Subject: [Newsclips] IETF SYN-ACK Newspack 2021-11-01

From: "David Goldstein" <[email-masked]>
Date: Mon, 1 Nov 2021 15:10:21 +1100

The IETF SYN-ACK Newspack collects IETF-related items from a variety of news outlets and other online publications. They do not represent the views of the IETF and are not checked for factual accuracy.

**********************

IETF IN THE NEWS

**********************

ICANN boss warns over existential “threat” from Russia

The Cthulian threat of an intergovernmental takeover of ICANN has reared its head again, but this time a resurgent, interventionist Russia is behind it and ICANN’s CEO is worried. Speaking at ICANN 72, the Org’s virtual annual general meeting this week, Göran Marby highlighted recent moves by Russia in the UN-backed International Telecommunications Union as a “threat” to ICANN’s existence and the current internet governance status quo in general. Speaking at a constituency meeting on Monday, Marby said: We see a threat to the multistakeholder model and ICANN’s role in the Internet ecosystem. And anyone in this call are well aware about this threat: Russia in their attempt to be the next secretary-general of the ITU. Their platform is about having a government running not only ICANN but also the RIRs, the IETF and the root server system.

< <http://domainincite.com/27172-icann-boss-warns-over-existential-threat-from-russia> http://domainincite.com/27172-icann-boss-warns-over-existential-threat-from-russia>

On DNS Openness by Geoff Huston 

... We can pose some questions about the openness of the DNS. Is the DNS an open system? The DNS resolution protocol is an open standard published by the IETF without any constraints on access as to who can access this specification. By and large most of the DNS resolution protocol is free of any IPR encumbrance, although that is not a comprehensive claim relating to the entirety of the DNS specification. The process to change this specification is an open IETF process, open to all to participate in. I’d say that the DNS meets the criteria of being an open specification within the parameters we commonly use to define openness.

< <https://www.potaroo.net/ispcol/2021-10/open.html> https://www.potaroo.net/ispcol/2021-10/open.html>

< <https://circleid.com/posts/20211030-on-dns-openness> https://circleid.com/posts/20211030-on-dns-openness>

IGF: In celebration of the Internet by Dr. Jaijit Bhattacharya

... The root of the problem lies in many things, including the root of the internet the 13 root servers and who controls them. In a very simplistic way, the internet is primarily run by ICANN and IETF. ICANN (formerly IANA) defines the domain names that we use and helps us find the servers where these domain names hold the information that we aim to seek. So in a way, it is the postal service of the internet, without which, one would not be able to access information on the internet in the easy manner that we access it today.

< <https://www.indiatoday.in/opinion-columns/story/igf-in-celebration-of-the-internet-opinion-1869646-2021-10-26> https://www.indiatoday.in/opinion-columns/story/igf-in-celebration-of-the-internet-opinion-1869646-2021-10-26>

< <https://www.msn.com/en-in/money/news/igf-in-celebration-of-the-internet-opinion/ar-AAPY6DK> https://www.msn.com/en-in/money/news/igf-in-celebration-of-the-internet-opinion/ar-AAPY6DK>

Preparing for the quantum migration

... To protect data flowing between businesses and their staff — who are likely to remain working from home for the foreseeable future — a hybrid, quantum-safe VPN is a good option. Recently, the IETF developed a set of specifications for such VPN products, with our team playing a central role in the original creation and development of those specifications.

< <https://www.techuk.org/resource/preparing-for-the-quantum-migration.html> https://www.techuk.org/resource/preparing-for-the-quantum-migration.html>

Ericsson software promises consistent low latency for public, private 5G

... Ericsson has already performed trials with partners Deutsche Telekom and Australia’s Telstra. DT showed off a speedboat racing game, where reducing latency hiccups with congestion controls and capacity management resulted in less jitter with a much smoother and more realistic gaming experience. The demo applied the precommercial L4S (Low Latency Low Loss Scalable) feature, a managed low latency technology (based on the IETF standardization) available in the vendor’s new software toolkit.

