- iot-wg - mailman.ripe.net

draft agenda for RIPE77
by Jim Reid 21 Sep '18

21 Sep '18

Here’s the draft agenda for the WG meeting next month. Other than tweaks to the running order, there shouldn’t be any significant changes. See you all in Amsterdam! # # $Id: agenda,v 1.4 2018/09/21 08:40:30 jim Exp $ # 1. Administrivia 2. NCC Update Marco Hoegwoning - RIPE NCC 3. The Internet of Threats: fighting FUD with MUD Michael Richardson - Sandelman Software Works For many internet organizations, the #1 risk on their risk register is a large scale (Dyn like) DDoS attack. One of the mitigation mechanisms for this risk is to prevent weaponization of consumer grade connected devices --- to keep Things from becoming Threats. What we need are security controls that will protect IoT devices from the internet, and to protect the internet from IoT devices. CIRALabs's Secure Home Gateway project is developing a comprehensive extension to the common OpenWRT code base to include processing of IETF standard Manufacturer Usage Description (MUD) files. 4. Police perspective on IoT, challenges & strategy Jaap van Oss, Manon den Dunnen - Politie The accelerated deployment of IoT is reshaping society and offers new opportunities and threats in the area of safety. Privacy, security and collaboration are fundamental in addressing the challenges. In this presentation we'll share how we look at the IoT domain, what steps we take and the struggles we face. 5. Security Problems in IoT Thomas Stols - Computest Computest has a lot of experience (security) testing various IoT devices. During this talk we’ll give the viewer some insight in common security problems we see during our daily work. 6. The Internet-of-Insecure-Things: Causes, Trends and Responses Arman Noroozian - TU Delft We know poorly secured IoT devices are flooding our markets. And we know they get compromised at scale. Why is this so hard to stop? We look at the underlying causes for why this problem persists. Next, we explore data on where compromised IoT is located, what kind of devices are affected and which networks have the higher concentrations. We end by exploring different responses to help mitigate these threats, with a special focus on the role of network operators. 7. AOB

1 0

agenda items for RIPE77
by Jim Reid 05 Sep '18

05 Sep '18

Colleagues, if you have suggestions for agenda topics or presentations for the WG session next month, please send them to iot-wg-chairs(a)ripe.net. There are fabulous cash prizes on offer. Well OK, maybe not. :-)

1 0

RIOT Summit: Registration open
by Matthias Waehlisch 13 Aug '18

13 Aug '18

Dear RIPE IoT WG, the third RIOT Summit (http://summit.riot-os.org/) will take place in Amsterdam, Netherlands at the Science Park Congress Center on September 13-14, 2018. The first day is dedicated to single-track presentations. The second day allows for break-out sessions and coding. If you want to attend, please register as soon as possible: https://riot-summit18.eventbrite.com/. This is a great opportunity to meet the community behind RIOT, the friendly open source operating system for the Internet of Things. **Talks** Keynote by Jaime Jiménez (Co-chair of IETF CoRE Working Group and Master Researcher @ Ericsson) More speakers: http://summit.riot-os.org/2018/#speakers **Social* After the talks of the first day, we have organized a casual BBQ at the Rolling Rock Kitchen (http://rollingrockkitchen.com) Food is sponsored. **Hotels** Please note that Amsterdam is pretty crowded during the week of the RIOT Summit. Book soon! You should also consider options such as hotwire.com, airbnb, or accommodations in Utrecht (~40 minutes by public transport). **Registration** Participation at the RIOT Summit is free of charge. However, registration is required: https://riot-summit18.eventbrite.com/ *Supporters** We gratefully thank the following companies for their generous support: Cisco, RIPE NCC, SIDN Labs, STMicroelectronics, wolfSSL, Zühlke. We also thank Freie Universitaet Berlin, HAW Hamburg, and INRIA. Looking forward to meet you in Amsterdam! Cheers matthias -- Matthias Waehlisch . Freie Universitaet Berlin, Computer Science .. http://www.cs.fu-berlin.de/~waehl

1 0

2nd EUROPOL-ENISA IoT Security Conference 2018
by Marco Hogewoning 10 Aug '18

10 Aug '18

Dear Colleagues, For the second year in a row, Europol and ENISA are co-organising a conference to raise awareness on the security implications of the Internet of Things (IoT). The conference aims to enable a broad discussion by bringing together experts from cybercrime units, CSIRTs, international organisations, private industry, regulatory agencies, and academia, with particular focus on hands-on and demo sessions. This conference will be on 24 and 25 October 2018 at the Europol headquarters in The Hague. The three main sessions of the two-day conference will focus on: • Industry 4.0 (confirmed speakers: KPN, SAP Labs, Barbaraiot, Bosch) • IoT Application Domains and Case Studies (confirmed speakers: BMW, Airbus, Continental, Vtolabs, GSMA) • Emerging IoT trends (confirmed speakers: IBM, RiskIQ, Shadowserver, CSA, Pentest Partners ) This conference is by invitation only, but Europol has informed us that they are happy to accommodate for a few interested participants from this Working Group and extend an invitation to them. If you are keen in attending this conference, please send me an email including a short bio and contact details and we will pass this on to our colleagues at Europol and coordinate with them concerning the invitations. Please note that places are limited and we cannot guarantee that you will receive an invite. Also importantly, this only concerns the invitation, this event is not funded and participants are required to make and fund their own travel arrangements and accommodation. Regards, Marco Hogewoning -- Senior External Relations Officer RIPE NCC http://www.ripe.net

