Re: [Patient] [saag] [EXT] Re: Internet Draft posted as requested -

[Tero Kivinen <[e-mail]>]

Black, David writes:
> Some of the people on this list are among the fraction of 1% of
> Internet users who can configure a firewall.

True. On the other hand most of the network access devices (ADSL
modems, LTE modems etc) already have firewall built in and the default
configuration quite commonly is, outbound traffic allowed, inbound
traffic forbidden.

This already protects quite a lot of devices...

On the other hand as that configuration is so common, lots of IoT
devices have "call home" protocol, i.e., they will periodically
connect to some home server and ask if there is anything they need to
do, and this allows attack vector for attacking those devices. 

> However, that's probably more of an argument for ISP/ISV/IHV
> firewall management as a security service that may or may not be
> bundled with other services than an argument for encrypted traffic
> access. 

Yep. Offloading firewall configuration to security service vendor
makes lots of sense, as they can then change configuration quickly
when some kind of new attack is found out.

> That's not as simple as one might like.   I recently had to request
> opening up the corporate firewall to allow a web conferencing
> service (name of service omitted to protect the innocent ... and the
> guilty).  That request involved two TCP ports (in addition to 443)
> plus a large UDP port range (for RTP) across seven IPv4 address
> blocks whose size ranges from /26 to /21.   That's quite a bit more
> than "two locations," and this is something that an IoT web
> conferencing system could require.

What, no /48 networks? Bad, bad system, you should require proper
software that actually works on the internet instead of those old
legacy systems :-)

> That suggests separation of those two classes of use cases in
> discussion and design applicability.  The above line of reasoning
> also appears to assume that it's acceptable to prohibit P2P
> functionality (i.e., "talk[ing] to random devices in the Internet")
> in IoT devices.  I'm not sure about that. 

Yes. They are different use cases. But even then there is multiple
different use cases in the IoT too.

IoT is quite often used to mean devices that do machine to machine
communications, i.e., where there is no user or user interface on the
device. I.e., the thermostat sending temperature, or fetching the
configuration from the cloud or local server.

For those devices connecting random IP-address in the world is not
usually needed. They only communicate with the machines they are
configured to communicate with and thats it. These devices have also
long lifetime, i.e., they might be installed once and assumed to work
for next decade or two. For those devices there might also be long
term support for them, including firmware updates.

Another class of IoT, is the cheap devices connected to the internet
doing something. Those devices can include toys, webcams etc. Those
devices might actually want to do peer to peer or similar systems as
they might want to create network of other people using same devices
etc. Protecting them is going to very difficult as their behavior can
be very random or unpredictable, thus making rules for them in
firewall etc can be hard.

Also those are quite often throw-away devices, meaning that if they
are broken, they are thrown away, and there is no point of repairing
them. Updating the firmware can be considered as repairing it, thus
vendors might even not make them so they can be updated, if something
goes wrong they just say throw it away and buy new one... 
-- 
[e-mail]