< <https://www.fiercewireless.com/5g/ericsson-software-promises-consistent-low-latency-for-public-private-5g> https://www.fiercewireless.com/5g/ericsson-software-promises-consistent-low-latency-for-public-private-5g>

uk: Ofcom orders phone networks to block foreign scam calls

... The new protocols, known as "Stir and Shaken" in a nod to James Bond, were developed by an international standards body, the US-based IETF.

< <https://www.bbc.com/news/business-59032795> https://www.bbc.com/news/business-59032795>

< <https://www.primenewsghana.com/tech/ofcom-orders-phone-networks-to-block-foreign-scam-calls.html> https://www.primenewsghana.com/tech/ofcom-orders-phone-networks-to-block-foreign-scam-calls.html>

< <https://news.yahoo.com/ofcom-orders-phone-networks-block-012237759.html> https://news.yahoo.com/ofcom-orders-phone-networks-block-012237759.html>

Ofcom Tell UK Phone Operators to Block Foreign VoIP Scam Calls

... One other way of tackling this issue would be a new telephone identification protocol, which can help operators to authenticate that all calls and text messages come from a real number. The IETF has been attempting to do this via their suit of STIR/SHAKEN protocols (i.e. STIR = Secure Telephony Identity Revisited / SHAKEN = Signature-based Handling of Asserted information using toKENs), but so far it’s been mostly focused upon the USA and Canada.

< <https://www.ispreview.co.uk/index.php/2021/10/ofcom-tell-uk-phone-operators-to-block-foreign-voip-scam-calls.html> https://www.ispreview.co.uk/index.php/2021/10/ofcom-tell-uk-phone-operators-to-block-foreign-voip-scam-calls.html>

Celebrating 50 Years Since the First Email Sent Over a Network

... Our engineers have worked with others across the global technology community to help create a safer ecosystem not just for our users, but for all email users. Working (and in some cases, leading) within organizations such as M3AAWG, IETF, and APWG, we’ve been able to help fight email-based messaging abuse and foster development in such technologies as DMARC, MTA-STS, and ARC. While continuing to develop technologies for the community, we’ve also deployed these within our own platform utilizing IPv6 and DNSSEC, deploying DANE and MTA-STS to help secure connections, and SPF/DKIM/DMARC to perform message authentication.

< <https://corporate.comcast.com/stories/celebrating-50-years-since-the-first-email> https://corporate.comcast.com/stories/celebrating-50-years-since-the-first-email>

The state of CMMC from an assessor perspective

... In my opinion, however, the biggest changes coming to CMMC are related to the model and its implementation requirements for the DIB contractors. The current version, 1.02, came out in March 2020 and has not been updated or revised since then. In the cybersecurity world, 18 months is forever, and the state of security today is different than at that time, and the practices need review and updating. Think SolarWinds, Exchange, ransomware attacks, etc. For example, the data-in-transit tool of choice, Transport Layer Security (TLS) versions 1.0 and 1.1 were recently completely turned off by the IETF for the entire internet ecosystem, and this needs to be reflected in the model. Also, the National Institute of Standards and Technology has introduced SP 800-53 revision 5 and SP 800-172 documents, both of which are source documents for the CMMC model, and these need reflection into the model and its practices.

< <https://defensesystems.com/articles/2021/10/29/cmmc-assessor-insights.aspx> https://defensesystems.com/articles/2021/10/29/cmmc-assessor-insights.aspx>

Ransomware-Bekämpfung mit Multi-Faktor-Authentifizierung [Fighting ransomware with multi-factor authentication]

... TOTP ist ein weithin akzeptierter und weitgehend integrierter Algorithmus mit MFA, der auf RFC-6238 der IETF basiert. Aufgrund der verbesserten Sicherheitsmerkmale, wie z. B. dem verkürzten Ablauf des Passcodes, der typischerweise zwischen 30 und 90 Sekunden beträgt, wird TOTP häufig eingesetzt.

< <https://www.it-daily.net/it-sicherheit/cloud-security/31042-ransomware-bekaempfung-mit-multi-faktor-authentifizierung> https://www.it-daily.net/it-sicherheit/cloud-security/31042-ransomware-bekaempfung-mit-multi-faktor-authentifizierung>

Journal Comme une impression de déjà vu… [Diary: Like an impression of déjà vu...]

