Re: [cti-cybox] Software object - reccomend to use CPE?

[Patrick Maroney <Pmaroney@Specere.org>]

Re: "I'm not suggesting adopting the XML format": This was understood.

How do we define/reference the CPE naming dictionaries?  Or do we just define it as a String?

Patrick Maroney
President
Integrated Networking Technologies, Inc.
Desk: (856)983-0001
Cell: (609)841-5104
Email: pmaroney@specere.org

_____________________________
From: Jason Keirstead <jason.keirstead@ca.ibm.com>
Sent: Friday, September 23, 2016 8:40 AM
Subject: Re: [cti-cybox] Software object - reccomend to use CPE?
To: Patrick Maroney <pmaroney@specere.org>
Cc: Paul Patrick <paul.patrick@fireeye.com>, OASIS CTI TC CybOX SC list <cti-cybox@lists.oasis-open.org>, Jason Keirstead <jason.keirstead@ca.ibm.com>, 寺田真敏 / TERADA，MASATO <masato.terada.rd@hitachi.com>, Coderre, Robert <rcoderre@verisign.com>

I'm not suggesting adopting the XML format, simply the naming dictionary for entries.

cpe:2.3:a:adobe:acrobat:10.1:*:*:*:*:*:*:*

Vendor: adobe
Product: acrobat
Version: 10.1


cpe:2.3:a:google:chrome:0.2.149.27:*:*:*:*:*:*:*
Vendor: google
Product: chrome
Version: 0.2.149.27
-
Jason Keirstead
STSM, Product Architect, Security Intelligence, IBM Security Systems
www.ibm.com/security | www.securityintelligence.com

Without data, all you are is just another person with an opinion - Unknown


Patrick Maroney ---09/23/2016 09:30:32 AM---[+1] on the concept of adopting CPE. However, since CPE is defined in XML and requires support dict

From: Patrick Maroney <Pmaroney@Specere.org>
To: 寺田真敏 / TERADA，MASATO <masato.terada.rd@hitachi.com>, Paul Patrick <paul.patrick@fireeye.com>
Cc: OASIS CTI TC CybOX SC list <cti-cybox@lists.oasis-open.org>, Jason Keirstead/CanEast/IBM@IBMCA, "Coderre, Robert" <rcoderre@verisign.com>
Date: 09/23/2016 09:30 AM
Subject: Re: [cti-cybox] Software object - reccomend to use CPE?

---

[+1] on the concept of adopting CPE. However, since CPE is defined in XML and requires support dictionary extensions (also in XML) it's not clear how we can subsume this directly.

We have this challenge with adoption of other XML based standards.

(1) What's the current strategy?
(2) If we don't have a strategy, does this broader issue warrant a working group?

Patrick Maroney
President
Integrated Networking Technologies, Inc.
Desk: (856)983-0001
Cell: (609)841-5104
Email: pmaroney@specere.org

---

From: cti-cybox@lists.oasis-open.org <cti-cybox@lists.oasis-open.org> on behalf of 寺田真敏 / TERADA，MASATO <masato.terada.rd@hitachi.com>
Sent: Thursday, September 22, 2016 11:54:04 PM
To: Paul Patrick
Cc: Coderre, Robert; Jason Keirstead; OASIS CTI TC CybOX SC list
Subject: Re: Re: [cti-cybox] Software object - reccomend to use CPE?


+2 for using CPE

{Masato Terada}
Hitachi Incident Response Team
masato.terada.rd@hitachi.com
+81-90-4369-3601

On Sep 23, 2016, at 10:56, Paul Patrick <Paul.Patrick@FireEye.com> wrote:

+1 for using CPE

From: <cti-cybox@lists.oasis-open.org> on behalf of "Coderre, Robert" <rcoderre@verisign.com>
Date: Thursday, September 22, 2016 at 6:36 PM
To: Jason Keirstead <Jason.Keirstead@ca.ibm.com>
Cc: OASIS CTI TC CybOX SC list <cti-cybox@lists.oasis-open.org>
Subject: Re: [cti-cybox] Software object - reccomend to use CPE?

I would support using CPE as a SHOULD in this case. It's what we've standardized on as a product identifier.


CPE is not without its limitations, but it's better than a free form text field. Although, for giggles, you should look up Internet Explorer in the CPE dictionary at the NVD site...

--
Rob Coderre
iDefense, Director of Product Management
Verisign, Inc.
rcoderre@verisign.com
o: +1 703-948-3833
m: +1 571-224-4627

On Sep 22, 2016, at 8:41 PM, Jason Keirstead <Jason.Keirstead@ca.ibm.com> wrote:
I have concerns about the Cybox "software" object, and how it is so free-form with no real limitations.

Based on experience of trying to map things based on software names, it will descend into a mess. You will have some vendors using the word "MSIE" and others using "Microsoft IE" and others using "Internet Explorer" and others using "Microsoft Internet Explorer", all in the same field (this is just one example).

Should we perhaps instead look to use CPE? Or at least suggesting using CPE where it fits as aSHOULD ? Why are we reinventing the wheel when CPE solved this...

-
Jason Keirstead
STSM, Product Architect, Security Intelligence, IBM Security Systems
http://www.ibm.com/security |http://www.securityintelligence.com

Without data, all you are is just another person with an opinion - Unknown
This email and any attachments thereto may contain private, confidential, and/or privileged material for the sole use of the intended recipient. Any review, copying, or distribution of this email (or any attachments thereto) by others is strictly prohibited. If you are not the intended recipient, please contact the sender immediately and permanently delete the original and any copies of this email and any attachments thereto.