Re: [sacm] Draft: Automated IoT Security

Thank you Oscar and Thorsten for your work on PAVA and PASC, this does look
promising.  I realize I am reviewing an early version of the draft and am
wondering if the concepts are further developed.  I may be asking questions
that have been solved at this point, and look forward to learning more.
Here's a quick review and I would like to review later iterations as well
to see if we as a community can help you progress your work.

Section 2.1: nit

   A manufacturer cannot be aware at design place about the security
   risks that might appear in the future.

I think you meant design time?  If I am not right (on any comment), please
say so and explain.
s/place/time/

Nit at end of 2.3
Period is missing at the end of the following sentence:
   System operators benefit of PASC and PAVA since they minimize
   operational cost while ensuring that the system remains secure at any
   moment: PASC allows them to configure security automatically; PAVA
   allows for automated vulnerability detection

Section 4.1
I need further information on the listed exchanges and commands to better
understand the protocol.  How does the RISK ASSESSMENT occur?  What does
that entail?  Are other protocols used in the assessment (YANG/RESTCONF)?

Is there an existing protocol that PASC rides over and adds these commands
or is it new?  What does a DEVICE INFO request look like for the exchange
and what are the possible responses (or where is the response obtained from?

Section 4.2
Can you explain a little further on how syslog reports can help with
vulnerability assessment?  Do you mean detection of known threats that can
be mapped to syslog generated messages?  Or have you added some type of
logging requirement in IoT devices that you are working with that produce
syslog messages specific to PAVA that somehow map to vulnerability
assessment information?

Does the first bullet meat to say events as opposed to vulnerabilities
perhaps?

Or by vulnerability, do you mean that an event triggered by an IoT device
and a log in syslog would signal behavior that did not match the expected
behavior as in the deployer's accepted MUD files?

Section 6 -
Do you have planned reuse of existing device protocols, perhaps YANG with
NETCONF/RESTCONF, or DMTF's Common Information Model (CIM) where each are
in use?  I see you mention YANG for security configuration, so I'll be
curious as to how you fit MUD and YANG together (which I agree is a good
direction).  Can YANG be used elsewhere?  I asked this question because of
statements on developing protocols, bu this is an early draft.

Question on where the work could be done: It could fit in SACM or it could
also be it's own WG IMO.

Thank you!!  It's off to a great start.

Best regards,
Kathleen

On Fri, Oct 19, 2018 at 12:45 PM Abhik Chaudhuri <abhik.chaudhuri@gmail.com>
wrote:

> Dear Thorsten,
>
> Thanks for sharing the draft.
>
> Both PASC and PAVA looks promising in first glance, although many
> follow-up questions come in mind from architectural, operational  and
> domain based application (eg: feasibility in Health-IoT) perspectives,
>
> I am interested to know more.
>
> Thanks and regards,
>
> Abhik Chaudhuri
>
> Book author: "*Internet of Things, for Things and by Things*" (Taylor and
> Francis, US; Published in August 2018);
>
> Co-creator of 'IoT Privacy by Design Framework' with Dr. Ann Cavoukian
> (Feb 2018);
>
> Chevening Fellow (UK);
>
> Fellow of Cloud Security Alliance (US);
>
> Member: IETF SACM;
>
> Co-Editor: ISO/IEC JTC1 SC27.
>
>
> On Fri, 19 Oct 2018 at 21:49, Garcia-Morchon O, Oscar <
> oscar.garcia-morchon@philips.com> wrote:
>
>> Hi all,
>>
>> this one should work:
>>
>>
>> https://datatracker.ietf.org/doc/draft-garciamorchon-t2trg-automated-iot-security/
>>
>>
>> Regards, Oscar.
>>
>> On 19 Oct 2018, at 18:14, Kathleen Moriarty <
>> kathleen.moriarty.ietf@gmail.com> wrote:
>>
>> Hello,
>>
>> Is the link provided correct?  It's not working for me.
>>
>> Thank you,
>> Kathleen
>>
>> On Fri, Oct 19, 2018 at 12:06 PM Thorsten Dahm <thorstendlux=
>> 40google.com@dmarc.ietf.org> wrote:
>>
>>> Hello SACM list,
>>>
>>> we just submitted the following draft today and plan to present it in
>>> the T2TRG WG in Bangkok:
>>>
>>>
>>> https://datatracker.ietf.org/doc/draft-garciamorchon-t2trg-automated-iot-security/
>>> <https://datatracker.ietf..org/doc/draft-garciamorchon-t2trg-automated-iot-security/>
>>>
>>> But the topic might be interesting for this WG as well. In case there is
>>> any interest, I could also present this in SACM.
>>>
>>> Regards,
>>> Thorsten
>>>
>>> --
>>> Thorsten Dahm
>>>
>>> Network Engineer
>>> Google Ireland Ltd.
>>> The Gasworks, Barrow Street
>>> Dublin 4,  Ireland
>>>
>>> Registered in Dublin, Ireland
>>> Registration Number: 368047
>>> _______________________________________________
>>> sacm mailing list
>>> sacm@ietf.org
>>> https://www.ietf.org/mailman/listinfo/sacm
>>> <https://emea01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fsacm&data=02%7C01%7C%7C5216f14881a64b9d702908d635de1a7b%7C1a407a2d76754d178692b3ac285306e4%7C0%7C0%7C636755625375970565&sdata=frbJtRuGeeZZnGV7TteFFzON%2FzURXDx4s747MioWZRg%3D&reserved=0>
>>>
>>
>>
>> --
>>
>> Best regards,
>> Kathleen
>>
>>
>> _______________________________________________
>> sacm mailing list
>> sacm@ietf.org
>> https://www.ietf.org/mailman/listinfo/sacm
>>
>

-- 

Best regards,
Kathleen