Subject: [Mud] SBOMs and version non-specific MUD files

From: Michael Richardson <[email-masked]>
Date: Fri, 04 Feb 2022 12:39:53 -0500

ietf-opsawg-sbom-access provides for linking to an SBOM from a MUD file.

My understanding is that for the sbom-retrival-method==cloud, that
a list of sboms is included, one per version of the device firmware.

I just wanted to re-iterate that this really is a good thing, because it allows
for a version agnostic MUD file to list many things.

I would like a cloud example to be added.

I think that we need some RFC6125 text for the https: local-well-known text
to explain how validation is (not) done.

We still need some way to determine what version of firmware a device is
running, and while the correct answer is remote attestation, it would be
lovely if there was a recommendation for a lighter weight process.
LLDP regularly reveals this, but that's unlikely to work over wifi or in
residential situations.
(I acknowledge that this is out of scope for sbom-access)

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-

---

From: "Dick Brooks" <[email-masked]>
Date: Fri, 4 Feb 2022 14:01:03 -0500

Michael,

The predominant "SBOM delivery channel" I see is through access controlled
customer portals where customers can download SBOM's Vulnerability
Disclosures and other artifacts needed to perform a NIST C-SCRM risk
assessment for Executive Order 14028.
Here's a use case to consider, listing all of the evidence data needed:
https://github.com/rjb4standards/REA-Products/blob/master/UseCaseVDR117/READ
ME.md

Thanks,

Dick Brooks

Never trust software, always verify and report! T
http://www.reliableenergyanalytics.com
Email: [email-masked]
Tel: +1 978-696-1788

-----Original Message-----
From: OPSAWG <[email-masked]> On Behalf Of Michael Richardson
Sent: Friday, February 4, 2022 12:40 PM
To: [email-masked]
Cc: [email-masked]
Subject: [OPSAWG] SBOMs and version non-specific MUD files

My understanding is that for the sbom-retrival-method==cloud, that a list of
sboms is included, one per version of the device firmware.

I just wanted to re-iterate that this really is a good thing, because it
allows for a version agnostic MUD file to list many things.

--
Michael Richardson <[email-masked]>, Sandelman Software Works  -=
IPv6 IoT consulting =-

---

From: Michael Richardson <[email-masked]>
Date: Fri, 04 Feb 2022 15:30:41 -0500

> assessment for Executive Order 14028.

For hospitals, sure.
For baby monitors, maybe not.

--
Michael Richardson <[email-masked]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide

---

From: "Dick Brooks" <[email-masked]>
Date: Fri, 4 Feb 2022 16:10:58 -0500

I agree, Chris,

Just got out of a meeting with Rusty. SAG-PM already supports retrieval of SBOM’s from rkvst – out of the box, no changes needed. 

An SBOM URL is provided to customers via an open source Vendor Response File, along with other required evidence data:

https://github.com/rjb4standards/REA-Products/blob/master/SAGVendorResponseSAMPLE.xml

<SAG:SBOM type="cycloneDX" version="1.2" format="XML" DigitalSignatureURL="https://softwareassuranceguardian.com/REDACTED">https://softwareassuranceguardian.com/REDACTED</SAG:SBOM>

<SAG:KnownVulnInfoURL DocFormat="XML" DigitalSignatureURL="">https://raw.githubusercontent.com/rjb4standards/REA-Products/master/SAGVulnDisclosureSAMPLE.xml</SAG:KnownVulnInfoURL>

<SAG:SDLCPolicyURL>https://softwareassuranceguardian.com/REDACTED</SAG:SDLCPolicyURL>

<SAG:SDLCEvidenceDataURL>https://softwareassuranceguardian.com/REDACTED</SAG:SDLCEvidenceDataURL>

Thanks,

Dick Brooks

 <https://reliableenergyanalytics.com/products> Never trust software, always verify and report! ™

