Re: [T2TRG] [saag] New Version Notification for draft-irtf-t2trg-iot-seccons-02.txt

Hi Team,

I agree with Eliot. The draft is disconnected with reality. I attend a lot of “IoT  Hack-a-thons” out in Asia (my wife is usually a judge). These are always huge events whose participation exceeds the organizer’s expectations. At no time do I see any of the teams ever think about security. The few times I offer to give “mini-IoT security workshops” get little interest. Why? Because everyone is focused on the IoT coding for the function - not the lifecycle. 

The reality with IoT devices is that drafts like this are idea, but don’t match reality. I’m now thinking a head what we have to do on the Network in Operators when my “rate of customer infection” goes from 20% - 30% (today) to 70% - 80%. Connected Appliances with a +10 year lifecycle with the owners not maintaining them, is a new world for us.

I survey of all the IoT Security “standards” and “guidelines” assumes we can remediate the violated IoT device. I put forward for the IETF that we cannot assume remediation. We have to assume that we cannot remediate. Hence, we need other tools in the network to mitigate the risk. 

Barry

> On Apr 4, 2017, at 3:32 AM, Eliot Lear <lear@cisco.com> wrote:
> 
> Hi Oscar,
> 
> While I appreciate the draft, there is an elephant in the room.  Not a
> day passes when we hear of yet another compromise of a so-called "IoT"
> system.  Sometimes these compromises are trivial, and sometimes they are
> involved.  At the end of the day, the sheer quantity of Things mandates
> some form of network-level protection that the draft should discuss, to
> protect those devices from attack.  As was mentioned in the f2f, what if
> Bob turns out to be, or becomes evil, or is otherwise 0wn3d by Chuck?
> 
> Eliot
> 
> 
> On 4/3/17 9:10 AM, Garcia-Morchon O, Oscar wrote:
>> Hi,
>> 
>> we have submitted a new version of the Internet Draft on security considerations for the IoT.
>> Comments are welcome.
>> 
>> https://tools.ietf.org/html/draft-irtf-t2trg-iot-seccons-02
>> 
>> Regards, Oscar.
>> 
>> -----Original Message-----
>> From: internet-drafts@ietf.org [mailto:internet-drafts@ietf.org]
>> Sent: Friday, March 31, 2017 2:11 PM
>> To: Mohit Sethi <mohit@piuha.net>; Kumar, Sandeep <sandeep.kumar@philips.com>; Kumar, Sandeep <sandeep.kumar@philips.com>; Garcia-Morchon O, Oscar <oscar.garcia-morchon@philips.com>; irtf-chair@irtf.org; t2trg-chairs@ietf.org
>> Subject: New Version Notification for draft-irtf-t2trg-iot-seccons-02.txt
>> 
>> 
>> A new version of I-D, draft-irtf-t2trg-iot-seccons-02.txt
>> has been successfully submitted by Oscar Garcia-Morchon and posted to the IETF repository.
>> 
>> Name:draft-irtf-t2trg-iot-seccons
>> Revision:02
>> Title:State of the Art and Challenges for the Internet of Things
>> Document date:2017-03-31
>> Group:t2trg
>> Pages:56
>> URL:            https://www.ietf.org/internet-drafts/draft-irtf-t2trg-iot-seccons-02.txt
>> Status:         https://datatracker.ietf.org/doc/draft-irtf-t2trg-iot-seccons/
>> Htmlized:       https://tools.ietf.org/html/draft-irtf-t2trg-iot-seccons-02
>> Htmlized:       https://datatracker.ietf.org/doc/html/draft-irtf-t2trg-iot-seccons-02
>> Diff:           https://www.ietf.org/rfcdiff?url2=draft-irtf-t2trg-iot-seccons-02
>> 
>> Abstract:
>>   The Internet of Things concept refers to the usage of standard
>>   Internet protocols to allow for human-to-thing or thing-to-thing
>>   communication.  The security needs are well-recognized and and many
>>   standardization steps have been taken, for example, specification of
>>   CoAP over DTLS.  However, security challenges still exist and there
>>   are some use cases that lack a suitable solution.  This document
>>   first provides an overview of security architecture, its deployment
>>   model, security needs in the context of the lifecycle of a thing, as
>>   well as the state of the art on IoT security.  Then, we discuss the
>>   concept of security profiles for the successful roll-out of secure
>>   IoT applications and describe remaining security challenges in the
>>   IoT.
>> 
>> 
>> 
>> 
>> Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org.
>> 
>> The IETF Secretariat
>> 
>> 
>> ________________________________
>> The information contained in this message may be confidential and legally protected under applicable law. The message is intended solely for the addressee(s). If you are not the intended recipient, you are hereby notified that any use, forwarding, dissemination, or reproduction of this message is strictly prohibited and may be unlawful. If you are not the intended recipient, please contact the sender by return e-mail and destroy all copies of the original message.
>> _______________________________________________
>> T2TRG mailing list
>> T2TRG@irtf.org
>> https://www.irtf.org/mailman/listinfo/t2trg
>> 
> 
> 
> _______________________________________________
> saag mailing list
> saag@ietf.org
> https://www.ietf.org/mailman/listinfo/saag