- iot-wg - mailman.ripe.net

[iot-discussion] Summary of RIPE 74 IoT BoF
by Suzanne Taylor 10 May '17

10 May '17

Hi all, As Marco promised, here’s an overview of the main topics discussed during yesterday’s IoT BoF at RIPE 74. Please let me know if you have any questions – and by all means, please contribute your own ideas and thoughts to keep the discussion going. ******** Eliot Lear from Cisco Systems kicked off the discussion with an overview of the many factors involved in IoT security, focusing on the existing divide between manufacturers, vendors, service providers, governments and consumers. His main question to the group was whether ISPs want to organise in order to try to tackle the issue of IoT security, and to try to define what part of the problem they could potentially contribute to. A lot of different potential solutions were discussed in terms of what these different stakeholders can do to mitigate the serious security threats that exist across the IoT landscape. On a technical level, these included: - banning the use of default usernames and passwords - the need for cryptographically enhanced protocols and firmware updates - the possibility of disconnecting misbehaving devices - a potential requirement for two-step verification before any new devices connect for the first time - creating “gaps” in the architecture so that things can be shutdown if necessary - intelligent computing that extends all the way to the edge On a non-technical level, ideas debated included: - the extent to which regulation can play a role - the need to educate governments about the technical aspects involved - the viability of shared standards across borders - the need to create market demand for secure devices among consumers The role and responsibility of ISPs as gatekeepers of potentially malicious traffic was also discussed, along with the difficulty in keeping up with security advances when it comes to devices that are likely to exist for years beyond their initial deployment. The group agreed that the technical community could do more to educate manufacturers about what “good security” looks like and share its expertise with them. However, the point was made that network operators may also have a direct role to play and should not simply point fingers elsewhere. What about quarantining bad actors at the ISP level, for example? Another focus was the lack of a clear chain of accountability when it comes to IoT devices that exists, for example, in car manufacturing. Who is responsible when something goes wrong? There are many layers to security, from the control of and access to devices, to what information devices produce and where this is shared. In addition, different approaches will be needed for different types of devices (e.g. light bulbs probably shouldn’t be treated the same way as pacemakers). Paul Rendek from the RIPE NCC urged participants to figure out which piece of the IoT discussion the RIPE community can most effectively contribute to and to “own that space” by actively participating in external fora such as the ITU, the IEEE and others. There was general agreement that the RIPE community should get more involved and help shape the public policy debate before regulation comes into place. The group agreed that there is a lot of interest in the IoT and how the RIPE community can help mitigate security risks, and there was overwhelming support for the possible creation of a new RIPE Working Group focused on IoT. There was also consensus that the group needed to move quickly in light of how fast things in IoT are moving forward. Volunteers came forward to draft a rough outline of a charter, and RIPE Chair Hans Petter Holen offered a slot during the Friday plenary session at RIPE 74 so it could be discussed more broadly. ******** We’ll report back on the outcome of the discussion on Friday…stay tuned! Cheers, Suzanne _____________________ Suzanne Taylor External Relations Officer RIPE NCC

3 2

Re: [iot-discussion] iot-discussion Digest, Vol 6, Issue 4
by Corinne Cath 09 May '17

