draft-ietf-opsec-current-practices-01.txt   draft-ietf-opsec-current-practices-02.txt 
OPSEC M. Kaeo OPSEC M. Kaeo
Internet-Draft Double Shot Security, Inc. Internet-Draft Double Shot Security, Inc.
Expires: January 18, 2006 July 17, 2005 Expires: January 18, 2006 July 17, 2005
Operational Security Current Practices Operational Security Current Practices
draft-ietf-opsec-current-practices-01 draft-ietf-opsec-current-practices-02
Status of this Memo Status of this Memo
By submitting this Internet-Draft, each author represents that any By submitting this Internet-Draft, each author represents that any
applicable patent or other IPR claims of which he or she is aware applicable patent or other IPR claims of which he or she is aware
have been or will be disclosed, and any of which he or she becomes have been or will be disclosed, and any of which he or she becomes
aware will be disclosed, in accordance with Section 6 of BCP 79. aware will be disclosed, in accordance with Section 6 of BCP 79.
Internet-Drafts are working documents of the Internet Engineering Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF), its areas, and its working groups. Note that Task Force (IETF), its areas, and its working groups. Note that
skipping to change at page 2, line 8 skipping to change at page 2, line 8
This document is a survey of the current practices used in today's This document is a survey of the current practices used in today's
large ISP operational networks to secure layer 2 and layer 3 large ISP operational networks to secure layer 2 and layer 3
infrastructure devices. The information listed here is the result of infrastructure devices. The information listed here is the result of
information gathered from people directly responsible for defining information gathered from people directly responsible for defining
and implementing secure infrastructures in Internet Service Provider and implementing secure infrastructures in Internet Service Provider
environments. environments.
Table of Contents Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3
1.1 Threat Model . . . . . . . . . . . . . . . . . . . . . . . 3 1.1. Scope . . . . . . . . . . . . . . . . . . . . . . . . . . 3
1.2 Operational Security Impact from Threats . . . . . . . . . 3 1.2. Threat Model . . . . . . . . . . . . . . . . . . . . . . . 3
1.3 Document Layout . . . . . . . . . . . . . . . . . . . . . 6 1.3. Attack Sources . . . . . . . . . . . . . . . . . . . . . . 4
1.4 Definitions . . . . . . . . . . . . . . . . . . . . . . . 6 1.4. Operational Security Impact from Threats . . . . . . . . . 5
2. Protected Operational Functions . . . . . . . . . . . . . . . 8 1.5. Document Layout . . . . . . . . . . . . . . . . . . . . . 7
2.1 Device Physical Access . . . . . . . . . . . . . . . . . . 8 1.6. Definitions . . . . . . . . . . . . . . . . . . . . . . . 7
2.2 Device In-Band Management . . . . . . . . . . . . . . . . 10 2. Protected Operational Functions . . . . . . . . . . . . . . . 9
2.3 Device Out-of-Band Management . . . . . . . . . . . . . . 14 2.1. Device Physical Access . . . . . . . . . . . . . . . . . . 9
2.4 Data Path . . . . . . . . . . . . . . . . . . . . . . . . 18 2.2. Device In-Band Management . . . . . . . . . . . . . . . . 11
2.5 Routing Control Plane . . . . . . . . . . . . . . . . . . 20 2.3. Device Out-of-Band Management . . . . . . . . . . . . . . 15
2.6 Software Upgrades and Configuration Integrity / 2.4. Data Path . . . . . . . . . . . . . . . . . . . . . . . . 19
Validation . . . . . . . . . . . . . . . . . . . . . . . . 24 2.5. Routing Control Plane . . . . . . . . . . . . . . . . . . 21
2.7 Logging Considerations . . . . . . . . . . . . . . . . . . 27 2.6. Software Upgrades and Configuration Integrity /
2.8 Denial of Service Tracking / Tracing . . . . . . . . . . . 30 Validation . . . . . . . . . . . . . . . . . . . . . . . . 25
3. Security Considerations . . . . . . . . . . . . . . . . . . . 32 2.7. Logging Considerations . . . . . . . . . . . . . . . . . . 28
4. Normative References . . . . . . . . . . . . . . . . . . . . . 32 2.8. Filtering Considerations . . . . . . . . . . . . . . . . . 31
Author's Address . . . . . . . . . . . . . . . . . . . . . . . 32 2.9. Denial of Service Tracking / Tracing . . . . . . . . . . . 32
A. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 33 3. Security Considerations . . . . . . . . . . . . . . . . . . . 34
B. Protocol Specific Attacks . . . . . . . . . . . . . . . . . . 34 4. Normative References . . . . . . . . . . . . . . . . . . . . . 34
Intellectual Property and Copyright Statements . . . . . . . . 36 Appendix A. Acknowledgments . . . . . . . . . . . . . . . . . . . 35
Appendix B. Protocol Specific Attacks . . . . . . . . . . . . . . 36
B.1. Layer 2 Attacks . . . . . . . . . . . . . . . . . . . . . 36
B.2. IPv4 Attacks . . . . . . . . . . . . . . . . . . . . . . . 36
B.3. IPv6 Attacks . . . . . . . . . . . . . . . . . . . . . . . 37
Author's Address . . . . . . . . . . . . . . . . . . . . . . . . . 38
Intellectual Property and Copyright Statements . . . . . . . . . . 39
1. Introduction 1. Introduction
Security practices are well understood by the network operators who Security practices are well understood by the network operators who
have for many years gone through the growing pains of securing their have for many years gone through the growing pains of securing their
network infrastructures. However, there does not exist a written network infrastructures. However, there does not exist a written
document that enumerates these security practices. Network attacks document that enumerates these security practices. Network attacks
are continually increasing and although it is not necessarily the are continually increasing and although it is not necessarily the
role of an ISP to act as the Internet police, each ISP has to ensure role of an ISP to act as the Internet police, each ISP has to ensure
that certain security practices are followed to ensure that their that certain security practices are followed to ensure that their
network is operationally available for their customers. This network is operationally available for their customers. This
document is the result of a survey conducted to find out what current document is the result of a survey conducted to find out what current
security practices are being deployed to secure network security practices are being deployed to secure network
infrastructures. infrastructures.
1.1 Threat Model 1.1. Scope
The scope for this survey is restricted to security practices that The scope for this survey is restricted to security practices that
mitigate exposure to risks with the potential to adversely impact mitigate exposure to risks with the potential to adversely impact
network availability and reliability. Securing the actual data network availability and reliability. Securing the actual data
traffic is outside the scope of the conducted survey. This document traffic is outside the scope of the conducted survey. This document
focuses solely on documenting currently deployed security mechanisms focuses solely on documenting currently deployed security mechanisms
for layer 2 and layer 3 network infrastructure devices. for layer 2 and layer 3 network infrastructure devices. Although
primarily focused on IPv4, many of the same practices can apply to
IPv6 networks. Both IPv4 and IPv6 network infrastructures are taken
into account in this survey.
1.2 Operational Security Impact from Threats 1.2. Threat Model
A threat is a potential for a security violation, which exists when A threat is a potential for a security violation, which exists when
there is a circumstance, capability, action, or event that could there is a circumstance, capability, action, or event that could
breach security and cause harm [RFC2828]. Every operational network breach security and cause harm [RFC2828].Every operational network is
is subject to a multitude of threat actions, or attacks, i.e. an subject to a multitude of threat actions, or attacks, i.e. an assault
assault on system security that derives from an intelligent act that on system security that derives from an intelligent act that is a
is a deliberate attempt to evade security services and violate the deliberate attempt to evade security services and violate the
security policy of a system [RFC2828]. These attacks can be sourced security policy of a system [RFC2828]. All of the threats in any
in a variety of ways: network infrastructure is an instantiation or combination of the
following:
Reconnaissance: An attack whereby information is gathered to
ascertain the network topology or specific device information which
can be further used to exploit known vulnerabilities
Man-In-The-Middle: An attack where a malicious user impersonates
either the sender or recipient of a communication stream.
Protocol Vulnerability Exploitation: An attack which takes advantage
of known protocol deficiencies to cause inappropriate behavior.
Message Insertion: This can be a valid message (which could be a
reply attack,, which is a scenario where a message is captured and
resent at later time). A message can also be inserted with any of
the fields in the message being OspoofedO, such as IP addresses, port
numbers, header fields or even packet content. Flooding is also part
of this threat instantiation.
Message Diversion/Deletion: An attack where legitimate messages are
removed before they can reach the desired recipient or are re-
directed to a network segment that is normally not part of the data
path.
Message Modification: This is a subset of a message insertion attack
where a previous message has been captured and modified before being
retransmitted. The message can be captured by using a man-in-the-
middle attack or message diversion.
Note that sometimes Denial of service attacks are listed as separate
categories. A denial of service is a consequence of an attack and
can be the result of too much traffic (i.e. flooding), or exploting
protocol expoitation or inserting/deleting/diverting/midifying
messages.
