Re: [Smart] CLESS side meeting notes

Hello!

Thanks again for your work on these drafts!  I just scanned CLESS and the
taxonomy draft and have some high-level feedback.  I'd like to get some
folks internal to my organization to help build it out further.

I think combining the OS and execution environment into one bucket is large
and it involves multiple vendors in many circumstances, so these should be
separated out.  I am assuming with your execution environment, you are
including all the functions and keys on a TEE (random number generator,
keys, etc), firmware and BIOS.

Since we already have the RATS working group, references to white listing
capabilities that include code signing type functions should also include
attestation.

The MUD [RFC8520] work should also be referenced as it provides a way to
detect unexpected behavior patterns for devices with a small profile.
Being able to do this in a similar way that scales for larger systems is
still an open are of research.

The draft should also call out compromises in code or even hardware prior
to the vendor providing an attestation or signing code as that is an open
area of research.  If a backdoor is placed by a hacker and does not behave
in ways that signal unexpected behavior or remains idle, there's no way to
detect it.

There is some duplication that editing can resolve.  I'll have more time
for helping with that in the future, but wanted to at least look at the
current revisions now.

Best regards,
Kathleen

On Sun, Oct 20, 2019 at 1:51 PM Adam Montville <adam.montville.sdo@gmail.com>
wrote:

> All:
>
> The below is snipped from the original message. Is the taxonomy draft
> going to be updated prior to Singapore?
>
> Kind regards,
>
> Adam
>
> > On Jul 31, 2019, at 07:36, Arnaud.Taddei.IETF <Arnaud.Taddei.IETF=
> 40protonmail.com@dmarc.ietf.org> wrote:
> >
> > Plan PART 1: Mark McFadden wrote endpoint-taxonomy-cless to describe the
> endpoints more accurately and give a language for working with these. Reach
> out to Henk to work on this. Suggestion to make things less qualitative and
> more quantitative. Due to virtualization and containerization, this varies
> – IoT characteristic work done elsewhere (David NIST gives reference: RFC
> 7228). He plans to issue revision in August based on comments from
> Montreal; and get another version for this before Singapore. Needs to group
> virtualized environments with their devices, have more detail on the
> taxonomy. Should it be a taxonomy or a categorization? (How deep to go?)
>
> --
> Smart mailing list
> Smart@irtf.org
> https://www.irtf.org/mailman/listinfo/smart
>

-- 

Best regards,
Kathleen