1 0

co-chair selection procedure
by Jim Reid 19 Jul '18

19 Jul '18

We still have to sort out an appointment procedure and that's my fault. Sorry. It was too easy to procrastinate when $dayjob got in the way. Anyways, we need to get something sorted soon. Ideally, I'd like to get WG agreement by mid-September (allowing for the summer holidays). That would allow us to run the appointment process and have a stuckee in place before RIPE77 (Oct 15-20th). If you have concerns that more time is needed for either agreeing a procedure or then using it, please speak up. I would also ask the WG to avoid the temptation to rat-hole or over-think the selection procedure, for instance by proposing elaborate steps to apply in corner cases that in all probability will never arise. We're just appointing a WG co-chair, not the Internet's Supreme-Leader-for-Life. We can always change the suggested process later if practical experience proves it is broken or needs improvement. I hope we can just put something quick and simple in place that solves the immediate need. Note too that there is no mention of elections or votes. This is deliberate. Can we live with the following? (1) The IoT WG will have 2 co-chairs who serve staggered 2-year terms. (2) A co-chair cannot serve more than 3 consecutive terms. (3) Each year, the longest serving co-chair will stand down and subject to (2) may make themselves available for re-appointment. (4) The incoming co-chair will be chosen by the WG using consensus and the remaining co-chair will make the consensus determination. (5) Any circumstances not covered by the above will be resolved by the RIPE Chair whose decision will be final.

4 3

Draft minutes from RIPE76
by Jim Reid 19 Jul '18

19 Jul '18

Colleagues, here are the draft minutes from the WG meeting in Marseille. My thanks to Amanda for taking such excellent notes. Please let me know if there are any corrections or ommissions. IoT Working Group Minutes - RIPE 76 17 May 2018, 14:00 - 15:30 WG Chair: Jim Reid Scribe: Mirjam Kühne Status: draft The presentation is available at: https://ripe76.ripe.net/archives/video/124 1. Administrivia Jim Reid opened the meeting and explained that the WG chair selection process is still ongoing. He will pick this up on the mailing list again. It is expected to conclude this within the next few months so that the WG will have selected chairs at the next RIPE meeting. 2. Report on RIPE NCC IoT Activities Marco Hogewoning, RIPE NCC The presentation is available at: https://ripe76.ripe.net/archives/video/125 Jim expressed his personal thanks to Marco for helping to get the IoT WG off the ground. There were no further questions. 3. Privacy Implications of Sewage Testing for Illicit Drugs Elif Sert, Istanbul Bilgi University The presentation is available at: https://ripe76.ripe.net/archives/video/127 Jim asked if there are any indications that this data might be cross-referenced with other types of data to get closer granularity (i.e. the bus network)? Elif responded that this sounds indeed very possible. This particular research data was for instance merged with geographical and mobile phone data, but it was not clear what the results were. The goal was definitely to get more accurate results (on groups and individuals). Hugo Vincent, ARM Research, reported that they have seen quite a lot of progress in the last couple of years in regulating privacy for individuals. He wondered if there were any groups or organisations that were making progress around trying to define how to regulate group privacy? Elif said that there is some research on this and that some books have been published on this topic. She added that at the moment they have a very individual way to look at privacy, and that they might have to lift it up to the group level in order to better protect people. 3. RIOT: Networking from the Friendly OS Perspective Matthias Waehlisch, FU Berlin The presentation is available at: https://ripe76.ripe.net/archives/video/128 Jim asked what the next big thing would be for RIOT. Matthias explained that one thing there were working on were automatic updates for the devices, preferably over the air and secure. Another thing was an easy system to share applications, working on an app store. 4. SPIN: Security and Privacy for In-Home Networks Jelte Jansen, SIDN The presentation is available at: https://ripe76.ripe.net/archives/video/130 Matthias Waehlisch asked if Jelte was aware of the people from Princeton (referring to the IoT inspector). Jelte said that he was aware of them, but that he had no contact yet. Jim said he was fascinated to hear that Jelte’s TV was actually talking to Facebook and wondered if it wouldn’t be a useful service for end users to have some kind of a Little Snitch sitting on the home router reporting what weird things a TV, fridge, kettle etc., werere doing in the background. He asked Jelte if he has considered such a service. Jelte answered that he would like to actually visualise that. However, this could only be done in real time. Looking into the actual data would cause a whole new set of privacy problems. He clarified that one of the reasons this was a research project is that they wanted to look into how they could efficiently report what kind of things people's devices were doing. Niels Bakker asked on the chat channel what Jelte’s ISP was that kept disconnecting him. Jelte didn’t want to mention the name, but said it was a helpdesk service by Ziggo that was responsible for the building he lives in and he didn’t have a choice. Someone else mentioned on the chat channel that there were products on the market that do per-device 'parental controls', like FRITZ!Box, that any end user can use to easily isolate their IoT devices, wired or wireless. Jelte said that he was aware of this, but they were usually restricted to things like parental control. 5. Securing IoT Devices - Closing the Gaps Hugo Vincent, ARM Security The presentation is available at: https://ripe76.ripe.net/archives/video/132 Alain Durand, ICANN, asked what would happen if these devices were to live for 25 years. How does one manage trust anchors if devices are powered down for many years? Hugo said that this was obviously a big challenge. One needs to have strong hardware identity to be able to make sure that this is still the same device later on. Alain added that he thinks authentication has to go both ways. Hugo agreed. Vesna Manojlovic, RIPE NCC, suggested that since Hugo was considering very long terms, to also look at sustainability. Where will the material come from and what about recycling and waste? Hugo said that this was a fantastic question and that he was definitely interested in overall global efficiency. He said ARM wanted to make the device as sustainable as possible and that they were looking at extremely low power usage. They’re doing work with plastic semi-conductors for example to reduce the energy input into the device compared to silicon. He agreed that this was a very important question. Vesna asked if Hugo would be willing to present about this topic at the next RIPE Meeting. Hugo answered that one of his colleagues could definitely do that. Petr Špaček, CZ.NIC, asked to let him know when they found a way to solve the trust anchor issue, because the domain name community has been struggling with that problem for years already. Jim commented that ARM was in a very interesting position in this particular marketplace and that there was a lot of good things they could do to encourage their partners to have a security framework for the live updates of IoT devices. He also suggested to consider open sourcing some of that work. Hugo responded that a lot of their IoT stack was already open source. He agreed that they don’t only have the opportunity but the responsibility to improve security of IoT devices. 6. Role for the Name and Numbering Community in the IoT Domain Sandoche Balakrichenan, AFNIC The presentation is available at: https://ripe76.ripe.net/archives/video/134 Marco Hogewoning clarified that from the RIPE NCC’s perspective, IPv6 addresses are not good for identification. A lot of people want both: a fixed identifier and at the same time an identifier to deliver traffic to the device where ever it is. This can be solved. But as the RIPE NCC we would like some guidance from the community how to handle this. Jim added that it would be good if the speaker could help to do some outreach into these other communities in the area of IoT. He recommended to find out what the problem statements and approaches are and to encourage them to come to the meetings and participate. Victoria Risk, ISC, asked if the speaker had considered using MAC addresses as identifiers. Sandoche responded that in LowRa they are using UI64 (which is a bit like a MAC address). He said that for locating communication in a computers, one could use a MAC type UI64 address and for the communication between the protocols on the Internet, one could use IPv6. But they will still have to see if this would work. 7. AOB Jim Reid closed the meeting and encouraged everyone to participate in the IoT/IPv6 discussion taking place in the IPv6 WG later that afternoon.

