Re: [T2TRG] [saag] New Version Notification for draft-irtf-t2trg-iot-seccons-02.txt

Hi Barry,

It is sad to hear your experience during the hack-a-thons. Network security can indeed mitigate threats if devices have certain security vulnerabilities. Which methods would you suggest to include in the document? What are the key challenges in your opinion for IoT network security?

There are other required functionalities next to network security, for instance, transport security or security software updates. We believe that it is also important to mention those. Do you agree? It can always happen that devices (even networking devices such as IoT routers,...) have vulnerabilities and we have to remediate them.

The document describes them in the context of the lifecycle of a device since this summarizes the interactions of users, manufacturers, and network operators. We believe that it is important to describe these interactions since they show how users use the IoT systems, the challenges for manufactures, etc. Do you agree?

Regards, Oscar.

-----Original Message-----
From: T2TRG [mailto:t2trg-bounces@irtf.org] On Behalf Of Barry Raveendran Greene
Sent: Tuesday, April 4, 2017 4:22 PM
To: Eliot Lear <lear@cisco.com>
Cc: Garcia-Morchon O, Oscar <oscar.garcia-morchon@philips.com>; Mohit Sethi <mohit.m.sethi@ericsson.com>; T2TRG@irtf.org; saag@ietf.org; Kumar, Sandeep <sandeep.kumar@philips.com>
Subject: Re: [T2TRG] [saag] New Version Notification for draft-irtf-t2trg-iot-seccons-02.txt

Hi Team,

I agree with Eliot. The draft is disconnected with reality. I attend a lot of “IoT  Hack-a-thons” out in Asia (my wife is usually a judge). These are always huge events whose participation exceeds the organizer’s expectations. At no time do I see any of the teams ever think about security. The few times I offer to give “mini-IoT security workshops” get little interest. Why? Because everyone is focused on the IoT coding for the function - not the lifecycle. 

The reality with IoT devices is that drafts like this are idea, but don’t match reality. I’m now thinking a head what we have to do on the Network in Operators when my “rate of customer infection” goes from 20% - 30% (today) to 70% - 80%. Connected Appliances with a +10 year lifecycle with the owners not maintaining them, is a new world for us.

I survey of all the IoT Security “standards” and “guidelines” assumes we can remediate the violated IoT device. I put forward for the IETF that we cannot assume remediation. We have to assume that we cannot remediate. Hence, we need other tools in the network to mitigate the risk. 

Barry

> On Apr 4, 2017, at 3:32 AM, Eliot Lear <lear@cisco.com> wrote:
> 
> Hi Oscar,
> 
> While I appreciate the draft, there is an elephant in the room.  Not a 
> day passes when we hear of yet another compromise of a so-called "IoT"
> system.  Sometimes these compromises are trivial, and sometimes they 
> are involved.  At the end of the day, the sheer quantity of Things 
> mandates some form of network-level protection that the draft should 
> discuss, to protect those devices from attack.  As was mentioned in 
> the f2f, what if Bob turns out to be, or becomes evil, or is otherwise 0wn3d by Chuck?
> 
> Eliot
> 
> 
> On 4/3/17 9:10 AM, Garcia-Morchon O, Oscar wrote:
>> Hi,
>> 
>> we have submitted a new version of the Internet Draft on security considerations for the IoT.
>> Comments are welcome.
>> 
>> https://tools.ietf.org/html/draft-irtf-t2trg-iot-seccons-02
>> 
>> Regards, Oscar.
>> 
>> -----Original Message-----
>> From: internet-drafts@ietf.org [mailto:internet-drafts@ietf.org]
>> Sent: Friday, March 31, 2017 2:11 PM
>> To: Mohit Sethi <mohit@piuha.net>; Kumar, Sandeep 
>> <sandeep.kumar@philips.com>; Kumar, Sandeep 
>> <sandeep.kumar@philips.com>; Garcia-Morchon O, Oscar 
>> <oscar.garcia-morchon@philips.com>; irtf-chair@irtf.org; 
>> t2trg-chairs@ietf.org
>> Subject: New Version Notification for 
>> draft-irtf-t2trg-iot-seccons-02.txt
>> 
>> 
>> A new version of I-D, draft-irtf-t2trg-iot-seccons-02.txt
>> has been successfully submitted by Oscar Garcia-Morchon and posted to the IETF repository.
>> 
>> Name:draft-irtf-t2trg-iot-seccons
>> Revision:02
>> Title:State of the Art and Challenges for the Internet of Things 
>> Document date:2017-03-31 Group:t2trg
>> Pages:56
>> URL:            https://www.ietf.org/internet-drafts/draft-irtf-t2trg-iot-seccons-02.txt
>> Status:         https://datatracker.ietf.org/doc/draft-irtf-t2trg-iot-seccons/
>> Htmlized:       https://tools.ietf.org/html/draft-irtf-t2trg-iot-seccons-02
>> Htmlized:       https://datatracker.ietf.org/doc/html/draft-irtf-t2trg-iot-seccons-02
>> Diff:           https://www.ietf.org/rfcdiff?url2=draft-irtf-t2trg-iot-seccons-02
>> 
>> Abstract:
>>   The Internet of Things concept refers to the usage of standard
>>   Internet protocols to allow for human-to-thing or thing-to-thing
>>   communication.  The security needs are well-recognized and and many
>>   standardization steps have been taken, for example, specification of
>>   CoAP over DTLS.  However, security challenges still exist and there
>>   are some use cases that lack a suitable solution.  This document
>>   first provides an overview of security architecture, its deployment
>>   model, security needs in the context of the lifecycle of a thing, as
>>   well as the state of the art on IoT security.  Then, we discuss the
>>   concept of security profiles for the successful roll-out of secure
>>   IoT applications and describe remaining security challenges in the
>>   IoT.
>> 
>> 
>> 
>> 
>> Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org.
>> 
>> The IETF Secretariat
>> 
>> 
>> ________________________________
>> The information contained in this message may be confidential and legally protected under applicable law. The message is intended solely for the addressee(s). If you are not the intended recipient, you are hereby notified that any use, forwarding, dissemination, or reproduction of this message is strictly prohibited and may be unlawful. If you are not the intended recipient, please contact the sender by return e-mail and destroy all copies of the original message.
>> _______________________________________________
>> T2TRG mailing list
>> T2TRG@irtf.org
>> https://www.irtf.org/mailman/listinfo/t2trg
>> 
> 
> 
> _______________________________________________
> saag mailing list
> saag@ietf.org
> https://www.ietf.org/mailman/listinfo/saag

_______________________________________________
T2TRG mailing list
T2TRG@irtf.org
https://www.irtf.org/mailman/listinfo/t2trg