Scott, Yes this has been around for a while. It certainly matters how people use SNMP. Like most things done badly a number of attacks afford. See recent open redirects on Connect. Implementations matter. We are continuing the work referenced below with SNMP around physical security system networked devices. Regards, Sal From: Scott Shorter [mailto:sshorter@electrosoft-inc.com] Sent: Tuesday, May 20, 2014 9:59 AM To: Salvatore D'Agostino Cc: dg-idot@kantarainitiative.org Subject: Re: [DG-IDoT] snmp for security devices Hi all, I'm resurrecting this old thread to share a happy update. I just learned about RFC 3414 <http://www.ietf.org/rfc/rfc3414.txt> and RFC 3826 <http://www.ietf.org/rfc/rfc3826.txt> which add support for SHA-1 and AES to SNMPv3. - Scott On Tue, Dec 17, 2013 at 3:52 PM, Salvatore D'Agostino <sal@idmachines.com> wrote: Reality of what’s out there not what it should be. From: Scott Shorter [mailto:sshorter@electrosoft-inc.com] Sent: Tuesday, December 17, 2013 2:07 PM To: Salvatore D'Agostino Cc: dg-idot@kantarainitiative.org Subject: Re: [DG-IDoT] snmp for security devices Thanks Sal, very helpful presentation. Slide 9 makes me sad, though. MD5 and DES should be extinct. Algorithm flexibility, please! Best, Scott On Tue, Dec 17, 2013 at 1:01 PM, Salvatore D'Agostino <sal@idmachines.com> wrote: All, I think I may have already sent this to the list. It is what I talked to on the call. There is a presentation with further background on the page. http://www.siaonline.org/Pages/Standards/SNMP-Subcommittee.aspx Happy holidays. Sal Salvatore D'Agostino, CSCIP IDmachines LLC |1264 Beacon Street, #5 | Brookline, MA 02446 | USA http:\\www.idmachines.com <http://www.idmachines.com/> | http:\\idmachines.blogspot.com <http://idmachines.blogspot.com/> | @idmachines +1 617.201.4809 <tel:%2B1%20617.201.4809> ph | +1 617.812.6495 <tel:%2B1%20617.812.6495> fax _______________________________________________ DG-IDoT mailing list DG-IDoT@kantarainitiative.org http://kantarainitiative.org/mailman/listinfo/dg-idot -- Scott Shorter, Principal Security Engineer, Electrosoft Services Inc. sshorter@electrosoft-inc.com O: 703-437-9451 x21 <tel:703-437-9451%20x21> M: 240-994-7793 -- Scott Shorter, Principal Security Engineer, Electrosoft Services Inc. sshorter@electrosoft-inc.com O: 703-437-9451 x21 M: 240-994-7793