Re: [T2TRG] [saag] New Version Notification for draft-irtf-t2trg-iot-seccons-02.txt

[Peter Gutmann <[e-mail]>]

Barry Raveendran Greene <[e-mail]> writes:

>I survey of all the IoT Security “standards” and “guidelines” assumes we can
>remediate the violated IoT device. I put forward for the IETF that we cannot
>assume remediation. We have to assume that we cannot remediate. Hence, we
>need other tools in the network to mitigate the risk.

That's always struck me as a bit odd as well when I read some standard for
secure firmware update, for IoS devices like the Raspberry Pi and similar
Linux-based/like devices the update process is already sorted (apt-get update)
and for SCADA/embedded or whatever running some RTOS it can't be updated,
whatever you ship today will be used in that form for the next ten to twenty
years (or more, I've seen fifty-year-old ladder logic controllers still in
active use).  So the diagram in Figure 1 is replaced after "application
running" with a dotted line leading up to the present day, there's no updates,
no reconfiguration, no maintenance and re-bootstrapping, it just keeps running
once put into service.

I don't want to start nitpicking individual bits of the draft, but I think it
would help if it laid out what's meant by "IoT", are we talking Android phones
(mentioned in one place), fridges, PLCs, routers, what?  Or perhaps come up
with a few sample device profiles and provide specific advice for each case.
At the moment it's so generic that it seems to be one-size-fits-nothing...
it's like trying to write safe-driving instructions that have to cover cars,
buses, trucks, motorbikes, locomotives, boats, oil tankers, jet skis, jet
aircraft, jet bikes, scooters, and submarines.

Peter.