March 2017 - iot-wg - mailman.ripe.net

[iot-discussion] Heads up for RIPE 74: Security BoF: On the Linkage Between Device and Infrastructure
by Marco Hogewoning 29 Mar '17

29 Mar '17

Dear colleagues, Happy to inform you that the PC has accepted our proposal to organise another BoF during RIPE 74 in Budapest. Unfortunately the exact time slot has not been decided yet, but we hope to get this cleared up in the coming weeks. Regardless, we can start our preparation for this and maybe already discuss some of the elements on this list. In this BoF we would like to focus on the relation between access providers, gateway devices (CPE) and IoT security. In particular the fact that often the provider is the sole entity who can quarantine or disconnect devices or networks that have been compromised (I am attaching the whole abstract below). The key questions we hope to address are: - Is there a role for the access provider in controlling/limiting access of compromised devices to the infrastructure? - Are there technical means to detect and contain devices that form a potential threat? - Would it be feasible to limit connectivity for such unsafe devices? - Are there feasible alternative means to mitigate the threat that these compromised devices form to our systems? I hope to run the BoF in a similar open fashion as the one in Madrid, with a minimum of slides and lots of time for a dialogue between the participants. But if you are doing relevant work or have an idea, I am open to suggestions for discussion starters or projects that would be relevant to the questions above. Hope to see you all in Budapest. Regards, Marco Hogewoning -- External Relations - RIPE NCC ***Security BoF: On the Linkage Between Device and Infrastructure*** Whatever the definition of the Internet of Things, one thing is for sure: the number of devices connected to the Internet is constantly growing. Even the traditional access markets continue to expand their number of end users and, importantly, the bandwidth available to them. As a follow-up to the RIPE 73 IoT BoF, we plan to explore the effects of this ever-expanding network in terms of infrastructure stability and security. Botnets, including the ones made up from relatively dumb devices such as the Mirai botnet, pose a substantial threat to the very infrastructure those devices depend on for their connectivity. Not only does the phenomenal growth in the number of poorly maintained devices increase the attack surface, but with more bandwidth available to them, the threat becomes even bigger. Can we prevent the Internet from collapsing under its own weight? Aside from the ongoing discussions on the need to secure these devices, with options ranging from capacity building to regulation, this BoF will explore the role of access providers in the ecosystem. As the natural gatekeepers between the local networks and the global infrastructure, what are their options to protect their own and other networks from these attacks? This BoF will tackle the following questions: - Is there a role for the access provider in controlling/limiting access of compromised devices to the infrastructure? - Are there technical means to detect and contain devices that form a potential threat? - Would it be feasible to limit connectivity for such unsafe devices? - Are there feasible alternative means to mitigate the threat that these compromised devices form to our systems?

1 0

[iot-discussion] Request to contribute to AIOTI survey on IoT indentifiers
by Marco Hogewoning 14 Mar '17

14 Mar '17

Dear colleagues, The RIPE NCC is a member of the the Alliance for Internet of Things Innovation (AIOTI). Its standardisation group (WG3) has established a task force to look at identifiers for use in the Internet of Things (IoT). One of the task force's work items is to collect information about any existing identification systems and standards that could be considered for application in IoT and investigate identification needs and requirements from IoT implementers. They have created a short survey to gather this information and asked us to invite the RIPE community to contribute. As both the requirements and options available will probably vary significantly between different IoT products and services, we don't think it's feasible to provide the task force with a consolidated response, as compiling such an answer to some extent would duplicate the work of the task force. Instead, we encourage RIPE community members who have a stake in IoT or associated identification mechanisms or standards to respond to the survey on an individual basis. The survey is available here: https://goo.gl/forms/vT22nR1ZEh13lfzi1 You are kindly requested to respond before 7 April. Please also see the attached message from Juergen Helles, Chair of the task force. As a member of AIOTI, we will continue to monitor and contribute to the work of AIOTI WG3 and this task force. Regards Marco Hogewoning RIPE NCC - External Relations > > > The Alliance for Internet of Things Innovation AIOTI (www.aioti.org) was initiated by the European Commission in 2015, with the aim to strengthen the dialogue and interaction among Internet of Things (IoT) players in Europe, and to contribute to the creation of a dynamic European IoT ecosystem to speed up the take up of IoT. Further objectives of the Alliance are fostering experimentation, replication, and deployment of IoT and supporting convergence and interoperability of IoT standards; gathering evidence on market obstacles for IoT deployment; and mapping and bridging global, EU, and member states' IoT innovation activities. > > AIOTI Working Group 03 is a focus of European engagement and steering in the IoT standardization process: > - Maintain a view on the landscape of IoT standards-relevant activities being driven by Standard Developing Organizations, Consortia, Alliances and Open Source Software projects > - Provide a forum for analysis, discussion and alignment of strategic, cross-domain, technical themes and shared concerns across landscape activities > - Develop recommendations and guidelines addressing those concerns > - Engage the IoT community in disseminating and promoting the results and steering emerging standards > Note that AIOTI will not develop standards itself but interact with standardization development organizations and consortia in order to initiate standardization activities. > > Identification plays an important role for IoT. In addition to the identification of the Things identification of other entities will be needed. Various identification schemes already exist, are standardized and deployed. A thorough analysis of the identification needs and related standardization for IoT is therefore needed. The AIOTI WG03 IoT Identifier task force was setup specifically to > - Evaluate identification needs for IoT and related requirements > - Collect existing identification standards and ongoing standardization work and elaborate their applicability for IoT. > The results of these activities will be published in a public report on IoT Identifiers. > > The task force has setup a online survey in order to collect input for the above task. > > IoT Identifier Survey (https://goo.gl/forms/vT22nR1ZEh13lfzi1) > > We are asking RIPE Community to provide feedback to the survey until Friday April 7th 2017. > > Please also feel free to distribute this survey request to your members for their individual feedback to the survey. > > Please note, that the information that you provide will be anonymized, i.e. there will be no reference to your specific contribution to the survey in the public report. Still you can request to be listed in the report as a contributor to the survey without reference to your specific contribution. > A pdf file with the survey questions is attached for your information, but please use the only survey (see link above) for your feedback. > > In case you have questions on the survey don’t hesitate to contact the co-chair of the AITOI WG3 IoT Identifier task force (juergen.heiles(a)siemens.com, henri.barthel(a)gs1.org). > > > Best Regards > > Juergen Heiles, AIOTI WG3 IoT Identifier task force co-chair

1 0

[iot-discussion] ENISA call for IoT Security Experts Group
by Marco Hogewoning 10 Mar '17

10 Mar '17

Dear colleagues, ENISA, the European Agency for Network and Information Security, is launching an IoT Security Experts Group with the objective to gather experts in the domains of the entire spectrum of Internet of Things to exchange viewpoints and ideas on cyber security threats, challenges and solutions. More information about this call for experts and the group is available via https://resilience.enisa.europa.eu/iot-security-experts-group-1 We also would welcome any thoughts or suggestions of how RIPE NCC can contribute to the field of IoT security, which remains one of the key concerns for all stakeholders involved. Groet, MarcoH RIPE NCC

1 0