 <http://www.reliableenergyanalytics.com/> http://www.reliableenergyanalytics.com

Email:  <mailto:[email-masked]> [email-masked]

Tel: +1 978-696-1788

From: Christopher Gates <[email-masked]> 
Sent: Friday, February 4, 2022 3:40 PM
To: Michael Richardson <[email-masked]>; [email-masked]; [email-masked]; [email-masked]
Subject: Re[2]: [OPSAWG] SBOMs and version non-specific MUD files

There are already public databases with both secured and public SBOMs

https://sbom.rkvst.io/publicsboms

Christopher Gates

--------------------------------

Director of Product Security

www.velentium.com <http://www.velentium.com/> 

(805)750-0171

Las Vegas, NV

(GMT-8)

Our new book is now shipping:

Medical Device Cybersecurity for Engineers and Manufacturers

U.S. <https://us.artechhouse.com/Medical-Device-Cybersecurity-A-Guide-for-Engineers-and-Manufacturers-P2128.aspx>  | Worldwide <https://uk.artechhouse.com/Medical-Device-Cybersecurity-A-Guide-for-Engineers-and-Manufacturers-P2073.aspx> 

Amazon <https://www.amazon.com/Medical-Device-Cybersecurity-Engineers-Manufacturers/dp/1630818151/ref=sr_1_1?dchild=1&keywords=Axel+Wirth&qid=1592335625&sr=8-1> & Digital <https://us.artechhouse.com/Medical-Device-Cybersecurity-for-Engineers-and-Manufacturers-P2174.aspx> 

Security Book Of The Year! <https://engineering.tapad.com/the-best-information-security-books-of-2020-e7430444fbd4> 

“If everyone is thinking alike, then somebody isn't thinking.” -George S. Patton

"Facts are stubborn things."  -John Adams, 1770

------ Original Message ------

From: "Michael Richardson" <[email-masked] <mailto:[email-masked]> >

To: [email-masked] <mailto:[email-masked]> ; [email-masked] <mailto:[email-masked]> ; [email-masked] <mailto:[email-masked]> 

Sent: 2/4/2022 12:30:41 PM

Subject: Re: [OPSAWG] SBOMs and version non-specific MUD files

For hospitals, sure.

 

--

Michael Richardson <[email-masked] <mailto:[email-masked]> > . o O ( IPv6 IøT consulting )

 

Disclaimer: The information and attachments transmitted by this e-mail are proprietary to Velentium, LLC and the information and attachments may be confidential and legally protected under applicable law and are intended for use only by the individual or entity to whom it was addressed. If you are not the intended recipient, you are hereby notified that any use, forwarding, dissemination, or reproduction of this message and attachments is strictly prohibited and may be unlawful. If you are not the intended recipient, please contact the sender by return e-mail and delete this message from your system immediately hereafter.

---

From: "Dick Brooks" <[email-masked]>
Date: Fri, 4 Feb 2022 16:19:10 -0500

True, some IoT devices will "auto update" using MUD/SUIT capabilities and a customer may never see, or have access to, the SBOM. 

Thanks,

Dick Brooks

Never trust software, always verify and report! ™
http://www.reliableenergyanalytics.com
Email: [email-masked]
Tel: +1 978-696-1788

-----Original Message-----
From: Michael Richardson <[email-masked]> 
Sent: Friday, February 4, 2022 3:31 PM
To: [email-masked]; [email-masked]; [email-masked]
Subject: Re: [OPSAWG] SBOMs and version non-specific MUD files

For hospitals, sure.

