From nobody Fri Feb 4 09:40:10 2022 Return-Path: X-Original-To: mud@ietfa.amsl.com Delivered-To: mud@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0FEED3A1CB4; Fri, 4 Feb 2022 09:40:02 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.899 X-Spam-Level: X-Spam-Status: No, score=-6.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SsPMNTTmg84Y; Fri, 4 Feb 2022 09:39:57 -0800 (PST) Received: from relay.sandelman.ca (relay.cooperix.net [176.58.120.209]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0223A3A1CB5; Fri, 4 Feb 2022 09:39:56 -0800 (PST) Received: from dooku.sandelman.ca (unknown [142.169.78.77]) by relay.sandelman.ca (Postfix) with ESMTPS id 00CBB1F44B; Fri, 4 Feb 2022 17:39:54 +0000 (UTC) Received: by dooku.sandelman.ca (Postfix, from userid 179) id 82FA81A03ED; Fri, 4 Feb 2022 12:39:53 -0500 (EST) From: Michael Richardson To: mud@ietf.org cc: opsawg@ietf.org X-Attribution: mcr X-Mailer: MH-E 8.6+git; nmh 1.7.1; GNU Emacs 26.3 MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha512; protocol="application/pgp-signature" Date: Fri, 04 Feb 2022 12:39:53 -0500 Message-ID: <282926.1643996393@dooku> Archived-At: Subject: [Mud] SBOMs and version non-specific MUD files X-BeenThere: mud@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Discussion of Manufacturer Ussage Descriptions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 04 Feb 2022 17:40:02 -0000 --=-=-= Content-Type: text/plain ietf-opsawg-sbom-access provides for linking to an SBOM from a MUD file. My understanding is that for the sbom-retrival-method==cloud, that a list of sboms is included, one per version of the device firmware. I just wanted to re-iterate that this really is a good thing, because it allows for a version agnostic MUD file to list many things. I would like a cloud example to be added. I think that we need some RFC6125 text for the https: local-well-known text to explain how validation is (not) done. We still need some way to determine what version of firmware a device is running, and while the correct answer is remote attestation, it would be lovely if there was a recommendation for a lighter weight process. LLDP regularly reveals this, but that's unlikely to work over wifi or in residential situations. (I acknowledge that this is out of scope for sbom-access) -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQGzBAEBCgAdFiEEow/1qDVgAbWL2zxYcAKuwszYgEMFAmH9ZOkACgkQcAKuwszY gEPb/gwAiT1hNTIO3FHtvEFJ2vWvJjD6Du8TfrJeF8L12uSgEFppQtRLYwbiWx0H PhLDQG0BUsOkfz3KJyqhdzxbPlOTU9HLQvEdgVNRv5GLA8AtGHJrPPS1EHhzwHjE 9WIcTQqm2Fp/4bg/IiVyicmeixV/GI/40LpsWzFIg17VNwQTe417kgpRt6Xq/Mp8 CiAFTF29dPFIrIrRDnLs+ucr95r9PlJpppZc/ji32AzwxNOOJKcHOQjxVwxqCtjJ xnB5wFjMuevTpxFEnwiyn25AFU+LTE8bqSoxJEhzcGYQcvpqn9yV9DTpNamzX42u 94y/Lq3a3LdyEhXIMF/N0CztcQR73BTpvNoG+IKyWQv4rKtg6+YjU9fkFfY95JT6 pezJVtBlA+rWv77nhQh9EwLAsAPfszODaLkRRJGiV/ZJDhU+9+cVuvg4w5U/rTF7 lO62F1DzL/ADUpyN9necOv5IcWovwTMqA0wo0m8vpEgBxIm4c25mxDQL13vCk3y7 Mb/TGSS2 =ZEwX -----END PGP SIGNATURE----- --=-=-=-- From nobody Fri Feb 4 11:01:15 2022 Return-Path: X-Original-To: mud@ietfa.amsl.com Delivered-To: mud@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CF5C83A1F6F; Fri, 4 Feb 2022 11:01:11 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=messagingengine.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 03SshqIUM3Mb; Fri, 4 Feb 2022 11:01:06 -0800 (PST) Received: from forward2-smtp.messagingengine.com (forward2-smtp.messagingengine.com [66.111.4.226]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 918933A1F6E; Fri, 4 Feb 2022 11:01:06 -0800 (PST) Received: from compute4.internal (compute4.nyi.internal [10.202.2.44]) by mailforward.nyi.internal (Postfix) with ESMTP id E822B19401C3; Fri, 4 Feb 2022 14:01:05 -0500 (EST) Received: from mailfrontend1 ([10.202.2.162]) by compute4.internal (MEProxy); Fri, 04 Feb 2022 14:01:05 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding :content-type:date:date:from:from:in-reply-to:in-reply-to :message-id:mime-version:references:reply-to:reply-to:sender :subject:subject:to:to:x-me-proxy:x-me-proxy:x-me-sender :x-me-sender:x-sasl-enc; s=fm2; bh=v6KaSKolEzYqzmg2FfpyDAbN6WZz9 xQYBtbE+1aBwwU=; b=eHd/GpVX7ynU/JBEh9vI/+M2XvuxHsVJCE011tSn/NjIy jQvJ3l8y8eMzsTZZNi6sbc500P1LO6/byW/xyEcuMwwYLKqkjaaOTEGsOfqkZ8k4 gRoSMSKjmgMr5PhTw9G6stWRlzbAF0nqnEI5IkktzDw2A/+hEZqvf9H+bZ31MaGP HxxO4B6F7GrPixHdtQ2QNth/dPNTTzNlbhiwIDf7+36pQ4HcEOCr9tdtpLxZHT5k H3HyzjXpCBR0sHor472FgPqvAMuKqZML5sz/oVvrInUh6fj85Kgue9aFMDwAL+lR jKhrYvWrF1evRXBwD1VX7lh0AZyoFKjDa0fRQ9qGw== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedvvddrgeelgdduudekucetufdoteggodetrfdotf fvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfqfgfvpdfurfetoffkrfgpnffqhgen uceurghilhhouhhtmecufedttdenucenucfjughrpehrhffvfhgjufffohfkgggtgffoth esthejghdtvddtvdenucfhrhhomhepfdffihgtkhcuuehrohhokhhsfdcuoeguihgtkhes rhgvlhhirggslhgvvghnvghrghihrghnrghlhihtihgtshdrtghomheqnecuggftrfgrth htvghrnhepkedtueehtdetledthfekjeetjeevjeetvefghfefvdfhhfdvgfetveeuuefh teefnecuffhomhgrihhnpehgihhthhhusgdrtghomhdprhgvlhhirggslhgvvghnvghrgh ihrghnrghlhihtihgtshdrtghomhenucevlhhushhtvghrufhiiigvpedtnecurfgrrhgr mhepmhgrihhlfhhrohhmpeguihgtkhesrhgvlhhirggslhgvvghnvghrghihrghnrghlhi htihgtshdrtghomh X-ME-Proxy: Received: by mail.messagingengine.com (Postfix) with ESMTPA; Fri, 4 Feb 2022 14:01:05 -0500 (EST) Reply-To: From: "Dick Brooks" To: "'Michael Richardson'" , Cc: References: <282926.1643996393@dooku> In-Reply-To: <282926.1643996393@dooku> Date: Fri, 4 Feb 2022 14:01:03 -0500 Organization: Reliable Energy Analytics LLC Message-ID: <686901d819f9$8ffc5720$aff50560$@reliableenergyanalytics.com> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Outlook 16.0 Thread-Index: AQKKKG9YQSV0Fk837yYvHefh3I71d6sfoTFQ Content-Language: en-us Archived-At: Subject: Re: [Mud] [OPSAWG] SBOMs and version non-specific MUD files X-BeenThere: mud@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Discussion of Manufacturer Ussage Descriptions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 04 Feb 2022 19:01:13 -0000 Michael, The predominant "SBOM delivery channel" I see is through access controlled customer portals where customers can download SBOM's Vulnerability Disclosures and other artifacts needed to perform a NIST C-SCRM risk assessment for Executive Order 14028. Here's a use case to consider, listing all of the evidence data needed: https://github.com/rjb4standards/REA-Products/blob/master/UseCaseVDR117/READ ME.md Thanks, Dick Brooks Never trust software, always verify and report! T http://www.reliableenergyanalytics.com Email: dick@reliableenergyanalytics.com Tel: +1 978-696-1788 -----Original Message----- From: OPSAWG On Behalf Of Michael Richardson Sent: Friday, February 4, 2022 12:40 PM To: mud@ietf.org Cc: opsawg@ietf.org Subject: [OPSAWG] SBOMs and version non-specific MUD files ietf-opsawg-sbom-access provides for linking to an SBOM from a MUD file. My understanding is that for the sbom-retrival-method==cloud, that a list of sboms is included, one per version of the device firmware. I just wanted to re-iterate that this really is a good thing, because it allows for a version agnostic MUD file to list many things. I would like a cloud example to be added. I think that we need some RFC6125 text for the https: local-well-known text to explain how validation is (not) done. We still need some way to determine what version of firmware a device is running, and while the correct answer is remote attestation, it would be lovely if there was a recommendation for a lighter weight process. LLDP regularly reveals this, but that's unlikely to work over wifi or in residential situations. (I acknowledge that this is out of scope for sbom-access) -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- From nobody Fri Feb 4 12:30:58 2022 Return-Path: X-Original-To: mud@ietfa.amsl.com Delivered-To: mud@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CDB253A223E; Fri, 4 Feb 2022 12:30:50 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.099 X-Spam-Level: X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=sandelman.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ghlVC3atI2Vl; Fri, 4 Feb 2022 12:30:45 -0800 (PST) Received: from tuna.sandelman.ca (tuna.sandelman.ca [IPv6:2607:f0b0:f:3:216:3eff:fe7c:d1f3]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3C7BD3A223A; Fri, 4 Feb 2022 12:30:44 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by tuna.sandelman.ca (Postfix) with ESMTP id F198E389BF; Fri, 4 Feb 2022 15:38:05 -0500 (EST) Received: from tuna.sandelman.ca ([127.0.0.1]) by localhost (localhost [127.0.0.1]) (amavisd-new, port 10024) with LMTP id 9Efbk5-b6P3r; Fri, 4 Feb 2022 15:38:04 -0500 (EST) Received: from sandelman.ca (obiwan.sandelman.ca [IPv6:2607:f0b0:f:2::247]) by tuna.sandelman.ca (Postfix) with ESMTP id B1E91389B0; Fri, 4 Feb 2022 15:38:04 -0500 (EST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=sandelman.ca; s=mail; t=1644007084; bh=EBML6Isqo7x88onUmKkBLbt2fdFANB9z8v7zSiE2NWQ=; h=From:To:Subject:In-Reply-To:References:Date:From; b=L3eSFrdAo2qJmQsH6pDejQ7oVVPwyoN3tRpqoA4UT4BK4sDce+4aygRanfTvJXL0C xXaCulGlkVFxrrQg1XjskkWOqJMB4+suPzTxhtJ4EsQkOQ1a+oeV/eEbOcFqg+5AP6 Gy08eN8XOUU66cun7ZbbLYCLBES7GasYQJIma8IaFI7PpRW/84ekjpp+X6R9m8n5YF IKyZkM0CDKXDwaO817vpJ4XPmouW8UkVSI1J0oKSQLj0EVOcC6+9gsGwb1ZSL4NnHI 6rvkx0/sGNBjSmwEK3QYYdl0ZBZKgq8l4jF/2rO5K4omhucp5wH74B/B0plIhbiL8X eZXmivxjL42oQ== Received: from localhost (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id 4AF846CE; Fri, 4 Feb 2022 15:30:41 -0500 (EST) From: Michael Richardson To: dick@reliableenergyanalytics.com, mud@ietf.org, opsawg@ietf.org In-Reply-To: <686901d819f9$8ffc5720$aff50560$@reliableenergyanalytics.com> References: <282926.1643996393@dooku> <686901d819f9$8ffc5720$aff50560$@reliableenergyanalytics.com> X-Mailer: MH-E 8.6+git; nmh 1.7+dev; GNU Emacs 26.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [Mud] [OPSAWG] SBOMs and version non-specific MUD files X-BeenThere: mud@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Discussion of Manufacturer Ussage Descriptions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 04 Feb 2022 20:30:51 -0000 --=-=-= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Dick Brooks wrote: > The predominant "SBOM delivery channel" I see is through access contr= olled > customer portals where customers can download SBOM's Vulnerability > Disclosures and other artifacts needed to perform a NIST C-SCRM risk > assessment for Executive Order 14028. For hospitals, sure. For baby monitors, maybe not. =2D- Michael Richardson . o O ( IPv6 I=C3=B8T consulti= ng ) Sandelman Software Works Inc, Ottawa and Worldwide --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iPMEAQEKAB0WIQSk7ZHEG9TCGBNASfm/sjw/rPYc8wUCYf2M8QAKCRC/sjw/rPYc 86TIBf9lfoT5l4/dkhNaUnChV6sd8P8qiz3YxYOFPFRf/xgXmP7n79kA/Z/75Yvc dE+tMLu1xtYO6txdhO87LzBaTAKLXpcYed2urm+PpYnXs3+a2c6/HC5A0KzXV2oF ihcpKysRScTpcq1OcPQH7j4dMUpVBMH5atSZZsGR1gvoZcva814BQ9YE4KxH1B3i zo4x7bLsFnHpbGbCf0UThpdZQE3mj03KfkVczMejl3V6GB2vC7jg4m7WJSGYAr/2 bcVrhsc= =F7r7 -----END PGP SIGNATURE----- --=-=-=-- From nobody Fri Feb 4 13:11:20 2022 Return-Path: X-Original-To: mud@ietfa.amsl.com Delivered-To: mud@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C91AF3A237A; Fri, 4 Feb 2022 13:11:06 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=messagingengine.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5clv8UgJFoA6; Fri, 4 Feb 2022 13:11:01 -0800 (PST) Received: from forward3-smtp.messagingengine.com (forward3-smtp.messagingengine.com [66.111.4.237]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 86A653A2379; Fri, 4 Feb 2022 13:11:01 -0800 (PST) Received: from compute1.internal (compute1.nyi.internal [10.202.2.41]) by mailforward.nyi.internal (Postfix) with ESMTP id D54A61940185; Fri, 4 Feb 2022 16:11:00 -0500 (EST) Received: from mailfrontend2 ([10.202.2.163]) by compute1.internal (MEProxy); Fri, 04 Feb 2022 16:11:00 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-type:date:date:from:from :in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:reply-to:sender:subject:subject:to:to:x-me-proxy :x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm2; bh=ks7ZqY lTLTCvyaOTAi0IvzC3RIctSUjbAcSKztbFOz4=; b=MtZncoVdoRfv2WSKggOvh1 jIhbiINTlXZGpvsdWkeR7lVJcMZsTUlaEBgkqrceKGdKcdVJ2lqExtXDQMvwCN4f gWtRVd/mX9X/haVMf08ZYDVSWI6WkPOUuPcZ4X2aGHO8kJ2lfQoH8Oeo15lvRpyv yvcWXHX1pBWvcshdjeeCPdMOX6zzlWptlBcGsjmolvS24NoMD0bnlX5m231yIL9d senA//KVUVnIATmufsANCTHt0nhxPkiLTIn22J8dJneryGf/g+VhyJ24PEesyLvi d8O8f3kzJ5qVXtaWy/AnyJ0LhpSVeFT5buw3ohZ4+ShucEmePzjHV1UHADnqIG6A == X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedvvddrgeelgddugeeiucetufdoteggodetrfdotf fvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfqfgfvpdfurfetoffkrfgpnffqhgen uceurghilhhouhhtmecufedttdenucesvcftvggtihhpihgvnhhtshculddquddttddmne cujfgurheprhfhvfhfjgfuffhokfggtgfothesrhdtghepvddtjeenucfhrhhomhepfdff ihgtkhcuuehrohhokhhsfdcuoeguihgtkhesrhgvlhhirggslhgvvghnvghrghihrghnrg hlhihtihgtshdrtghomheqnecuggftrfgrthhtvghrnhepfeehtdehueeuveekiefhuedv hfffuddthffgkedvffdtleekgfejfffftdegudelnecuffhomhgrihhnpehgihhthhhusg drtghomhdpshhofhhtfigrrhgvrghsshhurhgrnhgtvghguhgrrhguihgrnhdrtghomhdp ghhithhhuhgsuhhsvghrtghonhhtvghnthdrtghomhdprhgvlhhirggslhgvvghnvghrgh ihrghnrghlhihtihgtshdrtghomhdprhhkvhhsthdrihhopdhvvghlvghnthhiuhhmrdgt ohhmpdgrrhhtvggthhhhohhushgvrdgtohhmpdgrmhgriihonhdrtghomhdpthgrphgrug drtghomhenucevlhhushhtvghrufhiiigvpedtnecurfgrrhgrmhepmhgrihhlfhhrohhm peguihgtkhesrhgvlhhirggslhgvvghnvghrghihrghnrghlhihtihgtshdrtghomh X-ME-Proxy: Received: by mail.messagingengine.com (Postfix) with ESMTPA; Fri, 4 Feb 2022 16:11:00 -0500 (EST) Reply-To: From: "Dick Brooks" To: "'Christopher Gates'" , "'Michael Richardson'" , , References: <282926.1643996393@dooku> <686901d819f9$8ffc5720$aff50560$@reliableenergyanalytics.com> <27407.1644006641@localhost> In-Reply-To: Date: Fri, 4 Feb 2022 16:10:58 -0500 Organization: Reliable Energy Analytics LLC Message-ID: <3fe901d81a0b$b657f610$2307e230$@reliableenergyanalytics.com> MIME-Version: 1.0 Content-Type: multipart/related; boundary="----=_NextPart_000_3FEA_01D819E1.CD8410F0" X-Mailer: Microsoft Outlook 16.0 Thread-Index: AQKKKG9YQSV0Fk837yYvHefh3I71dwGBqSaeAWr2vPACHLL/Jar3ebsA Content-Language: en-us Archived-At: Subject: Re: [Mud] [OPSAWG] SBOMs and version non-specific MUD files X-BeenThere: mud@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Discussion of Manufacturer Ussage Descriptions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 04 Feb 2022 21:11:07 -0000 This is a multipart message in MIME format. ------=_NextPart_000_3FEA_01D819E1.CD8410F0 Content-Type: multipart/alternative; boundary="----=_NextPart_001_3FEB_01D819E1.CD8410F0" ------=_NextPart_001_3FEB_01D819E1.CD8410F0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable I agree, Chris, =20 Just got out of a meeting with Rusty. SAG-PM already supports retrieval = of SBOM=E2=80=99s from rkvst =E2=80=93 out of the box, no changes = needed.=20 =20 An SBOM URL is provided to customers via an open source Vendor Response = File, along with other required evidence data: https://github.com/rjb4standards/REA-Products/blob/master/SAGVendorRespon= seSAMPLE.xml ht= tps://softwareassuranceguardian.com/REDACTED https://raw.githubusercontent.com/rjb4standards/= REA-Products/master/SAGVulnDisclosureSAMPLE.xml https://softwareassuranceguardian.com/REDACTED https://softwareassuranceguardian.com/REDACTED =09 =20 Thanks, =20 Dick Brooks Never trust software, = always verify and report! =E2=84=A2 = http://www.reliableenergyanalytics.com Email: = dick@reliableenergyanalytics.com Tel: +1 978-696-1788 =20 From: Christopher Gates =20 Sent: Friday, February 4, 2022 3:40 PM To: Michael Richardson ; = dick@reliableenergyanalytics.com; mud@ietf.org; opsawg@ietf.org Subject: Re[2]: [OPSAWG] SBOMs and version non-specific MUD files =20 There are already public databases with both secured and public SBOMs https://sbom.rkvst.io/publicsboms =20 Christopher Gates -------------------------------- Director of Product Security www.velentium.com =20 (805)750-0171 Las Vegas, NV (GMT-8) =20 Our new book is now shipping: Medical Device Cybersecurity for Engineers and Manufacturers U.S. = | Worldwide = =20 Amazon = & Digital = =20 Security Book Of The Year! = =20 =20 =E2=80=9CIf everyone is thinking alike, then somebody isn't = thinking.=E2=80=9D -George S. Patton "Facts are stubborn things." -John Adams, 1770 =20 ------ Original Message ------ From: "Michael Richardson" > To: dick@reliableenergyanalytics.com = ; mud@ietf.org = ; opsawg@ietf.org =20 Sent: 2/4/2022 12:30:41 PM Subject: Re: [OPSAWG] SBOMs and version non-specific MUD files =20 =20 Dick Brooks > wrote: > The predominant "SBOM delivery channel" I see is through access = controlled > customer portals where customers can download SBOM's Vulnerability > Disclosures and other artifacts needed to perform a NIST C-SCRM risk > assessment for Executive Order 14028. =20 For hospitals, sure. For baby monitors, maybe not. =20 =20 -- Michael Richardson = > . o O ( IPv6 I=C3=B8T consulting ) Sandelman Software Works Inc, Ottawa and Worldwide =20 =20 =20 =20 Disclaimer: The information and attachments transmitted by this e-mail = are proprietary to Velentium, LLC and the information and attachments = may be confidential and legally protected under applicable law and are = intended for use only by the individual or entity to whom it was = addressed. If you are not the intended recipient, you are hereby = notified that any use, forwarding, dissemination, or reproduction of = this message and attachments is strictly prohibited and may be unlawful. = If you are not the intended recipient, please contact the sender by = return e-mail and delete this message from your system immediately = hereafter. ------=_NextPart_001_3FEB_01D819E1.CD8410F0 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable

