[Iotops] Relevant ETSI work on consumer IoT security

[Jasper Pandza <[e-mail]>]

Hello IoT Ops,

With reference to draft-moran-iot-nets-02 and as promised in my
intervention yesterday, here is an overview of ETSI’s work on security for
connected consumer devices.

EN 303 645
<https://www.etsi.org/deliver/etsi_en/303600_303699/303645/02.01.01_60/en_303645v020101p.pdf>
– baseline requirements for consumer IoT security. Worth noting this
includes both technical and procedural (e.g. vulnerability disclosure)
requirements. Whilst it says “European Standard (EN)”, this work had
contributions from a global stakeholder community.

TS 103 701
<https://www.etsi.org/deliver/etsi_ts/103700_103799/103701/01.01.01_60/ts_103701v010101p.pdf>
– assessment specification. Tells you how one might assess devices against
the (sometimes outcome-focused) requirements of the EN.

TR 103 621
<https://www.etsi.org/deliver/etsi_tr/103600_103699/103621/01.02.01_60/tr_103621v010201p.pdf>
– the implementation guide. Attempts to provide accessible guidance to
manufacturers how to implement each provision of the EN, using multiple
example implementations.

Full overview: https://www.etsi.org/technologies/consumer-iot-security

Additionally:  https://iotsecuritymapping.com/ - this maps a wide variety
of guides/standards to EN 303 645.

So, at least for the consumer domain, I think we have already gone a
significant way in addressing the problem statement identified in section 1
of the above paper.

The relevant ETSI committee (TC CYBER) would welcome further contributions,
including from the IETF community. I can make introductions if needed.

All the best,
Jasper