1.3. Attack Sources
These attacks can be sourced in a variety of ways:
Active vs passive attacks Active vs passive attacks
An active attack involves writing data to the network. It is An active attack involves writing data to the network. It is
common practice in active attacks to disguise one's address and common practice in active attacks to disguise one's address and
conceal the identity of the traffic sender. A passive attack conceal the identity of the traffic sender. A passive attack
involves only reading information off the network. This is involves only reading information off the network. This is
possible if the attacker has control of a host in the possible if the attacker has control of a host in the
communications path between two victim machines or has compromised communications path between two victim machines or has compromised
the routing infrastructure to specifically arrange that traffic the routing infrastructure to specifically arrange that traffic
skipping to change at page 4, line 49 skipping to change at page 5, line 43
It is nearly impossible to stop insider attacks or unintentional It is nearly impossible to stop insider attacks or unintentional
events. However, if appropriate monitoring mechanisms are in place, events. However, if appropriate monitoring mechanisms are in place,
these attacks can be as easily detected and mitigated as with any these attacks can be as easily detected and mitigated as with any
other attack source. Any of the specific attacks discussed further other attack source. Any of the specific attacks discussed further
in this document will elaborate on attacks which are sourced by an in this document will elaborate on attacks which are sourced by an
"outsider" and are deliberate attacks. Some further elaboration will "outsider" and are deliberate attacks. Some further elaboration will
be given to the feasibility of passive vs active and on-path vs off- be given to the feasibility of passive vs active and on-path vs off-
path attacks to show the motivation behind deploying certain security path attacks to show the motivation behind deploying certain security
features. features.
The threat consequences are the security violations which results 1.4. Operational Security Impact from Threats
from a threat action, i.e. an attack. These are typically classified
as follows: The main concern for any of the potential attack scenarios is the
impact and harm it can cause to the network infrastructure. The
threat consequences are the security violations which results from a
threat action, i.e. an attack. These are typically classified as
follows:
(Unauthorized) Disclosure (Unauthorized) Disclosure
A circumstance or event whereby an entity gains access to data for A circumstance or event whereby an entity gains access to data for
which the entity is not authorized. which the entity is not authorized.
Deception Deception
A circumstance or event that may result in an authorized entity A circumstance or event that may result in an authorized entity
receiving false data and believing it to be true. receiving false data and believing it to be true.
skipping to change at page 6, line 8 skipping to change at page 7, line 5
a malicious user who has the capability to eavesdrop on traffic. a malicious user who has the capability to eavesdrop on traffic.
First, he may listen in on traffic for a while to do some First, he may listen in on traffic for a while to do some
reconnaissance work and ascertain which IP addresses belonged to reconnaissance work and ascertain which IP addresses belonged to
specific devices such as routers. Were this miscreant to obtain specific devices such as routers. Were this miscreant to obtain
information such as a router password sent in cleartext, he can then information such as a router password sent in cleartext, he can then
proceed to compromise the actual router. From there, the miscreant proceed to compromise the actual router. From there, the miscreant
can launch various active attacks such as sending bogus routing can launch various active attacks such as sending bogus routing
updates to redirect traffic or capture additional traffic to updates to redirect traffic or capture additional traffic to
compromise other network devices. compromise other network devices.
1.3 Document Layout 1.5. Document Layout
This document is a survey of current operational practices that This document is a survey of current operational practices that
mitigate the risk of being susceptible to any threat actions. As mitigate the risk of being susceptible to any threat actions. As
such, the main focus is on the currently deployed security practices such, the main focus is on the currently deployed security practices
used to detect and/or mitigate attacks. The top-level categories in used to detect and/or mitigate attacks. The top-level categories in
this document are based on operational functions for ISPs and this document are based on operational functions for ISPs and
generally relate to what is to be protected. This is followed by a generally relate to what is to be protected. This is followed by a
description of which attacks are possible and the security practices description of which attacks are possible and the security practices
currently deployed which will provide the necessary security services currently deployed which will provide the necessary security services
to help mitigate these attacks. These security services are to help mitigate these attacks. These security services are
skipping to change at page 6, line 48 skipping to change at page 7, line 45
a combination of these services. For example, AAA can offer user a combination of these services. For example, AAA can offer user
authentication, user authorization and audit / logging services while authentication, user authorization and audit / logging services while
SSH can provide data origin authentication, data integrity and data SSH can provide data origin authentication, data integrity and data
confidentiality. The services offered are more important than the confidentiality. The services offered are more important than the
actual protocol used. Each section ends with an additional actual protocol used. Each section ends with an additional
considerations section which explains why specific protocols may or considerations section which explains why specific protocols may or
may not be used and also gives some information regarding may not be used and also gives some information regarding
capabilities which are not possible today due to bugs or lack of ease capabilities which are not possible today due to bugs or lack of ease
of use. of use.
1.4 Definitions 1.6. Definitions
RFC 2119 Keywords
RFC 2119 Keywords
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL
NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL"
in this document are to be interpreted as described in [RFC2119]. in this document are to be interpreted as described in [RFC2119].
The use of the RFC 2119 keywords is an attempt, by the editor, to The use of the RFC 2119 keywords is an attempt, by the editor, to
assign the correct requirement levels ("MUST", "SHOULD", assign the correct requirement levels ("MUST", "SHOULD",
"MAY"...). It must be noted that different organizations, "MAY"...). It must be noted that different organizations,
operational environments, policies and legal environments will operational environments, policies and legal environments will
generate different requirement levels. generate different requirement levels.
2. Protected Operational Functions 2. Protected Operational Functions
2.1 Device Physical Access 2.1. Device Physical Access
Device physical access pertains to protecting the physical location Device physical access pertains to protecting the physical location
of the layer 2 or layer 3 network infrastructure device. Although it of the layer 2 or layer 3 network infrastructure device. Although it
is important to have contingency plans for natural disasters such as is important to have contingency plans for natural disasters such as
earthquakes and floods which can cause damage to networking devices, earthquakes and floods which can cause damage to networking devices,
this is out-of-scope for this document. Here we concern ourselves this is out-of-scope for this document. Here we concern ourselves
with protecting access to the physical location and how a device can with protecting access to the physical location and how a device can
be further protected from unauthorized access if the physical be further protected from unauthorized access if the physical
location has been compromised, i.e protecting the console access. location has been compromised, i.e protecting the console access.
2.1.1 Threats / Attacks 2.1.1. Threats / Attacks
If any intruder gets physical access to a layer 2 or layer 3 device, If any intruder gets physical access to a layer 2 or layer 3 device,
the entire network infrastructure can be under the control of the the entire network infrastructure can be under the control of the
intruder. At a minimum, the intruder can take the compromised device intruder. At a minimum, the intruder can take the compromised device
out-of-service, causing network disruption, the extent of which out-of-service, causing network disruption, the extent of which
depends on the network topology. A worse scenario is where the depends on the network topology. A worse scenario is where the
intruder can use this device to crack the console password and have intruder can use this device to crack the console password and have
complete control of the device, perhaps without anyone detecting such complete control of the device, perhaps without anyone detecting such
a compromise, or to attach another network device onto a port and a compromise, or to attach another network device onto a port and
siphon off data with which the intruder can ascertain the network siphon off data with which the intruder can ascertain the network
topology and take control of the entire network. topology and take control of the entire network.
The threat of gaining physical access can be realized in a variety of The threat of gaining physical access can be realized in a variety of
ways even if critical devices are under high-security. There still ways even if critical devices are under high-security. There still
occur cases where attackers have impersonated maintenance workers to occur cases where attackers have impersonated maintenance workers to
gain physical access to critical devices that have caused major gain physical access to critical devices that have caused major
outages and privacy compromises. Insider attacks from authorized outages and privacy compromises. Insider attacks from authorized
personnel also pose a real threat and must be adequately recognized personnel also pose a real threat and must be adequately recognized
and dealt with. and dealt with.
2.1.2 Security Practices 2.1.2. Security Practices
For physical device security, equipment is kept in highly restrictive For physical device security, equipment is kept in highly restrictive
environments. Only authorized users with card key badges have access environments. Only authorized users with card key badges have access
to any of the physical locations that contain critical network to any of the physical locations that contain critical network
infrastructure devices. These card-key systems keep track of who infrastructure devices. These card-key systems keep track of who
accessed which location and at what time. accessed which location and at what time.
All console access is always password protected and the login time is All console access is always password protected and the login time is
set to time out after a specified amount of inactivity - typically set to time out after a specified amount of inactivity - typically
between 3-10 minutes. Individual users are authentication to get between 3-10 minutes. Individual users are authentication to get
basic access. For privileged (i.e. enable) access, a second basic access. For privileged (i.e. enable) access, a second
authentication step needs to be completed. Typically all console authentication step needs to be completed. Typically all console
access is provided via an out-of-band (OOB) management infrastructure access is provided via an out-of-band (OOB) management infrastructure
which is discussed in the section on OOB management. which is discussed in the section on OOB management.
2.1.3 Security Services 2.1.3. Security Services
The following security services are offered through the use of the The following security services are offered through the use of the
practices described in the previous section: practices described in the previous section:
o User Authentication - All individuals who have access to the o User Authentication - All individuals who have access to the
physical facility are authenticated. Console access is physical facility are authenticated. Console access is
authenticated. authenticated.
o User Authorization - An authenticated individual has implicit o User Authorization - An authenticated individual has implicit
authorization to perform commands on the device. Console access authorization to perform commands on the device. Console access
skipping to change at page 9, line 36 skipping to change at page 10, line 36
o Data Confidentiality - Not applicable o Data Confidentiality - Not applicable
o Auditing / Logging - All access to the physical locations of the o Auditing / Logging - All access to the physical locations of the
infrastructure equipment is logged via electronic card-key infrastructure equipment is logged via electronic card-key
systems. All console access is logged (refer to the OOB systems. All console access is logged (refer to the OOB
management section for more details) management section for more details)
o DoS Mitigation - Not applicable o DoS Mitigation - Not applicable
2.1.4 Additional Considerations 2.1.4. Additional Considerations
Physical security is relevant to operational security practices as Physical security is relevant to operational security practices as
described in this document mostly from a console access perspective. described in this document mostly from a console access perspective.