09 May '17

Dear Marco, Could you maybe share the findings of the group with the mailinglist for those not physically present? Best, On Tue, May 9, 2017 at 11:00 AM, <iot-discussion-request(a)ripe.net> wrote: > Send iot-discussion mailing list submissions to > iot-discussion(a)ripe.net > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.ripe.net/mailman/listinfo/iot-discussion > or, via email, send a message with subject or body 'help' to > iot-discussion-request(a)ripe.net > > You can reach the person managing the list at > iot-discussion-owner(a)ripe.net > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of iot-discussion digest..." > > > Today's Topics: > > 1. Reminder: Security BoF, relation between (IoT) devices and > infrastructure (Marco Hogewoning) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Tue, 9 May 2017 11:55:09 +0200 > From: Marco Hogewoning <marcoh(a)ripe.net> > To: iot-discussion(a)ripe.net > Subject: [iot-discussion] Reminder: Security BoF, relation between > (IoT) devices and infrastructure > Message-ID: <F3406CE5-41FF-4335-B1F7-A4368389CC9F(a)ripe.net> > Content-Type: text/plain; charset=utf-8 > > Dear colleagues, > > If you are attending RIPE 74, please be reminded that tonight at 18:00 we > will organise a BoF to explore the link between insecure devices and > infrastructure security and stability, especially what we would like to > discuss is the possible role of the access providers in the system. > > ?What role do service providers want to play? > ?What role can service providers play? > ?What do we need from manufacturers? > ?What is the role of governments? > > Please join us at the Tutorial Room (opposite of the maIn room) at 18:00 > local time. > > Groet, > > MarcoH > > > > > ------------------------------ > > Subject: Digest Footer > > _______________________________________________ > iot-discussion mailing list > iot-discussion(a)ripe.net > https://lists.ripe.net/mailman/listinfo/iot-discussion > > > ------------------------------ > > End of iot-discussion Digest, Vol 6, Issue 4 > ******************************************** > -- Corinne J.N. Cath Ph.D. Candidate, Oxford Internet Institute & Alan Turing Institute Web: www.oii.ox.ac.uk/people/corinne-cath Email: ccath(a)turing.ac.uk & corinnecath(a)gmail.com Twitter: @C_Cath

3 3

[iot-discussion] Cerf on the ethics of IoT
by Marco Hogewoning 04 May '17

04 May '17

Dear colleagues, Somebody drew my attention to an article by Vint Cerf and Francine Berman on the ethics of IoT, some of you might find it an interesting read as well. http://www.cs.rpi.edu/~bermaf/Berman+Cerf_IoT.pdf Following this, an interview with Berman was published on The Atlantic earlier this week https://www.theatlantic.com/technology/archive/2017/05/internet-of-things-e… As a reminder, we are still setup to have a BoF aiming to discuss some of this space as well, in particular the expected or desired role of the parties providing connectivity to these devices. This “IoT Security BoF” will take place after the main RIPE 74 program, on Tuesday May 9 at 18:00 in the Tutorial Room of the meeting venue. Unfortunately, due to this being a BoF and as this room only has a very limited technical setup there won’t be any remote participation offered. So hope to see many of you in the room in Budapest next week, Groet, MarcoH

2 1

[iot-discussion] European Commission Report: Workshop on Security & Privacy in IoT
by Bastiaan Goslings 01 May '17

01 May '17

On 13 January the European Commission organised and hosted a workshop in Brussels, the main purpose of which was ‘to discuss minimum baseline security and privacy requirements along the entire networked architecture and value chain similar in various sectors.’ It took them a while for them to publish a report, but it’s an interesting read for this group nonetheless, I imagine. ‘Participants were asked to come with, reflect and comment on concrete minimum IoT privacy and security principles to create a trusted IoT environment’ The results of the workshop can be found at https://ec.europa.eu/digital-single-market/en/news/internet-things-privacy-… (Was anyone on the list there btw?) As the EU is part of the RIPE NCC service region, I think it is important to follow closely what the EC is up to and it probably makes sense to engage with them on this topic if we’re not already doing so.

5 4

[iot-discussion] Participatory webinar on “Cybersecurity and its impact on EU-US ICT collaboration”.
by Gordon Lennox 24 Apr '17

24 Apr '17

"The PICASSO project is organizing a participatory webinar on “Cybersecurity and its impact on EU-US ICT collaboration”. The aim of this webinar is to discuss and refine policy recommendations designed to improve EU-US ICT-oriented collaborations – specifically in three technological domains: 5G networks; Big Data; and the Internet of Things/Cyber-physical systems (IoT/CPS). Focus is set on the implications of technological developments for cybersecurity policy, taking into account the different approaches towards cybersecurity being taken in the USA and in Europe, the technical and socio-economic backgrounds and new developments likely to affect the security and vulnerability of ICT systems. The participatory and interactive webinar will validate initial conclusions based on a policy briefing on Cybersecurity and its impact on EU/US ICT Policy collaborationprepared by the PICASSO ICT Policy Expert Group.” See: http://www.picasso-project.eu/newsevents/project-events/webinar-cybersecuri…

1 0

[iot-discussion] What role does the SP play in protecting consumers re IoT?
by Eliot Lear 21 Apr '17

