Subject: [T2TRG] New reference for draft-irtf-t2trg-iot-seccons-14.txt

From: Mark O <[email-masked]>
Date: Mon, 30 Apr 2018 15:47:51 +0000

I realise that draft-irtf-t2trg-iot-seccons-14 is in IRSG Poll, but if it's not too late for inclusion, there is a new publication from the UK Government that has guidelines for IoT security. It was published in March 2018 so is quite recent.

I suggest incorporating the following into Section 4.3 of the draft ("IoT Security Guidelines"):

Secure by Design: Improving the cyber security of consumer Internet of Things Report [DCMS]: This report from the UK Government Department for Digital, Culture, Media and Sport has a Code of Practice (Section 4.5) that lists 13 steps for improving IoT security. The list includes: No default passwords; implement a vulnerability disclosure policy; keep software updated. The report is of relevance to device manufacturers, IoT service providers, mobile application developers and retailers.

[DCMS] "Secure by Design: Improving the cyber security of consumer Internet of Things Report", Web https://www.gov.uk/government/publications/secure-by-design, March 2018.

- Mark
This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information legislation. Refer any FOIA queries to [email-masked]