Most ISPs provide console access via an OOB management infrastructure Most ISPs provide console access via an OOB management infrastructure
which is discussed in the OOB management section of this document. which is discussed in the OOB management section of this document.
The physical and logical authentication and logging systems should be The physical and logical authentication and logging systems should be
run independently of each other and reside in different physical run independently of each other and reside in different physical
locations. locations.
Social engineering plays a big role in many physical access Social engineering plays a big role in many physical access
compromises. Most ISPs have set up training classes and awareness compromises. Most ISPs have set up training classes and awareness
programs to educate company personnel to deny physical access to programs to educate company personnel to deny physical access to
people who are not properly authenticated or authorized to have people who are not properly authenticated or authorized to have
physical access to critical infrastructure devices. physical access to critical infrastructure devices.
2.2 Device In-Band Management 2.2. Device In-Band Management
In-band management is generally considered to be device access where In-band management is generally considered to be device access where
the control traffic takes the same data path as the data which the control traffic takes the same data path as the data which
traverses the network. In many environments, device management for traverses the network. In many environments, device management for
layer 2 and layer 3 infrastructure devices is deployed as part of an layer 2 and layer 3 infrastructure devices is deployed as part of an
out-of-band management infrastructure although there are some out-of-band management infrastructure although there are some
instances where it is deployed in-band as well. Presently, the instances where it is deployed in-band as well. Presently, the
mechanisms used for in-band management are via virtual terminal mechanisms used for in-band management are via virtual terminal
access (i.e. Telnet or SSH), SNMP, or HTTP. In all large ISPs that access (i.e. Telnet or SSH), SNMP, or HTTP. In all large ISPs that
were interviewed, HTTP management is never used and is explicitly were interviewed, HTTP management is never used and is explicitly
disabled. Note that file transfer protocols (TFTP, FTP, SCP) will disabled. Note that file transfer protocols (TFTP, FTP, SCP) will be
be covered in the 'Software Upgrades and Configuration Integrity/ covered in the 'Software Upgrades and Configuration Integrity/
Validation' section. Validation' section.
2.2.1 Threats / Attacks 2.2.1. Threats / Attacks
For in-band device management, passive attacks are possible if For in-band device management, passive attacks are possible if
someone has the capability to intercept data between the management someone has the capability to intercept data between the management
device and the managed device. The threat is possible if a single device and the managed device. The threat is possible if a single
infrastructure device is somehow compromised and can act as a network infrastructure device is somehow compromised and can act as a network
sniffer or if it is possible to insert a new device which acts as a sniffer or if it is possible to insert a new device which acts as a
network sniffer. network sniffer.
Active attacks are possible for both on-path and off-path scenarios. Active attacks are possible for both on-path and off-path scenarios.
For on-path active attacks, the situation is the same as for a For on-path active attacks, the situation is the same as for a
passive attack, where either a device has to already be compromised passive attack, where either a device has to already be compromised
or a device can be inserted into the path. For off-path active or a device can be inserted into the path. For off-path active
attacks, the attack is generally limited to message insertion or attacks, the attack is generally limited to message insertion or
modification. modification.
2.2.1.1 Confidentiality Violations 2.2.1.1. Confidentiality Violations
Confidentiality violations can occur when a miscreant intercepts Confidentiality violations can occur when a miscreant intercepts
confidential data that has been sent in cleartext. This includes confidential data that has been sent in cleartext. This includes
interception of usernames and passwords with which an intruder can interception of usernames and passwords with which an intruder can
obtain unauthorized access to network devices. It can also include obtain unauthorized access to network devices. It can also include
other information such as logging or configuration information if an other information such as logging or configuration information if an
administrator is remotely viewing local logfiles or configuration administrator is remotely viewing local logfiles or configuration
information. information.
2.2.1.2 Offline Cryptographic Attacks 2.2.1.2. Offline Cryptographic Attacks
If username/password information was encrypted but the cryptographic If username/password information was encrypted but the cryptographic
mechanism used made it easy to capture data and break the encryption mechanism used made it easy to capture data and break the encryption
key, the device management traffic could be compromised. The traffic key, the device management traffic could be compromised. The traffic
would need to be captured either by eavesdropping on the network or would need to be captured either by eavesdropping on the network or
by being able to divert traffic to a malicious user. by being able to divert traffic to a malicious user.
2.2.1.3 Replay Attacks 2.2.1.3. Replay Attacks
For a replay attack to be successful, in-band management traffic For a replay attack to be successful, in-band management traffic
would need to first be captured either on-path or diverted to an would need to first be captured either on-path or diverted to an
attacker to later be replayed to the intended recipient. attacker to later be replayed to the intended recipient.
2.2.1.4 Message Insertion/Deletion/Modification 2.2.1.4. Message Insertion/Deletion/Modification
Data can be manipulated by someone in control of intermediary hosts. Data can be manipulated by someone in control of intermediary hosts.
Forging data is also possible with IP spoofing, where a remote host Forging data is also possible with IP spoofing, where a remote host
sends out packets which appear to come from another, trusted host. sends out packets which appear to come from another, trusted host.
2.2.1.5 Man-In-The-Middle 2.2.1.5. Man-In-The-Middle
A man-in-the-middle attack attacks the identity of a communicating A man-in-the-middle attack attacks the identity of a communicating
peer rather than the data stream itself. The attacker intercepts peer rather than the data stream itself. The attacker intercepts
traffic that is sent from an in-band management system to the traffic that is sent from an in-band management system to the
networking infrastructure device and traffic that is sent from the networking infrastructure device and traffic that is sent from the
network infrastructure device to the in-band management system. network infrastructure device to the in-band management system.
2.2.2 Security Practices 2.2.2. Security Practices
All in-band management access to layer 2 and layer 3 devices is All in-band management access to layer 2 and layer 3 devices is
authenticated. The user authentication and authorization is authenticated. The user authentication and authorization is
typically controlled by a AAA server (i.e. RADIUS and/or TACACS+). typically controlled by a AAA server (i.e. RADIUS and/or TACACS+).
Credentials used to determine the identity of the user vary from Credentials used to determine the identity of the user vary from
static username/password to one-time username/password scheme such as static username/password to one-time username/password scheme such as
Secure-ID. Static username/passwords are expired after a specified Secure-ID. Static username/passwords are expired after a specified
period of time, usually 30 days. Every authenticated entity via AAA period of time, usually 30 days. Every authenticated entity via AAA
is an individual user for greater granularity of control. In some is an individual user for greater granularity of control. In some
deployments, The AAA servers used for in-band management deployments, The AAA servers used for in-band management
skipping to change at page 12, line 46 skipping to change at page 13, line 44
All in-band device management access is audited and any violations All in-band device management access is audited and any violations
trigger alarms which initiate automated email, pager and/or telephone trigger alarms which initiate automated email, pager and/or telephone
notifications. AAA servers keeps track of the authenticated entity notifications. AAA servers keeps track of the authenticated entity
as well as all the commands that were carried out on a specific as well as all the commands that were carried out on a specific
device. Additionally, the device itself logs any access control device. Additionally, the device itself logs any access control
violations (i.e. if an SSH request comes in from an IP address which violations (i.e. if an SSH request comes in from an IP address which
is not explicitly permitted, that event is logged so that the is not explicitly permitted, that event is logged so that the
offending IP address can be tracked down and investigations made as offending IP address can be tracked down and investigations made as
to why it was trying to access a particular infrastructure device) to why it was trying to access a particular infrastructure device)
2.2.3 Security Services 2.2.3. Security Services
The following security services are offered through the use of the The following security services are offered through the use of the
practices described in the previous section: practices described in the previous section:
o User Authentication - All individuals are authenticated via AAA o User Authentication - All individuals are authenticated via AAA
services. services.
o User Authorization - All individuals are authorized via AAA o User Authorization - All individuals are authorized via AAA
services to perform specific operations once successfully services to perform specific operations once successfully
authenticated. authenticated.
skipping to change at page 13, line 36 skipping to change at page 14, line 33
o Auditing / Logging - Using AAA provides an audit trail for who o Auditing / Logging - Using AAA provides an audit trail for who
accessed which device and which operations were performed. accessed which device and which operations were performed.
o DoS Mitigation - Using packet filters to allow only specific IP o DoS Mitigation - Using packet filters to allow only specific IP
addresses to have access to the infrastructure devices. This addresses to have access to the infrastructure devices. This
limits but does not prevent spoofed DoS attacks directed at an limits but does not prevent spoofed DoS attacks directed at an
infrastructure device. Often OOB management is used to lower that infrastructure device. Often OOB management is used to lower that
risk. risk.
2.2.4 Additional Considerations 2.2.4. Additional Considerations
Password selection for any in-band device management protocol used is Password selection for any in-band device management protocol used is
critical to ensure that the passwords are hard to guess or break critical to ensure that the passwords are hard to guess or break
using a brute-force attack. using a brute-force attack.
IPsec is considered too difficult to deploy and the common protocol IPsec is considered too difficult to deploy and the common protocol
to provide for confidential in-band management access is SSH. There to provide for confidential in-band management access is SSH. There
are exceptions for using SSH due to equipment limitations since SSH are exceptions for using SSH due to equipment limitations since SSH
may not be supported on legacy equipment. Also, in the case where may not be supported on legacy equipment. Also, in the case where
the SSH key is stored on a route processor card, a re-keying of SSH the SSH key is stored on a route processor card, a re-keying of SSH
skipping to change at page 14, line 28 skipping to change at page 15, line 24
Kerberized UNIX server using SSH and generate a Kerberos 'ticket'. Kerberized UNIX server using SSH and generate a Kerberos 'ticket'.