1 0

AFNIC and the IoT
by Gordon Lennox 09 Jul '18

09 Jul '18

Afnic have published an issues paper on the IoT. You can find the English language version here: https://www.afnic.fr/en/about-afnic/news/general-news/11093/show/issue-pape… Gordon

1 0

Fwd: CRYPTO-GRAM, May 15, 2018
by Jim Reid 15 May '18

15 May '18

In case some of you don't read Cryptogram (why not?)... > Begin forwarded message: > > From: Bruce Schneier <schneier(a)schneier.com> > Subject: CRYPTO-GRAM, May 15, 2018 > Date: 15 May 2018 at 06:07:08 BST > To: jim(a)rfc1035.com > Cc: Crypto-Gram Mailing List <crypto-gram(a)lists.schneier.com> > > Researchers at Princeton University have released IoT Inspector, a tool that analyzes the security and privacy of IoT devices by examining the data they send across the Internet. They've already used the tool to study a bunch of different IoT devices. Their first two findings are "Many IoT devices lack basic encryption and authentication" and "User behavior can be inferred from encrypted IoT device traffic." No surprises there. > https://freedom-to-tinker.com/2018/04/23/announcing-iot-inspector-a-tool-to… <https://freedom-to-tinker.com/2018/04/23/announcing-iot-inspector-a-tool-to…> > https://iot-inspector.princeton.edu/ <https://iot-inspector.princeton.edu/> > https://boingboing.net/2018/04/23/promiscuous-mode.html <https://boingboing.net/2018/04/23/promiscuous-mode.html>