I agree, = Chris,

 

Just got out of a meeting with Rusty. SAG-PM already = supports retrieval of SBOM=E2=80=99s from rkvst =E2=80=93 out of the = box, no changes needed.

 

An SBOM URL = is provided to customers via an open source Vendor Response File, along = with other required evidence data:

https://github.com/rjb4standards/REA-Products/blob/= master/SAGVendorResponseSAMPLE.xml

<SAG:SDLCEvidenceDataURL>https://softwareassuranc= eguardian.com/REDACTED</SAG:SDLCEvidenceDataURL>

<SAG:SBOM type=3D"cycloneDX" = version=3D"1.2" format=3D"XML" = DigitalSignatureURL=3D"https://softwareassuranceguardian.com/REDACTE= D">https://softwareassuranceguardian.com/REDACTED</SAG:SBOM>= ;

<SAG:KnownVulnInfoURL = DocFormat=3D"XML" = DigitalSignatureURL=3D"">https://raw.githubusercontent.com/r= jb4standards/REA-Products/master/SAGVulnDisclosureSAMPLE.xml</SAG:Know= nVulnInfoURL>

<SAG:SDLCPolicyURL>https://softwareassuranceguard= ian.com/REDACTED</SAG:SDLCPolicyURL>

 

From: Christopher Gates = <chris.gates@velentium.com>
Sent: Friday, February 4, = 2022 3:40 PM
To: Michael Richardson = <mcr+ietf@sandelman.ca>; dick@reliableenergyanalytics.com; = mud@ietf.org; opsawg@ietf.org
Subject: Re[2]: [OPSAWG] SBOMs = and version non-specific MUD files

 

There are = already public databases with both secured and public = SBOMs

 

Christopher Gates

--------------------------------

D= irector of Product Security=

www.velentium.com

(8= 05)750-0171

La= s Vegas, NV

(G= MT-8)

 

Our new book is now = shipping:

Medical = Device Cybersecurity for Engineers and = Manufacturers

U.S. | Worldwide

Amazon& Digital

Security Book Of The = Year!

 

=E2= =80=9CIf everyone is thinking alike, then somebody isn't thinking.=E2=80=9D = -George S. Patton

"Facts are stubborn things."  -John Adams, = 1770

 

------ Original Message = ------

From: = "Michael Richardson" <mcr+ietf@sandelman.ca><= /o:p>

Sent: = 2/4/2022 12:30:41 PM

Subject: Re: [OPSAWG] SBOMs and version non-specific MUD = files

 

 

> The predominant "SBOM delivery channel" I see is = through access controlled

> customer portals where customers can download SBOM's = Vulnerability

> Disclosures = and other artifacts needed to perform a NIST C-SCRM = risk

> assessment for = Executive Order 14028.

 

For hospitals, = sure.

For baby monitors, = maybe not.

 

 

--

Michael Richardson = <mcr+IETF@sandelman.ca> . o = O ( IPv6 I=C3=B8T consulting )

Sandelman Software Works Inc, Ottawa and = Worldwide

 

 

 

 


Di= sclaimer: The information and attachments transmitted by this e-mail are = proprietary to Velentium, LLC and the information and attachments may be = confidential and legally protected under applicable law and are intended = for use only by the individual or entity to whom it was addressed. If = you are not the intended recipient, you are hereby notified that any = use, forwarding, dissemination, or reproduction of this message and = attachments is strictly prohibited and may be unlawful. If you are not = the intended recipient, please contact the sender by return e-mail = and delete this message from your system immediately = hereafter.