This 'ticket' is generally set to have a lifespan of 10 hours and is This 'ticket' is generally set to have a lifespan of 10 hours and is
used to automatically authenticate the individual to the used to automatically authenticate the individual to the
infrastructure devices. infrastructure devices.
In instances where SNMP is used, some legacy devices only support In instances where SNMP is used, some legacy devices only support
SNMPv1 which then requires the provider to mandate its use across all SNMPv1 which then requires the provider to mandate its use across all
infrastructure devices for operational simplicity. SNMPv2 is infrastructure devices for operational simplicity. SNMPv2 is
primarily deployed since it is easier to set up than v3. primarily deployed since it is easier to set up than v3.
2.3 Device Out-of-Band Management 2.3. Device Out-of-Band Management
Out-of-band management is generally considered to be device access Out-of-band management is generally considered to be device access
where the control traffic takes a separate path as the data which where the control traffic takes a separate path as the data which
traverses the network. Console access is always architected via an traverses the network. Console access is always architected via an
OOB network. SNMP management is also usually carried out via that OOB network. SNMP management is also usually carried out via that
same OOB network infrastructure. same OOB network infrastructure.
2.3.1 Threats / Attacks 2.3.1. Threats / Attacks
For OOB device management, passive attacks are possible if someone For OOB device management, passive attacks are possible if someone
has the capability to intercept data between the management device has the capability to intercept data between the management device
and the managed device. The threat is possible if a single and the managed device. The threat is possible if a single
infrastructure device is somehow compromised and can act as a network infrastructure device is somehow compromised and can act as a network
sniffer or if it is possible to insert a new device which acts as a sniffer or if it is possible to insert a new device which acts as a
network sniffer. network sniffer.
Active attacks are possible for both on-path and off-path scenarios. Active attacks are possible for both on-path and off-path scenarios.
For on-path active attacks, the situation is the same as for a For on-path active attacks, the situation is the same as for a
passive attack, where either a device has to already be compromised passive attack, where either a device has to already be compromised
or a device can be inserted into the path. For off-path active or a device can be inserted into the path. For off-path active
attacks, the attack is generally limited to message insertion or attacks, the attack is generally limited to message insertion or
modification. modification.
2.3.1.1 Confidentiality Violations 2.3.1.1. Confidentiality Violations
Confidentiality violations can occur when a miscreant intercepts any Confidentiality violations can occur when a miscreant intercepts any
of the OOB management data that has been sent in cleartext. This of the OOB management data that has been sent in cleartext. This
includes interception of usernames and passwords with which an includes interception of usernames and passwords with which an
intruder can obtain unauthorized access to network devices. It can intruder can obtain unauthorized access to network devices. It can
also include other information such as logging or configuration also include other information such as logging or configuration
information if an administrator is remotely viewing local logfiles or information if an administrator is remotely viewing local logfiles or
configuration information. configuration information.
2.3.1.2 Offline Cryptographic Attacks 2.3.1.2. Offline Cryptographic Attacks
If username/password information was encrypted but the cryptographic If username/password information was encrypted but the cryptographic
mechanism used made it easy to capture data and break the encryption mechanism used made it easy to capture data and break the encryption
key, the OOB management traffic could be compromised. The traffic key, the OOB management traffic could be compromised. The traffic
would need to be captured either by eavesdropping on the network or would need to be captured either by eavesdropping on the network or
by being able to divert traffic to a malicious user. by being able to divert traffic to a malicious user.
2.3.1.3 Replay Attacks 2.3.1.3. Replay Attacks
For a replay attack to be successful, the OOB management traffic For a replay attack to be successful, the OOB management traffic
would need to first be captured either on-path or diverted to an would need to first be captured either on-path or diverted to an
attacker to later be replayed to the intended recipient. attacker to later be replayed to the intended recipient.
2.3.1.4 Message Insertion/Deletion/Modification 2.3.1.4. Message Insertion/Deletion/Modification
Data can be manipulated by someone in control of intermediary hosts. Data can be manipulated by someone in control of intermediary hosts.
Forging data is also possible with IP spoofing, where a remote host Forging data is also possible with IP spoofing, where a remote host
sends out packets which appear to come from another, trusted host. sends out packets which appear to come from another, trusted host.
2.3.1.5 Man-In-The-Middle 2.3.1.5. Man-In-The-Middle
A man-in-the-middle attack attacks the identity of a communicating A man-in-the-middle attack attacks the identity of a communicating
peer rather than the data stream itself. The attacker intercepts peer rather than the data stream itself. The attacker intercepts
traffic that is sent from an OOB management system to the networking traffic that is sent from an OOB management system to the networking
infrastructure device and traffic that is sent from the network infrastructure device and traffic that is sent from the network
infrastructure device to the OOB management system. infrastructure device to the OOB management system.
2.3.2 Security Practices 2.3.2. Security Practices
OOB is done via a terminal server at each location. SSH access is OOB is done via a terminal server at each location. SSH access is
used to get to the terminal server from where sessions to the devices used to get to the terminal server from where sessions to the devices
are initiated. Dial-in access is deployed as a backup if the network are initiated. Dial-in access is deployed as a backup if the network
is not available. is not available.
All OOB management access to layer 2 and layer 3 devices is All OOB management access to layer 2 and layer 3 devices is
authenticated. The user authentication and authorization is authenticated. The user authentication and authorization is
typically controlled by a AAA server (i.e. RADIUS and/or TACACS+). typically controlled by a AAA server (i.e. RADIUS and/or TACACS+).
Credentials used to determine the identity of the user vary from Credentials used to determine the identity of the user vary from
static username/password to one-time username/password scheme such as static username/password to one-time username/password scheme such as
Secure-ID. Static username/passwords are expired after a specified Secure-ID. Static username/passwords are expired after a specified
period of time, usually 30 days. Every authenticated entity via AAA period of time, usually 30 days. Every authenticated entity via AAA
is an individual user for greater granularity of control. Note that is an individual user for greater granularity of control. Note that
often the AAA server used for OOB management authentication is a often the AAA server used for OOB management authentication is a
separate physical device from the AAA server used for in-band separate physical device from the AAA server used for in-band
management user authentication. management user authentication.
For backup purposes, there is often a single local database entry for For backup purposes, there is often a single local database entry for
skipping to change at page 17, line 18 skipping to change at page 18, line 14
All OOB device management access is audited. The AAA server keeps All OOB device management access is audited. The AAA server keeps
track of the authenticated entity as well as all the commands that track of the authenticated entity as well as all the commands that
were carried out on a specific device. Additionally, the device were carried out on a specific device. Additionally, the device
itself logs any access control violations (i.e. if an SSH request itself logs any access control violations (i.e. if an SSH request
comes in from an IP address which is not explicitly permitted, that comes in from an IP address which is not explicitly permitted, that
event is logged so that the offending IP address can be tracked down event is logged so that the offending IP address can be tracked down
and investigations made as to why it was trying to access a and investigations made as to why it was trying to access a
particular infrastructure device) particular infrastructure device)
2.3.3 Security Services 2.3.3. Security Services
The security services offered for device OOB management are nearly The security services offered for device OOB management are nearly
identical to those of device in-band management. Due to the critical identical to those of device in-band management. Due to the critical
nature of controlling and limiting device access, many ISPs feel that nature of controlling and limiting device access, many ISPs feel that
physically separating the management traffic from the normal customer physically separating the management traffic from the normal customer
data traffic will provide an added level of risk mitigation and limit data traffic will provide an added level of risk mitigation and limit
the potential attack vectors. For OOB management, the security the potential attack vectors. For OOB management, the security
services offered through the use of the practices described in the services offered through the use of the practices described in the
previous section are: previous section are:
skipping to change at page 18, line 14 skipping to change at page 19, line 8
o Auditing / Logging - Using AAA provides an audit trail for who o Auditing / Logging - Using AAA provides an audit trail for who
accessed which device and which operations were performed. accessed which device and which operations were performed.
o DoS Mitigation - Using packet filters to allow only specific IP o DoS Mitigation - Using packet filters to allow only specific IP
addresses to have access to the infrastructure devices. This addresses to have access to the infrastructure devices. This
limits but does not prevent spoofed DoS attacks directed at an limits but does not prevent spoofed DoS attacks directed at an
infrastructure device. However, the risk is lowered by using a infrastructure device. However, the risk is lowered by using a
separate physical network for management purposes. separate physical network for management purposes.
2.3.4 Additional Considerations 2.3.4. Additional Considerations
Password selection for any OOB device management protocol used is Password selection for any OOB device management protocol used is
critical to ensure that the passwords are hard to guess or break critical to ensure that the passwords are hard to guess or break
using a brute-force attack. using a brute-force attack.
IPsec is considered too difficult to deploy and the common protocol IPsec is considered too difficult to deploy and the common protocol
to provide for confidential OOB management access is SSH. There are to provide for confidential OOB management access is SSH. There are
exceptions for using SSH due to equipment limitations since SSH may exceptions for using SSH due to equipment limitations since SSH may
not be supported on legacy equipment. Also, in the case where the not be supported on legacy equipment. Also, in the case where the
SSH key is stored on a route processor card, a re-keying of SSH would SSH key is stored on a route processor card, a re-keying of SSH would
skipping to change at page 18, line 47 skipping to change at page 19, line 41
allowed to an infrastructure device except from specific jumphosts; allowed to an infrastructure device except from specific jumphosts;
i.e. packet filters are used at the console server and/or i.e. packet filters are used at the console server and/or
infrastructure device to ensure that Telnet is only allowed from infrastructure device to ensure that Telnet is only allowed from
specific IP addresses. specific IP addresses.