21 Apr '17

Hi everyone, Marco and I have been talking. There is a discussion forming about the role of the consumer and the role of the manufacturer around protecting against invasions of privacy, and other security faux pas. What about the role of the service provider? Can the service provider take a more direct part in assisting the consumer in protecting themselves, and if so, what help is needed from manufacturers, CPE vendors, and yes, companies like mine (Cisco)? What role does/should the government play? These are some pretty hefty questions. My question to you: is there interest in such a dialog? Eliot

12 48

[iot-discussion] Heads up for RIPE 74: Security BoF: On the Linkage Between Device and Infrastructure
by Marco Hogewoning 29 Mar '17

29 Mar '17

Dear colleagues, Happy to inform you that the PC has accepted our proposal to organise another BoF during RIPE 74 in Budapest. Unfortunately the exact time slot has not been decided yet, but we hope to get this cleared up in the coming weeks. Regardless, we can start our preparation for this and maybe already discuss some of the elements on this list. In this BoF we would like to focus on the relation between access providers, gateway devices (CPE) and IoT security. In particular the fact that often the provider is the sole entity who can quarantine or disconnect devices or networks that have been compromised (I am attaching the whole abstract below). The key questions we hope to address are: - Is there a role for the access provider in controlling/limiting access of compromised devices to the infrastructure? - Are there technical means to detect and contain devices that form a potential threat? - Would it be feasible to limit connectivity for such unsafe devices? - Are there feasible alternative means to mitigate the threat that these compromised devices form to our systems? I hope to run the BoF in a similar open fashion as the one in Madrid, with a minimum of slides and lots of time for a dialogue between the participants. But if you are doing relevant work or have an idea, I am open to suggestions for discussion starters or projects that would be relevant to the questions above. Hope to see you all in Budapest. Regards, Marco Hogewoning -- External Relations - RIPE NCC ***Security BoF: On the Linkage Between Device and Infrastructure*** Whatever the definition of the Internet of Things, one thing is for sure: the number of devices connected to the Internet is constantly growing. Even the traditional access markets continue to expand their number of end users and, importantly, the bandwidth available to them. As a follow-up to the RIPE 73 IoT BoF, we plan to explore the effects of this ever-expanding network in terms of infrastructure stability and security. Botnets, including the ones made up from relatively dumb devices such as the Mirai botnet, pose a substantial threat to the very infrastructure those devices depend on for their connectivity. Not only does the phenomenal growth in the number of poorly maintained devices increase the attack surface, but with more bandwidth available to them, the threat becomes even bigger. Can we prevent the Internet from collapsing under its own weight? Aside from the ongoing discussions on the need to secure these devices, with options ranging from capacity building to regulation, this BoF will explore the role of access providers in the ecosystem. As the natural gatekeepers between the local networks and the global infrastructure, what are their options to protect their own and other networks from these attacks? This BoF will tackle the following questions: - Is there a role for the access provider in controlling/limiting access of compromised devices to the infrastructure? - Are there technical means to detect and contain devices that form a potential threat? - Would it be feasible to limit connectivity for such unsafe devices? - Are there feasible alternative means to mitigate the threat that these compromised devices form to our systems?

1 0

[iot-discussion] Request to contribute to AIOTI survey on IoT indentifiers
by Marco Hogewoning 14 Mar '17