------=_NextPart_001_3FEB_01D819E1.CD8410F0-- ------=_NextPart_000_3FEA_01D819E1.CD8410F0 Content-Type: image/png; name="image001.png" Content-Transfer-Encoding: base64 Content-ID: iVBORw0KGgoAAAANSUhEUgAAAQsAAAAxCAYAAADNw4wtAAAACXBIWXMAAA7DAAAOwwHHb6hkAAAA GXRFWHRTb2Z0d2FyZQB3d3cuaW5rc2NhcGUub3Jnm+48GgAAIABJREFUeJztnXl4VcX5xz9zzr3J zUIWCQgCMSwadgFRwARkx51iRXFFbbWiKASsWtsqbj83NkWtpa2t1bpv1SKybwFBRXZkU4GEkJB9 T+5y5vfHnGtuTu5Nci8QHvF+n4eH3HNm+c7MO++8886cGUEYJxWjp2Umo8vRQshhUooLgESgFRBr BvEAhVKKnULIr5HyS3e8Z8nqWSNqWozjg8vipTPyUiHESKA7QvZEigSgzCeYRMi90hBfaRqbXB73 4tXzR5S0FEeAsTPWdPJIfaTQjMFSaj2BZIGMN1/XAgVI9kkhtupSbtXd9jWLFwwuayTJMIKAONUE TkdMnPieXtyp3a9A/BYYC2hx0fquQT1a/9i1Y4zz7LYOuyNS1wDKqz3uI/nVxncHK2yb95V0q6xx dwdKgfdBvLZ8bvrGk8Vz7P1rRhoefQZCjgVsURH6dwPOjT/Qu0s8Hdo4jGi7kJouHBVV7pq8wtqa 77IrE7/+ruSs8mpXT8ANfCSQry2bO2zFyeO4JEZ6Ym5GyNskXBAdqR/q3y0++9yOscXtkiIq42Ij BEB1tdtVUe2OOXCk0rbxu5I2x4prB6AU8ScC8WZaXNoXs2YJ42Tx/CUgrCxOMEbNzBwjDDkbQd/E Vvbtt1+afGDAuQldbLroA+hNRPe4PXLr13tKfnxj2eGUwlLXQJCfasL24NI5F+05URxHz8xMR8p5 wMC4GNuWW8Yk7x7cKzHVbhP9m8PRY8gtX+4qzHr9i6yUsipPfySrhdQyls1P23qiOA6ftcphK9Xv RYiHHBF69YSh7XeMvaBNUnSk3g+wNRXfkHLvd4cqdr72+cG22fm16SC2IuUDy+cNXd5E1Egg2vy7 Fqgx8zNQCvIXi7CyOEEY/eCyeFyOvwETkxIjvvnDjecUdGgdNUIo4QsFNblFNUueenP/mceKawcC cxKzjv7x/fev9YTKMe2BzFZRbp4F+buEGPuWWbel/tC+teNKwBFiklW5RTVLZv1zT0pxhfs8kK/Y XRX3L15wWW2oHAFGTV8/RGief0dE2Oz3X9v5m/O6JgwHWoeYnKe00r3i6bf2237MqRyJFIs0Xdy+ dHbasQDhOwJ3At8CnYEfgD7AaiAzRA6nBcLK4gRg9Iw1/UF7X2i0n3ZN50VDerS+lDqfxPGi/Ju9 xZ/OfveHKyTya1kTMWnFy4MKg01k7P1rOhuG9qkQpEy7put/h/Q84zKQiSeGoizZtLv0v/M+ODBB IncJXbtm2XPpOaGkNGrGuhkCnh3WL+m/U8anDNBUhz0RcB3Iqfzvo//cm+Z2G1JIecOyecPWBAg7 EVgOjEf1ER3YQ1hZhHE8UKOg8UVctO3w/Km9C2OibBefjHxqnZ41U1/Y0bqsyh0tdOOSZc9fvL+5 ccfOXHe+Ifk8KlIvWDC97+FWDv2Sk8Gxqtq98t4FO9pXVHvidbhsydyh25obd+LE9/SiTu1fEHD7 wzee8+l53eKvoekpUdBwe+S2jFd2uo4V1fYH7lw+d+hrfoKNBr4CLgY+A7oAccAJm2b9HBFWFscB r6JoHW/f8fJ95yUIjV4nMz8p2Tttwc6SvOKaFB3GNaczjsvY0M0jPOsTW9lzXpnW16HpovvJ5Wjs vGf+jorCMld3hLhy+Zz0Zo3Go2eu/YtATFpwX5/lbRIirzm5HMl6+B+7D/xwpOpiKcXtK+alv34y 8ztdEFYWIWLUtI1nCt21JT7GduzVmedFa0Kc0xL5Ssm+O+dsrS6rdJ8tDHnFsvnD1gcKO3z6qgSb ZvsmNspWvfD+8wxdE31bgqPhkXvunLvVXV7l6SIQE5fNTf+8sfCjMzKnIuTsOff0XNQxKfrqluAo JVnTF+w8nFtcc4GBMWLl3Is3tES+P2dop5rAzxGzZklN011vaLqIeGnaeSUtpSgAhODcV6b3rdI1 4ZaaWDp65tpxgcLqmn2eJkTiyxm9y1tKUQBouuj+6ox+pTZNVEnkJ6MzMm8IFHbM9PX9EHLetKu7 vttSigJACDrNndorOkLX8jW0d9IeyGzVUnn/XBFWFiFgfXnmjRLG/PGm1CURdnFSfBSNwW7Thjx8 4zlLgGik+HR0Rua11jCjMtZdIpC3zpzU7ROH3TakpTnadJH20E3nrAPsCPnGmBnr7rGGmTVLalIY r57TMWb9kD6J17U0R10T/Z/4TY/VQKcoN0+1dP4/N4SVRZCYOGtXhJTMOispamXvlNhfnSoevbvE TUxu41gDRCDk29bOqAkeO6u1I3PgufETTxFF+nSOu7LLWTFfApqEl8ZkrH3E931maeZkBL0euSU1 +jiWmI8LZ7ePuqbzmTHLQN419v41J2rl5bREWFkEiaLS4uuBzo/emuqmbvPOqUDEA9efW2X+rUl4 adTMzMcAxs5cM0zChX+8+ZwC1NbyUwXbA5O6/bTnQgrx2JgZ614AKUAKBL8fO7DNqgi7dsGpIigg 8o83d6sAdMPQf3+qePwc0OROuDDqQwg5qW1i5KaEGNvIIKI5c48eXXznHbcd3rdn97BpGfevyMnJ ES6XK/buqdNSkpOTx4TCJSkxYmRinH17cZmrL4CQ8pFRMzKTPRj5SfERW1vHR14abJqGYeQfOZK9 7t23/pN38NDB5Jjo6LKzU1I8MbGxHqfTGXvHnVN+RRBLmomt7EPbJzo2Hy2uOR9Awn2jZqw/QxjG O0KI1JvHdQqWYj0U5B/b8vZ/3iy5d/qMEaGm0SrGfkW7MyI35hY5bxiSsWHml/Muqj4uUqcpwpZF EBg+fVUCMHLyuI5HCU7RRrRr3368EHJvfn5+1JR77pv8xFPPTElLS8/u3yf1+2PH8gKuaDQGAZE3 jOp4oP4zeauQeo/Hb0v9IRTTXtO0Np06Jl+64MW52zd9uaHrs7PnTbx76rSbJt/6m8m9e/c1EBwN Mkl90pizsi0cb0ITU28a0+kfETatR7AcfXH3XXccevyxPx9zupy7jyMZ+63jOuWAjI/BPfZ4+JzO CCuLIKDr+nAgom/XhDahxO/QIblWCFEIxAOOK8dfPT06OvrrZ556IuQPnAacG9+u4VPjitnvft9B Co6ElKggKjk5udZut1XgoxQHD7loDJK2wSbXr2ucv63al/xvQ25vw2OE3Mlramo21zprizRN275g 3pxmb1Lzhz5d47oCSCFCsvJ+CQgriyAgDDFIEyInwhbaMuTZnc52RcfEOPmpAxpCCNE6Nja2qtGI jSDWYeuFkA22f/94tGrQzAU7jyD5IZR04+PjKzRNs/KqBSKCTcsRYesOFFifF1e4hkyZv11zuWVI H8kt/MtL33/838+Hv7rwtajZzz/jkFIeCiUdAJuupWpC5AjJwFDTON0RVhbBQKNLYpz9e9TW36CR dGaSLiECRLGUcv/f/vqXd1NSOg96ZNYTXY+DVXzbBMeP/l4cKay58J4XtlcYHvYGm2hMXJyzpLQk xuVybfR4PFvzjuW+t3vXzk0hckxKiNH9jvwlFe7uU1/cEeF2y6AsA2nIo7W1tdWapnW58qoJlzmd zvUfffh+qPwAopMS7XsQJ3eH688ZYWURBKQhkhJaRYR8mIrb7ZZVFRVxb73x+pLBF/bb/dADM1P/ /Z/3HDa7vdvx8EpqFRnQMikodfa9e/424TaCG3UjIyP1ozk5rbZu2ZJ38OCPJevXrK2urKx0hsox ITZwvZWUO7vc88L2aLdHft/c9FatWr5uyj33ngVgs9sG3P/gH3JnTJvaFj8WTHMRF20rBRk/cdau oK2nXwLCyiIYCGytIrWQzzQoLigUNput4Iabb7lu09fbLhw9etyHaYMHRFRXVW8+HlrRUXplY+9L q9zdyivdpcGkWVNTE9WhQ4ecCy68cHzXrt2GXz3x2pv6ntevS6gcHQ57o5/Wl1S4Onx3qOJwsxKT VM+cPlV75603D21Yv+6DLxYvenfP7t1DKirKN2/+5uumzqsIiGh7RDlAVU1RTKhpnM4IL50GAyFL q1yekDcP5eTlOux2u4b6Jqf92+99eM/woYOeHjKo351btu85IoToEEq6pdWuqICUBZ6n7+ixIbGV fWgwaWYfOhQppfSVD93hcAwIhR9ArdPdmKzJe3/deVGfLq2uaE5aOTlHlrz+xrt6n379bvau+Fxy 6eXynrvvvPe2yTcM2L5rfxUh7IHJL6u2Aa7o74+Gj+Lzg7BlEQwkh4vKXPFNB/SPgry8qJqamkSp HIVout596cp1dxQVFr4/aeKEzUBIjs78olq/qzNCiOo5d/VemdIuOihFAbizsrIiq6qq63U4j9u9 3+Px5IfCsaTcGWgFyXPfr7u8k9679eXNTEo++EBGed9+/S62LA2LKVOmXngkO/uHrVu+/TQEirKg xNVZIo4czwFDpzPCyiIIaIJNBSXO7kBRkFHdWVlZS/fu39s7ISGh3bfffP2RYRgVAA5HVPrmrbtH HD16JPsPD8z8TEoZrMLIKalwd7Q+FEIrffHeXis7tHUEuxQopTRWVVVVtaqoKG+3dcuWz/Ly8pYX 5BesevLJWdtAhjLqFhZXuFP8PK995JZz307rfcb1NOsLaFG8aeOX/8w/dqyDs7Y226t0AaQhcxyO KAfANROu7F5dXbURdRReszm6PEaqoPl+k18awtOQIKAZ+pce4UmsrHGvjXHYhgUR1dapU6exm7fs 8v6+3vdlm7Ztx69d/3VInMoq3HtAWneTHpt/T8+lbRMdNwWbntvlOnAs/5j92+17xrlczi2AVl5e Vgtw402To3RdD/p4u4oq1y7AWl+V907o/PdeneOmNTcdKQ37wAsuGLboixUVQoj6J5EJ7J27dB5w rKiiAimjhKa1IYjBsNbp2Q0Mk4hAp2f94hFWFkFgybwh34+ekZm1emth0eWDzzzVdABY8W2+dVpw WEre/zG3une71sEfrWmz288566wOJ/ST+3U7i3PrPRCyECmf+Xht7q/T+7Z200w5FELE6rrN78qR EKKNrttC2iwH8O3+MrVXRbI61DROd4SnIUFBSCQLP1h9tDeI4lPNBij7ZEPehT6/92gY6Rqy7K+f HuxB8NOlk4Gid5YfOc/n91EpGKmjLcsurB5cVOZcdsqY1cH9zsqsrsDhM7JzwofgBEBYWQQJadj/ VlXr7rQvu/yUC/nerPIlNbVu72fVm+0uOWzp3IuzDGfky9VOT+u9hytCXkY8UTiQXbm4xuVJVb/k AZvhvmjF7GHbzSMBNz779n4nEPL+jROBwjLnytwiZ1+JeDXs3AyMsLIIEiteGJwn4M3n3tp/LhDo OPmWQMFzb//g3Xa+xu6yj1y8YFg+gHn69+w57x3ow6nlmPPkm/v7AkjY5tY9Q7+YP+Kg96WQ2qMH c6uvyC+t/eSUMZRU/9+b+1uDKI1wGX8/ZTx+BggrixDgEu6Hyqs9HRdtzDtlI/f7q46sqKh2pSLF okqpX2q9ps9d455dWumO+Whdzkm7LawpfJKZu7S61t0HWO8x3MNXPz+inu9i2by0pUjxxazX93bh FCm1zF1Fn2TnV58Pxh+8yjYM/wgrixCwes6IAqS4599Lsn5VVO76rKXzzyuu/eSDtUevlog3iysd E/ydv7D6lREVEnHruytzJuQV137c0hzzy2o/fHtF9vVCsjiqImpsoHtR3XbXXQXFzm6vfPLjYlp4 OlJc5vp4wYc/XAlkpscN/WtL5v1zRFhZhIjl89LfA/nKfS9uH1jr8qxqqXyrazwrMl7emQbyr0Pj 0iZvXjjQFSjsirnpq6SQj05/eWd6dY27xSyMWqdnTcaCnRcBHxVVRo3/bOHAgHtHVj83ItsQ4oY1 2wpv2rir+J2W4uh0G5lTX9wxACh06+6J4XtQm0b4KoDjghSjMzJfdUTql/xlRp9D0ZG2YHdKBoWK as/yKfO293C6PG8unzv0oebGGzNj3bN2XbvxpRl9tsRH25u1pTpUVNW6106Zs6NTtdPz6dD49BnN 7YRjMjLvkkIumHJVyr+G90+aDNhPFscal2fZ757fnlLjMtpqmkhfOjtt58nK63RCWFkcJ2bNklpm 6frZuo2bnr6j17qzz3RM4MTXq7Evq+KdR/65Z7ghxeMr5qYHbTKPmbn2YRAZj93eY3Fqx5jrOfF7 bGRWfs3HD7y6K10acu6yuUOfDTaBUTMyfyeQC64YcuaHN4/tNBKCP2inKY65RbXvz3h5Z7rhkYah y8tXzB62/QTncdoirCxOEEbPWHc7MH9YvzOW3n1Vl75CcEI2NnkMdrzwwfd7Nn5XcgFCXLtiTlpo Wz2B0RlrxyPEa+enJiydeW2X3rqm9T4RHA3Jjws/Pfjtqq0Fw9DkbctnD1sUalpjMtaPlcJ4u3Wc ff+zv+td1CpaD/ocUX+Qkux/fZG15ouv8q4Fdrht7vGrnxuR3WTEMH5CWFmcQIz8/fqumsd4WddE /99enrxyeP+kAZoQ54aSlttg55Kv8nb+Z1l2mtsjP3JE8tiiZ4Ye90aw4Q+s6mhz2+ZqQlx805gO n186+MzBWogHvnikPLh2S8Gmfyw+fLHLLVdJjz1jxQuD846X47jpa9t7NPEKcPmgXgn/m3JV54So CH04oclr3ld7ipYv+OjQRU6Xp71EPF5S4ZjdmK8nDP8IK4uTgNEz145DigeF4Py0PmesHp/W3ujY xtFTE6IbgZ3KHsMj9/9wrHrnx2uOxH6zt2wIyEW61B9dMu+iAwHiHAfHzHRhyIelYPCgXgmrrxl6 