- iot-wg - mailman.ripe.net

GrowthEnabler's "Market Pulse Report for Internet of Things"
by Töma Gavrichenkov 18 Oct '18

18 Oct '18

Hi all, Apparently, the report I've mentioned today during the WG session is available on the Web, feel free to take a look: https://growthenabler.com/flipbook/pdf/IOT%20Report.pdf | Töma Gavrichenkov | gpg: 2deb 97b1 0a3c 151d b67f 1ee5 00e7 94bc 4d08 9191 | mailto: ximaera(a)gmail.com | fb: ximaera | telegram: xima_era | skype: xima_era | tel. no: +7 916 515 49 58

1 0

code of conduct for IoT devices
by Jim Reid 16 Oct '18

16 Oct '18

The UK's National Cyber Security Centre and the Department for Digital, Culture, Media and Sport has just published a code of conduct on security for consumer IoT devices. It's full of the usual advice: no default passwords, update firmware, protect personal data, etc. The document's available here: https://www.gov.uk/government/publications/secure-by-design/code-of-practic… In case anyone's wondering DCMS is the government department which (amongst other things) looks after Internet matters.

3 2

another heave on the co-chair selection procedure
by Jim Reid 15 Oct '18

15 Oct '18

Colleagues, the selection process needs another nudge. Although there have been a few expressions of support and no objections, I’m reluctant to declare consensus because only a handful of people have spoken. I’d *really* like to declare victory so we can get on with the job of finding a co-chair. It’s uncomfortable to do this when the WG has argely been silent about how the leadership is selected. So could you please indicate your support or opposition to the following? Thanks. I would also ask the WG to avoid the temptation to rat-hole or over-think the selection procedure, for instance by proposing elaborate steps to apply in corner cases that in all probability will never arise. We're only appointing a WG co-chair, not the Internet's Supreme-Leader-for-Life. The WG can always change the suggested process later if practical experience proves it is broken or needs improvement. Note too that there is no mention of elections or votes. This is deliberate. (1) The IoT WG will have 2 co-chairs who serve staggered 2-year terms. (2) A co-chair cannot serve more than 3 consecutive terms. (3) Each year, the longest serving co-chair will stand down and subject to (2) may make themselves available for re-appointment. (4) The incoming co-chair will be chosen by the WG using consensus and the remaining co-chair will make the consensus determination. (5) Any circumstances not covered by the above will be resolved by the RIPE Chair whose decision will be final. Vote early, vote often. Well OK, we don’t vote but I hope you get the point. :-)

15 21

New on RIPE Labs: RIOT in Amsterdam
by Mirjam Kuehne 15 Oct '18

15 Oct '18

Dear colleagues, Please find on RIPE Labs a summary of the RIOT Summit that took place in Amsterdam last month. The RIOT Summit is the yearly get-together of the community around the RIOT operating system for the Internet of Things (IoT). https://labs.ripe.net/Members/martine_sophie_lenders/riot-in-amsterdam Kind regards, Mirjam Kühne RIPE NCC

1 0

Re: [iot-wg] RIPE document on IoT security solutions
by Apostolos Malatras 11 Oct '18

