Subject: Re: [sacm] Updated IETF 95 Agenda Posted

From: Lisa Lorenzin <[email-masked]>
Date: Fri, 1 Apr 2016 16:04:40 +0000

Hi Adam et al.,

Now that the WGLC last call for the requirements draft has completed with no new issues raised, I have a follow-up request:

Like Jim, I can only attend on Wednesday; I'd like to be able to participate in the ECP conversation   Can we move it to Wednesday by either dropping the requirements draft entirely, or moving the requirements draft to Friday?

Regarding the requirements draft - I don't think we need 20 minutes for it in BA:  
  * All four remaining open issues from github were addressed in the latest version, based on the agreements reached either in the issue thread or at the last virtual interim.
  * The updates to address those issues were all brief - two of them add one sentence each; two of them change one word each.
  * No new issues were raised in the WGLC.

So I believe we could drop the requirements draft entirely from the F2F agenda and move directly to a call for consensus to progress the draft, based on the lack of objections in the WGLC.  

If it's mandatory to review the changes at an F2F before doing so, I believe that will only take about 5 minutes.  Either way, I think the remaining 15 or 20 minutes on Friday would be much better spent on the terminology draft!

Regards,
Lisa

-----Original Message-----
From: sacm [mailto:[email-masked]] On Behalf Of Adam Montville
Sent: Tuesday, March 29, 2016 8:03 PM
To: <[email-masked]> <[email-masked]>
Subject: [sacm] Updated IETF 95 Agenda Posted

I’ve updated the agenda based on Jim’s request to move the information model forward (I swapped it with SWID).

If you are on the agenda as a presenter, please get your slides to the chairs at least the day before our Wednesday session.  Also, please let us know if you need to present remotely so we can loop in the MeetEcho folks as necessary.

Finally, and as always, we’re going to need a couple of people in the room to take notes and a jabber scribe.  Any early takers?

Kind regards,

Adam

---

From: Adam Montville <[email-masked]>
Date: Fri, 1 Apr 2016 13:27:08 -0500

I have no issue dropping that slot entirely and using that time for ECP.

If no one objects over the next day or so, I’ll gladly update the agenda.  My understanding is that as long as no issues were raised during WGLC we can progress the draft.

Thanks for offering up opinions—agenda as originally posted was just a proposed starting place.

Adam

> On Apr 1, 2016, at 11:04 AM, Lisa Lorenzin <[email-masked]> wrote:
> 
> Hi Adam et al.,
>

---

From: Adam Montville <[email-masked]>
Date: Fri, 1 Apr 2016 13:27:08 -0500

Adam

---

From: Tony Rutkowski <[email-masked]>
Date: Thu, 7 Apr 2016 08:00:57 -0400

Hi Adam,

Interesting to seem the presentations and
brainstorming on materials.  A few "inquiring
minds" questions.

For the Information Model Update presentation,
slide 9 portrays two SWIDS: "SWID XML Schema"
and "SWID CBOR Data Definition."  It's not clear
what the former represents, and the latter
presumably will eventually be revealed in
draft-birkholz-sacm-coswid-00.

The SWID CBOR effort usefully begins to head
slowly in the right direction of getting real, but it
refers to ISO/IEC 19770-2:2015 as the source
of SWID information structures, and combined
with ISO/IEC 19770-5:2013 also referenced, sets
one back $389 to take a peek at them.  Maybe that's
easy change for a government agency, but no one in
the real world is going to spend that amount to
take a peek at a specification.

  The problem here is compounded because NISTIR
8060 is out on the street for comment, but it references
the 2009 version.  To make matters worse, the NISTIR
references the 2015 version as an extension schema,
but the URL to get the extension schema is broken.
http://csrc.nist.gov/ns/swid/2015-extensions/1.0

Not that this isn't elegant work, but it has the surreal
attributes that pervaded the OSI world 30 years ago
where the previous generation of some of the same
government agency actors inhabited standards
meetings - writing for years some of the best
specifications that no one ever used.