1 0

updated WG agenda for RIPE76
by Jim Reid 08 May '18

08 May '18

Colleagues, here's an updated agenda for next week. This should be the final version -- famous last words! -- but the running order may change, # # $Id: agenda,v 1.3 2018/05/08 08:56:19 jim Exp $ # 1) Administrivia 2) Report on NCC IoT Activities Marco Hogewoning, RIPE NCC 3) Privacy implications of sewage testing for illicit drugs Elif Sert, Istanbul Bilgi University In smart cities of the future, many IoT devices will be deployed to monitor community behaviour while being designed not to collect personal data in order to preserve individual privacy. This presentation will question this view by examining the phenomenon of sewage testing to monitor community use of illicit drugs in communities 4) RIOT: Networking from the friendly OS perspective Matthias Waehlisch, Freie Universitaet Berlin RIOT is the friendly operating system for the Internet of Things, targeting low-power IoT devices. In this presentation, we will report about the networking stack and deployment scenarios of this open source project. 5) SPIN - Security and Privacy for In-home networks Jelte Jansen, SIDN The SPIN project at SIDN Labs aims to explore - and prototype - methods so improve the security and privacy of home networks with regards to the IoT. Within SPIN, we research several topics, such as device traffic visualisation, automated recognition of (bad) patterns, device descriptions, and abuse handling. 6) Securing Internet of Things Devices: Closing the Gaps Hugo Vincent, ARM A lot has been published about the (in)security of Internet of Things (IoT) devices during the past few years. There is also no shortage of good ideas on how to secure IoT devices and the infrastructure. This presentation gives a brief overview of the comprehensive security approach developed by ARM to secure IoT devices and provides links to relevant software and hardware. 7) Role for the numbering and naming community in the IoT domain Sandoche Balakrichenan - AFNIC Both the numbering (RIRs such as RIPE) and naming communities (domain name registries such as Afnic) play an vital role in the current Internet infrastructure. This talk will focus on how the earlier mentioned communities will play the same vital role in the IoT domain. 8) AOB

1 0

draft agenda for Marseille
by Jim Reid 01 May '18

01 May '18

Colleagues, here’s the draft agenda for the WG meeting at RIPE76. Please note this is likely to change between now and then. See you all in Marseille. # # $Id: agenda,v 1.2 2018/05/01 13:23:25 jim Exp jim $ # 1) Administrivia 2) Report on NCC IoT Activities Marco Hogewoning, RIPE NCC 3) Privacy implications of sewage testing for illicit drugs Elif Sert, Istanbul Bilgi University In smart cities of the future, many IoT devices will be deployed to monitor community behaviour while being designed not to collect personal data in order to preserve individual privacy. This presentation will question this view by examining the phenomenon of sewage testing to monitor community use of illicit drugs in communities 4) RIOT Matthias Waehlisch, Freie Universitaet Berlin 5) SPIN - Security and Privacy for In-home networks Jelte Jansen, SIDN The SPIN project at SIDN Labs aims to explore -and prototype- methods so improve the security and privacy of home networks with regards to the IoT. Within SPIN, we research several topics, such as device traffic visualisation, automated recognition of (bad) patterns, device descriptions, and abuse handling. 6) Role for the numbering and naming community in the IoT domain Sandoche Balakrichenan - AFNIC Both the numbering (RIRs such as RIPE) and naming communities (domain name registries such as Afnic) play an vital role in the current Internet infrastructure. This talk will focus on how the earlier mentioned communities will play the same vital role in the IoT domain. 7) AOB

1 0

Agenda items for RIPE76
by Jim Reid 26 Mar '18

26 Mar '18

RIPE 76 is 6-7 weeks away. Yikes! Plese send your suggestions for speakers or agenda items for the WG to iot-wg-chairs(a)ripe.net.

1 0

Fwd: [ipv6-wg] Invitation to supply feedback on ITU draft Recommendation on IPv6 address planning for IoT
by Michael J. Oghia 26 Mar '18

