Re: [saag] Side meeting on USG efforts to combat botnets, Wednesday at 3:15

["Beth Flippo" <[e-mail]>]

Hello everyone!
 
I am an embedded software developer at TELEGRID and we specialize in the
development of custom embedded cybersecurity solutions for the US
Military.  
 
I personally develop on ARM microcontrollers as well as embedded LINUX
microprocessors.
 
Unfortunately I wasn't able to attend the botnet meeting last month but
I did read the attached Best Practices for IOT Devices document.  I
think it is a good approach to secure software development from a
high-level.
 
I don't know if this is the right forum but I was hoping to provide
tangible steps to implement security on IoT embedded platforms based on
my experience.
 
Any recomendations for how I can get involved?
 
Thank you!
Beth
 
 
 
Beth Flippo
VP Embedded Software Development
TELEGRID Technologies, Inc.
23 Vreeland Road
Florham Park, NJ 07932
Work: [phone] 
www.telegrid.com
TELEGRID is ISO 9001:2008 Certified
 
------------------------------------------------------------------------
-------------------------------
This is a PRIVATE message. If you are not the intended recipient, please
delete without copying and kindly advise us by e-mail of the mistake in
delivery. NOTE: Regardless of content, this e-mail shall not operate to
bind TELEGRID to any order or other contract unless pursuant to explicit
written agreement or government initiative expressly permitting the use
of e-mail for such purpose.
------------------------------------------------------------------------
-------------------------------

-----Original Message-----
From: saag [mailto:[e-mail]] On Behalf Of Joseph Lorenzo
Hall
Sent: Wednesday, July 19, 2017 10:05 AM
To: Polk, Tim (Fed)
Cc: [e-mail]
Subject: Re: [saag] Side meeting on USG efforts to combat botnets,
Wednesday at 3:15


Richard Barnes pointed to this I-D that looks pretty damn good here in
terms of a floor for IoT technical requirements:

https://tools.ietf.org/html/draft-moore-iot-security-bcp-01


On Tue, Jul 18, 2017 at 11:51 AM, Polk, Tim (Fed)
<[e-mail]> wrote:




Folks,

 

I have reserved the side meeting room (Tyrolka, Mezzanine Level) on
Wednesday from 3:15 - 4:30 for an informal discussion of an ongoing US
Government effort to combat botnets and other "automated, distributed
threats" to the Internet.  This effort will produce a document that
identifies and promotes "action by appropriate stakeholders" by May of
2018.  Given that the USG does not own or operate the Internet, such an
effort is always at risk of creating shelfware, and I am too old to
waste my time that way.  To ensure that actions identified in the report
are pragmatic and effective, I would like to encourage participation by
members of this community.

 

If you have an interest, please join me in Tyrolka tomorrow afternoon or
catch me in the hallway between meetings.

 

For those with an interest, here is some additional background
information, including an immediate opportunity to participate:

 

Executive Order 13800, Strengthening the Cybersecurity of Federal
Networks and Critical Infrastructure, which was issued May 11, 2017,
requires the Secretaries of Commerce and Homeland Security to "jointly
lead an open and transparent process to identify and promote action by
appropriate stakeholders to improve the resilience of the internet and
communications ecosystem and to encourage collaboration with the goal of
dramatically reducing threats perpetrated by automated and distributed
attacks (e.g., botnets)."  

 

The executive order requires Commerce and DHS to issue a draft report in
240 days (January 5, 2018) and submit a final report to the President
one year after issuance (May 11, 2018).  Given this aggressive timeline,
there are several different (but hopefully complementary) workstreams
underway at Commerce and DHS that may be of interest.  In particular:

 

(1) The National Telecommunications and Information Administration
(NTIA) published a "Request for Comments on Promoting Stakeholder Action
Against Botnets and Other Automated Threats" on June 8.  In the request,
"NTIA seeks broad input from all interested stakeholders-including
private industry, academia, civil society, and other security experts-on
ways to improve industry's ability to reduce threats perpetuated by
automated distributed attacks, such as botnets, and what role, if any,
the U.S. Government should play in this area."  NTIA would definitely
appreciate comments from members of this community!

 

Additional details may be in the full text of the request for comments,
found in 

https://www.gpo.gov/fdsys/pkg/
<https://www.gpo.gov/fdsys/pkg/FR-2017-06-13/pdf/2017-12192.pdf>
FR-2017-06-13/pdf/2017-12192.pdf

 

Note that the official comment period was extended to July 28 in

https://www.gpo.gov/fdsys/pkg/
<https://www.gpo.gov/fdsys/pkg/FR-2017-06-22/pdf/2017-13034.pdf>
FR-2017-06-22/pdf/2017-13034.pdf

 

(2) Last week, NIST hosted a public workshop on "Enhancing Resilience of
the Internet and Communications Ecosystem".  150 participants from a
range of industry sectors, civil society, and government participated in
a day and half workshop.   The workshop explored a range of current and
emerging solutions to enhance the resiliency of the Internet against
automated, distributed threats. The workshop agenda is available at 

https://www.nist.gov/sites/
<https://www.nist.gov/sites/default/files/documents/2017/07/10/final-dra
ft-agenda-resilience-workshop-070517.pdf>
default/files/documents/2017/07/10/final-draft-agenda-resilience-worksho
p-070517.pdf

 

NIST plans to summarize results in a workshop report for publication in
September 2017.

 

 Regards,

 

Tim Polk

 





_______________________________________________
saag mailing list
[e-mail]
https://www.ietf.org/mailman/
<https://www.ietf.org/mailman/listinfo/saag> listinfo/saag






-- 

Joseph Lorenzo Hall
Chief Technologist, Center for Democracy & Technology
[https://www.cdt.org]
1401 K ST NW STE 200, Washington DC 20005-3497
e: [e-mail], p: 202.407.8825, pgp: https://josephhall.org/gpg-key
Fingerprint: 3CA2 8D7B 9F6D DBD3 4B10  1607 5F86 6987 40A9 A871