Re: [Suit] Ripple20

Hi Dick

> On 16 Jun 2020, at 19:12, Dick Brooks <dick@reliableenergyanalytics.com> wrote:
> 
> Eliot,
>  
>                 I want to thank you for pointing me to the NTIA SBOM work. I spoke with Allan Friedman of NTIA this morning. I explained the importance of having SBOM metadata aligned with CVE database vendors to enable automated CVE searches that should produce a better signal/noise ratio as part of  a risk assessment supporting NERC CIP-010-3 R1, Part 1.6 (software verification). Today’s CVE search results produce a significant number of false positives, rendering them nearly useless.

Right.  Until someone does an evaluation, there’s almost no point.  How this would work with the NTIA model is that those products that publish SBOMs would immediately be considered potentially vulnerable, and then VEX would provide the opportunity to refine that to “not vulnerable” to “vulnerable with workaround” to “vulnerable with fix”, etc.

I do have a question for the chairs/AD.  I realize that this is a bit out of scope for SUIT.  Is there a more appropriate list we should be vectored to?  Thanks for the group’s indulgence to this point.

Eliot

>  
> FYI:  I’ve offered to assist NTIA within the energy industry, hopefully starting with a communication to DOE regarding the 5/1 emergency Executive Order on cybersecurity and the potential benefits of an SBOM.
>  
>  
> Thanks,
>  
> Dick Brooks
> <image001.jpg>
> Never trust software, always verify and report! <https://reliableenergyanalytics.com/products> ™
> http://www.reliableenergyanalytics.com <http://www.reliableenergyanalytics.com/>
> Email: dick@reliableenergyanalytics.com <mailto:dick@reliableenergyanalytics.com>
> Tel: +1 978-696-1788
>  
> From: Suit <suit-bounces@ietf.org> On Behalf Of Eliot Lear
> Sent: Tuesday, June 16, 2020 12:39 PM
> To: Russ Housley <housley@vigilsec.com>
> Cc: suit <suit@ietf.org>
> Subject: Re: [Suit] Ripple20
>  
> Thanks for passing that along, Russ.  This is also an interesting test case for the discussion that we just had re SBOM.  The focus of that work has largely been on OSS.  Well.
>  
> Eliot
> 
> 
>> On 16 Jun 2020, at 18:22, Russ Housley <housley@vigilsec.com <mailto:housley@vigilsec.com>> wrote:
>>  
>> Just in case anyone forgot why SUIT is so important to the IoT ecosystem...
>>  
>> https://thehackernews.com/2020/06/new-critical-flaws-put-billions-of.html?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+TheHackersNews+%28The+Hackers+News+-+Cyber+Security+Blog%29&_m=3n.009a.2250.sd0ao0e9al.1eue <https://thehackernews.com/2020/06/new-critical-flaws-put-billions-of.html?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed:+TheHackersNews+(The+Hackers+News+-+Cyber+Security+Blog)&_m=3n..009a.2250.sd0ao0e9al.1eue>
>>  
>>  
>> _______________________________________________
>> Suit mailing list
>> Suit@ietf.org <mailto:Suit@ietf.org>
>> https://www.ietf.org/mailman/listinfo/suit <https://www.ietf.org/mailman/listinfo/suit>
>  
> _______________________________________________
> Suit mailing list
> Suit@ietf.org
> https://www.ietf.org/mailman/listinfo/suit