Difference between revisions of "Updating and Patching The Internet of Things"

From OWASP
Jump to: navigation, search
(Background)
(Major Topics)
Line 20: Line 20:
 
=== Methodology to Determine Cat 1 vs Cat 2 ===
 
=== Methodology to Determine Cat 1 vs Cat 2 ===
 
Prescriptive process to determine if an IoT is cat 1 or cat 2
 
Prescriptive process to determine if an IoT is cat 1 or cat 2
 +
 +
== Expectations for Updates ==
 +
=== Cat 1 ===
 +
Delivered under supervision
 +
 +
=== Cat 2 ===
 +
* Delivered remotely
 +
* Point of consideration - whether to allow users to delay update for X # of hours, force reboot, etc

Revision as of 12:21, 26 August 2014

Note: This page is a work in progress to capture major ideas on the topic. It will be formalized as the community provides more information and review.

Background

Discussion on OWASP-Community mailing list - Internet of Things and criticality of patching

Major Topics

Seamless & Reliable Update vs Secure Update

Explain the difference in the intent of the topics

Different Categories of IoT Devices

Life impacting vs internet as a feature

  • Category 1 - Medical & other life impacting systems, cars, what else?
  • Category 2 - Non-life systems - Ovens, refrigerators, pedometers, thermostats

Methodology to Determine Cat 1 vs Cat 2

Prescriptive process to determine if an IoT is cat 1 or cat 2

Expectations for Updates

Cat 1

Delivered under supervision

Cat 2

  • Delivered remotely
  • Point of consideration - whether to allow users to delay update for X # of hours, force reboot, etc