In instances where SNMP is used, some legacy devices only support In instances where SNMP is used, some legacy devices only support
SNMPv1 which then requires the provider to mandate its use across all SNMPv1 which then requires the provider to mandate its use across all
infrastructure devices for operational simplicity. SNMPv2 is infrastructure devices for operational simplicity. SNMPv2 is
primarily deployed since it is easier to set up than v3. primarily deployed since it is easier to set up than v3.
2.4 Data Path 2.4. Data Path
This section refers to how traffic is handled which traverses the This section refers to how traffic is handled which traverses the
network infrastructure device. The primary goal of ISPs is to network infrastructure device. The primary goal of ISPs is to
forward customer traffic. However, due to the large amount of forward customer traffic. However, due to the large amount of
malicious traffic that can cause DoS attacks and render the network malicious traffic that can cause DoS attacks and render the network
unavailable, specific measures are sometimes deployed to ensure the unavailable, specific measures are sometimes deployed to ensure the
availability to forward legitimate customer traffic. availability to forward legitimate customer traffic.
2.4.1 Threats / Attacks 2.4.1. Threats / Attacks
Any data traffic can potentially be attack traffic and the challenge Any data traffic can potentially be attack traffic and the challenge
is to detect and potentially stop forwarding any of the malicious is to detect and potentially stop forwarding any of the malicious
traffic. The deliberately sourced attack traffic can consist of traffic. The deliberately sourced attack traffic can consist of
packets with spoofed source and/or destination addresses or any other packets with spoofed source and/or destination addresses or any other
malformed packet which mangle any portion of a header field to cause malformed packet which mangle any portion of a header field to cause
protocol-related security issues (such as resetting connections, protocol-related security issues (such as resetting connections,
causing unwelcome ICPM redirects, creating unwelcome IP options or causing unwelcome ICPM redirects, creating unwelcome IP options or
packet fragmentations). packet fragmentations).
2.4.2 Security Practices 2.4.2. Security Practices
Filtering and rate limiting are the primary mechanism to provide risk Filtering and rate limiting are the primary mechanism to provide risk
mitigation of malicious traffic rendering the ISP services mitigation of malicious traffic rendering the ISP services
unavailable. However, filtering and rate limiting of data path unavailable. However, filtering and rate limiting of data path
traffic is deployed in a variety of ways depending on how automated traffic is deployed in a variety of ways depending on how automated
the process is and what the capabilities and performance limitations the process is and what the capabilities and performance limitations
of existing deployed hardware are. of existing deployed hardware are.
The ISPs which do not have performance issues with their equipment The ISPs which do not have performance issues with their equipment
follow BCP38 [BCP38] guidelines. Null routes and black-hole follow BCP38 [BCP38] guidelines. Null routes and black-hole
skipping to change at page 19, line 42 skipping to change at page 20, line 39
implemented if there is no performance limitations on the devices. implemented if there is no performance limitations on the devices.
Netflow is used for tracking traffic flows but there is some concern Netflow is used for tracking traffic flows but there is some concern
whether sampling is good enough to detect malicious behavior. whether sampling is good enough to detect malicious behavior.
Unicast RPF is not consistently implemented. Some ISPs are in Unicast RPF is not consistently implemented. Some ISPs are in
process of doing so while other ISPs think that the perceived benefit process of doing so while other ISPs think that the perceived benefit
of knowing that spoofed traffic comes from legitimate addresses are of knowing that spoofed traffic comes from legitimate addresses are
not worth the operational complexity. Some providers have a policy not worth the operational complexity. Some providers have a policy
of implementing uRPF at link speeds of DS3 and below. of implementing uRPF at link speeds of DS3 and below.
2.4.3 Security Services 2.4.3. Security Services
o User Authentication - Not applicable o User Authentication - Not applicable
o User Authorization - Not applicable o User Authorization - Not applicable
o Data Origin Authentication - When IP address filtering per BCP38 o Data Origin Authentication - When IP address filtering per BCP38
and uRPF are deployed at network edges it can ensure that any and uRPF are deployed at network edges it can ensure that any
spoofed traffic comes from at least a legitimate IP address and spoofed traffic comes from at least a legitimate IP address and
can be tracked. can be tracked.
skipping to change at page 20, line 20 skipping to change at page 21, line 16
o Data Integrity - Not applicable o Data Integrity - Not applicable
o Data Confidentiality - Not applicable o Data Confidentiality - Not applicable
o Auditing / Logging - Filtering exceptions are logged for potential o Auditing / Logging - Filtering exceptions are logged for potential
attack traffic. attack traffic.
o DoS Mitigation - Black-hole triggered filtering and rate-limiting o DoS Mitigation - Black-hole triggered filtering and rate-limiting
are used to limit the risk of DoS attacks. are used to limit the risk of DoS attacks.
2.4.4 Additional Considerations 2.4.4. Additional Considerations
For layer 2 devices, MAC address filtering and authentication is not For layer 2 devices, MAC address filtering and authentication is not
used. This is due to the problems it can cause when troubleshooting used. This is due to the problems it can cause when troubleshooting
networking issues. Port security becomes unmanageable at a large networking issues. Port security becomes unmanageable at a large
scale where 1000s of switches are deployed. scale where 1000s of switches are deployed.
Rate limiting is used by some ISPs although other ISPs believe it is Rate limiting is used by some ISPs although other ISPs believe it is
not really useful since attackers are not well behaved and it doesn't not really useful since attackers are not well behaved and it doesn't
provide any operational benefit over the complexity. Rate limiting provide any operational benefit over the complexity. Rate limiting
may be improved by developing flow-based rate-limiting capabilities may be improved by developing flow-based rate-limiting capabilities
skipping to change at page 20, line 43 skipping to change at page 21, line 39
Lack of consistency regarding the ability to filter, especially with Lack of consistency regarding the ability to filter, especially with
respect to performance issues cause some ISPs to not implement BCP38 respect to performance issues cause some ISPs to not implement BCP38
guidelines for ingress filtering. One such example is at edge boxes guidelines for ingress filtering. One such example is at edge boxes
where you have up to 1000 T1's connecting into a router with an OC-12 where you have up to 1000 T1's connecting into a router with an OC-12
uplink. Some deployed devices experience a large performance impact uplink. Some deployed devices experience a large performance impact
with filtering which is unacceptable for passing customer traffic with filtering which is unacceptable for passing customer traffic
through. Where performance is not an issue, the ISPs make a tradeoff through. Where performance is not an issue, the ISPs make a tradeoff
between management versus risk. between management versus risk.
2.5 Routing Control Plane 2.5. Routing Control Plane
The routing control plane deals with all the traffic which is part of The routing control plane deals with all the traffic which is part of
establishing and maintaining routing protocol information. establishing and maintaining routing protocol information.
2.5.1 Threats / Attacks 2.5.1. Threats / Attacks
Attacks on the routing control plane can be both from passive or Attacks on the routing control plane can be both from passive or
active sources. Passive attacks are possible if someone has the active sources. Passive attacks are possible if someone has the
capability to intercept data between the communicating routing peers. capability to intercept data between the communicating routing peers.
This can be accomplished if a single routing peer is somehow This can be accomplished if a single routing peer is somehow
compromised and can act as a network sniffer or if it is possible to compromised and can act as a network sniffer or if it is possible to
insert a new device which acts as a network sniffer. insert a new device which acts as a network sniffer.
Active attacks are possible for both on-path and off-path scenarios. Active attacks are possible for both on-path and off-path scenarios.
For on-path active attacks, the situation is the same as for a For on-path active attacks, the situation is the same as for a
skipping to change at page 21, line 24 skipping to change at page 22, line 19
attacker impersonating a legitimate routing peer and exchanging attacker impersonating a legitimate routing peer and exchanging
routing information. Unintentional active attacks are more common routing information. Unintentional active attacks are more common
due to configuration errors, which cause legitimate routing peers to due to configuration errors, which cause legitimate routing peers to
feed invalid routing information to other neighboring peers. feed invalid routing information to other neighboring peers.
For off-path active attacks, the attacks are generally limited to For off-path active attacks, the attacks are generally limited to
message insertion or modification which can divert traffic to message insertion or modification which can divert traffic to
illegitimate destinations and cause traffic to never reach its illegitimate destinations and cause traffic to never reach its
intended destination. intended destination.
2.5.2 Confidentiality Violations 2.5.2. Confidentiality Violations
Confidentiality violations can occur when a miscreant intercepts any Confidentiality violations can occur when a miscreant intercepts any
of the routing update traffic. This is becoming more of a concern of the routing update traffic. This is becoming more of a concern
because many ISPs are classifying addressing schemes and network because many ISPs are classifying addressing schemes and network
topologies as private and proprietary information. It is also a topologies as private and proprietary information. It is also a
concern because the routing protocol packets contain information that concern because the routing protocol packets contain information that
may show ways in which routing sessions could be spoofed or hijacked. may show ways in which routing sessions could be spoofed or hijacked.
This in turn could lead into a man-in-the-middle attack where the This in turn could lead into a man-in-the-middle attack where the
miscreants can insert themselves into the traffic path or divert the miscreants can insert themselves into the traffic path or divert the
traffic path and violate the confidentiality of user data. traffic path and violate the confidentiality of user data.
