Subject: [saag] Side meeting on USG efforts to combat botnets, Wednesday at 3:15

From: "Polk, Tim (Fed)" <[email-masked]>
Date: Tue, 18 Jul 2017 09:51:34 +0000

Folks,

I have reserved the side meeting room (Tyrolka, Mezzanine Level) on Wednesday from 3:15 – 4:30 for an informal discussion of an ongoing US Government effort to combat botnets and other “automated, distributed threats” to the Internet.  This effort will produce a document that identifies and promotes “action by appropriate stakeholders” by May of 2018.  Given that the USG does not own or operate the Internet, such an effort is always at risk of creating shelfware, and I am too old to waste my time that way.  To ensure that actions identified in the report are pragmatic and effective, I would like to encourage participation by members of this community.

If you have an interest, please join me in Tyrolka tomorrow afternoon or catch me in the hallway between meetings.

For those with an interest, here is some additional background information, including an immediate opportunity to participate:

Executive Order 13800, Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure, which was issued May 11, 2017, requires the Secretaries of Commerce and Homeland Security to “jointly lead an open and transparent process to identify and promote action by appropriate stakeholders to improve the resilience of the internet and communications ecosystem and to encourage collaboration with the goal of dramatically reducing threats perpetrated by automated and distributed attacks (e.g., botnets).”

The executive order requires Commerce and DHS to issue a draft report in 240 days (January 5, 2018) and submit a final report to the President one year after issuance (May 11, 2018).  Given this aggressive timeline, there are several different (but hopefully complementary) workstreams underway at Commerce and DHS that may be of interest.  In particular:

(1) The National Telecommunications and Information Administration (NTIA) published a “Request for Comments on Promoting Stakeholder Action Against Botnets and Other Automated Threats” on June 8.  In the request, “NTIA seeks broad input from all interested stakeholders—including private industry, academia, civil society, and other security experts—on ways to improve industry’s ability to reduce threats perpetuated by automated distributed attacks, such as botnets, and what role, if any, the U.S. Government should play in this area.”  NTIA would definitely appreciate comments from members of this community!

Additional details may be in the full text of the request for comments, found in

https://www.gpo.gov/fdsys/pkg/FR-2017-06-13/pdf/2017-12192.pdf

Note that the official comment period was extended to July 28 in

https://www.gpo.gov/fdsys/pkg/FR-2017-06-22/pdf/2017-13034.pdf

(2) Last week, NIST hosted a public workshop on “Enhancing Resilience of the Internet and Communications Ecosystem”.  150 participants from a range of industry sectors, civil society, and government participated in a day and half workshop.   The workshop explored a range of current and emerging solutions to enhance the resiliency of the Internet against automated, distributed threats. The workshop agenda is available at

https://www.nist.gov/sites/default/files/documents/2017/07/10/final-draft-agenda-resilience-workshop-070517.pdf

NIST plans to summarize results in a workshop report for publication in September 2017.

 Regards,

Tim Polk

---

From: Joseph Lorenzo Hall <[email-masked]>
Date: Wed, 19 Jul 2017 16:04:52 +0200

Richard Barnes pointed to this I-D that looks pretty damn good here in
terms of a floor for IoT technical requirements:

https://tools.ietf.org/html/draft-moore-iot-security-bcp-01

On Tue, Jul 18, 2017 at 11:51 AM, Polk, Tim (Fed) <[email-masked]>
wrote:

> Folks,
>
>
>
> I have reserved the side meeting room (Tyrolka, Mezzanine Level) on
> Wednesday from 3:15 – 4:30 for an informal discussion of an ongoing US
> Government effort to combat botnets and other “automated, distributed
> threats” to the Internet.  This effort will produce a document that
> identifies and promotes “action by appropriate stakeholders” by May of 2018.
> Given that the USG does not own or operate the Internet, such an effort is
> always at risk of creating shelfware, and I am too old to waste my time
> that way.  To ensure that actions identified in the report are pragmatic
> and effective, I would like to encourage participation by members of this
> community.
>
>
>
> If you have an interest, please join me in Tyrolka tomorrow afternoon or
> catch me in the hallway between meetings.
>
>
>
> For those with an interest, here is some additional background
> information, including an immediate opportunity to participate:
>
>
>
> Executive Order 13800, Strengthening the Cybersecurity of Federal Networks
> and Critical Infrastructure, which was issued May 11, 2017, requires the
> Secretaries of Commerce and Homeland Security to “jointly lead an open and
> transparent process to identify and promote action by appropriate
> stakeholders to improve the resilience of the internet and communications
> ecosystem and to encourage collaboration with the goal of dramatically
> reducing threats perpetrated by automated and distributed attacks (e.g.,
> botnets).”
>
>
>
> The executive order requires Commerce and DHS to issue a draft report in
> 240 days (January 5, 2018) and submit a final report to the President one
> year after issuance (May 11, 2018).  Given this aggressive timeline,
> there are several different (but hopefully complementary) workstreams
> underway at Commerce and DHS that may be of interest.  In particular:
>
>
>
> (1) The National Telecommunications and Information Administration (NTIA)
> published a “Request for Comments on Promoting Stakeholder Action Against
> Botnets and Other Automated Threats” on June 8.  In the request, “NTIA
> seeks broad input from all interested stakeholders—including private
> industry, academia, civil society, and other security experts—on ways to
> improve industry’s ability to reduce threats perpetuated by automated
> distributed attacks, such as botnets, and what role, if any, the U.S.
> Government should play in this area.”  NTIA would definitely appreciate
> comments from members of this community!
>
>
>
> (2) Last week, NIST hosted a public workshop on “Enhancing Resilience of
> the Internet and Communications Ecosystem”.  150 participants from a range
> of industry sectors, civil society, and government participated in a day
> and half workshop.   The workshop explored a range of current and
> emerging solutions to enhance the resiliency of the Internet against
> automated, distributed threats. The workshop agenda is available at
>
> https://www.nist.gov/sites/default/files/documents/2017/
> 07/10/final-draft-agenda-resilience-workshop-070517.pdf
>
>
>
> _______________________________________________
> saag mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/saag
>
>

-- 
Joseph Lorenzo Hall
Chief Technologist, Center for Democracy & Technology [https://www.cdt.org]
1401 K ST NW STE 200, Washington DC 20005-3497
e: [email-masked], p: 202.407.8825, pgp: https://josephhall.org/gpg-key
Fingerprint: 3CA2 8D7B 9F6D DBD3 4B10  1607 5F86 6987 40A9 A871