---

From: "Christopher Gates" <[email-masked]>
Date: Fri, 04 Feb 2022 20:40:15 +0000

Christopher Gates

www.velentium.com

(805)750-0171

Las Vegas, NV

(GMT-8)

U.S. 
<https://us.artechhouse.com/Medical-Device-Cybersecurity-A-Guide-for-Engineers-and-Manufacturers-P2128.aspx> 
| Worldwide 
<https://uk.artechhouse.com/Medical-Device-Cybersecurity-A-Guide-for-Engineers-and-Manufacturers-P2073.aspx>

Amazon 
<https://www.amazon.com/Medical-Device-Cybersecurity-Engineers-Manufacturers/dp/1630818151/ref=sr_1_1?dchild=1&keywords=Axel+Wirth&qid=1592335625&sr=8-1> 
& Digital 
<https://us.artechhouse.com/Medical-Device-Cybersecurity-for-Engineers-and-Manufacturers-P2174.aspx>

Security Book Of The Year! 
<https://engineering.tapad.com/the-best-information-security-books-of-2020-e7430444fbd4>

“If everyone is thinking alike, then somebody isn't thinking.” -George 
S. Patton

------ Original Message ------
From: "Michael Richardson" <[email-masked]>
To: [email-masked]; [email-masked]; [email-masked]
Sent: 2/4/2022 12:30:41 PM
Subject: Re: [OPSAWG] SBOMs and version non-specific MUD files

-- 
Disclaimer: The information and attachments transmitted by this e-mail are 
proprietary to Velentium, LLC and the information and attachments may be 
confidential and legally protected under applicable law and are intended 
for use only by the individual or entity to whom it was addressed. If you 
are not the intended recipient, you are hereby notified that any use, 
forwarding, dissemination, or reproduction of this message and attachments 
is strictly prohibited and may be unlawful. If you are not the intended 
recipient, please contact the sender by return e-mail and delete this 
message from your system immediately hereafter.

---

From: Tony Turner <[email-masked]>
Date: Fri, 4 Feb 2022 20:45:11 +0000

I also wouldn’t ignore the model where SBOMs will be delivered through 3rd party supply chain attestation data libraries that are already aggregating this data as part of C-SCRM assessment activities for mutual benefit.

Certainly MUD makes a lot of sense in very device-centric scenarios and I’m really excited to plug into this model (as I run one of the above mentioned data libraries, not just SBOM, but HBOM/MBOM,  SOC2, build artifacts, other 3rd party product and vendor assessments and product certifications, etc) – but I find that discovery of MUD sources is half of the challenge. What I find really interesting is the potential for dynamic updating of SBOM as firmware is updated and communication of software risks this will make possible to device management infrastructure. Its far more likely 3rd party tools like data aggregators for supply chain or vulnerability risk management will interoperate with the management portal for a fleet of devices than with the individual devices themselves.

--
Tony Turner
Vice President, Fortress Labs (R&D)
Fortress Information Security
Cell  321-634-4886 Main 855.FORTRESS
189 S. Orange Ave., Suite 1950, Orlando, FL 32801
fortressinfosec.com<http://fortressinfosec.com/>

From: OPSAWG <[email-masked]> on behalf of Dick Brooks <[email-masked]>
Date: Friday, February 4, 2022 at 2:01 PM
To: 'Michael Richardson' <[email-masked]>, [email-masked] <[email-masked]>
Cc: [email-masked] <[email-masked]>
Subject: [EXTERNAL SOURCE] Re: [OPSAWG] SBOMs and version non-specific MUD files
Michael,

Thanks,

Dick Brooks

-----Original Message-----
From: OPSAWG <[email-masked]> On Behalf Of Michael Richardson
Sent: Friday, February 4, 2022 12:40 PM
To: [email-masked]
Cc: [email-masked]
Subject: [OPSAWG] SBOMs and version non-specific MUD files

_______________________________________________
OPSAWG mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/opsawg
IMPORTANT: The information transmitted is intended only for the person or entity to which it is addressed. The content may contain business confidential and/or proprietary information, and it may be reviewed and logged for archival purposes by parties at Fortress Information Security other than those named in the message header. Any views or opinions presented in this email are solely those of the author and do not necessarily represent those of the company. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from any computer.