... En fait c'est même le but du groupe de travail (terminé) Lager à l'IETF qui a écrit la RFC 7940 qui (basiquement) définit un format pour décrire quels sont les "labels" autorisés ou variants l'un de l'autre.

< <https://linuxfr.org/users/ploum/journaux/comme-une-impression-de-deja-vu> https://linuxfr.org/users/ploum/journaux/comme-une-impression-de-deja-vu>

なりすましメールに根源的な対策を─S/MIMEの概要と現況［前編］ [Fundamental Measures for Spoofed Emails - Overview and Current Status of S/MIME [Part 1]]

「S/MIME」が提唱されたのは1990年代後半。IETFによって最初の規格（S/MIME Version 2/RFC 2311～2315）が策定されたのが1998年のことである。メールのなりすましを防止し、エンドツーエンドでの暗号化による安全な通信をサポートする技術として注目され続けてきた。

< <https://it.impress.co.jp/articles/-/22235> https://it.impress.co.jp/articles/-/22235>

我国IPv6正处于爆发初期 [China's IPv6 is in the early stages of outbreak]

... SRv6只是IPv6创新打开的第一扇门。华为首席IP协议专家、IETF互联网架构委员会委员李振斌说，今天IPv6创新和发展机会中，最重要的应用是5G、云、工业互联网、物联网领域中。

< <https://tech.huanqiu.com/article/45Lo0upzCHr> https://tech.huanqiu.com/article/45Lo0upzCHr>

< <http://www.ciia.org.cn/news/15834.cshtml> http://www.ciia.org.cn/news/15834.cshtml>

L4S: Η Ericsson και η DT παρουσιάζουν προηγμένο 5G με χαμηλή καθυστέρηση [L4S: Ericsson and DT present advanced 5G with low latency]

... Το L4S είναι μια νέα τεχνολογία που βασίζεται σε μια τυποποίηση της Ομάδας Εργασίας Τεχνολογίας Διαδικτύου (IETF), η οποία παρέχει υψηλή απόδοση και χαμηλή καθυστέρηση στην κίνηση IP, με αποτέλεσμα την βελτιωμένη, ταχεία διαχείριση της προσαρμογής του ρυθμού και τη μείωση της συμφόρησης του δικτύου, της ουράς αναμονής και της απώλειας πακέτων.

< <https://www.techgear.gr/l4s-i-ericsson-kai-i-dt-paroysiazoyn-proigmeno-5g-me-chamili-kathysterisi-31687> https://www.techgear.gr/l4s-i-ericsson-kai-i-dt-paroysiazoyn-proigmeno-5g-me-chamili-kathysterisi-31687>

**********************

SECURITY & PRIVACY

**********************

Cybersecurity in the EU – Why we need NIS2 and what changes does it mean for the tech sector?

Cybersecurity is one of the European Commission’s top priorities and a cornerstone of the digital and connected Europe. An increase of cyber attacks during the COVID crisis has shown how important it is to protect hospitals, research centres and other critical infrastructure. According to the Commission, the review of the Directive on Security of Network and Information Systems (NIS2) is an essential step towards a more resilient Europe, ensuring state-of-the-art risk management of current and emerging cyber threats to vital sectors of the EU economy and society. 

< <https://www.euractiv.com/section/digital/video/live-now-cybersecurity-in-the-eu-why-we-need-nis2-and-what-changes-does-it-mean-for-the-tech-sector/> https://www.euractiv.com/section/digital/video/live-now-cybersecurity-in-the-eu-why-we-need-nis2-and-what-changes-does-it-mean-for-the-tech-sector/>

NSA and CISA Provide Cybersecurity Guidance for 5G Cloud Infrastructures

The National Security Agency (NSA) and the Cybersecurity and Infrastructure Security Agency (CISA) have published cybersecurity guidance to securely build and configure cloud infrastructures in support of 5G. Security Guidance for 5G Cloud Infrastructures: Prevent and Detect Lateral Movement is the first of a four-part series created by the Enduring Security Framework (ESF), a cross-sector, public-private working group which provides cybersecurity guidance that addresses high priority cyber-based threats to the nation’s critical infrastructure.