VmTHtlHnNHW7moS92QXV+z5Zd1Su31mYJg1tNdLz2PJ5F+844RzvXzccg8eBi7p1jFkzaUSHop4p cam6ulO2Med8Tkmla++iTcfyP9+Qm+72yNYC3tSk/szJqMtfCsLK4iRi7P3re0vDc62UYjyCcxx2 /bvuZ8cebZMQUXlGnN3jdBnRxZVuvbC0Rt+bVd3Z6fR0Ar4RUrwTESnfPRGWRFMYl7Ghm4H7Bim4 AkSfxFj74eT2UVlt4xwFQsMVE6G7j5U4HbklNXHHipwdy6tdXRFyO/C+7uGdJfOHBXvad9AYPWNN f4T2W2FwlRS0j7Br+1PaRx3smBRVFRmhFds1TVTUeOz5Jc64IwXVbYvKnL2AOBBbJHzs0V1/s+7x CCN4hJVFC2H0g8viNU/E+VJqHTCU405qlAMgqZGa3OqJ9exePWtEyCdxHS+G370q1uaw9xZCdpZS JghEnBTSCaJSGrJMSvaVVkXvOJUm/IiMzF42TQ6QiD4Ysh2CNghsGKJWCJmLlIclbNMlX7WEIgsj jDDCCMMCAaRQf/4ngXygwk/4jgQ+Cr7KjGNd7vIAvofFOoCz/MQ/SMPDSuJR6+3+DmHtQMNLdGqB HFQZvEih4fw2l/qnUvkL40WZn/xbm9wCIRtVV14UAtYzMGMA3+/ca1FlbYyHE0iyPK9GtVdTFkkK qu4jUcumTlR7HTTfWa3MAjPPeFR5fXk0dSiuw4xjvbfEBiT7/C42//kiGvC9C8UFZPkJEw9+Lzxq Q8MrGytQ28kjqN8uXuQANSjZ9T0noxQlq42dcRpjpl8DWI83LKHhl7+tgLNR7RVpxotEtYN3y34s SjYSzHB78Dnox4Q/+S8y8/TiTJOfL5rTfl3NsjhRdV0J2DVUhY8EpgGzUA01FXgesJ4dkGe+nwZ8 AIwF+gH9zTgVJtlJwH+AXjRs0BqT7A3AM8A4VGP527zzO2B+gALloipyCrDELGBX4PfAn6jrdEeB C03OT6CE07qjMAcYYIZ5zayPvsD5JgcrClGddBKwEbgcGGTGmY7qFOXAdcBdwHKUEPuiEiWM8813 eSaP/o3wKDPTnQSsBToBFwGPATPwP61MA14EhqME7AygPZCOajOJ6kgjTe5PUKcoMDkWAQtQHc3v tm0LbjD5W+E2448H7kbVi/Xc0SpUGz0JdEa1sxWTgUB7TQpQHetGYDNK4L3ffDjN/K8FnjJ5HkXJ JKh6cAGvoxR3ghkmFeiOas+ZwMfAaPNZMnCrGVei2m4xSj58FUWKWeaHUAroDJRyOh+4DdU+AFeY eWrmv7vMerAiz+Q3DXiLur7ni3yzPHcA68xyNrhjxgcjUfI41Ey7A0rGRgE/XWo9DKUovDdxa8DV wGc0vNcywQz7quX5IJ+/rwFWojpvIEwC/o6qdH9wAEtRSic5QBhMzr6fi/dACcIEn2f9TM5PNZJO bzPMnyzPBzUM+hOuAay7/9pRn+9qk+NSGo48oDqy72jWy+Tx50Z4TLTk2wd4FLjFEmcC8BH+hQ2U UPhiEqoDp1qeX2W+ay4+R5WrsR2tS1EdYRX+72F5EqXUrNDMuH9FtWsg3AAEWvmwm++/8pP3w/DT RUM9qd820SYv69ep5/v8/Xsg0/K+B6o97w3AR0Mp7z6oevNV+m1QMuEPkShZ+SjAey/uALY2EeY6 4G9AoBPch3lHX69G8mpCw3x2DBpsLipDaVCrWe17wYv3XWOjkDdMoDMdrwOeBr4mcCV70/E1ZXNR U58kSxjf//2hJECYxi6uKfUTPhfwPdL+K5Qy+4C6EcsXhdQ3c5vDwzvae7ED2Av82ufZQFQnXwj4 vYQIsN6x+hnKIniaOoFtjxL25n63MdRMYxt1g48/bEV1+n8Db9BQkRaD6QCuj3GoDrUFuK+R9P21 jRcu1Ej7JvBHn+eDUNOBb8zfu6k/Ha+izjryhe9VDqUW3oI6q3NBAD4GsAFVB62oP03PR01D/KHW /NfUNQ+N1QUo67Qvqv0D3WCX6VUW3g7rO++1ocxO610OBkq4ff0Cbak/CnjT89fYXpQ2EaYLatT5 FjXqB7oFrIL6U5ihJhffLy2bw8f7zrdcvWl8Pd+rOH1hvdqwCNiH6hirUR3J11qrtaThj0cvS5wy lEL0woGyBrb5PGuLmoIsaYS/depXiarvA6iObkeNiC80koYVo1Aj3X5UpwxkXRahBHMZSkj/TX1/ mIv6ZfQiDVgEfIfqWIGuTygj8EAEyg+yFWVmj0TN769HmfSNoRL//jwvrMqiP5AITR7XZ6DkZA3w HnXTEvBfD140Vc7mhGkNDEZZhAH5eb8P8JLpiBLMwSihfxr/x9N7qJvzOlGa83HLe2j8k2PvO6vj BtSo6B31dqBGgckE1swDTC69UJp4IfWdOM3h4w1zKaqjulCj2LVNxOkAZKCEqBWqUfx9b3AQ1XFt Jr878O+n8eVh+PC4zhImGqVQO6DmuVUoH5AXsah5s1WZNYU9wArgAVQbP0HdnL4ptEN1QgPVft1R VuH0RuJkoxSGDvwLNZUK5KztDOxClWkTcB5qKmOdsoGqo6Y+eV+HUhLPoBTXlCbCY+bdWJ06qV9f 7VHO2OZcJFWCmr67gN8AN6N8Eo0pJw/++5A1TGN1YaAUWqNOcq+y8JqcbVEjVF+UxzbQRzY6yrH3 kvl7reV9cz59944i/pxylwD/Z/5djBK8PwOv0FDLCpOnl0sXlB/kCtQ8vrl8vHWxDHjZ/LupS4V1 lKNpns+zcY2E/x6lMKJQjiR/J1v74+HveHodNWr3QjnP1lFfsdfS0BOOmbf1JN9y6gvKRtQI1xrV OZuLSdQ5Nj0oM/5KVGdpzAw+hPKVRKF8EXcECHcNdQNGDcoK+hNKcVoHtea0uUQpqyWoqdqJ2AQX 4Sdvb2dsDg4D75u8+qJG+8sIrDCaU86mwgiacX+vNxGvUH2LMiGfQ5mGf/eTkY4atXw35uyh/vJW c26D8pKLtTxvjRpBfoty5N0ODDG5XeknHQf1teYPKCFtS50DLBg+vuVaSeMmYLwlPNR3tkLD+tuL qttClIKzdmh/PFZRvzPHoiyYZSil8y/Uio+vs1ii2mWIHz4dUfP93Sh/hBWlKAFvzHNuhQ0l3JNQ VtBk4AKU4vmtn/DWevke1TH2ohSOVXgdKIfjLWb6t6Is2k2AvysPomnepkPvlK65ZY2hocz6Io76 bboVZTE0NohY4UQp6y+B/2G5OsKCKJouZ1N1YUf5gBq9cc7bYAk+kUCtj28yE3jEEsfbiIGEHOoq 018n9TpM4yz/e3E9yqO8EKVhX0OZiWtR5r610LE0HCkFapRI8gnTFB/vvgnfchk0vp8igYb1YI3j L/5u4BOUoN5teReIR4LP7wTqO0qXoObaf6ZuJWanmccc6u87qERN7VaY+X9JQ/NTQw0KwRwIc5WZ 10LgXZQzdx5qZWACDevJX73sQ3WOH4H7Le8moqa63vT/Zea3BqWYrPt/YvG/+nQW9eXAa8k1p6zR qHpvTCbiLO+PoKbGETS+OqSj/Ce++Aa1yBDoekoNVa/+3vsuTASqiy6o8n+F6l+PE3gfle5VFl4T yXdD1U7UyJWK2kfghVdorR3vEp+/vZtqrJU6mLoNPnF+wjhQezv8HWHvoaHHX5icfblEmBy7owTJ l48/U+sy8/9A5WrsE2l/yqI7alrgxdkB4m4DvkA5Pq1p+uNxiSWM774NA9XpX0VZg5EoC2sbSmEs BMZQfzRPRpm2/ubfSai6TfDzzh8Eas+NvylLJcrTP9XyPFC97EbJne8VhDrKselvVceJGtis1ks7 /Hfqa6k/ZfHKfHPK6g0TSFkIlDxY5ewjVFvfjtpTYbfEuQ6lxKyWcyrKmgrkdPVepOSPj2+fDVQX V6IGiiOoaewm1EpTT0u4M4Ebbah5r7fhElBz4H0oM9gbeRJq88ox6kyVtqh9CwUm4SRUA6eaif+I 8jHsQs2JY1HaLgO1npyEMneTzeeVKD9DLso03m8WxLvLNNJ8NwYlUKVmoexmmEfMvBJQAnSbGb8r dfsGhqEcTllmvPaoTtaFOk18HmqTUxFK8fg7sSnBTLO1yfMFs8JrzbSeQTVkKsrJeCFK0Vnn7WuA ET6/O/vw6GvhEWHWYXdU3e8y4+5BtU0parqioUbll1DLzvtR+wB6ojp0FWqU2W3WpRUpJl/MPPuj 5CHQLsYzUKsJpah2PWCWGZTzNcbMc4CZ1hEzYlzaAAAAp0lEQVTUgFCNGjz20tBXsAHlXAUlJ2NR o3MvM32vQy/ZLEs5arqVidrYlmrGy0Mty+5DyUQb6kZODVXX3o6RQn3Zt6ITalrl3VYw0OTuXflo Z8bXTI4XmmmVmHz/gZqSnIOS1SLUqN4DtbLzrpn286gpWaX5fi7+d1x2NPl4816IcqKDko8cs7w9 UW1QibL2vKtUbalvTW013w1BWYlXmO9bodruvv8H8WZbOaRLnGgAAAAASUVORK5CYII= ------=_NextPart_000_3FEA_01D819E1.CD8410F0-- From nobody Fri Feb 4 13:19:41 2022 Return-Path: X-Original-To: mud@ietfa.amsl.com Delivered-To: mud@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B32433A23B1; Fri, 4 Feb 2022 13:19:22 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=messagingengine.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id H1VdQvqt3uOa; Fri, 4 Feb 2022 13:19:18 -0800 (PST) Received: from forward3-smtp.messagingengine.com (forward3-smtp.messagingengine.com [66.111.4.237]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 05A773A23AF; Fri, 4 Feb 2022 13:19:13 -0800 (PST) Received: from compute4.internal (compute4.nyi.internal [10.202.2.44]) by mailforward.nyi.internal (Postfix) with ESMTP id 680201940DC8; Fri, 4 Feb 2022 16:19:12 -0500 (EST) Received: from mailfrontend2 ([10.202.2.163]) by compute4.internal (MEProxy); Fri, 04 Feb 2022 16:19:12 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-transfer-encoding:content-type :date:date:from:from:in-reply-to:in-reply-to:message-id :mime-version:references:reply-to:reply-to:sender:subject :subject:to:to:x-me-proxy:x-me-proxy:x-me-sender:x-me-sender :x-sasl-enc; s=fm2; bh=wiwGoe79pqb0OKI2JDToy6PAOwNNwh0teSUsd1XXs I4=; b=JjdpTdSM2/JuJrp8p9iJ4Ps17YC19cPvlJlGrSTPnOWNzWqVFVSpLASgE FL6lJK323lM2evv2NzoyTVbV8UUBvoDGJrMt0LcRBLdMbsihaWW5TJ668kw8rIfj KHUpuGaPAwfpAVpQ5FwC+tnDTta+vM2IYgQDyk15Aip50tCmW+RYASAhCDffiUL7 XvisYvw25ARyHuUC5u16k8X7ek1adVVdo14SYLFM7dLVTJkYKPxTm5OgZ2kC9dRN qj4VQs1iZFDf72Iv8kEigDO9SQAHFnwzwhQEMGSq9nz1qmyXA3mzpos566HR7azq dfSL3xa74HYzqbYjMbPFuF2wZcCjA== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedvvddrgeelgddugeejucetufdoteggodetrfdotf fvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfqfgfvpdfurfetoffkrfgpnffqhgen uceurghilhhouhhtmecufedttdenucenucfjughrpehrhffvfhgjufffohfkgggtgffoth esthhqghdtvddtjeenucfhrhhomhepfdffihgtkhcuuehrohhokhhsfdcuoeguihgtkhes rhgvlhhirggslhgvvghnvghrghihrghnrghlhihtihgtshdrtghomheqnecuggftrfgrth htvghrnhepvdeuledvffdttdeutdffveejueektedtlefggfektefgudetjefggedvjeei gfeunecuffhomhgrihhnpehrvghlihgrsghlvggvnhgvrhhghigrnhgrlhihthhitghsrd gtohhmnecuvehluhhsthgvrhfuihiivgeptdenucfrrghrrghmpehmrghilhhfrhhomhep ughitghksehrvghlihgrsghlvggvnhgvrhhghigrnhgrlhihthhitghsrdgtohhm X-ME-Proxy: Received: by mail.messagingengine.com (Postfix) with ESMTPA; Fri, 4 Feb 2022 16:19:11 -0500 (EST) Reply-To: From: "Dick Brooks" To: "'Michael Richardson'" , , References: <282926.1643996393@dooku> <686901d819f9$8ffc5720$aff50560$@reliableenergyanalytics.com> <27407.1644006641@localhost> In-Reply-To: <27407.1644006641@localhost> Date: Fri, 4 Feb 2022 16:19:10 -0500 Organization: Reliable Energy Analytics LLC Message-ID: <401a01d81a0c$db2feaf0$918fc0d0$@reliableenergyanalytics.