Subject: [Suit] Ripple20

From: Russ Housley <[email-masked]>
Date: Tue, 16 Jun 2020 12:22:18 -0400

Just in case anyone forgot why SUIT is so important to the IoT ecosystem...

https://thehackernews.com/2020/06/new-critical-flaws-put-billions-of.html?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+TheHackersNews+%28The+Hackers+News+-+Cyber+Security+Blog%29&_m=3n.009a.2250.sd0ao0e9al.1eue <https://thehackernews.com/2020/06/new-critical-flaws-put-billions-of.html?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed:+TheHackersNews+(The+Hackers+News+-+Cyber+Security+Blog)&_m=3n.009a.2250.sd0ao0e9al.1eue>

---

From: Eliot Lear <[email-masked]>
Date: Tue, 16 Jun 2020 18:39:27 +0200

Thanks for passing that along, Russ.  This is also an interesting test case for the discussion that we just had re SBOM.  The focus of that work has largely been on OSS.  Well.

Eliot

> On 16 Jun 2020, at 18:22, Russ Housley <[email-masked]> wrote:
> 
> _______________________________________________
> Suit mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/suit

---

From: "Dick Brooks" <[email-masked]>
Date: Tue, 16 Jun 2020 13:12:00 -0400

Eliot,

                I want to thank you for pointing me to the NTIA SBOM work. I
spoke with Allan Friedman of NTIA this morning. I explained the importance
of having SBOM metadata aligned with CVE database vendors to enable
automated CVE searches that should produce a better signal/noise ratio as
part of  a risk assessment supporting NERC CIP-010-3 R1, Part 1.6 (software
verification). Today's CVE search results produce a significant number of
false positives, rendering them nearly useless.

FYI:  I've offered to assist NTIA within the energy industry, hopefully
starting with a communication to DOE regarding the 5/1 emergency Executive
Order on cybersecurity and the potential benefits of an SBOM.

Thanks,

Dick Brooks

 <https://reliableenergyanalytics.com/products> Never trust software, always
verify and report! T

 <http://www.reliableenergyanalytics.com/>
http://www.reliableenergyanalytics.com

Email:  <mailto:[email-masked]>
[email-masked]

Tel: +1 978-696-1788

From: Suit <[email-masked]> On Behalf Of Eliot Lear
Sent: Tuesday, June 16, 2020 12:39 PM
To: Russ Housley <[email-masked]>
Cc: suit <[email-masked]>
Subject: Re: [Suit] Ripple20

Thanks for passing that along, Russ.  This is also an interesting test case
for the discussion that we just had re SBOM.  The focus of that work has
largely been on OSS.  Well.

Eliot

On 16 Jun 2020, at 18:22, Russ Housley <[email-masked]
<mailto:[email-masked]> > wrote:

 
<https://thehackernews.com/2020/06/new-critical-flaws-put-billions-of.html?u
tm_source=feedburner&utm_medium=feed&utm_campaign=Feed:+TheHackersNews+(The+
Hackers+News+-+Cyber+Security+Blog)&_m=3n.009a.2250.sd0ao0e9al.1eue>
https://thehackernews.com/2020/06/new-critical-flaws-put-billions-of.html?ut
m_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+TheHackersNews+%28T
he+Hackers+News+-+Cyber+Security+Blog%29&_m=3n.009a.2250.sd0ao0e9al.1eue

_______________________________________________
Suit mailing list
[email-masked] <mailto:[email-masked]> 
https://www.ietf.org/mailman/listinfo/suit

---

From: Eliot Lear <[email-masked]>
Date: Tue, 16 Jun 2020 19:29:58 +0200

Hi Dick

> On 16 Jun 2020, at 19:12, Dick Brooks <[email-masked]> wrote:
> 
> Eliot,
>  
>                 I want to thank you for pointing me to the NTIA SBOM work. I spoke with Allan Friedman of NTIA this morning. I explained the importance of having SBOM metadata aligned with CVE database vendors to enable automated CVE searches that should produce a better signal/noise ratio as part of  a risk assessment supporting NERC CIP-010-3 R1, Part 1.6 (software verification). Today’s CVE search results produce a significant number of false positives, rendering them nearly useless.

Right.  Until someone does an evaluation, there’s almost no point.  How this would work with the NTIA model is that those products that publish SBOMs would immediately be considered potentially vulnerable, and then VEX would provide the opportunity to refine that to “not vulnerable” to “vulnerable with workaround” to “vulnerable with fix”, etc.

I do have a question for the chairs/AD.  I realize that this is a bit out of scope for SUIT.  Is there a more appropriate list we should be vectored to?  Thanks for the group’s indulgence to this point.