There are at least a dozen other industry SWID
standards efforts out there if there was an interest
in looking.  They have better properties for the
context, and some of those are used on a significant
scale.  But then again, it's kind of fun watching the
deja vu of OSI getting reinvented in the IETF!

--tony

ps. If the authors revise the SWID CBOR draft, finding
the details of X.1520 is easy.  In English, it is at:
<https://www.itu.int/rec/dologin_pub.asp?lang=e&id=T-REC-X.1520-201401-I!!PDF-E&type=items>

---

From: Adam Montville <[email-masked]>
Date: Thu, 7 Apr 2016 09:28:03 -0300

Tony,

Thanks for your comments, insights, and references.  I think SWID is a starting point, as any reasonable engineer would recognize that no single software identification standard will get security automation across the goal line.

To clarify the SWID XML/CBOR confusion, that was an example of the boundaries between information models, data models, and serializations.  If you have an opportunity, you should review the MeetEcho recording.

Kind regards,

Adam

> On Apr 7, 2016, at 9:00 AM, Tony Rutkowski <[email-masked]> wrote:
> 
> Hi Adam,
>

---

From: Tony Rutkowski <[email-masked]>
Date: Thu, 7 Apr 2016 08:50:36 -0400

Hi Adam,

My apologies for being irreverent, but watching
this OSI SC7 SWID effort unfold over the past ten
years is like watching OSI unfolding in the 1980s.
It's like malware that has now infected the IETF.

There are multiple ways of accomplishing the
objective within the industry today.  You need to
begin to look at how this is being done and how those
different approaches can be made to interoperate
without trying to cram it all into a hopeless ISO
standard with (from what I can tell) 105 different
xml data elements and 43 complex types.

Just as it was in the 1980s, it's a waste of good
talent and resources.

--tony

---

From: Lisa Lorenzin <[email-masked]>
Date: Thu, 7 Apr 2016 12:55:56 +0000

Hi Tony,

I'm not deeply familiar with the SWID community -  I'm afraid I don't know enough about that space to unpack what you're referring to. Of the dozen other industry efforts you mention, can you suggest one or two that have the relevant properties and/or are widely deployed?

Regards,

Lisa

Lisa Lorenzin
Principal Solutions Architect, Pulse Secure
919-384-7275<tel:919-384-7275> | [email-masked]<mailto: [email-masked]>

Please pardon brevity - sent from my phone

------ Original message------

From: Tony Rutkowski

Date: Thu, Apr 7, 2016 09:01

To: Adam Montville;

Cc: ;

Subject:[sacm] IETF 95 Agenda on SWID world

Hi Adam,

--tony

_______________________________________________
sacm mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/sacm

---

From: "Cheikes, Brant A." <[email-masked]>
Date: Thu, 7 Apr 2016 19:08:57 +0000

Just to correct the record:

* NIST IR 8060 is currently available in its fourth public draft for comment. The final draft is due imminently.

* IR 8060 cites the 2009 version of the SWID spec, but clearly states (first sentence, second paragraph, Introduction) that "This 
report provides an overview of the capabilities and usage of SWID tags defined by the ISO/IEC 19770-2:2015 standard."

* IR 8060 does not "[reference] the 2015 version as an extension schema". We introduce an extension schema to support a handful of guidelines in the IR. The link to that schema is broken until the final version of the IR is published.

With that, I need to get back to reinventing decades-old work.

/Brant

P.S. The relevance of X.1520 (common vulnerabilities and exposures) to SWID CBOR needs to be clarified. -b

-----Original Message-----
From: sacm [mailto:[email-masked]] On Behalf Of Tony Rutkowski
Sent: Thursday, April 07, 2016 8:01 AM
To: Adam Montville <[email-masked]>
Cc: <[email-masked]> <[email-masked]>
Subject: [sacm] IETF 95 Agenda on SWID world

Hi Adam,

Interesting to seem the presentations and brainstorming on materials.  A few "inquiring minds" questions.

For the Information Model Update presentation, slide 9 portrays two SWIDS: "SWID XML Schema"
and "SWID CBOR Data Definition."  It's not clear what the former represents, and the latter presumably will eventually be revealed in draft-birkholz-sacm-coswid-00.