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Mailer: Microsoft Outlook 16.0 Thread-Index: AQKKKG9YQSV0Fk837yYvHefh3I71dwGBqSaeAWr2vPCrCGJ80A== Content-Language: en-us Archived-At: Subject: Re: [Mud] [OPSAWG] SBOMs and version non-specific MUD files X-BeenThere: mud@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Discussion of Manufacturer Ussage Descriptions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 04 Feb 2022 21:19:23 -0000 True, some IoT devices will "auto update" using MUD/SUIT capabilities = and a customer may never see, or have access to, the SBOM.=20 Thanks, Dick Brooks Never trust software, always verify and report! =E2=84=A2 http://www.reliableenergyanalytics.com Email: dick@reliableenergyanalytics.com Tel: +1 978-696-1788 -----Original Message----- From: Michael Richardson =20 Sent: Friday, February 4, 2022 3:31 PM To: dick@reliableenergyanalytics.com; mud@ietf.org; opsawg@ietf.org Subject: Re: [OPSAWG] SBOMs and version non-specific MUD files Dick Brooks wrote: > The predominant "SBOM delivery channel" I see is through access = controlled > customer portals where customers can download SBOM's Vulnerability > Disclosures and other artifacts needed to perform a NIST C-SCRM = risk > assessment for Executive Order 14028. For hospitals, sure. For baby monitors, maybe not. -- Michael Richardson . o O ( IPv6 I=C3=B8T = consulting ) Sandelman Software Works Inc, Ottawa and Worldwide From nobody Wed Feb 9 23:01:08 2022 Return-Path: X-Original-To: mud@ietfa.amsl.com Delivered-To: mud@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 96F383A09E5 for ; Fri, 4 Feb 2022 12:42:14 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.098 X-Spam-Level: X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=velentium.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yAtAOD4lfXj8 for ; Fri, 4 Feb 2022 12:42:09 -0800 (PST) Received: from mail-pj1-x1035.google.com (mail-pj1-x1035.google.com [IPv6:2607:f8b0:4864:20::1035]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 134243A228A for ; Fri, 4 Feb 2022 12:42:08 -0800 (PST) Received: by mail-pj1-x1035.google.com with SMTP id z14-20020a17090ab10e00b001b6175d4040so14204213pjq.0 for ; Fri, 04 Feb 2022 12:42:08 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=velentium.com; s=google; h=from:to:subject:date:message-id:in-reply-to:references:reply-to :user-agent:mime-version; bh=zwMU3bCeM/vpRJ9Rs65AmSIbo3AygqebQVytnZey6rM=; b=KIbSVw79Uey0sRj2rBIAILYkZkUUHc5M+GUDWCzZ3g1Rtx8be9vUcO6GbRCZV03aIV Bq1SfPsCrXRJpRD17/K+u8MmEncWIIWHiEhy51rv2LXFeYfkm7ESe8280SNZrlOwNdwe G3v9owHQVSeJAkBqVN8KLU42OOCK2ZOoZ9z1A= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:reply-to:user-agent:mime-version; bh=zwMU3bCeM/vpRJ9Rs65AmSIbo3AygqebQVytnZey6rM=; b=iiK3rnl933YwlPiLsymYPysUObIR7ITqNlHkrnDA7ns0Y58na7gWRTZ1206hdLsmT1 JlDTOG6CAqSNX7XoeOcfVj+kD8500zV380vxhVov2xTT61LchIQBeUr9NaUttg00yJOu ewzyofUno2MhAChSaNWYCE1S0YTdHmgKCCq2REyUx5N5f4WumhGYvoHcYvbarLiu23vl TeQqFzjIGxdFyi+FET75AinL04xqSj2KYnmvTTKhxSop/eqgq9EbNNswnfMP2AxhejUJ NsksLLjBDMpHg27W1iq9coiWJvySmlmTAs3YXZf5z7q1fVLWRtq8lU+XTz3WD0DLoq5L tNjw== X-Gm-Message-State: AOAM532ywedvV2NjI3JDt/c0e/VGAxQHn48qmGIW9/ZtRszlpj+NWj8d yLAlO9krrcqGIIKOJ9BnR2BvxN1ic5U1YRSagZ2ygo5+2FW51LWqMQkIKtBFKj4mwhgAIMIrEG1 2xniP X-Google-Smtp-Source: ABdhPJxcwJpb6Ju1dQ93O/h9U0sT5P77UTfcFLBTIXf4jDWHrBfzmlgGZ1pO0H/z4hCwzYZJh/rjgA== X-Received: by 2002:a17:902:d50d:: with SMTP id b13mr4991480plg.141.1644007326891; Fri, 04 Feb 2022 12:42:06 -0800 (PST) Received: from ?IPv6:2600:8801:1298:5200:8414:c5d5:a88e:dea5? ([2600:8801:1298:5200:8414:c5d5:a88e:dea5]) by smtp.gmail.com with ESMTPSA id bt6sm13364834pjb.3.2022.02.04.12.42.06 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Fri, 04 Feb 2022 12:42:06 -0800 (PST) From: "Christopher Gates" To: "Michael Richardson" , dick@reliableenergyanalytics.com, mud@ietf.org, opsawg@ietf.org Date: Fri, 04 Feb 2022 20:40:15 +0000 Message-Id: In-Reply-To: <27407.1644006641@localhost> References: <282926.1643996393@dooku> <686901d819f9$8ffc5720$aff50560$@reliableenergyanalytics.com> <27407.1644006641@localhost> Reply-To: "Christopher Gates" User-Agent: eM_Client/8.2.1659.0 Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="------=_MB555ECB3C-B6DE-4590-937C-40BA2E1D09C5" Archived-At: X-Mailman-Approved-At: Wed, 09 Feb 2022 23:01:05 -0800 Subject: Re: [Mud] [OPSAWG] SBOMs and version non-specific MUD files X-BeenThere: mud@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Discussion of Manufacturer Ussage Descriptions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 04 Feb 2022 20:42:15 -0000 --------=_MB555ECB3C-B6DE-4590-937C-40BA2E1D09C5 Content-Type: text/plain; charset="UTF-8"; format=flowed Content-Transfer-Encoding: quoted-printable There are already public databases with both secured and public SBOMs https://sbom.rkvst.io/publicsboms Christopher Gates -------------------------------- Director of Product Security www.velentium.com (805)750-0171 Las Vegas, NV (GMT-8) Our new book is now shipping: Medical Device Cybersecurity for Engineers and Manufacturers U.S.=20 =20 | Worldwide=20 Amazon=20 =20 & Digital=20 Security Book Of The Year!=20 =E2=80=9CIf everyone is thinking alike, then somebody isn't thinking.=E2=80= =9D -George=20 S. Patton "Facts are stubborn things." -John Adams, 1770 ------ Original Message ------ From: "Michael Richardson" To: dick@reliableenergyanalytics.com; mud@ietf.org; opsawg@ietf.org Sent: 2/4/2022 12:30:41 PM Subject: Re: [OPSAWG] SBOMs and version non-specific MUD files > >Dick Brooks wrote: > > The predominant "SBOM delivery channel" I see is through access con= trolled > > customer portals where customers can download SBOM's Vulnerability > > Disclosures and other artifacts needed to perform a NIST C-SCRM ris= k > > assessment for Executive Order 14028. > >For hospitals, sure. >For baby monitors, maybe not. > > >-- >Michael Richardson . o O ( IPv6 I=C3=B8T consult= ing ) > Sandelman Software Works Inc, Ottawa and Worldwide > > > > --=20 Disclaimer: The information and attachments transmitted by this e-mail are= =20 proprietary to Velentium, LLC and the information and attachments may be=20 confidential and legally protected under applicable law and are intended=20 for use only by the individual or entity to whom it was addressed. If you= =20 are not the intended recipient, you are hereby notified that any use,=20 forwarding, dissemination, or reproduction of this message and attachments= =20 is strictly prohibited and may be unlawful. If you are not the intended=20 recipient, please contact the sender by return e-mail and=C2=A0delete this= =20 message from your system immediately hereafter. --------=_MB555ECB3C-B6DE-4590-937C-40BA2E1D09C5 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
There are already public databases with both secured and public = SBOMs

