Re: [Mud] how to increase trust in MUD URL

[Eliot Lear <[e-mail]>]

Hi Michael,

> On 23 Jan 2020, at 03:33, Michael Richardson <[e-mail]> wrote:
> 
> 
> Maybe the file could have something assertive, like: "bad bad, do not run,
> quarantine now" as flag?
> 


If the MUD file itself contains an error that overexposes a vulnerable device, it seems to me that the proper course of action is simply to post a correction that will get picked up sometime after the cache-validity period expires.

As to your other question: what if the MUD file can’t be reached?  The general answer is simple: keep doing what you were doing.  Don’t change policies because you can’t get to the mud file server.  That’s just asking for a boot to the head.  If the device never had a MUD file, you would have some default handling.  If it already had a mud file, then you have some policy to go with.

So suppose the device has a bad mud file, and the attacker tries to block the file server.  At that point, the device is vulnerable, but the fact that the file is not accessible, particularly if it is not accessible for some period of time, is probably something that is worthy of attention.  Did it become unavailable because of an attack, or did it become unavailable because the maker went out of business?

Is it the administrator or the mud file manager that should attend to this?  Could be either, but over the long run you would rather it be the latter, with some back end support.

Eliot