs of which I'm aware.
I expect that the major OS platform vendors
will want to engage here as well.  This is important
and it needs to be a team effort.  As I recall,
others after engaging in similar exercises ended
up with something simple, e.g. UUID + scheme.
The problem here isn't exactly new to the IETF
or the industry.

Thirty years ago in the old CCITT-ISO world, all
software was supposed to have a unique OID.
As you know, more recently, Bob Kahn has been
proposing handles and DOIs.  Both of those are
SWID like schemes.  This is almost the industry's
oldest problem - which never changes, only a
new generation of people.  Maybe we can find
a future proof solution. :-)

--tony

---

From: "Cheikes, Brant A." <[email-masked]>
Date: Wed, 11 Mar 2015 20:00:56 +0000

Microsoft is backing SWID. We need to know more about Apple and Android; are they open to adopting an open standard? My understanding from at least one Linux vendor is that their native package manager supports auto generation of SWIDs.

/Brant

Sent with Good (www.good.com)

-----Original Message-----
From: Tony Rutkowski [[email-masked]<mailto:[email-masked]>]
Sent: Wednesday, March 11, 2015 02:35 PM Eastern Standard Time
To: Lorenzin, Lisa; Cheikes, Brant A.; [email-masked]
Subject: Re: [sacm] I-D Action: draft-ietf-sacm-information-model-01.txt

Hi Lisa,

thanks,
tony

---

From: Tony Rutkowski <[email-masked]>
Date: Thu, 12 Mar 2015 07:25:43 -0400

Hi Lisa,

The attached document from a GSMA
Security Group (now the Security and
Fraud Group) meeting two years ago
provides a useful summary of alternative
software identification approaches, including
rather difficult to find information from the
3GPP work.

It is now two years old and this material
needs to be updated and expanded.  This
doesn't provide needed specific text for
the SACM information model, but it at
least begins to set the use cases and
requirements for the text.

For those of you not familiar with the venue
here, the GSMA is the global body for all
the world's mobile operators and vendors -
based in London.  It is an extremely active
group that has numerous active working
groups - one of which deals with security
and fraud (FASG) They exchange information
about security assurance and threats,
publish their own standards, run global
databases, and engage with other industry
standards bodies, especially the 3GPP
behemoth that turns out mandatory standards
for what is essentially the operating system
for the global mobile infrastructure now
on Release 12.

3GPP SA3 (security) is presently engaged in
an activity analogous to SACM that will be
overseen by GSMA FASG.  It was started after
a Common Criteria Recognition Authority
briefing about 18 months ago.  SA3 meets
every 60-90 days different places around
the world.  It would be a good thing to
find a wormhole between the SACM and SA3
parallel universes.

--tony

---

From: "Cheikes, Brant A." <[email-masked]>
Date: Thu, 12 Mar 2015 18:54:57 +0000

Honestly, I don't know what to make of this. One conclusion is that mobile platforms are simply a different beast from the platforms more familiar to me (Windows, Unix/Linux, MacOS), and that the software identification/characterization issues and requirements for mobile are completely different than those for Windows/etc. I do not see the mobile software identification solutions described in the GSMA document working on, say, Windows. That is, I do not see the described GSMA approaches coming anywhere close to meeting the (unarticulated) requirements that I believe SACM has for interoperable solutions to identifying and characterizing installed and discoverable software in Windows environments. I'm open to persuasion on that point. I can certainly imagine that people approaching the software ID/characterization problem from the mobile perspective could feel that SWID tags are irrelevant. But I'm not confident that the solutions apparently in use on mobile platforms will give SACM what it needs generally.

This group needs to find a way to get beyond the tired "Yay SWID"/"Boo SWID" non-debate we've episodically had. Is it time to organize a small task force to gather requirements for software identification and characterization within scope for SACM, evaluate available options (including those Tony has proposed), and develop recommendations for the broader SACM community to consider?

/Brant

Brant A. Cheikes
The MITRE Corporation

-----Original Message-----
From: Tony Rutkowski [mailto:[email-masked]] 
Sent: Thursday, March 12, 2015 7:26 AM
To: Lorenzin, Lisa; Cheikes, Brant A.; [email-masked]
Subject: Re: [sacm] I-D Action: draft-ietf-sacm-information-model-01.txt

Hi Lisa,

The attached document from a GSMA
Security Group (now the Security and
Fraud Group) meeting two years ago
provides a useful summary of alternative software identification approaches, including rather difficult to find information from the 3GPP work.