26 Mar '18

This might be relevant to this list as well. Best, -Michael ---------- Forwarded message --------- From: Sander Steffann <sander(a)steffann.nl> Date: Thu, Mar 22, 2018, 12:52 PM Subject: Re: [ipv6-wg] Invitation to supply feedback on ITU draft Recommendation on IPv6 address planning for IoT To: ipv6-wg(a)ripe.net <ipv6-wg(a)ripe.net> Hi, > We are happy to announce that ITU Study Group 20 has responded positively to our offer and have decided to share the current working draft with us, for the purpose of review and for RIPE community to provide feedback. > > As it is quite big, the text of this draft Recommendation Y.IPv6RefModel “Reference model of IPv6 subnet addressing plan for Internet of things deployment” has been made available on the IPv6 WG pages: > > https://www.ripe.net/participate/ripe/wg/ipv6/documents/itu-ipv6refmodel > > We kindly invite you to provide feedback and comments on the contents of this document via this mailing list or of course the RIPE Forum web interface. The RIPE NCC has agreed to ensure that the comments will be collected and made available to the ITU via response to the Liaison Statement below. Thanks! As the document is indeed quite long I will give feedback by mentioning the page number, section and quote the particular bit I'm commenting on. I assume, as there are still editorial notes in the document, that minor issues such as grammatical errors don't need comments and will be fixed in a future updates. > Page 3, Introduction: "The current ISPs practice tend to allocate /48 or /64 prefixes to regular customers (e.g., homes) and up to /29 for companies registered at RIRs." There are two issues with this text. The practice of assigning only a /64 goes against the best practice documented in RIPE-690. While I agree that it happens, this should be noted. Also, the "up to /29" text is plain wrong. There are plenty of examples of larger-than-/29 allocations. I guess it means to talk to enterprises that become an LIR, and I don't know any examples for that specific subset. (I'm explicitly NOT going into the difference between allocations and assignments. That doesn't bother me in documents like this) Suggested text: "The current ISPs best current operational practice advises to allocate /48 or /56 prefixes to regular customers (e.g., homes) and up to /29 for enterprises that become LIRs themselves." I think this also better aligns with the scope defined later in the document. > Page 9, 4 Abbreviations and acronyms Might want to add LIR here as well. > Page 13, 9 IPv6 address structure, "Larger networks owners, such as large companies, can get up to /32 global routing prefixes." This contradict the text on page 3. Suggested: "Larger networks owners, such as large companies, can commonly get up to a /29 global routing prefixes." > Page 14, 10 Subnet address requirements, "a smooth transition from IPv4, to dual stack environment (IPv4 and IPv6) and finally to IPv6 only deployments" It might be noted here that IPv4 -> dual-stack -> IPv6 is often no longer the preferred transition path. Technologies like SIIT-DC and NAT64 make it increasingly preferable to skip the dual-stack step. Both to save the cost of an extra transition step and to reduce the complexity caused by the dual-stack phase. > Pages 15&16, 11 Reference model for IPv6 subnet addressing plan I'm not mentioning specific sentences here because I don't agree with the concept behind the whole section. I understand the incentive to map IPv4 prefixes to IPv6 prefixes in the short term. The problem with that strategy is that the given approach results in a very bad IPv6 addressing plan. And it won't be applicable unless the IPv4 addressing plan already conforms to a whole set of conditions. If the IPv4 plan deviates even slightly from the proposed plan then it can't be used. That realistically only makes it deployable in greenfield, in which case there are much better addressing plan possible. Some unrealistic constraints on the IPv4 plan: - the organisation uses a /16 split into /24s - the "categories" subnets have to be kind of hex-aligned (DMZ=0-31, Servers=32-63 etc) And then it creates a suboptimal IPv6 addressing plan: - it is aggregated by building - but the "IPv4-mapping" part is completely unaggregatable - which causes overly complex routing topologies - which causes overly complex firewall rules Without the IPv4 mapping the addressing plan would be close to what the SURFnet addressing plan document recommends (note: I'm one of the authors of that document). In short: this suggested plan is likely not deployable on existing networks, and greenfield networks could do much better. I therefore think this is not a good recommendation at all. > Later sections While there is some sense in the general structure of section 11 (except for the IPv4 mapping), the whole concept is wrangled to pieces in the subsequent sections. For the /56 it's still understandable, but applying this to a /36 is really not even close to a best practice anymore. Networks of that scale just aren't organised in the way that this paper assumes. Furthermore, it also is assigning more than a /44 to a single site, which would violate RIPE policy unless explicitly approved by the RIPE NCC IPRAs. And with a badly structured plan like the recommended one I just can't see that happening. That makes the plan undeployable. So, in summary: it is great that the ITU is helping organisations with deploying IPv6. This plan however seems too far removed from operational reality to be really usable. It looks like an academic exercise without operational experience. It does not feel right to me to publish this as a recommendation unless the shortcomings of the /48 plan section are addressed, and the sections that talk about larger address blocks take common architectures of larger networks into account. Cheers, Sander

3 5

Save the date & call for sponsors: RIOT Summit 2018
by Matthias Waehlisch 14 Mar '18

14 Mar '18

Hi, for those who don't know: RIOT is a modern open source operating system for low-end IoT devices, https://riot-os.org/. Initially developed by folks from academia, the RIOT community now consists of companies, makers, and hobbyist, distributed all around the world. The RIOT community meets annually f2f at the RIOT Summit. The next RIOT Summit is scheduled for September 13-14, 2018 in Amsterdam, locally supported by RIPE NCC. The RIOT Summit aims for bringing together RIOTers, beginners and experts, as well as people interested in the IoT in general and decision makers who plan to deploy RIOT in the future. The event combines plenary talks, hands-on tutorials, and demos. All details are available at https://summit.riot-os.org/2018/. To make the RIOT Summit 2018 a successful event, we need your help! Please consider the following calls: * https://summit.riot-os.org/2018/blog/call-for-sponsors/ * https://summit.riot-os.org/2018/blog/call-for-contributions/ If you have questions, feel free to contact me directly or via summit(a)riot-os.org. Thanks matthias -- Matthias Waehlisch . Freie Universitaet Berlin, Computer Science .. http://www.cs.fu-berlin.de/~waehl

1 0

Fwd: Call for new ENISA Expert Group on Transport Security
by Marco Hogewoning 13 Mar '18

13 Mar '18

Dear Colleagues, Please find below a message received from ENISA regarding the creation of an expert group on transport security and resilience. Although quite far away from RIPE’s mission and mandate, with the ever increasing importance of Internet technology and the IP transport layer, it might be of benefit to bring expertise on these areas into that dialogue. At this stage RIPE NCC does not envision to take part in this group directly, although we will try and keep track of progress and any outcomes that might relate to the interests of the RIPE community. Regards, Marco Hogewoning Senior External Relations Officer RIPE NCC Begin forwarded message: > > Dear Experts, > > I trust this email finds you well. > > We would like to bring to your attention a call for applications for a new ENISA Experts Group on Transport Security and Resilience. > The focus of the group will be air, rail and water transport and you can find more information here: https://www.enisa.europa.eu/news/enisa-news/call-for-experts-for-transsec-t… > > Please feel free to share with your networks. > > Best regards, > -Apostolos > > ------------------------------------------------------------------------------------------------------ > Dr Apostolos Malatras > > Network and Information Security Expert > European Union Agency for Network & Information Security > > Address: 1 Vass Sofias Str, Marousi 151 24, Attica, Greece > E- mail: Apostolos.Malatras(a)enisa.europa.eu<mailto:Apostolos.Malatras@enisa.europa.eu> > Office: +30 2814 409 630 > Mobile: +30 6985 051 401