2.5.3 Offline Cryptographic Attacks 2.5.3. Offline Cryptographic Attacks
If any cryptographic mechanism was used to provide for data integrity If any cryptographic mechanism was used to provide for data integrity
and confidentiality, an offline cryptographic attack could and confidentiality, an offline cryptographic attack could
potentially compromise the data. The traffic would need to be potentially compromise the data. The traffic would need to be
captured either by eavesdropping on the network or by being able to captured either by eavesdropping on the network or by being able to
divert traffic to a malicious user. Note that by using divert traffic to a malicious user. Note that by using
cryptographically protected routing information, the latter would cryptographically protected routing information, the latter would
require the cryptographic key to already be compromised anyway so require the cryptographic key to already be compromised anyway so
this attack is only feasible if a device was able eavesdrop and this attack is only feasible if a device was able eavesdrop and
capture the cryptographically protected routing information. capture the cryptographically protected routing information.
2.5.4 Replay Attacks 2.5.4. Replay Attacks
For a replay attack to be successful, the routing control plane For a replay attack to be successful, the routing control plane
traffic would need to first be captured either on-path or diverted to traffic would need to first be captured either on-path or diverted to
an attacker to later be replayed to the intended recipient. an attacker to later be replayed to the intended recipient.
2.5.5 Message Insertion/Deletion/Modification 2.5.5. Message Insertion/Deletion/Modification
Routing control plane traffic can be manipulated by someone in Routing control plane traffic can be manipulated by someone in
control of intermediate hosts. In addition, traffic can be injected control of intermediate hosts. In addition, traffic can be injected
by forging IP addresses, where a remote router sends out packets by forging IP addresses, where a remote router sends out packets
which appear to come from another, trusted router. If enough traffic which appear to come from another, trusted router. If enough traffic
is injected to be processed by limited memory routers it can cause a is injected to be processed by limited memory routers it can cause a
DoS attack. DoS attack.
2.5.6 Man-In-The-Middle 2.5.6. Man-In-The-Middle
A man-in-the-middle attack attacks the identity of a communicating A man-in-the-middle attack attacks the identity of a communicating
peer rather than the data stream itself. The attacker intercepts peer rather than the data stream itself. The attacker intercepts
traffic that is sent from one routing peer to the other and traffic that is sent from one routing peer to the other and
communicates on behalf of one of the peers. This can lead to communicates on behalf of one of the peers. This can lead to
diversion of the user traffic to either an unauthorized receiving diversion of the user traffic to either an unauthorized receiving
party or cause legitimate traffic to never reach its intended party or cause legitimate traffic to never reach its intended
destination. destination.
2.5.7 Security Practices 2.5.7. Security Practices
Securing the routing control plane takes many features which are Securing the routing control plane takes many features which are
generally deployed as a system. MD5 authentication is used by some generally deployed as a system. MD5 authentication is used by some
ISPs to validate the sending peer and to ensure that the data in ISPs to validate the sending peer and to ensure that the data in
transit has not been altered. Some ISPs only deploy MD-5 transit has not been altered. Some ISPs only deploy MD-5
authentication at customer's request. Additional sanity checks to authentication at customer's request. Additional sanity checks to
ensure with reasonable certainty that the received routing update was ensure with reasonable certainty that the received routing update was
originated by a valid routing peer include route filters and the BTSH originated by a valid routing peer include route filters and the BTSH
feature [BTSH]. Note that validating whether a legitimate peer has feature [BTSH]. Note that validating whether a legitimate peer has
the authority to send the contents of the routing update is a the authority to send the contents of the routing update is a
skipping to change at page 23, line 5 skipping to change at page 23, line 45
outgoing prefix filters for peers and upstream neighbors, incoming outgoing prefix filters for peers and upstream neighbors, incoming
AS-PATH filter for BGP customers, outgoing AS-PATH filter towards AS-PATH filter for BGP customers, outgoing AS-PATH filter towards
peers and upstream neighbors, route dampening and rejecting selected peers and upstream neighbors, route dampening and rejecting selected
attributes and communities. Consistency between these policies attributes and communities. Consistency between these policies
varies greatly although there is a trend to start depending on AS- varies greatly although there is a trend to start depending on AS-
PATH filters because they are much more manageable than the large PATH filters because they are much more manageable than the large
numbers of prefix filters that would need to be maintained. Many numbers of prefix filters that would need to be maintained. Many
ISPs also do not propagate interface IP addresses to further reduce ISPs also do not propagate interface IP addresses to further reduce
attack vectors on routers and connected customers. attack vectors on routers and connected customers.
2.5.8 Security Services 2.5.8. Security Services
o User Authentication - Not applicable o User Authentication - Not applicable
o User Authorization - Not applicable o User Authorization - Not applicable
o Data Origin Authentication - By using MD5 authentication and/or o Data Origin Authentication - By using MD5 authentication and/or
the TTL-hack a routing peer can be reasonably certain that traffic the TTL-hack a routing peer can be reasonably certain that traffic
originated from a valid peer. originated from a valid peer.
o Access Control - Route filters, AS-PATH filters and prefix limits o Access Control - Route filters, AS-PATH filters and prefix limits
are used to control access to specific parts of the network. are used to control access to specific parts of the network.
o Data Integrity - By using MD5 authentication a peer can be o Data Integrity - By using MD5 authentication a peer can be
reasonably certain that the data has not been modified in transit reasonably certain that the data has not been modified in transit
but there is no mechanism to prove the validity of the routing but there is no mechanism to prove the validity of the routing
skipping to change at page 23, line 25 skipping to change at page 24, line 18
o Access Control - Route filters, AS-PATH filters and prefix limits o Access Control - Route filters, AS-PATH filters and prefix limits
are used to control access to specific parts of the network. are used to control access to specific parts of the network.
o Data Integrity - By using MD5 authentication a peer can be o Data Integrity - By using MD5 authentication a peer can be
reasonably certain that the data has not been modified in transit reasonably certain that the data has not been modified in transit
but there is no mechanism to prove the validity of the routing but there is no mechanism to prove the validity of the routing
information itself. information itself.
o Data Confidentiality - Not implemented o Data Confidentiality - Not implemented
o Auditing / Logging - TBD o Auditing / Logging - Filter exceptions are logged.
o DoS Mitigation - Many DoS attacks are mitigated using a o DoS Mitigation - Many DoS attacks are mitigated using a
combination of techniques including: MD5 authentication, the BTSH combination of techniques including: MD5 authentication, the BTSH
feature, filtering routing advertisements to bogons and filtering feature, filtering routing advertisements to bogons and filtering
routing advertisements to one's own network. routing advertisements to one's own network.
2.5.9 Additional Considerations 2.5.9. Additional Considerations
So far the primary concern to secure the routing control plane has So far the primary concern to secure the routing control plane has
been to validate the sending peer and to ensure that the data in been to validate the sending peer and to ensure that the data in
transit has not been altered. Although MD-5 routing protocol transit has not been altered. Although MD-5 routing protocol
extensions have been implemented which can provide both services, extensions have been implemented which can provide both services,
they are not consistently deployed amongst ISPs. Two major they are not consistently deployed amongst ISPs. Two major
deployment concerns have been implementation issues where both deployment concerns have been implementation issues where both
software bugs and the lack of graceful re-keying options have caused software bugs and the lack of graceful re-keying options have caused
significant network down times. Also, some ISPs express concern that significant network down times. Also, some ISPs express concern that
deploying MD5 authentication will itself be a worse DoS attack victim deploying MD5 authentication will itself be a worse DoS attack victim
skipping to change at page 24, line 14 skipping to change at page 25, line 6
IPsec is not deployed since the operational management aspects of IPsec is not deployed since the operational management aspects of
ensuring interoperability and reliable configurations is too complex ensuring interoperability and reliable configurations is too complex
and time consuming to be operationally viable. There is also limited and time consuming to be operationally viable. There is also limited
concern to the confidentiality of the routing information. The concern to the confidentiality of the routing information. The
integrity and validity of the updates are of much greater concern. integrity and validity of the updates are of much greater concern.
There is concern for manual or automated actions which introduce new There is concern for manual or automated actions which introduce new
routes and can affect the entire routing domain. routes and can affect the entire routing domain.
2.6 Software Upgrades and Configuration Integrity / Validation 2.6. Software Upgrades and Configuration Integrity / Validation
Software upgrades and configuration changes are usually performed as Software upgrades and configuration changes are usually performed as
part of either in-band or OOB management functions. However, there part of either in-band or OOB management functions. However, there
are additional considerations to be taken into account which are are additional considerations to be taken into account which are
enumerated in this section. enumerated in this section.
2.6.1 Threats / Attacks 2.6.1. Threats / Attacks
Attacks performed on system software and configurations can be both Attacks performed on system software and configurations can be both
from passive or active sources. Passive attacks are possible if from passive or active sources. Passive attacks are possible if
someone has the capability to intercept data between the network someone has the capability to intercept data between the network
infrastructure device and the system which is downloading or infrastructure device and the system which is downloading or
uploading the software or configuration information. This can be uploading the software or configuration information. This can be
accomplished if a single infrastructure device is somehow compromised accomplished if a single infrastructure device is somehow compromised
and can act as a network sniffer or if it is possible to insert a new and can act as a network sniffer or if it is possible to insert a new
device which acts as a network sniffer. device which acts as a network sniffer.
Active attacks are possible for both on-path and off-path scenarios. Active attacks are possible for both on-path and off-path scenarios.