Christopher Gates=

= --------------------------------

Director of Pro= duct Security

www.velentium.com

(805)750-0171

Las Vegas, NV

(GMT-8)

=C2=A0

Our new book is now shipping:

Medical Device Cybersecurity for Engineers and Manufacturers

U.S.=C2=A0| Worldwide

Amazon= =C2=A0& Digital

Security Book Of The Year!

=E2=80=9CIf everyone is thinking alike, then so= mebody isn't thinking.=E2=80=9D -George S. Patton

"Facts are st= ubborn things."=C2=A0 -John Adams, 1770

=

------ Original Message ------
From: "Michael Richardson" <mcr+ietf@sandelman.ca>
To: dick@reliablee= nergyanalytics.com; mud@ietf.org; <= a href=3D"mailto:opsawg@ietf.org">opsawg@ietf.org
Sent: 2/4/2022 12:30:41 PM
Subject: Re: [OPSAWG] SBOMs and version non-specific MUD files

=C2=A0
Dick Brooks <dick@reliableenergyanalytics.com> wrote:
> The predominant "SBOM delivery channel" = I see is through access controlled
> customer portals where customers can dow= nload SBOM's Vulnerability
> Disclosures and other artifacts needed t= o perform a NIST C-SCRM risk
> assessment for Executive Order 14028.
=C2=A0
For hospitals, sure.
For baby monitors, maybe not.
=C2=A0
=C2=A0
--
Michael Richardson <mcr+IETF@sandelman.ca> . o O ( IPv6 I=C3=B8T consul= ting )
Sandelman Software Works Inc, Ottawa a= nd Worldwide
=C2=A0
=C2=A0
=C2=A0
=C2=A0