2 1

some suggestions on "work items" for the WG
by Jim Reid 16 Feb '18

16 Feb '18

Here are a few random thoughts about the sorts of things the WG might do. I hope these will spark some discussion. Please note I’m not saying the WG will or won’t adopt any of these suggestions. Or that these are the only topics of interest. This is just an attempt to get everyone to think about the WG’s activities and come forward with their own suggestions. 1) Interaction with SDOs and industry fora How could/should the WG engage with these? Do we want updates from (say) AIOTI, IETF, ETSI and so on? Are any members of the WG involved in the IoT work at these sorts of organisations? 2) Liaison with government/regulators What is and isn’t appropriate here? 3) Advice/support to the NCC The NCC gets asked about IoT. They are going to want the WG to provide advice or present the consensus view (if any) of the RIPE community. 4) Academia We had a few IoT themed presentations at RIPE75 from academics. Does the WG want more (or less) of that sort of thing? What’s the best way to collaborate with academia and what does the WG want to get from that? 5) Training & Documentation Should the WG try to develop training materials/tutorials on IoT, white papers, use cases, best practices and so on? [Probably yes.] If so, what should these focus on and are there any volunteers to help produce these? 6) IP(v6) Addressing Issues What are the main issues around IP(v6) addressing/subnetting schemes for IoT devices and networks? 7) Security Anyone interested in the security aspects of IoT, both in terms of the edge devices and their potential role in DDoS attacks like Mirai? Could the WG develop some recommendations or advice? 8) Policy Making What sort of policies (and on what) could the WG develop for the NCC to implement? 9) Tools and toys Does anyone have new/interesting tools for playing with IoT devices or have useful development environments for them, say for writing/debugging code on a Raspbery Pi or even cheaper chipsets? 10) Anything else? Er.... Let’s hear what you all have to say about the above. Or other things I’ve either overlooked or forgotten about. Over to you...

12 15

mailing list etiquette
by Jim Reid 23 Dec '17

23 Dec '17

What’s this? Have we been teleported back to the late 1980s? :-) Could I remind everyone to use meaningful and relevant Subject: headers when posting to the mailing list. In particular, *PLEASE* do not reply to message digests. It’s inconsiderate and unhelpful to reply to message digests. So don’t do that. Thanks. Replies to message digests create unnecessary and easily avoided problems. Here are the main ones: [1] It messes up the article threading used by everybody’s mail clients. [2] It’s not clear which message(s) in the digest are being replied to. [3] The list archives contain completely useless Subject: headers (like "iot-wg Digest, Vol X, Issue Y”) which make it difficult when browsing the archives to find out who said what and when. Item [3] becomes a real nuisance if/when there’s a need to consult the list archives to verify a consensus decision or review the development of things such as policy proposals.

1 0

Second Part of RIPE Atlas as IoT Devices - The RIPE Atlas Architecture
by Mirjam Kuehne 19 Dec '17

19 Dec '17

Dear colleagues, Here is the second part of the story about RIPE Atlas as IoT Devices. This time we we give some insights into the overall architecture of the RIPE Atlas network and how we manage secure communication with our probe flock. https://labs.ripe.net/Members/kistel/ripe-atlas-architecture-how-we-manage-… Kind regards, Mirjam Kühne RIPE NCC

1 0

DMARC Solution Applied to this Mailing List
by Adam Castle 18 Dec '17

18 Dec '17

Dear Working Group, As more email providers enable Domain Message Authentication Reporting & Conformance (DMARC), some people find they can no longer receive emails from the mailing lists they are subscribed to. We have deployed a Mailman setting change to address this problem. After consultation with the RIPE Working Group Chairs, we have enabled the DMARC "Munge From" setting on all RIPE mailing lists. This means that if your email service provider has DMARC enabled, you will continue to receive all emails sent to this mailing list, but the "From" part of the header will change. If you don't have DMARC enabled, you won't see any change to the emails you receive from this mailing list. You can find more information about how we have been handling DMARC in the following RIPE Labs articles: https://labs.ripe.net/Members/adam_castle/dmarc-and-the-ripe-ncc https://labs.ripe.net/Members/adam_castle/ripe-mailing-lists-and-dmarc To ensure all working group participants are aware of the changes, I am sending this mail to all working groups. If you have any questions or encounter any issues on this mailing list, please let me know. Many thanks. Adam Castle Web Services Manager RIPE NCC