< <https://www.cisa.gov/news/2021/10/28/nsa-and-cisa-provide-cybersecurity-guidance-5g-cloud-infrastructures> https://www.cisa.gov/news/2021/10/28/nsa-and-cisa-provide-cybersecurity-guidance-5g-cloud-infrastructures>

Evaluation of anti-DDoS features in full-service resolvers

Japan Registry Services Co, Ltd. (JPRS) is the ccTLD registry of the .jp domain name and also operates a gTLD ‘.jprs’, as a research and design platform. JPRS has conducted some research experiments with .jprs in collaboration with Japanese ISPs. 

< <https://blog.apnic.net/2021/10/25/evaluation-of-anti-ddos-features-in-full-service-resolvers/> https://blog.apnic.net/2021/10/25/evaluation-of-anti-ddos-features-in-full-service-resolvers/>

European Union’s Network and Information Security Directive Threatens Internet with Fragmentation and Creates Security Risks

The second iteration of the European Union’s Network and Information Security Directive, NIS 2, was written with good intentions. But many worry the cybersecurity rules could splinter the Internet and undermine security. Among those concerned are Internet Society chapters and members in Europe.

< <https://www.internetsociety.org/blog/2021/10/european-unions-network-and-information-security-directive-threatens-internet-fragmentation-and-creates-security-risks/> https://www.internetsociety.org/blog/2021/10/european-unions-network-and-information-security-directive-threatens-internet-fragmentation-and-creates-security-risks/>

DNSSEC with RSA-4096 keys by Geoff Huston, João Damas 

Let’s look at the operation of DNSSEC and its use of public key cryptographic algorithms. The DNSSEC specification does not define in advance which algorithm you should use to generate the digital signature records for a DNSSEC-signed zone. And that's a very good thing. The issue here is that cryptographic algorithms do not generate computationally impossible problems. Instead, they generate computationally infeasible problems. 

< <https://www.potaroo.net/ispcol/2021-10/rsa.html> https://www.potaroo.net/ispcol/2021-10/rsa.html>

JavaScript Packing Found in More Than 25% of Malicious Sites

Obfuscation techniques are extremely prevalent, data shows, but they can't be used as a single indicator of compromise because legitimate websites use them.

< <https://www.darkreading.com/application-security/javascript-packing-found-in-more-than-25-of-malicious-sites> https://www.darkreading.com/application-security/javascript-packing-found-in-more-than-25-of-malicious-sites>

NIS 2: pay attention or pay the costs

At the end of 2020, the European Commission came up with a proposal to revise EU cybersecurity legislation, following the allegedly increased cyberthreats due to the COVID-19 pandemic. The NIS 2 Directive proposal aims to improve the resilience and incident response capacities of public and private entities, deemed to be critical infrastructures. These entities also include domain name registries, registrars, DNS service providers and root servers operators.

< <https://www.centr.org/news/blog/nis2-costs.html> https://www.centr.org/news/blog/nis2-costs.html>

Cybersecurity in the EU – Why we need NIS2 and what changes does it mean for the tech sector?

Cybersecurity is one of the European Commission’s top priorities and a cornerstone of the digital and connected Europe. An increase of cyber attacks during the COVID crisis has shown how important it is to protect hospitals, research centres and other critical infrastructure. According to the Commission, the review of the Directive on Security of Network and Information Systems (NIS2) is an essential step towards a more resilient Europe, ensuring state-of-the-art risk management of current and emerging cyber threats to vital sectors of the EU economy and society.

< <https://www.euractiv.com/section/digital/video/live-now-cybersecurity-in-the-eu-why-we-need-nis2-and-what-changes-does-it-mean-for-the-tech-sector/> https://www.euractiv.com/section/digital/video/live-now-cybersecurity-in-the-eu-why-we-need-nis2-and-what-changes-does-it-mean-for-the-tech-sector/>

Protecting critical infrastructure from a cyber pandemic

We are in the midst of a “cyber pandemic”. In 2020, COVID-19 accelerated a transition towards remote working and the software being used for these attacks has become easier to execute, ransomware attacks have risen rapidly and continue to accelerate in 2021:

< <https://europeansting.com/2021/10/21/protecting-critical-infrastructure-from-a-cyber-pandemic/> https://europeansting.com/2021/10/21/protecting-critical-infrastructure-from-a-cyber-pandemic/>

The Future of Cybersecurity in APJ

Sophos and Tech Research Australia (TRA) have collaborated again to bring you the second edition of the Future of Cybersecurity in Asia Pacific and Japan report. Based on a comprehensive study of 900 business decision makers across APJ, this report unveils insights into the issues faced and what has changed since our first edition in 2019.

