3 ms·

I never knew regulation also referred to government procurement requirements. I thought it was only for rules for market participants in general. If you do incl

I never knew regulation also referred to government procurement requirements. I thought it was only for rules for market participants in general. If you do include government procurement requirements then your post adds a lot to the conversation. If you were to jot down some rules of government procurement for IoT, what would you put in there?

ethbro 9y ago
I'd say most of the important government regulation comes in the form of procurement requirements. It's far more politically tenable to suggest that "here is a quality that needs to exist in a product the government buys" than "here is something everyone needs to do." And it just so happens that the US government is a huge buyer, so the market adapts.
- nickpsecurity 9y ago
  That last line is exactly what happened for a while. They maintained and enhanced the products for over a decade, too, since there were profitable sales. Same thing is happening with DO-178B/C. One company even made a robust graphics driver for Radeon on non-Windows and non-Mac platform. Something the private sector can't be expected to do based on my experience. ;)
nickpsecurity 9y ago
Instead of telling you what they recommended, I'm going to give you my modern list instead of assurance activities that could be considered for the next evaluation scheme. Orange Book had a subset of these. I pulled from the whole field to get a larger list. https://lobste.rs/s/mhqf7p/static_typing_will_not_save_us_from_broken/comments/d7gega#c_d7gega https://lobste.rs/s/mhqf7p/static_typing_will_not_save_us_fr... The two summaries of the history of successes and problems in TCSEC are here: http://lukemuehlhauser.com/wp-content/uploads/Bell-Looking-Back-Addendum.pdf http://lukemuehlhauser.com/wp-content/uploads/Bell-Looking-B... https://www.acsac.org/2004/papers/ClassicPaperSchafer.pdf https://www.acsac.org/2004/papers/ClassicPaperSchafer.pdf

ethbro 9y ago

I'd say most of the important government regulation comes in the form of procurement requirements. It's far more politically tenable to suggest that "here is a quality that needs to exist in a product the government buys" than "here is something everyone needs to do." And it just so happens that the US government is a huge buyer, so the market adapts.

nickpsecurity 9y ago
That last line is exactly what happened for a while. They maintained and enhanced the products for over a decade, too, since there were profitable sales. Same thing is happening with DO-178B/C. One company even made a robust graphics driver for Radeon on non-Windows and non-Mac platform. Something the private sector can't be expected to do based on my experience. ;)

nickpsecurity 9y ago

Instead of telling you what they recommended, I'm going to give you my modern list instead of assurance activities that could be considered for the next evaluation scheme. Orange Book had a subset of these. I pulled from the whole field to get a larger list. https://lobste.rs/s/mhqf7p/static_typing_will_not_save_us_from_broken/comments/d7gega#c_d7gega https://lobste.rs/s/mhqf7p/static_typing_will_not_save_us_fr... The two summaries of the history of successes and problems in TCSEC are here: http://lukemuehlhauser.com/wp-content/uploads/Bell-Looking-Back-Addendum.pdf http://lukemuehlhauser.com/wp-content/uploads/Bell-Looking-B... https://www.acsac.org/2004/papers/ClassicPaperSchafer.pdf https://www.acsac.org/2004/papers/ClassicPaperSchafer.pdf