1 0

Re: [iot-wg] iot-wg Digest, Vol 13, Issue 3
by Avetik Yessayan 12 Dec '17

12 Dec '17

Hi Michael, I will be at IGF, i can make a presentation on IOT Security, will let you know the title of the presentation tomorrow. Please let me know the schedule, duration and if possible to send the details about the session and other presenters to make the best fit. best regards, Avetik Yessayan, CEO Shirak Technologies 8 Koriun Street, suite 13 Yerevan - 0009, Armenia Voice: +374 (60) 50-4004 US: +1 (325) 500-4004 Mob: +374 (98) 504-504 On Dec 12, 2017, at 19:38, iot-wg-request(a)ripe.net<mailto:iot-wg-request@ripe.net> wrote: Send iot-wg mailing list submissions to iot-wg(a)ripe.net<mailto:iot-wg@ripe.net> To subscribe or unsubscribe via the World Wide Web, visit https://lists.ripe.net/mailman/listinfo/iot-wg or, via email, send a message with subject or body 'help' to iot-wg-request(a)ripe.net You can reach the person managing the list at iot-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of iot-wg digest..." Today's Topics: 1. Fwd: Re: [Internet Governance Forum] IGF Workshop: Internet of things for smart city (Michael J. Oghia) ---------------------------------------------------------------------- Message: 1 Date: Tue, 12 Dec 2017 16:36:04 +0100 From: "Michael J. Oghia" <mike.oghia(a)gmail.com> To: "IoT List (RIPE)" <iot-wg(a)ripe.net> Cc: sheminglei2009(a)163.com Subject: [iot-wg] Fwd: Re: [Internet Governance Forum] IGF Workshop: Internet of things for smart city Message-ID: <CAMCMt7q-rZ=uw=fgY31HZhxOpm6umyV_j_3Xkn06M0p-NrJonw(a)mail.gmail.com> Content-Type: text/plain; charset="utf-8" Hi all, Is anyone that's on this list going to be at the IGF in Geneva next week? There is a session on IoT and smart city sustainability, and unfortunately one of the speakers from Kenya wasn't issued a visa. So, now they need someone to speak about IoT security. I've CCd the organizer, Steve Sheh, and the session details are below. Can anyone join this session? *Session details:* Internet of Things for Smart City: Green and Sustainability December 20, 2017 ? 16:40-18:00 Room XXII-E https://www.intgovforum.org/multilingual/content/igf-2017- ws-42-internet-of-things-for-smart-city-green-and-sustainability Best, -Michael __________________ Michael J. Oghia #Netgov consultant & researcher | editor Belgrade, Serbia Skype: mikeoghia Twitter <https://www.twitter.com/MikeOghia> *|* LinkedIn <https://www.linkedin.com/in/mikeoghia> ---------- Forwarded message ---------- From: sheminglei2009(a)163.com <sheminglei2009(a)163.com> Date: Tue, Dec 12, 2017 at 3:32 PM Subject: Re: Re: [Internet Governance Forum] IGF Workshop: Internet of things for smart city To: "mike.oghia" <mike.oghia(a)gmail.com> Hi Michael: Thank you for your reply and interest. Our topic is internet of things for smart city: green and sustainability ( https://www.intgovforum.org/multilingual/content/igf-2017- ws-42-internet-of-things-for-smart-city-green-and-sustainability) It really can cover a lot of topics. Our original agenda as below, the speaker from Kenya was going to talk about Cybersecurity in IOT 1 Welcome remarks 2 IoT development worldwide, technologies currently available or being released into the market, strategic IoT solutions for smarter cities, and what are the challenges for IoT solutions to multi-stakeholders. 3 Smart City in Tunisia through the example of the QR Wepedia project <https://blog.wikimedia.org/2015/12/08/tunis-future-generations/> 4 The development of Smart City in China 5 Influence of IoT on Humans behavior (On-going investigations on Flow management of people by predictive analytics of their routes with the use of mobile devices) 6 Cybersecurity in IOT. 7 Open Discussion ------------------------------ ??? Steve Sheh ?????? ? ?????? ?? Website?www.cie-info.org.cn www.cast.org.cn ?? Email:sheminglei@cie-info.org.cn ; sheminglei2009(a)163.com Skype: sheminglei ?? Phone? +86-10-68278214 <+86%2010%206827%208214>?+86-18519101084 <+86%20185%201910%201084>?Whatsapp? ?? Add.????????????????13?? Building 13,Puhuinanli,Yuyuantan South Road,Haidian,Beijing,China

2 1

Fwd: Re: [Internet Governance Forum] IGF Workshop: Internet of things for smart city
by Michael J. Oghia 12 Dec '17

