IETF Logo Mail Archive

Re: [Suit] Ripple20

Dick Brooks <dick@reliableenergyanalytics.com> Tue, 16 June 2020 17:12 UTC

Return-Path: <dick@reliableenergyanalytics.com>
X-Original-To: suit@ietfa.amsl.com
Delivered-To: suit@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 940EC3A0783 for <suit@ietfa.amsl.com>; Tue, 16 Jun 2020 10:12:08 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.895
X-Spam-Level:
X-Spam-Status: No, score=-1.895 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=messagingengine.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4D_kTn4T2GaF for <suit@ietfa.amsl.com>; Tue, 16 Jun 2020 10:12:06 -0700 (PDT)
Received: from out2-smtp.messagingengine.com (out2-smtp.messagingengine.com [66.111.4.26]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 542E03A077D for <suit@ietf.org>; Tue, 16 Jun 2020 10:12:06 -0700 (PDT)
Received: from compute1.internal (compute1.nyi.internal [10.202.2.41]) by mailout.nyi.internal (Postfix) with ESMTP id A99445C0035; Tue, 16 Jun 2020 13:12:05 -0400 (EDT)
Received: from mailfrontend1 ([10.202.2.162]) by compute1.internal (MEProxy); Tue, 16 Jun 2020 13:12:05 -0400
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-proxy :x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm3; bh=fD1Xb9 sygLdQR2OFyC9ZoTaml0KMV83UT8hMmkVAMeE=; b=nOT1+zQKdHukhANwQSawrJ PeCFY//u8EsJGH+/PGQAw4Rb01gHHSURVgp1y0mgTfIU8DeHUW621NjgbmWYx7rG HZykQkobtIBtxauFnaMM70P4hlMvhl5/qhK7ND2OWPf/jZARm9U1mBV94Xbas2Jt yeHcudg5nKxuh6NWP8NX/JVaE8EgpA7GsW+NMo9sBMQxSdjCFbLjORhltxWEeEjx D1nz1DQmMl3ghMQOVvFXvt4UtkXF6P67t7qymJw6XleExEzGfJnBg7NQc4mnvqSX jAl+QDH8eHTUNExp9VrLEpftNZuriJSxI0Ws42d07cG5GZ+xvHcOJusCvohEMGNQ ==
X-ME-Sender: <xms:Zf3oXkMaTGbuwQghvT_14CWlZJ5yvZM8EvykcgNHq8OgV005PZcngQ>
X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeduhedrudejtddguddufecutefuodetggdotefrod ftvfcurfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfgh necuuegrihhlohhuthemuceftddtnecusecvtfgvtghiphhivghnthhsucdlqddutddtmd enucfjughrpefhvfhfjgfuffhokfggtgfothesrhdtghepvddtvdenucfhrhhomhepfdff ihgtkhcuuehrohhokhhsfdcuoeguihgtkhesrhgvlhhirggslhgvvghnvghrghihrghnrg hlhihtihgtshdrtghomheqnecuggftrfgrthhtvghrnhepkedvvedugfejvdfhveehhfej gfdvgeegtddvtdffueegjeekheefveekteeiteeunecuffhomhgrihhnpehrvghlihgrsg hlvggvnhgvrhhghigrnhgrlhihthhitghsrdgtohhmpdhthhgvhhgrtghkvghrnhgvfihs rdgtohhmpdhivghtfhdrohhrghenucfkphepvdduiedrudelfedrudegvddrvddvnecuve hluhhsthgvrhfuihiivgeptdenucfrrghrrghmpehmrghilhhfrhhomhepughitghksehr vghlihgrsghlvggvnhgvrhhghigrnhgrlhihthhitghsrdgtohhm
X-ME-Proxy: <xmx:Zf3oXq98uYXpL2LFVWK6HTcYkLlzfSIxtURHq8uZDzPejVL6wCVXYQ> <xmx:Zf3oXrSos0CXUzRr0Fz4cl5gPyVANqXK7vgD_xvUMvJpNhdGdKURrQ> <xmx:Zf3oXsv449iWuQAJPe5qL8Q1rGZusEXtNShY_3vCwpBRU45pr_z-7g> <xmx:Zf3oXmpqHmnV0Tilt1k7cMTqyhxOVP6_q70zONtv8qWQKtQnw2jL_Q>
Received: from farpoint (unknown [216.193.142.22]) by mail.messagingengine.com (Postfix) with ESMTPA id 1C458328005D; Tue, 16 Jun 2020 13:12:05 -0400 (EDT)
From: Dick Brooks <dick@reliableenergyanalytics.com>
To: 'Eliot Lear' <lear=40cisco.com@dmarc.ietf.org>, 'Russ Housley' <housley@vigilsec.com>
Cc: 'suit' <suit@ietf.org>
References: <F6BDED6E-B812-4CE8-9CDF-FC0CC2D4DB38@vigilsec.com> <9D9F401F-3DD8-48F7-92F5-9B5AAEF1D8E0@cisco.com>
In-Reply-To: <9D9F401F-3DD8-48F7-92F5-9B5AAEF1D8E0@cisco.com>
Date: Tue, 16 Jun 2020 13:12:00 -0400
Organization: Reliable Energy Analytics
Message-ID: <44c701d64401$415e3f40$c41abdc0$@reliableenergyanalytics.com>
MIME-Version: 1.0
Content-Type: multipart/related; boundary="----=_NextPart_000_44C8_01D643DF.BA4FAC80"
X-Mailer: Microsoft Outlook 16.0
Thread-Index: AQG+wxrzAypCg1McIomWLtn0vlY2pAG9USWcqPyO9YA=
Content-Language: en-us
Archived-At: <https://mailarchive.ietf.org/arch/msg/suit/b8nPNDI3xBXkepdoYqjjiSuMznM>
Subject: Re: [Suit] Ripple20
X-BeenThere: suit@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Software Updates for Internet of Things <suit.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/suit>, <mailto:suit-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/suit/>
List-Post: <mailto:suit@ietf.org>
List-Help: <mailto:suit-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/suit>, <mailto:suit-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 16 Jun 2020 17:12:09 -0000