For on-path active attacks, the situation is the same as for a For on-path active attacks, the situation is the same as for a
passive attack, where either a device has to already be compromised passive attack, where either a device has to already be compromised
or a device can be inserted into the path. For off-path active or a device can be inserted into the path. For off-path active
attacks, the attacks are generally limited to message insertion or attacks, the attacks are generally limited to message insertion or
modification where the attacker may wish to load illegal software or modification where the attacker may wish to load illegal software or
configuration files to an infrastructure device. configuration files to an infrastructure device.
2.6.2 Confidentiality Violations 2.6.2. Confidentiality Violations
Confidentiality violations can occur when a miscreant intercepts any Confidentiality violations can occur when a miscreant intercepts any
of the software image or configuration information. The software of the software image or configuration information. The software
image may give an indication of exploits which the device is image may give an indication of exploits which the device is
vulnerable to while the configuration information can inadvertently vulnerable to while the configuration information can inadvertently
lead attackers to identify critical infrastructure IP addresses and lead attackers to identify critical infrastructure IP addresses and
passwords. passwords.
2.6.3 Offline Cryptographic Attacks 2.6.3. Offline Cryptographic Attacks
If any cryptographic mechanism was used to provide for data integrity If any cryptographic mechanism was used to provide for data integrity
and confidentiality, an offline cryptographic attack could and confidentiality, an offline cryptographic attack could
potentially compromise the data. The traffic would need to be potentially compromise the data. The traffic would need to be
captured either by eavesdropping on the network or by being able to captured either by eavesdropping on the network or by being able to
divert traffic to a malicious user. divert traffic to a malicious user.
2.6.4 Replay Attacks 2.6.4. Replay Attacks
For a replay attack to be successful, the software image or For a replay attack to be successful, the software image or
configuration file would need to first be captured either on-path or configuration file would need to first be captured either on-path or
diverted to an attacker to later be replayed to the intended diverted to an attacker to later be replayed to the intended
recipient. recipient.
2.6.5 Message Insertion/Deletion/Modification 2.6.5. Message Insertion/Deletion/Modification
Software images and configuration files can be manipulated by someone Software images and configuration files can be manipulated by someone
in control of intermediate hosts. By forging an IP address and in control of intermediate hosts. By forging an IP address and
impersonating a valid host which can download software images or impersonating a valid host which can download software images or
configuration files, invalid files can be downloaded to an configuration files, invalid files can be downloaded to an
infrastructure device. An invalid software image or configuration infrastructure device. An invalid software image or configuration
file can cause a device to hang and become inoperable. Spoofed file can cause a device to hang and become inoperable. Spoofed
configuration files can be hard to detect, especially when the only configuration files can be hard to detect, especially when the only
added command is to allow a miscreant access to that device by added command is to allow a miscreant access to that device by
entering a filter allowing a specific host access and configuring a entering a filter allowing a specific host access and configuring a
local username/password database entry for authentication to that local username/password database entry for authentication to that
device. device.
2.6.6 Man-In-The-Middle 2.6.6. Man-In-The-Middle
A man-in-the-middle attack attacks the identity of a communicating A man-in-the-middle attack attacks the identity of a communicating
peer rather than the data stream itself. The attacker intercepts peer rather than the data stream itself. The attacker intercepts
traffic that is sent between the infrastructure device and the host traffic that is sent between the infrastructure device and the host
used to upload/download the system image or configuration file. He/ used to upload/download the system image or configuration file. He/
she can then act on behalf of one or both of these systems. she can then act on behalf of one or both of these systems.
If an attacker obtained a copy of the software image being deployed, If an attacker obtained a copy of the software image being deployed,
he could potentially exploit a known vulnerability and gain access to he could potentially exploit a known vulnerability and gain access to
the system. From a captured configuration file, he could obtain the system. From a captured configuration file, he could obtain
confidential network topology information or even more damaging confidential network topology information or even more damaging
information if any of the passwords in the configuration file were information if any of the passwords in the configuration file were
not encrypted. not encrypted.
2.6.7 Security Practices 2.6.7. Security Practices
Images and configurations are stored on specific hosts which have Images and configurations are stored on specific hosts which have
limited access. All access and activity relating to these hosts are limited access. All access and activity relating to these hosts are
authenticated and logged via AAA services. When uploaded/downloading authenticated and logged via AAA services. When uploaded/downloading
any system software or configuration files, either TFTP, FTP or SCP any system software or configuration files, either TFTP, FTP or SCP
can be used. Where possible, SCP is used to secure the data transfer can be used. Where possible, SCP is used to secure the data transfer
and FTP is generally never used. All TFTP and SCP access is and FTP is generally never used. All TFTP and SCP access is
username/password authenticated and in most environments scripts are username/password authenticated and in most environments scripts are
used for maintaining a large number of routers. To ensure the used for maintaining a large number of routers. To ensure the
integrity of the configurations, every hour the configuration files integrity of the configurations, every hour the configuration files
skipping to change at page 26, line 34 skipping to change at page 27, line 27
older software which may not support this functionality, older software which may not support this functionality,
configuration files are stored with passwords in readable format. [is configuration files are stored with passwords in readable format. [is
this true? are configuration files then protected? if passwords in this true? are configuration files then protected? if passwords in
readable format, is the thought that an OOB management network with readable format, is the thought that an OOB management network with
SCP will be enough protection? ] SCP will be enough protection? ]
Automated security validation is performed on infrastructure devices Automated security validation is performed on infrastructure devices
using nmap and nessus to ensure valid configuration against many of using nmap and nessus to ensure valid configuration against many of
the well-known attacks. the well-known attacks.
2.6.8 Security Services 2.6.8. Security Services
o User Authentication - All users are authenticated before being o User Authentication - All users are authenticated before being
able to download/upload any system images or configuration files. able to download/upload any system images or configuration files.
o User Authorization - All authenticated users are granted specific o User Authorization - All authenticated users are granted specific
privileges to download or upload system images and/or privileges to download or upload system images and/or
configuration files. configuration files.
o Data Origin Authentication - TBD o Data Origin Authentication - Filters are used to limit access to
uploading/downloading configuration files and system images to
specific IP addresses.
o Access Control - Filters are used to limit access to uploading/ o Access Control - Filters are used to limit access to uploading/
downloading configuration files and system images to specific IP downloading configuration files and system images to specific IP
addresses and protocols. addresses and protocols.
o Data Integrity - All systems use either a CRC-check or MD5 o Data Integrity - All systems use either a CRC-check or MD5
authentication to ensure data integrity. authentication to ensure data integrity.
o Data Confidentiality - If the SCP protocol is used then there is o Data Confidentiality - If the SCP protocol is used then there is
confidentiality of the downloaded/uploaded configuration files and confidentiality of the downloaded/uploaded configuration files and
system images. system images.
o Auditing / Logging - All access and activity relating to o Auditing / Logging - All access and activity relating to
downloading/uploading system images and configuration files are downloading/uploading system images and configuration files are
logged via AAA services and filter exception rules. logged via AAA services and filter exception rules.
o DoS Mitigation - TBD o DoS Mitigation - TBD
2.6.9 Additional Considerations 2.6.9. Additional Considerations
Where the MD5 algorithm is not used to perform data integrity Where the MD5 algorithm is not used to perform data integrity
checking of software images and configuration files, ISPs have checking of software images and configuration files, ISPs have
expressed an interest in having this functionality. IPsec is expressed an interest in having this functionality. IPsec is
considered too cumbersome and operationally difficult to use for data considered too cumbersome and operationally difficult to use for data
integrity and confidentiality. integrity and confidentiality.
2.7 Logging Considerations 2.7. Logging Considerations
Although logging is part of all the previous sections, it is Although logging is part of all the previous sections, it is
important enough to be covered as a separate item. The main issues important enough to be covered as a separate item. The main issues
revolve around what gets logged, how long are logs kept and what revolve around what gets logged, how long are logs kept and what
mechanisms are used to secure the logged information while it is in mechanisms are used to secure the logged information while it is in
transit and while it is stored. transit and while it is stored.
2.7.1 Threats / Attacks 2.7.1. Threats / Attacks
Attacks on the logged data can be both from passive or active Attacks on the logged data can be both from passive or active
sources. Passive attacks are possible if someone has the capability sources. Passive attacks are possible if someone has the capability
to intercept data between the recipient logging server and the device to intercept data between the recipient logging server and the device
the logged data originated from. This can be accomplished if a the logged data originated from. This can be accomplished if a
single infrastructure device is somehow compromised and can act as a single infrastructure device is somehow compromised and can act as a
network sniffer or if it is possible to insert a new device which network sniffer or if it is possible to insert a new device which
acts as a network sniffer. acts as a network sniffer.
Active attacks are possible for both on-path and off-path scenarios. Active attacks are possible for both on-path and off-path scenarios.
For on-path active attacks, the situation is the same as for a For on-path active attacks, the situation is the same as for a
passive attack, where either a device has to already be compromised passive attack, where either a device has to already be compromised
or a device can be inserted into the path. For off-path active or a device can be inserted into the path. For off-path active
attacks, the attacks are generally limited to message insertion or attacks, the attacks are generally limited to message insertion or
modification which can alter the logged data to keep any compromise modification which can alter the logged data to keep any compromise
from being detected or to destroy any evidence which could be used from being detected or to destroy any evidence which could be used
for criminal prosecution. for criminal prosecution.