12 Dec '17

Hi all, Is anyone that's on this list going to be at the IGF in Geneva next week? There is a session on IoT and smart city sustainability, and unfortunately one of the speakers from Kenya wasn't issued a visa. So, now they need someone to speak about IoT security. I've CCd the organizer, Steve Sheh, and the session details are below. Can anyone join this session? *Session details:* Internet of Things for Smart City: Green and Sustainability December 20, 2017 – 16:40-18:00 Room XXII-E https://www.intgovforum.org/multilingual/content/igf-2017- ws-42-internet-of-things-for-smart-city-green-and-sustainability Best, -Michael __________________ Michael J. Oghia #Netgov consultant & researcher | editor Belgrade, Serbia Skype: mikeoghia Twitter <https://www.twitter.com/MikeOghia> *|* LinkedIn <https://www.linkedin.com/in/mikeoghia> ---------- Forwarded message ---------- From: sheminglei2009(a)163.com <sheminglei2009(a)163.com> Date: Tue, Dec 12, 2017 at 3:32 PM Subject: Re: Re: [Internet Governance Forum] IGF Workshop: Internet of things for smart city To: "mike.oghia" <mike.oghia(a)gmail.com> Hi Michael: Thank you for your reply and interest. Our topic is internet of things for smart city: green and sustainability ( https://www.intgovforum.org/multilingual/content/igf-2017- ws-42-internet-of-things-for-smart-city-green-and-sustainability) It really can cover a lot of topics. Our original agenda as below, the speaker from Kenya was going to talk about Cybersecurity in IOT 1 Welcome remarks 2 IoT development worldwide, technologies currently available or being released into the market, strategic IoT solutions for smarter cities, and what are the challenges for IoT solutions to multi-stakeholders. 3 Smart City in Tunisia through the example of the QR Wepedia project <https://blog.wikimedia.org/2015/12/08/tunis-future-generations/> 4 The development of Smart City in China 5 Influence of IoT on Humans behavior (On-going investigations on Flow management of people by predictive analytics of their routes with the use of mobile devices) 6 Cybersecurity in IOT. 7 Open Discussion ------------------------------ 佘明磊 Steve Sheh 中国电子学会 · 学术交流中心网址 Website：www.cie-info.org.cn www.cast.org.cn 邮箱 Email:sheminglei@cie-info.org.cn ; sheminglei2009(a)163.com Skype: sheminglei 电话 Phone： +86-10-68278214 <+86%2010%206827%208214>，+86-18519101084 <+86%20185%201910%201084>（Whatsapp）地址 Add.：北京市海淀区玉渊潭南路普惠南里13号楼 Building 13,Puhuinanli,Yuyuantan South Road,Haidian,Beijing,China

1 0

next steps for the new WG
by Jim Reid 29 Nov '17

29 Nov '17

There are a few things which need to be sorted out in the coming months and will have to be discussed on the list. I’ll start separate threads for each of them. 1) Getting consensus on a co-chair selection/removal process 2) Deciding how many co-chairs and running the selection process to appoint them 3) Agreeing what things (excuse the pun!) the WG should do: ie what do we mean by “exchanging information about IoT”?

1 0

The IoT WG Charter
by Jim Reid 29 Nov '17

29 Nov '17

In case anyone’s not noticed, the IoT WG was created at RIPE75. Those who were on the (now closed down) iot-discussion mailing list have been migrated to the WG’s list iot-wg(a)ripe.net. There’s also a home page for the new WG: https://www.ripe.net/participate/ripe/wg/iot. Many thanks to Marco and his colleagues at the NCC for taking care of that. There was a little bit of wordsmithing on the proposed charter in Dubai. Here’s the text that got consensus in the IoT plenary. • To discuss challenges and opportunities of "IoT” for the RIPE community • To serve as a focal point for the RIPE NCC regarding community input to their IoT activities, including liaisons with other organisations • To invite IoT communities for a dialogue on matters of operational relevance, including security, the numbering system, and applicability of standards • To develop positions of the RIPE community on IoT matters Thanks to everyone who contributed to this text.

1 0

ENISA study "Baseline Security Recommendations for IoT in the context of CII" is out
by Apostolos Malatras 21 Nov '17

21 Nov '17

Dear all, We are very happy to announce that the ENISA Study "Baseline Security Recommendations for IoT in the context of CII" study is out: https://www.enisa.europa.eu/news/enisa-news/defining-and-securing-the-inter… Please feel free to share the study with your networks. Sincerely, -Apostolos ------------------------------------------------------------------------------------------------------ Dr Apostolos Malatras Network and Information Security Expert European Union Agency for Network & Information Security Address: 1 Vass Sofias Str, Marousi 151 24, Attica, Greece E- mail: Apostolos.Malatras(a)enisa.europa.eu Office: +30 2814 409 630 Mobile: +30 6985 051 401

1 0

IoT security
by Gordon Lennox 16 Nov '17

16 Nov '17

Bruce Schneier on IoT security and the US government: "IoT Cybersecurity: What's Plan B?" https://www.schneier.com/crypto-gram/archives/2017/1115.html#7

1 0

Welcome to the IoT Working Group Mailing List
by Marco Hogewoning 09 Nov '17

09 Nov '17

Dear Colleagues, As you are reading this email, we have successfully completed renaming the IoT Discussion list to iot-wg(a)ripe.net as announced yesterday. Your subscription has been automatically transferred from the old list, including all of its settings. Should you wish to change your settings or unsubscribe from this mailing list, you can do so via the administrative interface at: https://lists.ripe.net/mailman/listinfo/iot-wg This list now serves as the mailing list for the RIPE Internet of Things Working Group, which was established during the RIPE 75 meeting in Dubai. To provide some historic context, the archives of the IoT-Discussion list have also been migrated and are now available under the archive section of this mailing list. Over the next few days we will update www.ripe.net with more information on the IoT Working Group and finalise this migration by making sure all links and pointers are now referring to this new list. Please be reminded that any replies to previous mails should now be directed to the new address: iot-wg(a)ripe.net and that in line with the name change, message subject lines will now be tagged "[iot-wg]”, please make sure to update any filters that make use of this tag. Regards, Marco Hogewoning -- External Relations - RIPE NCC

3 4