Eliot,

 

                I want to thank you for pointing me to the NTIA SBOM work. I
spoke with Allan Friedman of NTIA this morning. I explained the importance
of having SBOM metadata aligned with CVE database vendors to enable
automated CVE searches that should produce a better signal/noise ratio as
part of  a risk assessment supporting NERC CIP-010-3 R1, Part 1.6 (software
verification). Today's CVE search results produce a significant number of
false positives, rendering them nearly useless.

 

FYI:  I've offered to assist NTIA within the energy industry, hopefully
starting with a communication to DOE regarding the 5/1 emergency Executive
Order on cybersecurity and the potential benefits of an SBOM.

 

 

Thanks,

 

Dick Brooks



 <https://reliableenergyanalytics.com/products> Never trust software, always
verify and report! T

 <http://www.reliableenergyanalytics.com/>
http://www.reliableenergyanalytics.com

Email:  <mailto:dick@reliableenergyanalytics.com>
dick@reliableenergyanalytics.com

Tel: +1 978-696-1788

 

From: Suit <suit-bounces@ietf.org> On Behalf Of Eliot Lear
Sent: Tuesday, June 16, 2020 12:39 PM
To: Russ Housley <housley@vigilsec.com>
Cc: suit <suit@ietf.org>
Subject: Re: [Suit] Ripple20

 

Thanks for passing that along, Russ.  This is also an interesting test case
for the discussion that we just had re SBOM.  The focus of that work has
largely been on OSS.  Well.

 

Eliot





On 16 Jun 2020, at 18:22, Russ Housley <housley@vigilsec.com
<mailto:housley@vigilsec.com> > wrote:

 

Just in case anyone forgot why SUIT is so important to the IoT ecosystem...

 

 
<https://thehackernews.com/2020/06/new-critical-flaws-put-billions-of.html?u
tm_source=feedburner&utm_medium=feed&utm_campaign=Feed:+TheHackersNews+(The+
Hackers+News+-+Cyber+Security+Blog)&_m=3n.009a.2250.sd0ao0e9al.1eue>
https://thehackernews.com/2020/06/new-critical-flaws-put-billions-of.html?ut
m_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+TheHackersNews+%28T
he+Hackers+News+-+Cyber+Security+Blog%29&_m=3n.009a.2250.sd0ao0e9al.1eue

 

 

_______________________________________________
Suit mailing list
Suit@ietf.org <mailto:Suit@ietf.org> 
https://www.ietf.org/mailman/listinfo/suit

v2.23.0 | Report a Bug | By Email