Subject: [Suit] ENISA study "Baseline Security Recommendations for IoT in the context of CII" is out

From: Apostolos Malatras <[email-masked]>
Date: Tue, 21 Nov 2017 10:54:08 +0000

Dear all,

We are very happy to announce that the ENISA Study "Baseline Security Recommendations for IoT in the context of CII" study is out:
https://www.enisa.europa.eu/news/enisa-news/defining-and-securing-the-internet-of-things        

Please feel free to share the study with your networks.

Sincerely,
-Apostolos

------------------------------------------------------------------------------------------------------
Dr Apostolos Malatras

Network and Information Security Expert
European Union Agency for Network & Information Security
Address:              1 Vass Sofias Str, Marousi 151 24, Attica, Greece
E- mail:                 [email-masked]
Office:                   +30 2814 409 630
Mobile:                 +30 6985 051 401

---

From: Hannes Tschofenig <[email-masked]>
Date: Tue, 21 Nov 2017 10:57:25 +0000

Thanks for sharing, Apostolos.

The recommendations also include firmware updates:

Secure Software / Firmware updates
- GP-TM-18: Ensure that the device software/firmware, its configuration and its applications have the
ability to update Over-The-Air (OTA), that the update server is secure, that the update file is transmitted
via a secure connection, that it does not contain sensitive data (e.g. hardcoded credentials), that it is
signed by an authorised trust entity and encrypted using accepted encryption methods, and that the
update package has its digital signature, signing certificate and signing certificate chain, verified by the
device before the update process begins.
-  GP-TM-19: Offer an automatic firmware update mechanism.
-  GP-TM-20: Backward compatibility of firmware updates. Automatic firmware updates should not modify
user-configured preferences, security, and/or privacy settings without user notification.

Ciao
Hannes

-----Original Message-----
From: Suit [mailto:[email-masked]] On Behalf Of Apostolos Malatras
Sent: 21 November 2017 11:54
To: [email-masked]
Subject: [Suit] ENISA study "Baseline Security Recommendations for IoT in the context of CII" is out

Dear all,

Sincerely,
-Apostolos

_______________________________________________
Suit mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/suit
IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.