Eliot

>  
> FYI:  I’ve offered to assist NTIA within the energy industry, hopefully starting with a communication to DOE regarding the 5/1 emergency Executive Order on cybersecurity and the potential benefits of an SBOM.
>  
>  
> Thanks,
>  
> Dick Brooks
> Never trust software, always verify and report! <https://reliableenergyanalytics.com/products> ™
> http://www.reliableenergyanalytics.com <http://www.reliableenergyanalytics.com/>
> Email: [email-masked] <mailto:[email-masked]>
> Tel: +1 978-696-1788
>  
>> On 16 Jun 2020, at 18:22, Russ Housley <[email-masked] <mailto:[email-masked]>> wrote:
>>  
>> https://thehackernews.com/2020/06/new-critical-flaws-put-billions-of.html?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+TheHackersNews+%28The+Hackers+News+-+Cyber+Security+Blog%29&_m=3n.009a.2250.sd0ao0e9al.1eue <https://thehackernews.com/2020/06/new-critical-flaws-put-billions-of.html?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed:+TheHackersNews+(The+Hackers+News+-+Cyber+Security+Blog)&_m=3n..009a.2250.sd0ao0e9al.1eue>
>>  
>>  
>> https://www.ietf.org/mailman/listinfo/suit <https://www.ietf.org/mailman/listinfo/suit>
>

---

From: Roman Danyliw <[email-masked]>
Date: Tue, 16 Jun 2020 21:22:45 +0000

Hi!

[snip]

> I do have a question for the chairs/AD.  I realize that this is a bit out of scope for SUIT.  
> Is there a more appropriate list we should be vectored to?  Thanks for the group’s indulgence to this point.

A timely and important topic here.  Indeed, solving SBOM directly is out of scope for the current SUIT charter, but this list seems like the closest we currently have to discussing security issues in the software supply chain.  I'm fine with it staying on suit@ietf.  If the volume increases, we can certainly make a dedicated list.

As exchanging CVE data was discussed too, the MILE WG has work in exchanging vulnerability data, but not with the lens suggested here.

Thanks for checking

Regards,
Roman

---

From: "Dick Brooks" <[email-masked]>
Date: Tue, 16 Jun 2020 17:52:26 -0400

Thank you, Roman.

The focus on SBOM took an interesting twist in May when Edison Electric Institute released boilerplate procurement language specifying that software vendors supply SBOM's as part of the NERC Supply Chain standards that are scheduled to go into effect on 10/1/2020. 
https://www.eei.org/issuesandpolicy/Documents/EEI%20Law%20-%20Model%20Procurement%20Contract%20Language.pdf

Excerpt from EEI procurement language I'm referring to: 
Requirement R1.2.5 Verification of software integrity and authenticity of all software and patches provided by the vendor for use in the BES Cyber System. Proposed EEI Contract Language
Hardware, Firmware, Software, and Patch Integrity and Authenticity:
...
(e) Contractor shall provide a software bill of materials for procured (including licensed) products consisting of a list of components and associated metadata that make up a component.

With regard to vulnerability reporting: I'm currently working with the Oasis-Open CTI workgroup developing STIX and TAXII standards; https://www.oasis-open.org/apps/org/workgroup/cti/index.php 

I've also heard that NIST is working on some enhancements to the NVD that may offer some improved search results with a better signal/noise ratio (less false positives).

The ideal scenario would be to have standardized SBOM data and semantics that are also used in the vulnerability search criteria of the vulnerability databases; this would provide a level of interoperability that the energy industry could really benefit from in their software risk assessment controls. 

Thanks,

Dick Brooks

Never trust software, always verify and report! ™
http://www.reliableenergyanalytics.com
Email: [email-masked]
Tel: +1 978-696-1788

-----Original Message-----
From: Roman Danyliw <[email-masked]> 
Sent: Tuesday, June 16, 2020 5:23 PM
To: Eliot Lear <lear=[email-masked]>; Dick Brooks <[email-masked]>
Cc: suit <[email-masked]>; Russ Housley <[email-masked]>
Subject: RE: [Suit] Ripple20

Hi!

[snip]

> I do have a question for the chairs/AD.  I realize that this is a bit 
> out of scope for SUIT. Is there a more appropriate list we should be vectored to?  Thanks for the group’s indulgence to this point.

Thanks for checking

Regards,
Roman

---

From: Kathleen Moriarty <[email-masked]>
Date: Tue, 16 Jun 2020 21:17:36 -0400

With a quick look, it seems like there could be ties into RATS as well.

Best regards,
Kathleen

On Tue, Jun 16, 2020 at 5:22 PM Roman Danyliw <[email-masked]> wrote:

> out of scope for SUIT.
> A timely and important topic here.  Indeed, solving SBOM directly is out
> of scope for the current SUIT charter, but this list seems like the closest
> we currently have to discussing security issues in the software supply
> chain.  I'm fine with it staying on suit@ietf.  If the volume increases,
> we can certainly make a dedicated list.
>
> As exchanging CVE data was discussed too, the MILE WG has work in
> exchanging vulnerability data, but not with the lens suggested here.
>
> Thanks for checking
>
> Regards,
> Roman

-- 

Best regards,
Kathleen