Disclaimer: The information and attachments transmitte= d by this e-mail are proprietary to Velentium, LLC and the information and = attachments may be confidential and legally protected under applicable law = and are intended for use only by the individual or entity to whom it was ad= dressed. If you are not the intended recipient, you are hereby notified tha= t any use, forwarding, dissemination, or reproduction of this message and a= ttachments is strictly prohibited and may be unlawful. If you are not the i= ntended recipient, please contact the sender by return e-mail and=C2=A0delete this message from your system immediately he= reafter. --------=_MB555ECB3C-B6DE-4590-937C-40BA2E1D09C5-- From nobody Wed Feb 9 23:01:19 2022 Return-Path: X-Original-To: mud@ietfa.amsl.com Delivered-To: mud@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EEB353A22A4; Fri, 4 Feb 2022 12:45:22 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.1 X-Spam-Level: X-Spam-Status: No, score=-0.1 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, GB_MUTUALBENEFIT=2, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fortressinfosec.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FS9-odzQOcO3; Fri, 4 Feb 2022 12:45:18 -0800 (PST) Received: from NAM10-BN7-obe.outbound.protection.outlook.com (mail-bn7nam10on2119.outbound.protection.outlook.com [40.107.92.119]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1A6923A22A2; Fri, 4 Feb 2022 12:45:18 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Jr6kWxg48S3CCCTmXUJZHcNwDAtjTmarXLfQqVQVYtGJICm0TvaLWfdLL6at0c9U5KJCNXCloAKpsLkSHUyDiHIaS49OV4lR58zvca/46wJ5iC/YGSRjPKzjvrWrHpxi2wzBGxVUL/CZ7AsdfSbfZ0P0kR9bHmyGDhZtDU9SZqQoblOKdkrV86viucuGAQSqoCrp1XIoTDXi6yNPmG9lST5vMyws2Ti7aK+U7sXi/JNkVn8LTYs203oYVLR48PI+CBx+TOLJav5W1OvPDLSAXZknSzv8z47AZHo2AnY5QDIp9tqZTpR69bZtqdCKUzs9dbAdTb0zZBNrtBss5CXn0A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=H8sq7Y9P59qgnnQ9Ct2rxAaesXpBQQsQb0qyKwLxAzQ=; b=CtuAt5dSzRZ+1HvvupqjbcB1Y0y6zfk9uOsvw4CY3R9DCockeLtBbX+VKYzC89dv3ab1TsRMSwNoU7hu3Z1bJPRvSFn0K09gsDWif0/AgCINB1hf8objUc99QIsgr8RzG+MjgZmbn3QR6x6SxUKZ/NFHCTIXlWY7ibP/3WWvtCc11bhjDHMH7yLaLE8O/pY4/Skr8uczWV/aDwfpCjMM2WpWRdcATmCHwXLhjeM6JhK29FkbY9ZyJuZqeWOK100qjGFDox3RagSzfFtiEcfnWU4R0VKsM9dqzMifAvWv28AKw77u0S1VIU5mbPBQ1RvAafeOdW0gg//EusIu7EnUiw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none; dkim=none; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fortressinfosec.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=H8sq7Y9P59qgnnQ9Ct2rxAaesXpBQQsQb0qyKwLxAzQ=; b=0hP+us3Rjvwi9DdwAx4cnynD/I8AWPXF9Wc+1ATJcGWwq5Simq5rVEURmGkh+717EhRoGGiZOUvg6mhvG0mLU5T4Q1tckOFwzTCeF7yivl2Zg1o0JY1LWNkT0vE+xww2obxk/Il8W/pXaA2Zx22ccmi8Wcr2PBsdQfEXFEV9dzV+Fgb71VSEFhBZVMEicCkmiRMhRmZkq5CLYX5mPWtlDvykTnxSAU5Jye53LfFc4v+gPFoXrKJsX8V66wyPnAuoqJ6PmFOsNmDOmXdnnPL6/8tZaaunq6O/fnKICQ7hL2fPpEznjRBajnOT9oFRtXBxhBBlIU89AC1deXYtg1+rmw== Received: from BN6PR18MB1041.namprd18.prod.outlook.com (2603:10b6:404:72::19) by BN9PR18MB4329.namprd18.prod.outlook.com (2603:10b6:408:11e::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4951.16; Fri, 4 Feb 2022 20:45:11 +0000 Received: from BN6PR18MB1041.namprd18.prod.outlook.com ([fe80::991f:c73e:df80:6014]) by BN6PR18MB1041.namprd18.prod.outlook.com ([fe80::991f:c73e:df80:6014%5]) with mapi id 15.20.4951.017; Fri, 4 Feb 2022 20:45:11 +0000 From: Tony Turner To: "dick@reliableenergyanalytics.com" , 'Michael Richardson' , "mud@ietf.org" CC: "opsawg@ietf.org" Thread-Topic: [EXTERNAL SOURCE] Re: [OPSAWG] SBOMs and version non-specific MUD files Thread-Index: AQHYGfmdkzXL/8hNIkWYFWLf84pcb6yD2klF Date: Fri, 4 Feb 2022 20:45:11 +0000 Message-ID: References: <282926.1643996393@dooku> <686901d819f9$8ffc5720$aff50560$@reliableenergyanalytics.com> In-Reply-To: <686901d819f9$8ffc5720$aff50560$@reliableenergyanalytics.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_62273edc-05ed-4f85-afbd-57c7e7a77f62_Enabled=True; MSIP_Label_62273edc-05ed-4f85-afbd-57c7e7a77f62_SiteId=595d5655-8e57-4275-9fba-16457e068878; MSIP_Label_62273edc-05ed-4f85-afbd-57c7e7a77f62_SetDate=2022-02-04T20:38:08.1584456Z; MSIP_Label_62273edc-05ed-4f85-afbd-57c7e7a77f62_ContentBits=0; MSIP_Label_62273edc-05ed-4f85-afbd-57c7e7a77f62_Method=Standard authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=fortressinfosec.com; x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 5e0a497b-8d85-4f4e-3f64-08d9e81f3d0a x-ms-traffictypediagnostic: BN9PR18MB4329:EE_ x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8882; x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: fciMo6USzBIwzCNLDrQJ0azDsu6BLPfU8wIuQokKbJ3GSssdXJhabGC6GCuavXDzuznGH1TI6zqjrd8eEwz4a7MuzJKY82YUsgkk/7QIl8NbPs5Y8C+lJgg6gKOOlQvUgi5BZeWEU7LKrQLUD1nXJTIlhpRQYx3Wo5e8rMwLAPmwHjw/QaiK6hFwk+5vDXy/WqvfSiVAzcuHmSItSUb6S4zY5yviw3mLWUoWsjUxOLe8cBkvolHwuB1vULTeEpzLZeGcGtkKkK6/BH63ITTjuoxqzc6j+qs14K91Bc01eoZiYATqRy6nm+qbPhEg7It/T1QFc8/TdhjEGWyJeUtoeQtClI+omUn/qHUIyczYTSpHw4/01ZKXDsKW9PhW1XD77JbCFmRZKP4yvmoTk6Qx93gD9zm43x2cZqFN7zW0pPZOxfckCtHnx/59LBGPRUrv3aTrFROcNy9iNJyUY0GLcbDmuKs6GuLXyu+KbGHdAHQUxcnHxyJ3UfJOPfqCAO24vDl5YgWNwhpT/GCD+04Q8PfU+nQKmYUo9sdAzCcDYOvZJ9vP4+rE/Rzwvb51bGTjvocNqtJLCvdh0n+sTDexihXMd2YIGbNkVmv8urTt0dqECpPk7zpSj8/bVduFgBJT+ByE3aaJwKaxGpAIN2v0/zYX8Zpoy46+MBZs17ffW80TV3wM2QA2mU4yF+N31A/5vZtwIkWE+KlcGV459i+yqzLkbufZEJcvAlD/XtycfpD9GmkQYELfg1TmcAOinun9XAqZ/nTDfjV/X9NBjlLyLG3C7E2+3dinWlIjT2XLRvo= x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:BN6PR18MB1041.namprd18.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230001)(4636009)(136003)(376002)(396003)(39840400004)(366004)(346002)(122000001)(9686003)(7696005)(6506007)(53546011)(38070700005)(2906002)(52536014)(33656002)(40140700001)(83380400001)(55016003)(86362001)(71200400001)(966005)(66946007)(66556008)(8936002)(316002)(66476007)(66446008)(64756008)(5660300002)(110136005)(76116006)(508600001)(8676002)(38100700002)(4326008)(166002)(186003)(26005); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?Windows-1252?Q?E0O5bleP9BlpH8U7LybmnY6hSKTAc4jR1FT1PUM6ujvjiKwhy3Dtur4Z?= =?Windows-1252?Q?YlGkl+9gNQVFy+I+avGuXZUujn2Wu4rrvQ2ibqMh5DkutcDMqTJ0iKfb?= =?Windows-1252?Q?l4VUH1eoW84NvTF/jWa/zpyzo+DvY6ewLNm9akBws34mUzTxb7Y8CMS4?= =?Windows-1252?Q?RGc5G+Peav7X1NC79/c3hyVY8Ji7AKma4CSEzRtFQYNdzI/oeLyOvR/J?= =?Windows-1252?Q?5FtkrZlqU+LmAv+tGk+vAODT8MYlnIqtRGcK1zPg1ThdappfFWW59+Nl?= =?Windows-1252?Q?E1fuqvF7QEE4EAzGl6l8QQNx60W9LXCpgznfvyrmxQ7V/92vnxyryq1h?= =?Windows-1252?Q?Ga3oisByReVNRc6EsQuQymX4rJkQRvx/LOXL4x/EFA16vXkv5l9lwuk9?= =?Windows-1252?Q?O4Jea1XwetN2pksYQ0ex3c9RuQsoV16bm2o5SXnUpH1IMlK4FthtrXxg?= =?Windows-1252?Q?Lq1o9GGcP7su9ySmbNXvbGTVPhLMhYpvFv75i39ZO6bscp6cWYO+SUPe?= =?Windows-1252?Q?f536fTHIEZ3VGE2sCynFYwVQ1U8EgBWsEC6naigMW4bZivhb7DEY1PKz?= =?Windows-1252?Q?iv5/uZ12+1TlyekyRgX9yBOLxLZpLJv4Nt8ploLszOo1q6jnWEdBKLHl?= =?Windows-1252?Q?4XdL1pHIbb9LYlUfLwBYsT4A7NE6kABhnH7Fk3AqlsHnJffTdgLkDb34?= =?Windows-1252?Q?qkff0ZjayMTw3+SrAHSjN8H2T/ZeDLrtXrX8G2q6FgvG7MPjKHFoRiQH?= =?Windows-1252?Q?VuN0aK/bGVbvOWyhWVSHUnRYqULUbJMbJMh/c1Ls2eQCOy6TvhMMwe3g?= =?Windows-1252?Q?t2P9HUUJ0kPbhOnayihHi0VfqOUOYsdJgQi88H3VxjFudyBJ1t3kjLSy?= =?Windows-1252?Q?FQUoI097BZMduFfubehZc3FlwIslLduIQWD5zu9+guoN4JCJUheqaQ6d?= =?Windows-1252?Q?/tXZn64CGwFy6GWZGdonXnwwxmKYiegZsGuWEdBrmCYZqkt2A4gBpand?= =?Windows-1252?Q?DtsjO2WGpFQtlvT3h0AuauBs5T4yI0X/tk43DhInSk+rt2kB3nj4B2q3?= =?Windows-1252?Q?Gt0nAYsbbRkxhWdroa2dhjZEdfv6hSG0VhoYZINri/uuwzRc2ZGsQPmS?= =?Windows-1252?Q?BMa/N7eCmJHaRyvFenpuMsC2KRUPFd5w0E6lkL3J0x/L24mDwkBgyE5w?= =?Windows-1252?Q?3NbSa9FSK2jDkjX/dbe4vKOlo0CXEYcJs4DUaonA5k0zM99wIFVrpn4M?= =?Windows-1252?Q?tjJea0zkr5tc988m0AAAzagkyqolaCnkQgGpHgj/bbX31Jwhrn8ymMwT?= =?Windows-1252?Q?egdp0bgHWLArkmcoCbw5INAoIjbLV00gZxzcRNxOHwFUEo3YkP3+CSdz?= =?Windows-1252?Q?rejUIMIf+mn0Wha33Dy6eHckPUaJ7NJ3caZ3uuUAZ2qQpbVH+Pm9+lUD?= =?Windows-1252?Q?URwvO1S2aKw7p+npmuDv73x3T+qtSlYk/ix5/YnPgF5V/LULoRC+n5cb?= =?Windows-1252?Q?f3aUKOyGgOqLWK4URAFwlFIGhhNO9+4QIfWA1omXEFTaWOk3IfiEJVdv?= =?Windows-1252?Q?Eix/GGkkIITAtUD1C27qJTvB1W7stUqg4i94b31FJljAe6k/p4nL5/xr?= =?Windows-1252?Q?yTnsmPECIaocdiRVy+GHMfFGHBg89Gntwp/JzZBRQ9dtwLDT6UdYWfPm?= =?Windows-1252?Q?RWlM+YlMyfYqYaIMUjQJ7dwQaocJ+1pLL8lDH/Jmn+Sm8lOWhBUBM6CH?= =?Windows-1252?Q?TcU7Mr1f23cZS18BGvjvAA/6krurWbMut2LXhpUDBwCiBnoi0O7T51Le?= =?Windows-1252?Q?SJ01t47bMhHAlnKiBz8QQ8lQ17M=3D?= Content-Type: multipart/alternative; boundary="_000_BN6PR18MB1041950CB205841DB571D982A8299BN6PR18MB1041namp_" MIME-Version: 1.0 X-OriginatorOrg: fortressinfosec.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: BN6PR18MB1041.namprd18.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 5e0a497b-8d85-4f4e-3f64-08d9e81f3d0a X-MS-Exchange-CrossTenant-originalarrivaltime: 04 Feb 2022 20:45:11.4410 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 595d5655-8e57-4275-9fba-16457e068878 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: wqmgXFkGp4R9wLU7FuqhOBVuwMcs5WPqE9NBYy7Oe+Edlzz0FansDkv5gSrMPz/2tJTTYWGcGueDr9FZebg4ofkHY3F1RLnFgvyAWjt2HH0= X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN9PR18MB4329 Archived-At: X-Mailman-Approved-At: Wed, 09 Feb 2022 23:01:05 -0800 Subject: Re: [Mud] [EXTERNAL SOURCE] Re: [OPSAWG] SBOMs and version non-specific MUD files X-BeenThere: mud@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Discussion of Manufacturer Ussage Descriptions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 04 Feb 2022 20:45:23 -0000 --_000_BN6PR18MB1041950CB205841DB571D982A8299BN6PR18MB1041namp_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable I also wouldn=92t ignore the model where SBOMs will be delivered through 3r= d party supply chain attestation data libraries that are already aggregatin= g this data as part of C-SCRM assessment activities for mutual benefit. Certainly MUD makes a lot of sense in very device-centric scenarios and I= =92m really excited to plug into this model (as I run one of the above ment= ioned data libraries, not just SBOM, but HBOM/MBOM, SOC2, build artifacts,= other 3rd party product and vendor assessments and product certifications,= etc) =96 but I find that discovery of MUD sources is half of the challenge= . What I find really interesting is the potential for dynamic updating of S= BOM as firmware is updated and communication of software risks this will ma= ke possible to device management infrastructure. Its far more likely 3rd pa= rty tools like data aggregators for supply chain or vulnerability risk mana= gement will interoperate with the management portal for a fleet of devices = than with the individual devices themselves. -- Tony Turner Vice President, Fortress Labs (R&D) Fortress Information Security Cell 321-634-4886 Main 855.FORTRESS 189 S. Orange Ave., Suite 1950, Orlando, FL 32801 fortressinfosec.com From: OPSAWG on behalf of Dick Brooks Date: Friday, February 4, 2022 at 2:01 PM To: 'Michael Richardson' , mud@ietf.org Cc: opsawg@ietf.org Subject: [EXTERNAL SOURCE] Re: [OPSAWG] SBOMs and version non-specific MUD = files Michael, The predominant "SBOM delivery channel" I see is through access controlled customer portals where customers can download SBOM's Vulnerability Disclosures and other artifacts needed to perform a NIST C-SCRM risk assessment for Executive Order 14028. Here's a use case to consider, listing all of the evidence data needed: https://github.com/rjb4standards/REA-Products/blob/master/UseCaseVDR117/REA= D ME.md Thanks, Dick Brooks Never trust software, always verify and report! T http://www.reliableenergyanalytics.com Email: dick@reliableenergyanalytics.com Tel: +1 978-696-1788 -----Original Message----- From: OPSAWG On Behalf Of Michael Richardson Sent: Friday, February 4, 2022 12:40 PM To: mud@ietf.org Cc: opsawg@ietf.org Subject: [OPSAWG] SBOMs and version non-specific MUD files ietf-opsawg-sbom-access provides for linking to an SBOM from a MUD file. My understanding is that for the sbom-retrival-method=3D=3Dcloud, that a li= st of sboms is included, one per version of the device firmware. I just wanted to re-iterate that this really is a good thing, because it allows for a version agnostic MUD file to list many things. I would like a cloud example to be added. I think that we need some RFC6125 text for the https: local-well-known text to explain how validation is (not) done. We still need some way to determine what version of firmware a device is running, and while the correct answer is remote attestation, it would be lovely if there was a recommendation for a lighter weight process. LLDP regularly reveals this, but that's unlikely to work over wifi or in residential situations. (I acknowledge that this is out of scope for sbom-access) -- Michael Richardson , Sandelman Software Works -=3D IPv6 IoT consulting =3D- _______________________________________________ OPSAWG mailing list OPSAWG@ietf.org https://www.ietf.org/mailman/listinfo/opsawg IMPORTANT: The information transmitted is intended only for the person or e= ntity to which it is addressed. The content may contain business confidenti= al and/or proprietary information, and it may be reviewed and logged for ar= chival purposes by parties at Fortress Information Security other than thos= e named in the message header. Any views or opinions presented in this emai= l are solely those of the author and do not necessarily represent those of = the company. Any review, retransmission, dissemination or other use of, or = taking of any action in reliance upon this information by persons or entiti= es other than the intended recipient is prohibited. If you received this in= error, please contact the sender and delete the material from any computer= . --_000_BN6PR18MB1041950CB205841DB571D982A8299BN6PR18MB1041namp_ Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable

I also wouldn=92t ignore the model where SBOMs will = be delivered through 3rd party supply chain attestation data lib= raries that are already aggregating this data as part of C-SCRM assessment = activities for mutual benefit.

 

Certainly MUD makes a lot of sense in very device-ce= ntric scenarios and I=92m really excited to plug into this model (as I run = one of the above mentioned data libraries, not just SBOM, but HBOM/MBOM, &n= bsp;SOC2, build artifacts, other 3rd party product and vendor assessments and product certifications, etc) =96 = but I find that discovery of MUD sources is half of the challenge. What I f= ind really interesting is the potential for dynamic updating of SBOM as fir= mware is updated and communication of software risks this will make possible to device management infrastruct= ure. Its far more likely 3rd party tools like data aggregators f= or supply chain or vulnerability risk management will interoperate with the= management portal for a fleet of devices than with the individual devices themselves.

 


-= - 

Tony Turner

Vice P= resident, Fortress Labs (R&D)

Fortress Information Security

Cell &nbs= p;321-634-4886 Main 855.FORTRESS

189 S. Orange Ave., Suite 1950, Orlando, FL 32801

fortressinfosec.com

 

 

From: OPSAWG <opsawg-b= ounces@ietf.org> on behalf of Dick Brooks <dick@reliableenergyanalyti= cs.com>
Date: Friday, February 4, 2022 at 2:01 PM
To: 'Michael Richardson' <mcr+ietf@sandelman.ca>, mud@ietf.org= <mud@ietf.org>
Cc: opsawg@ietf.org <opsawg@ietf.org>
Subject: [EXTERNAL SOURCE] Re: [OPSAWG] SBOMs and version non-specif= ic MUD files

Michael,

The predominant "SBOM delivery channel" I see is through access c= ontrolled
customer portals where customers can download SBOM's Vulnerability
Disclosures and other artifacts needed to perform a NIST C-SCRM risk
assessment for Executive Order 14028.
Here's a use case to consider, listing all of the evidence data needed:
https://github.com/rjb4standards/REA-Products/blob/master/Use= CaseVDR117/READ
ME.md


Thanks,

Dick Brooks

Never trust software, always verify and report! T
http://www.reliableenerg= yanalytics.com
Email: dick@reliableenergyanalytics.com
Tel: +1 978-696-1788

-----Original Message-----
From: OPSAWG <opsawg-bounces@ietf.org> On Behalf Of Michael Richardso= n
Sent: Friday, February 4, 2022 12:40 PM
To: mud@ietf.org
Cc: opsawg@ietf.org
Subject: [OPSAWG] SBOMs and version non-specific MUD files


ietf-opsawg-sbom-access provides for linking to an SBOM from a MUD file.
My understanding is that for the sbom-retrival-method=3D=3Dcloud, that a li= st of
sboms is included, one per version of the device firmware.

I just wanted to re-iterate that this really is a good thing, because it allows for a version agnostic MUD file to list many things.

I would like a cloud example to be added.

I think that we need some RFC6125 text for the https: local-well-known text=
to explain how validation is (not) done.

We still need some way to determine what version of firmware a device is running, and while the correct answer is remote attestation, it would be lovely if there was a recommendation for a lighter weight process.
LLDP regularly reveals this, but that's unlikely to work over wifi or in residential situations.
(I acknowledge that this is out of scope for sbom-access)


--
Michael Richardson <mcr+IETF@sandelman.ca>, Sandelman Software Works&= nbsp; -=3D
IPv6 IoT consulting =3D-

_______________________________________________
OPSAWG mailing list
OPSAWG@ietf.org
https://www.ietf.o= rg/mailman/listinfo/opsawg

IMPORTANT: The information transmitted i= s intended only for the person or entity to which it is addressed. The cont= ent may contain business confidential and/or proprietary information, and i= t may be reviewed and logged for archival purposes by parties at Fortress Information Security other than those name= d in the message header. Any views or opinions presented in this email are = solely those of the author and do not necessarily represent those of the co= mpany. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon th= is information by persons or entities other than the intended recipient is = prohibited. If you received this in error, please contact the sender and de= lete the material from any computer. --_000_BN6PR18MB1041950CB205841DB571D982A8299BN6PR18MB1041namp_--