< <https://secure2.sophos.com/en-us/security-news-trends/whitepapers/gated-wp/the-future-of-cybersecurity-in-apj-edition-2.aspx> https://secure2.sophos.com/en-us/security-news-trends/whitepapers/gated-wp/the-future-of-cybersecurity-in-apj-edition-2.aspx>

**********************

INTERNET OF THINGS

**********************

‘Yeah, we’re spooked’: AI starting to have big real-world impact, says expert

A scientist who wrote a leading textbook on artificial intelligence has said experts are “spooked” by their own success in the field, comparing the advance of AI to the development of the atom bomb.

< <https://www.theguardian.com/technology/2021/oct/29/yeah-were-spooked-ai-starting-to-have-big-real-world-impact-says-expert> https://www.theguardian.com/technology/2021/oct/29/yeah-were-spooked-ai-starting-to-have-big-real-world-impact-says-expert>

Top Tips for IoT Device Security: Designing Secure IoT Devices

On an ordinary Friday morning in February 2021, the city of Oldsmar, Florida, woke up to discover that their water system had been hacked. An intruder had broken in and attempted to poison city residents by boosting the quantity of sodium hydroxide (lye) in the water to toxic levels.

< <https://blog.checkpoint.com/2021/10/25/top-tips-for-iot-device-security-designing-secure-iot-devices/> https://blog.checkpoint.com/2021/10/25/top-tips-for-iot-device-security-designing-secure-iot-devices/>

Medical Artificial Intelligence: The European Legal Perspective

In late February 2020, the European Commission published a white paper on artificial intelligence (AI) and an accompanying report on the safety and liability implications of AI, the Internet of Things (IoT), and robotics. In the white paper, the Commission highlighted the "European Approach" to AI, stressing "it is vital that European AI is grounded in our values and fundamental rights such as human dignity and privacy protection." In April 2021, the proposal of a Regulation entitled "Artificial Intelligence Act" was presented. This Regulation shall govern the use of "high-risk" AI applications which will include most medical AI applications.

< <https://cacm.acm.org/magazines/2021/11/256384-medical-artificial-intelligence/fulltext> https://cacm.acm.org/magazines/2021/11/256384-medical-artificial-intelligence/fulltext>

IoT for SmartHome – New Technology, New Applications and New Business

SmartHome is an integrated topical field in the multi-layered IoT world and is regarded as an important building block in the topic areas of Smart Neighbourhoods and Smart Cities. But how are devices and components of the SmartHome world technically linked to the Internet?

< <https://international.eco.de/news/iot-for-smarthome-new-technology-new-applications-and-new-business/> https://international.eco.de/news/iot-for-smarthome-new-technology-new-applications-and-new-business/>

The Internet of Things, construction risk and insurance: A transformational combination

When risks manifest on the construction project there are four balance sheets that are most often affected: the contractor’s balance sheet, the insurer’s balance sheet, the design firm’s balance sheet and in some cases, the owner’s balance sheet. The pain inflicted upon the finances of these three entities is often done so in painful isolated silence. The contractor tallies up its impact from the loss, and then the insurer, then the design firm and then the owner.

< <https://www.on-sitemag.com/features/the-internet-of-things-construction-risk-and-insurance-a-transformational-combination/> https://www.on-sitemag.com/features/the-internet-of-things-construction-risk-and-insurance-a-transformational-combination/>

Poor security threatens Internet of Things hypergrowth

Most people familiar with computers and information technology know something about the Internet of Things (IoT) and probably own an IoT device or have seen it in use in the workplace. IoT adds internet connectivity to computing devices, mechanical and digital machines, and a huge array of non-computer objects.

