Re: Some SWID Tag Resources

["Landfield, Kent" <Kent_Landfield@McAfee.com>]

Thanks Dave.  I incorporated it into the Vulnerability related 
standards and efforts doc.

Thank you, Gracias, Grazie,  谢谢, Merci!, Спасибо!, Danke!, ありがとう, 
धन्यवाद!
 
-- 
Kent Landfield
+1.817.637.8026
kent_landfield@mcafee.com
 

On 12/14/17, 9:21 AM, "owner-cve-editorial-board-list@lists.mitre.org 
on behalf of Waltermire, David A. (Fed)" 
<owner-cve-editorial-board-list@lists.mitre.org on behalf of 
david.waltermire@nist.gov> wrote:

    Here are some software identification (SWID) tag resources:
    
    - Some general resources: https://scap.nist.gov/specifications/swid/
    
    - NISTIR 8060 provides an overview of the capabilities and usage of 
SWID tags. It also provides requirements for SWID tags that enable 
various cybersecurity use cases.
    
    http://nvlpubs.nist.gov/nistpubs/ir/2016/NIST.IR.8060.pdf
    
    - There is the CoSWID draft nearing completion in the IETF which 
defines an alternate serialization to the SWID tag XML format to 
support devices that may require a smaller tag footprint.
    
    https://datatracker.ietf.org/doc/draft-ietf-sacm-coswid/
    
    - NIST has produced a Java-based command-line SWID tag validator 
based on NISTIR 8060 and ISO/IEC 19770-2:2015. This tool can also be 
invoked by API. I plan to open source the tool and the Decima library 
which provides the validation functionality.
    
    https://scap.nist.gov/specifications/swid/ (under "SWID Tag 
Validation Tool")
    
    Regards,
    Dave