Re: [sacm] IETF 95 Agenda on SWID world

[Tony Rutkowski <[e-mail]>]

Hi Lisa,

My apologies for the delay, but I did promise you
an updated list of the diverse SWID platforms
that are part of the rather expansive ecosystem
as it has evolved over the years.  The list ordering
here conveys a sense of acceptance and use to the
extent that is possible.  There is also some significant
overlap of specialty SWIDs such as OIDs for ASN.1
code that has been extensively used by the IETF for
MIBs.

To recap my points:

1) SWIDs are a unique, trusted identifier together
with attribute tags for software and an essential
component of cybersecurity in general and
asset management in particular

2) SWIDs for this purpose have existed for
decades and been the subject of many
standards and platforms

3)  The USG's effort to create a means to
provide interoperability among SWIDs by
developing a common structured expression
for “software units” in the form of ISO/IEC
19770-2 is useful (even if a bad choice of
venue and implementation tactics reminiscent
of the mistakes make three decades ago),

4) From what I can tell, the 2015 version is
much improved and simplified versus the old
2009 version - and apparently what is now
being used within the SACM/NISTIR 8060/
TCG work now ongoing

5) If the USG wants to encourage greater use
of the 19770-2 platform, it would be helpful to
identify all the significant industry SWID instantiations
such as provided in the attached slide, and create a
“SWID common structured expression” work item
in OASIS or other open standards body with well-
versioned freely available specifications, and using
19770-2:2015 to develop structured mappings
among the industry instantiations.

6) Not covered here are SWID lookup mechanisms
- which deserve treatment in conjunction with the
topic.

On 2016-04-07 8:55 AM, Lisa Lorenzin wrote:
>
> Hi Tony,
>
>
> I'm not deeply familiar with the SWID community -  I'm afraid I don't 
> know enough about that space to unpack what you're referring to. 
> Of the dozen other industry efforts you mention, can you suggest one 
> or two that have the relevant properties and/or are widely deployed?
>
>
> Regards,
>
> Lisa
>