11 Oct '18

Hi all, Just my two cents that might help/contribute in this effort. In November 2017, ENISA published -with the help of an amazing group of experts- the Baseline IoT Security Recommendations, which among else provides numerous links to related ongoing initiatives: https://www.enisa.europa.eu/publications/baseline-security-recommendations-… These have also been mapped in the online tool available here: https://www.enisa.europa.eu/iot-tool We will be soon publishing more info on the topic so please do feel free to reach out to us. Best, -Apostolos ------------------------------------------------------------------------------------------------------ Dr Apostolos Malatras Network and Information Security Expert European Union Agency for Network & Information Security Address: 1 Vass Sofias Str, Marousi 151 24, Attica, Greece E- mail: Apostolos.Malatras(a)enisa.europa.eu Office: +30 2814 409 630 Mobile: +30 6985 051 401 -----Original Message----- From: iot-wg <iot-wg-bounces(a)ripe.net> On Behalf Of iot-wg-request(a)ripe.net Sent: Thursday, October 11, 2018 1:00 PM To: iot-wg(a)ripe.net Subject: iot-wg Digest, Vol 20, Issue 6 Send iot-wg mailing list submissions to iot-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://lists.ripe.net/mailman/listinfo/iot-wg or, via email, send a message with subject or body 'help' to iot-wg-request(a)ripe.net You can reach the person managing the list at iot-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of iot-wg digest..." Today's Topics: 1. Re: RIPE document on IoT security solutions (Peter Steinh?user) 2. Re: RIPE document on IoT security solutions (Nigel Titley) 3. Re: RIPE document on IoT security solutions (Peter Steinh?user) 4. Re: another heave on the co-chair selection procedure (Farzad Ebrahimi) ---------------------------------------------------------------------- Message: 1 Date: Wed, 10 Oct 2018 14:40:36 +0200 From: Peter Steinh?user <ps(a)embedd.com> To: Jim Reid <jim(a)rfc1035.com> Cc: RIPE IoT WG List <iot-wg(a)ripe.net> Subject: Re: [iot-wg] RIPE document on IoT security solutions Message-ID: <6A2D21F6-53DC-48D6-9C15-76AA861DC7CE(a)embedd.com> Content-Type: text/plain; charset="utf-8" > There?s not much to learn Peter. RIPE doesn?t develop standards. In the sense that IEEE or IETF develops standards. RIPE sometimes develops policies, usually on the allocation of numbering resources. These policies are produced though the process defined in RIPE document 710: https://www.ripe.net/publications/docs/ripe-710. > > Anything can become a RIPE document, not just policies. The process is simple. Someone just says to the NCC ?please publish this as a RIPE document?. And it is done. > > For this case, I think we want something that reflects a consensus view of the WG. If you can produce an initial draft or outline and post it to the list, we can discuss that, make changes and go through a few iterations of the document. Hopefully we then end up with something that has broad acceptance from the WG. At that point, someone takes the finished article to the NCC and asks for it to become a RIPE document. > > Over to you... Got it - will prepare an initial draft. - Peter Peter Steinh?user, CEO embeDD GmbH ? Alter Postplatz 2 ? 6370 Stans ? Switzerland Phone: +41 (41) 784 95 85 ? Fax: +41 (41) 784 95 64

1 0

Bad actors
by Wolfgang Tremmel 10 Oct '18

10 Oct '18

Hi, Interesting read about bad actors of IoT vendors (well, one vendor): https://krebsonsecurity.com/2018/10/naming-shaming-web-polluters-xiongmai/ best regards Wolfgang -- Wolfgang Tremmel Phone +49 69 1730902 26 | Fax +49 69 4056 2716 | Mobile +49 171 8600 816 | wolfgang.tremmel(a)de-cix.net Geschaeftsfuehrer Harald A. Summa | Registergericht AG Köln HRB 51135 DE-CIX Management GmbH | Lindleystrasse 12 | 60314 Frankfurt am Main | Germany | www.de-cix.net

7 15

draft agenda for RIPE77
by Jim Reid 21 Sep '18

21 Sep '18

Here’s the draft agenda for the WG meeting next month. Other than tweaks to the running order, there shouldn’t be any significant changes. See you all in Amsterdam! # # $Id: agenda,v 1.4 2018/09/21 08:40:30 jim Exp $ # 1. Administrivia 2. NCC Update Marco Hoegwoning - RIPE NCC 3. The Internet of Threats: fighting FUD with MUD Michael Richardson - Sandelman Software Works For many internet organizations, the #1 risk on their risk register is a large scale (Dyn like) DDoS attack. One of the mitigation mechanisms for this risk is to prevent weaponization of consumer grade connected devices --- to keep Things from becoming Threats. What we need are security controls that will protect IoT devices from the internet, and to protect the internet from IoT devices. CIRALabs's Secure Home Gateway project is developing a comprehensive extension to the common OpenWRT code base to include processing of IETF standard Manufacturer Usage Description (MUD) files. 4. Police perspective on IoT, challenges & strategy Jaap van Oss, Manon den Dunnen - Politie The accelerated deployment of IoT is reshaping society and offers new opportunities and threats in the area of safety. Privacy, security and collaboration are fundamental in addressing the challenges. In this presentation we'll share how we look at the IoT domain, what steps we take and the struggles we face. 5. Security Problems in IoT Thomas Stols - Computest Computest has a lot of experience (security) testing various IoT devices. During this talk we’ll give the viewer some insight in common security problems we see during our daily work. 6. The Internet-of-Insecure-Things: Causes, Trends and Responses Arman Noroozian - TU Delft We know poorly secured IoT devices are flooding our markets. And we know they get compromised at scale. Why is this so hard to stop? We look at the underlying causes for why this problem persists. Next, we explore data on where compromised IoT is located, what kind of devices are affected and which networks have the higher concentrations. We end by exploring different responses to help mitigate these threats, with a special focus on the role of network operators. 7. AOB