It is now two years old and this material needs to be updated and expanded.  This doesn't provide needed specific text for the SACM information model, but it at least begins to set the use cases and requirements for the text.

For those of you not familiar with the venue here, the GSMA is the global body for all the world's mobile operators and vendors - based in London.  It is an extremely active group that has numerous active working groups - one of which deals with security and fraud (FASG) They exchange information about security assurance and threats, publish their own standards, run global databases, and engage with other industry standards bodies, especially the 3GPP behemoth that turns out mandatory standards for what is essentially the operating system for the global mobile infrastructure now on Release 12.

3GPP SA3 (security) is presently engaged in an activity analogous to SACM that will be overseen by GSMA FASG.  It was started after a Common Criteria Recognition Authority briefing about 18 months ago.  SA3 meets every 60-90 days different places around the world.  It would be a good thing to find a wormhole between the SACM and SA3 parallel universes.

--tony

---

From: "Lorenzin, Lisa" <[email-masked]>
Date: Thu, 12 Mar 2015 18:59:31 +0000

+1 for the software identification subteam suggestion.

Regards,
Lisa

-----Original Message-----
From: sacm [mailto:[email-masked]] On Behalf Of Cheikes, Brant A.
Sent: Thursday, March 12, 2015 2:55 PM
To: [email-masked]
Subject: Re: [sacm] I-D Action: draft-ietf-sacm-information-model-01.txt

Honestly, I don't know what to make of this. One conclusion is that mobile platforms are simply a different beast from the platforms more familiar to me (Windows, Unix/Linux, MacOS), and that the software identification/characterization issues and requirements for mobile are completely different than those for Windows/etc. I do not see the mobile software identification solutions described in the GSMA document working on, say, Windows. That is, I do not see the described GSMA approaches coming anywhere close to meeting the (unarticulated) requirements that I believe SACM has for interoperable solutions to identifying and characterizing installed and discoverable software in Windows environments. I'm open to persuasion on that point. I can certainly imagine that people approaching the software ID/characterization problem from the mobile perspective could feel that SWID tags are irrelevant. But I'm not confident that the solutions apparently in use on mobile platforms will give SACM wh  at it needs generally.

/Brant

Brant A. Cheikes
The MITRE Corporation

-----Original Message-----
From: Tony Rutkowski [mailto:[email-masked]]
Sent: Thursday, March 12, 2015 7:26 AM
To: Lorenzin, Lisa; Cheikes, Brant A.; [email-masked]
Subject: Re: [sacm] I-D Action: draft-ietf-sacm-information-model-01.txt

Hi Lisa,

--tony

---

From: "Adam W. Montville" <[email-masked]>
Date: Fri, 13 Mar 2015 07:14:31 -0500

I’m certainly not opposed to such a sub/design team - we’ve got one going now for endpoint identification.  I’m also not certain such a sub/design team is yet needed.  I think we would all agree that there will be no “one way" to identify software, that each existing specification likely has a role to play, that future software identification methods and specifications will come about, and that some software in the wild won’t be covered by known software identification methods (or potentially by proprietary identification methods).

Rather than form a software identification team straight away, I’d like to see the information model updated to accommodate a general software identification method.

Adam

> On Mar 12, 2015, at 1:59 PM, Lorenzin, Lisa <[email-masked]> wrote:
>

---

From: "Lorenzin, Lisa" <[email-masked]>
Date: Fri, 13 Mar 2015 13:32:31 +0000

Hi Adam,

One challenge I see here is that there is no established "general software identification method" (the fun thing about standards is that there are so many to choose from!), inventing one seems far outside the scope of this group, and so the info model is going to reflect what the editors and contributors are familiar with.  You have a NIST editor, you get SWIDs.  :)

I think we absolutely need to build in extensibility, so that more than one method can be used - but I also think we need to define at least one mandatory-to-implement standard method in enough detail that end users can expect interoperability out of the box when using that method...   If we have the expertise and cycles to fully specify how to apply additional (optional) methods based on other standards, even better! That gives an even higher likelihood of OOB interoperability.

Regards,
Lisa

-----Original Message-----
From: Adam W. Montville [mailto:[email-masked]] 
Sent: Friday, March 13, 2015 8:15 AM
To: Lorenzin, Lisa
Cc: Cheikes, Brant A.; [email-masked]
Subject: Re: [sacm] I-D Action: draft-ietf-sacm-information-model-01.txt

Adam