14 Mar '17

Dear colleagues, The RIPE NCC is a member of the the Alliance for Internet of Things Innovation (AIOTI). Its standardisation group (WG3) has established a task force to look at identifiers for use in the Internet of Things (IoT). One of the task force's work items is to collect information about any existing identification systems and standards that could be considered for application in IoT and investigate identification needs and requirements from IoT implementers. They have created a short survey to gather this information and asked us to invite the RIPE community to contribute. As both the requirements and options available will probably vary significantly between different IoT products and services, we don't think it's feasible to provide the task force with a consolidated response, as compiling such an answer to some extent would duplicate the work of the task force. Instead, we encourage RIPE community members who have a stake in IoT or associated identification mechanisms or standards to respond to the survey on an individual basis. The survey is available here: https://goo.gl/forms/vT22nR1ZEh13lfzi1 You are kindly requested to respond before 7 April. Please also see the attached message from Juergen Helles, Chair of the task force. As a member of AIOTI, we will continue to monitor and contribute to the work of AIOTI WG3 and this task force. Regards Marco Hogewoning RIPE NCC - External Relations > > > The Alliance for Internet of Things Innovation AIOTI (www.aioti.org) was initiated by the European Commission in 2015, with the aim to strengthen the dialogue and interaction among Internet of Things (IoT) players in Europe, and to contribute to the creation of a dynamic European IoT ecosystem to speed up the take up of IoT. Further objectives of the Alliance are fostering experimentation, replication, and deployment of IoT and supporting convergence and interoperability of IoT standards; gathering evidence on market obstacles for IoT deployment; and mapping and bridging global, EU, and member states' IoT innovation activities. > > AIOTI Working Group 03 is a focus of European engagement and steering in the IoT standardization process: > - Maintain a view on the landscape of IoT standards-relevant activities being driven by Standard Developing Organizations, Consortia, Alliances and Open Source Software projects > - Provide a forum for analysis, discussion and alignment of strategic, cross-domain, technical themes and shared concerns across landscape activities > - Develop recommendations and guidelines addressing those concerns > - Engage the IoT community in disseminating and promoting the results and steering emerging standards > Note that AIOTI will not develop standards itself but interact with standardization development organizations and consortia in order to initiate standardization activities. > > Identification plays an important role for IoT. In addition to the identification of the Things identification of other entities will be needed. Various identification schemes already exist, are standardized and deployed. A thorough analysis of the identification needs and related standardization for IoT is therefore needed. The AIOTI WG03 IoT Identifier task force was setup specifically to > - Evaluate identification needs for IoT and related requirements > - Collect existing identification standards and ongoing standardization work and elaborate their applicability for IoT. > The results of these activities will be published in a public report on IoT Identifiers. > > The task force has setup a online survey in order to collect input for the above task. > > IoT Identifier Survey (https://goo.gl/forms/vT22nR1ZEh13lfzi1) > > We are asking RIPE Community to provide feedback to the survey until Friday April 7th 2017. > > Please also feel free to distribute this survey request to your members for their individual feedback to the survey. > > Please note, that the information that you provide will be anonymized, i.e. there will be no reference to your specific contribution to the survey in the public report. Still you can request to be listed in the report as a contributor to the survey without reference to your specific contribution. > A pdf file with the survey questions is attached for your information, but please use the only survey (see link above) for your feedback. > > In case you have questions on the survey don’t hesitate to contact the co-chair of the AITOI WG3 IoT Identifier task force (juergen.heiles(a)siemens.com, henri.barthel(a)gs1.org). > > > Best Regards > > Juergen Heiles, AIOTI WG3 IoT Identifier task force co-chair

1 0

[iot-discussion] ENISA call for IoT Security Experts Group
by Marco Hogewoning 10 Mar '17

10 Mar '17

Dear colleagues, ENISA, the European Agency for Network and Information Security, is launching an IoT Security Experts Group with the objective to gather experts in the domains of the entire spectrum of Internet of Things to exchange viewpoints and ideas on cyber security threats, challenges and solutions. More information about this call for experts and the group is available via https://resilience.enisa.europa.eu/iot-security-experts-group-1 We also would welcome any thoughts or suggestions of how RIPE NCC can contribute to the field of IoT security, which remains one of the key concerns for all stakeholders involved. Groet, MarcoH RIPE NCC

1 0

[iot-discussion] European Parliament Public Consultation: "Civil Law Rules On Robotics"
by Marco Hogewoning 16 Feb '17

16 Feb '17

Dear Colleagues. The European Parliament is undertaking a public consultation that seeks views on how to best address the challenging ethical, economic, legal and social issues related to the developments in the area of robotics and AI for civil use. This consultation aims to seek input from both experts as well as the general public, so while maybe not very closely related to RIPE’s activities, we would encourage you to consider contributing to this debate. The consultation runs until April 2017 and the results are expected to be published in the autumn and will contribute to further European Parliament initiatives. The consultation as well as some further information can be accessed via https://opinio.secure.europarl.europa.eu/opinio/s?s=secured_robotics In relation to those other initiatives, you might also want to take note of the RIPE Labs posting by Eirann Leverett, which discusses the aspects of product liability and consumer protection that has also come into scope of the European Parliament. https://labs.ripe.net/Members/eireann_leverett/time-to-decide-on-internet-o… Regards, Marco Hogewoning -- External Relations - RIPE NCC

1 0