1 0

agenda items for RIPE77
by Jim Reid 05 Sep '18

05 Sep '18

Colleagues, if you have suggestions for agenda topics or presentations for the WG session next month, please send them to iot-wg-chairs(a)ripe.net. There are fabulous cash prizes on offer. Well OK, maybe not. :-)

1 0

RIOT Summit: Registration open
by Matthias Waehlisch 13 Aug '18

13 Aug '18

Dear RIPE IoT WG, the third RIOT Summit (http://summit.riot-os.org/) will take place in Amsterdam, Netherlands at the Science Park Congress Center on September 13-14, 2018. The first day is dedicated to single-track presentations. The second day allows for break-out sessions and coding. If you want to attend, please register as soon as possible: https://riot-summit18.eventbrite.com/. This is a great opportunity to meet the community behind RIOT, the friendly open source operating system for the Internet of Things. **Talks** Keynote by Jaime Jiménez (Co-chair of IETF CoRE Working Group and Master Researcher @ Ericsson) More speakers: http://summit.riot-os.org/2018/#speakers **Social* After the talks of the first day, we have organized a casual BBQ at the Rolling Rock Kitchen (http://rollingrockkitchen.com) Food is sponsored. **Hotels** Please note that Amsterdam is pretty crowded during the week of the RIOT Summit. Book soon! You should also consider options such as hotwire.com, airbnb, or accommodations in Utrecht (~40 minutes by public transport). **Registration** Participation at the RIOT Summit is free of charge. However, registration is required: https://riot-summit18.eventbrite.com/ *Supporters** We gratefully thank the following companies for their generous support: Cisco, RIPE NCC, SIDN Labs, STMicroelectronics, wolfSSL, Zühlke. We also thank Freie Universitaet Berlin, HAW Hamburg, and INRIA. Looking forward to meet you in Amsterdam! Cheers matthias -- Matthias Waehlisch . Freie Universitaet Berlin, Computer Science .. http://www.cs.fu-berlin.de/~waehl

1 0

2nd EUROPOL-ENISA IoT Security Conference 2018
by Marco Hogewoning 10 Aug '18

10 Aug '18

Dear Colleagues, For the second year in a row, Europol and ENISA are co-organising a conference to raise awareness on the security implications of the Internet of Things (IoT). The conference aims to enable a broad discussion by bringing together experts from cybercrime units, CSIRTs, international organisations, private industry, regulatory agencies, and academia, with particular focus on hands-on and demo sessions. This conference will be on 24 and 25 October 2018 at the Europol headquarters in The Hague. The three main sessions of the two-day conference will focus on: • Industry 4.0 (confirmed speakers: KPN, SAP Labs, Barbaraiot, Bosch) • IoT Application Domains and Case Studies (confirmed speakers: BMW, Airbus, Continental, Vtolabs, GSMA) • Emerging IoT trends (confirmed speakers: IBM, RiskIQ, Shadowserver, CSA, Pentest Partners ) This conference is by invitation only, but Europol has informed us that they are happy to accommodate for a few interested participants from this Working Group and extend an invitation to them. If you are keen in attending this conference, please send me an email including a short bio and contact details and we will pass this on to our colleagues at Europol and coordinate with them concerning the invitations. Please note that places are limited and we cannot guarantee that you will receive an invite. Also importantly, this only concerns the invitation, this event is not funded and participants are required to make and fund their own travel arrangements and accommodation. Regards, Marco Hogewoning -- Senior External Relations Officer RIPE NCC http://www.ripe.net

1 0