Re: [saag] draft-moore-iot-bcp-00 (Best Current Practices for Securing Internet of Things (IoT) Devices)

How does your average consumer know if they're buying an Internet of
Shi^H^H^HThings device or proper SCADA gear?

Surely half the problem is educating price sensitive consumers about how to
distinguish from well-priced good hardware and cheap crap?

All the guidelines in the world will not stop people building crap to try
and sell it cheap

On 11 November 2016 at 09:50, Peter Gutmann <pgut001@cs.auckland.ac.nz>
wrote:

> Hannes Tschofenig <hannes.tschofenig@gmx.net> writes:
>
> >We probably have do a bit of document scoping. Many embedded devices do
> not
> >run Linux since they have no MMU. I would like to have guidelines that
> also
> >consider those ~50 billion of currently deployed devices as well.
>
> I think that would definitely be useful.  We should distinguish between, at
> least, desktop-PC equivalents (anything capable enough to Linux, in which
> case
> just use any standard Unix good-housekeeping rules, you don't necessarily
> need
> the same thing just with IoT stamped on it), and then real SCADA/embedded,
> where you've got a single binary blob comprising the RTOS and the
> application(s) it runs, no MMU, and barely anything else.
>
> There's also a split in engineering terms between an Internet of
> Shi^H^H^HThings device (take the cheapest Arm-based reference design,
> shovel
> Linux 2.6.x and equally old, unpatched binaries onto it, and throw it out
> to
> the public), and what I'd consider proper SCADA gear, stuff that's been
> properly designed and engineered, with environmental protection, fault-
> checking, and so on, something that won't break the first time you sneeze
> near
> it, or that needs constant tending just to keep it going.  IoS devices have
> very different goals (cheap and quick, and if it breaks the vendor doesn't
> really care) from SCADA (long engineering cycles, time to do it right but
> often political impediments to doing so, and companies that have to stand
> behind their products, often for decades after they've shipped).
>
> So the first question would be, how do you divide things up in order to
> decide
> what goals need to be met, and what goals can actually be met?
>
> Peter.
> _______________________________________________
> saag mailing list
> saag@ietf.org
> https://www.ietf.org/mailman/listinfo/saag
>