The SWID CBOR effort usefully begins to head slowly in the right direction of getting real, but it refers to ISO/IEC 19770-2:2015 as the source of SWID information structures, and combined with ISO/IEC 19770-5:2013 also referenced, sets one back $389 to take a peek at them.  Maybe that's easy change for a government agency, but no one in the real world is going to spend that amount to take a peek at a specification.

  The problem here is compounded because NISTIR
8060 is out on the street for comment, but it references the 2009 version.  To make matters worse, the NISTIR references the 2015 version as an extension schema, but the URL to get the extension schema is broken.
http://csrc.nist.gov/ns/swid/2015-extensions/1.0

Not that this isn't elegant work, but it has the surreal attributes that pervaded the OSI world 30 years ago where the previous generation of some of the same government agency actors inhabited standards meetings - writing for years some of the best specifications that no one ever used.

There are at least a dozen other industry SWID standards efforts out there if there was an interest in looking.  They have better properties for the context, and some of those are used on a significant scale.  But then again, it's kind of fun watching the deja vu of OSI getting reinvented in the IETF!

--tony

ps. If the authors revise the SWID CBOR draft, finding the details of X.1520 is easy.  In English, it is at:
<https://www.itu.int/rec/dologin_pub.asp?lang=e&id=T-REC-X.1520-201401-I!!PDF-E&type=items>

[email-masked]

---

From: Tony Rutkowski <[email-masked]>
Date: Thu, 7 Apr 2016 16:43:26 -0400

Hi Brant,

That's OK.  It'll provide an opportunity for
some latter-day Marshall T. Rose to develop
a Simple SWID RFC!  Notwithstanding many
doing that already.  Ironically, OIDs plus
ORS is one of the more interesting neo-SWID
platforms being advanced.

The CVE reference is simply to provide a use
case for SWID CBOR in the context of exchanging
vulnerability information.  A simple Google search
provides several thousand examples of that nexus
being made, so it hardly the first time the use case
has been made.

--tony

---

From: Tony Rutkowski <[email-masked]>
Date: Wed, 20 Apr 2016 16:30:45 -0400

Hi Lisa,

My apologies for the delay, but I did promise you
an updated list of the diverse SWID platforms
that are part of the rather expansive ecosystem
as it has evolved over the years.  The list ordering
here conveys a sense of acceptance and use to the
extent that is possible.  There is also some significant
overlap of specialty SWIDs such as OIDs for ASN.1
code that has been extensively used by the IETF for
MIBs.

To recap my points:

1) SWIDs are a unique, trusted identifier together
with attribute tags for software and an essential
component of cybersecurity in general and
asset management in particular

2) SWIDs for this purpose have existed for
decades and been the subject of many
standards and platforms

3)  The USG's effort to create a means to
provide interoperability among SWIDs by
developing a common structured expression
for “software units” in the form of ISO/IEC
19770-2 is useful (even if a bad choice of
venue and implementation tactics reminiscent
of the mistakes make three decades ago),

4) From what I can tell, the 2015 version is
much improved and simplified versus the old
2009 version - and apparently what is now
being used within the SACM/NISTIR 8060/
TCG work now ongoing

5) If the USG wants to encourage greater use
of the 19770-2 platform, it would be helpful to
identify all the significant industry SWID instantiations
such as provided in the attached slide, and create a
“SWID common structured expression” work item
in OASIS or other open standards body with well-
versioned freely available specifications, and using
19770-2:2015 to develop structured mappings
among the industry instantiations.

6) Not covered here are SWID lookup mechanisms
- which deserve treatment in conjunction with the
topic.

On 2016-04-07 8:55 AM, Lisa Lorenzin wrote:
>
> Hi Tony,
>
>
> I'm not deeply familiar with the SWID community -  I'm afraid I don't 
> know enough about that space to unpack what you're referring to. 
> Of the dozen other industry efforts you mention, can you suggest one 
> or two that have the relevant properties and/or are widely deployed?
>
>
> Regards,
>
> Lisa
>