Re: [T2TRG] [saag] New Version Notification for draft-irtf-t2trg-iot-seccons-02.txt

["Garcia-Morchon O, Oscar" <[e-mail]>]

Dear Peter,

Thanks for your remark. IoT is indeed a broad concept. We will refer to the definition of device classes. Do you think that this is a good approach?

>>>" At the moment it's so generic that it seems to be one-size-fits-nothing...
it's like trying to write safe-driving instructions that have to cover cars, buses, trucks, motorbikes, locomotives, boats, oil tankers, jet skis, jet aircraft, jet bikes, scooters, and submarines."

I agree that writing safe-driving instructions for cars, jets, etc ... is difficult. The jet goes faster than the car so I fully agree, recommending a common speed limit does not make sense. However, there are common guidelines, for instance, do not collide as a general rule.

It is not the intention of the draft to create common instructions. As for the cars, jets, ... this does not make sense.

The main goals are:
- summarize existing solutions out there and in IETF
- summarize security considerations and challenges that should be addressed in the future

Which existing solutions, security considerations, or challenges apply to an given IoT system depend on the IoT system itself and how it is used (this is similar to the example of cars, ...). In the document:
- we have some text on the process to identify risks, threats, and mitigation strategies that should help system designers and implementers.
- Similarly to the different transportation means that require different safety guidelines, we also have some initial text discussing security profiles. In an abstract way, this is the same idea... IoT systems (transportation systems) are very diverse and addressing the security threats require some specific type of solutions. A security profile could include some recommendations/guidelines for a specific type of IoT systems.

Does this make sense to you?

Kind regards, Oscar.


-----Original Message-----
From: saag [mailto:[e-mail]] On Behalf Of Peter Gutmann
Sent: Wednesday, April 5, 2017 8:44 AM
To: Barry Raveendran Greene <[e-mail]>; Eliot Lear <[e-mail]>
Cc: Mohit Sethi <[e-mail]>; [e-mail]; [e-mail]; Kumar, Sandeep <[e-mail]>
Subject: Re: [saag] [T2TRG] New Version Notification for draft-irtf-t2trg-iot-seccons-02.txt

Barry Raveendran Greene <[e-mail]> writes:

>I survey of all the IoT Security "standards" and "guidelines" assumes
>we can remediate the violated IoT device. I put forward for the IETF
>that we cannot assume remediation. We have to assume that we cannot
>remediate. Hence, we need other tools in the network to mitigate the risk.

That's always struck me as a bit odd as well when I read some standard for secure firmware update, for IoS devices like the Raspberry Pi and similar Linux-based/like devices the update process is already sorted (apt-get update) and for SCADA/embedded or whatever running some RTOS it can't be updated, whatever you ship today will be used in that form for the next ten to twenty years (or more, I've seen fifty-year-old ladder logic controllers still in active use).  So the diagram in Figure 1 is replaced after "application running" with a dotted line leading up to the present day, there's no updates, no reconfiguration, no maintenance and re-bootstrapping, it just keeps running once put into service.

I don't want to start nitpicking individual bits of the draft, but I think it would help if it laid out what's meant by "IoT", are we talking Android phones (mentioned in one place), fridges, PLCs, routers, what?  Or perhaps come up with a few sample device profiles and provide specific advice for each case.
At the moment it's so generic that it seems to be one-size-fits-nothing...
it's like trying to write safe-driving instructions that have to cover cars, buses, trucks, motorbikes, locomotives, boats, oil tankers, jet skis, jet aircraft, jet bikes, scooters, and submarines.

Peter.
_______________________________________________
saag mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/saag

________________________________
The information contained in this message may be confidential and legally protected under applicable law. The message is intended solely for the addressee(s). If you are not the intended recipient, you are hereby notified that any use, forwarding, dissemination, or reproduction of this message is strictly prohibited and may be unlawful. If you are not the intended recipient, please contact the sender by return e-mail and destroy all copies of the original message.