Re: [Iotops] Relevant ETSI work on consumer IoT security

[Michael Richardson <[e-mail]>]

Jasper Pandza <jasper.pandza=[e-mail]> wrote:
    > With reference to draft-moran-iot-nets-02 and as promised in my
    > intervention yesterday, here is an overview of ETSI’s work on security for
    > connected consumer devices.

    > EN 303 645
    > <https://www.etsi.org/deliver/etsi_en/303600_303699/303645/02.01.01_60/en_303645v020101p.pdf>
    > – baseline requirements for consumer IoT security. Worth noting this
    > includes both technical and procedural (e.g. vulnerability disclosure)
    > requirements. Whilst it says “European Standard (EN)”, this work had
    > contributions from a global stakeholder community.

Jasper thank you bringing this up.

And while there have been many carrots (and I was a subject-matter expert
for: https://www.iotsecurityfoundation.org/consumer-iot/ which dealt with
three key parts of 303645),   we still don't know what kind of sticks will be
applied.

What we really need is some real (public) consequences for shipping devices
that do not get this right.  Until when the CFO notices will we get some real
progress.

draft-richardson-t2trg-idevid-considerations was in part a response to
getting devices to ship with something-unique inserted at factory.
(whether it's a unique password or a unique private key...)

I've heard at previous RIPE meetings about potential EU regulations in this
space.  What's the UK situation?  Any new progress?  It would be great to
hear about this at a future IOTOPS meeting.

    > So, at least for the consumer domain, I think we have already gone a
    > significant way in addressing the problem statement identified in section 1
    > of the above paper.

    > The relevant ETSI committee (TC CYBER) would welcome further contributions,
    > including from the IETF community. I can make introductions if needed.



--
Michael Richardson <[e-mail]>, Sandelman Software Works
 -= IPv6 IoT consulting =-