< <https://www.securitymagazine.com/articles/96415-poor-security-threatens-internet-of-things-hypergrowth> https://www.securitymagazine.com/articles/96415-poor-security-threatens-internet-of-things-hypergrowth>

Edinburgh awards five-year contract to support smart city transformation

The City of Edinburgh has awarded a five-year contract to global IT and business consulting services firm CGI to help support its transformation to a smart city. CGI has been the primary provider of transformational ICT services to the city council since 2015.

< <https://www.smartcitiesworld.net/news/edinburgh-awards-five-year-contract-to-support-smart-city-transformation-7070> https://www.smartcitiesworld.net/news/edinburgh-awards-five-year-contract-to-support-smart-city-transformation-7070>

**********************

OTHERWISE NOTEWORTHY

**********************

G20: Creating a better future with international standards

The world’s leading standards bodies have issued a joint declaration calling on all countries to recognize, support and adopt international standards in order to contribute directly to the three pillars of the Italian G20 Presidency: People, Planet and Prosperity.

< <https://www.itu.int/en/myitu/News/2021/10/28/14/55/G20-creating-a-better-future-with-international-standards> https://www.itu.int/en/myitu/News/2021/10/28/14/55/G20-creating-a-better-future-with-international-standards>

Vint Cerf: Internet Is Evolving: A Glimpse at 2016-2036 [video]

< <https://www.smithsonianmag.com/videos/vint-cerf-internet-is-evolvinga-glimpse-at-20/> https://www.smithsonianmag.com/videos/vint-cerf-internet-is-evolvinga-glimpse-at-20/>

Email is 50 years old, and still where it’s @

50 years ago this month, Ray Tomlinson sent the very first email. He was a programmer working on ARPANET, the system that laid the groundwork for what would become the internet as we know it today. He tested the messaging system by sending emails to himself, and later said that the first note was probably something like “QWERTYUIOP.”

< <https://blog.google/products/gmail/email-is-50-years-old-and-still-where-its/> https://blog.google/products/gmail/email-is-50-years-old-and-still-where-its/>

Subspace Rebuilt the Internet for Real-Time Applications

The Internet was designed to move data worldwide, and to do so in spite of disruptions from natural disasters, nuclear attacks, or other catastrophes. At first the goal was just to increase the volume of data moving over networks. But with the rising importance of real-time applications like videoconferencing and online gaming, what now matters most is reducing latency—the time it takes to move data across the network.

< <https://spectrum.ieee.org/internet-latency> https://spectrum.ieee.org/internet-latency>

Assessing Internet Software Engineering, Encouraging Competitions

Andrei Sukhov considers the potential for reducing international tensions through competitive events, while Vivek S. Buzruk looks at the evolution of teaching Internet software engineering.

< <https://cacm.acm.org/magazines/2021/11/256375-assessing-internet-software-engineering-encouraging-competitions> https://cacm.acm.org/magazines/2021/11/256375-assessing-internet-software-engineering-encouraging-competitions>

What every IT person needs to know about OpenBSD Part 1: How it all started

‘Functional, free and secure by default’, OpenBSD remains a crucial yet largely unacknowledged player in the open-source field.

< <https://blog.apnic.net/2021/10/28/openbsd-part-1-how-it-all-started/> https://blog.apnic.net/2021/10/28/openbsd-part-1-how-it-all-started/>

Caching is key to interpreting root DNS anycast performance

IP anycast is a popular approach to routing; where geographically distributed servers all serve the same content and use the same IP address. It’s used by large, popular, latency-sensitive services including the Domain Name System (DNS), Content Delivery Networks (CDNs), and the cloud, and its popularity is only growing. As an example, Microsoft has more than doubled the size of its deployment since 2015, and Facebook recently switched from DNS-based redirection to anycast!

< <https://blog.apnic.net/2021/10/26/caching-is-key-to-interpreting-root-dns-anycast-performance/> https://blog.apnic.net/2021/10/26/caching-is-key-to-interpreting-root-dns-anycast-performance/>

------

David Goldstein

email:  <mailto:[email-masked]> [email-masked]

web:  <http://goldsteinreport.com/> http://goldsteinreport.com/

Twitter:  <https://twitter.com/goldsteinreport> https://twitter.com/goldsteinreport

phone: +61 418 228 605 - mobile; +61 2 9663 3430 - office/home