Software object - reccomend to use CPE?

["Jason Keirstead" <Jason.Keirstead@ca.ibm.com>]

I have concerns about the Cybox "software" object, and how it is so free-form with no real limitations.

Based on experience of trying to map things based on software names, it will descend into a mess. You will have some vendors using the word "MSIE" and others using "Microsoft IE" and others using "Internet Explorer" and others using "Microsoft Internet Explorer", all in the same field (this is just one example).

Should we perhaps instead look to use CPE? Or at least suggesting using CPE where it fits as a SHOULD ? Why are we reinventing the wheel when CPE solved this...

-
Jason Keirstead
STSM, Product Architect, Security Intelligence, IBM Security Systems
www.ibm.com/security | www.securityintelligence.com

Without data, all you are is just another person with an opinion - Unknown