2.7.1.1 Confidentiality Violations 2.7.1.1. Confidentiality Violations
Confidentiality violations can occur when a miscreant intercepts any Confidentiality violations can occur when a miscreant intercepts any
of the logging data which is in transit on the network. This could of the logging data which is in transit on the network. This could
lead to privacy violations if some of the logged data has not been lead to privacy violations if some of the logged data has not been
sanitized to disallow any data that could be a violation of privacy sanitized to disallow any data that could be a violation of privacy
to be included in the logged data. to be included in the logged data.
2.7.1.2 Offline Cryptographic Attacks 2.7.1.2. Offline Cryptographic Attacks
If any cryptographic mechanism was used to provide for data integrity If any cryptographic mechanism was used to provide for data integrity
and confidentiality, an offline cryptographic attack could and confidentiality, an offline cryptographic attack could
potentially compromise the data. The traffic would need to be potentially compromise the data. The traffic would need to be
captured either by eavesdropping on the network or by being able to captured either by eavesdropping on the network or by being able to
divert traffic to a malicious user. divert traffic to a malicious user.
2.7.1.3 Replay Attacks 2.7.1.3. Replay Attacks
For a replay attack to be successful, the logging data would need to For a replay attack to be successful, the logging data would need to
first be captured either on-path or diverted to an attacker and later first be captured either on-path or diverted to an attacker and later
replayed to the recipient. [is reply handled by syslog protocol?] replayed to the recipient. [is reply handled by syslog protocol?]
2.7.1.4 Message Insertion/Deletion/Modification 2.7.1.4. Message Insertion/Deletion/Modification
Logging data could be injected, deleted or modified by someone in Logging data could be injected, deleted or modified by someone in
control of intermediate hosts. Logging data can also be injected by control of intermediate hosts. Logging data can also be injected by
forging packets from either legitimate or illegitimate IP addresses. forging packets from either legitimate or illegitimate IP addresses.
2.7.1.5 Man-In-The-Middle 2.7.1.5. Man-In-The-Middle
A man-in-the-middle attack attacks the identity of a communicating A man-in-the-middle attack attacks the identity of a communicating
peer rather than the data stream itself. The attacker intercepts peer rather than the data stream itself. The attacker intercepts
traffic that is sent between the infrastructure device and the traffic that is sent between the infrastructure device and the
logging server or traffic sent between the logging server and the logging server or traffic sent between the logging server and the
database which is used to archive the logged data. Any unauthorized database which is used to archive the logged data. Any unauthorized
access to logging information could lead to knowledge of private and access to logging information could lead to knowledge of private and
proprietary network topology information which could be used to proprietary network topology information which could be used to
compromise portions of the network. An additional concern is having compromise portions of the network. An additional concern is having
access to logging information which could be deleted or modified so access to logging information which could be deleted or modified so
as to cover any traces of a security breach. as to cover any traces of a security breach.
2.7.2 Security Practices 2.7.2. Security Practices
Logging is mostly performed on an exception auditing basis when it Logging is mostly performed on an exception auditing basis when it
comes to filtering (i.e. traffic which is NOT allowed is logged). comes to filtering (i.e. traffic which is NOT allowed is logged).
Typically the data logged will contain the source and destination IP Typically the data logged will contain the source and destination IP
addresses and layer 4 port numbers as well as a timestamp. The addresses and layer 4 port numbers as well as a timestamp. The
syslog protocol is used to transfer the logged data between the syslog protocol is used to transfer the logged data between the
infrastructure device to the syslog server. Many ISPs use the OOB infrastructure device to the syslog server. Many ISPs use the OOB
management network to transfer syslog data since there is virtually management network to transfer syslog data since there is virtually
no security performed between the syslog server and the device. All no security performed between the syslog server and the device. All
ISPs have multiple syslog servers - some ISPs choose to use separate ISPs have multiple syslog servers - some ISPs choose to use separate
skipping to change at page 29, line 37 skipping to change at page 30, line 29
the device for log files. This provides a backup mechanism to see the device for log files. This provides a backup mechanism to see
what is going on in the network in the event that a device may what is going on in the network in the event that a device may
'forget' to do syslog if the CPU is busy. 'forget' to do syslog if the CPU is busy.
The logs from the various syslog server devices are generally The logs from the various syslog server devices are generally
transferred into databases at a set interval which can be anywhere transferred into databases at a set interval which can be anywhere
from every 10 minutes to every hour. One ISP uses Rsync to push the from every 10 minutes to every hour. One ISP uses Rsync to push the
data into a database and then the information is sorted manually by data into a database and then the information is sorted manually by
someone SSH'ing to that database. someone SSH'ing to that database.
2.7.3 Security Services 2.7.3. Security Services
o User Authentication - Not applicable o User Authentication - Not applicable
o User Authorization - Not applicable o User Authorization - Not applicable
o Data Origin Authentication - Not implemented o Data Origin Authentication - Not implemented
o Access Control - Filtering on logging host and server IP address o Access Control - Filtering on logging host and server IP address
to ensure that syslog information only goes to specific syslog to ensure that syslog information only goes to specific syslog
hosts. hosts.
skipping to change at page 30, line 4 skipping to change at page 30, line 42
o User Authorization - Not applicable o User Authorization - Not applicable
o Data Origin Authentication - Not implemented o Data Origin Authentication - Not implemented
o Access Control - Filtering on logging host and server IP address o Access Control - Filtering on logging host and server IP address
to ensure that syslog information only goes to specific syslog to ensure that syslog information only goes to specific syslog
hosts. hosts.
o Data Integrity - Not implemented o Data Integrity - Not implemented
o Data Confidentiality - Not implemented o Data Confidentiality - Not implemented
o Auditing / Logging - TBD o Auditing / Logging - This entire section deals with logging.
o DoS Mitigation - TBD o DoS Mitigation - TBD
2.7.4 Additional Considerations 2.7.4. Additional Considerations
There is no security with syslog and ISPs are fully cognizant of There is no security with syslog and ISPs are fully cognizant of
this. IPsec is considered too operationally expensive and cumbersome this. IPsec is considered too operationally expensive and cumbersome
to deploy. Syslog-ng and stunnel are being looked at for providing to deploy. Syslog-ng and stunnel are being looked at for providing
better authenticated and integrity protected solutions. Mechanisms better authenticated and integrity protected solutions. Mechanisms
to prevent unauthorized personnel from tampering with logs is to prevent unauthorized personnel from tampering with logs is
constrained to auditing who has access to the logging servers and constrained to auditing who has access to the logging servers and
files. files.
ISPs expressed requirements for more than just UDP syslog. They ISPs expressed requirements for more than just UDP syslog. They
would also like more granular and flexible facilities and priorities, would also like more granular and flexible facilities and priorities,
i.e. specific logs to specific servers. i.e. specific logs to specific servers.
2.8 Denial of Service Tracking / Tracing 2.8. Filtering Considerations
Although filtering has been covered under many of the previous
sections, this section will provide some more insights to the
filtering considerations that are currently being taken into account.
Filtering is now being categorized into three specific areas: data
plane, management plane and routing control plane.
2.8.1. Data Plane Filtering
Data plane filters control the traffic that traverses through a
device and affect transit traffic. Most ISPs deploy these kinds of
filters at the customer facing edge devices to mitigate spoofing
attacks.
2.8.2. Management Plane Filtering
Management filters control the traffic to and from a device. All of
the protocols which are used for device management fall under this
category and includes SSH, Telnet, SNMP, NTP, http, DNS, TFTP, FTP,
SCP and Syslog. This type of traffic is currently filtered per
interface and is based on any combination of protocol, source and
destination IP address and source and destination port number. Note
that logging the filtering rules can today place a burden on many
systems and more granularity is often required to more specifically
log the required exceptions.
IPv6 networks require the use of specific ICMP messages for proper
protocol operation. Therefore, ICMP cannot be completely filtered to
and from a device. Instead, granular ICMPv6 filtering is always
deployed to allow for specific ICMPv6 types to be sourced or destined
to a network device.
2.8.3. Routing Control Plane Filtering
Routing filters are used to control the flow of routing information.
In IPv6 networks, some providers are liberal in accepting /48Os due
to the still unresolved multihoming issues. Anything longer than a
/48 is discarded on EBGP.
2.9. Denial of Service Tracking / Tracing
Denial of Service attacks are an ever increasing problem and require Denial of Service attacks are an ever increasing problem and require
vast amounts of resources to combat effectively. Some large ISPs do vast amounts of resources to combat effectively. Some large ISPs do
not concern themselves with attack streams that are less than 1G in not concern themselves with attack streams that are less than 1G in
bandwidth - this is on the larger pipes where 1G is essentially less bandwidth - this is on the larger pipes where 1G is essentially less
than 5% of offered load. This is largely due to the large amounts of than 5% of offered load. This is largely due to the large amounts of
DDoS traffic which continually requires investigation and mitigation. DDoS traffic which continually requires investigation and mitigation.
At last count the number of hosts making up large distributed DoS At last count the number of hosts making up large distributed DoS
BOTnets exceeded 1 million hosts. BOTnets exceeded 1 million hosts.
New techniques are continually evolving to automate the process of New techniques are continually evolving to automate the process of
detecting DoS sources and mitigating any adverse effects as quickly detecting DoS sources and mitigating any adverse effects as quickly
as possible. At this time, ISPs are using a variety of mitigation as possible. At this time, ISPs are using a variety of mitigation
techniques including: sink hole routing, black-hole triggered techniques including: sink hole routing, black-hole triggered
routing, uRPF and rate limiting. Each of these techniques will be routing, uRPF and rate limiting. Each of these techniques will be
detailed below. detailed below.
2.8.1 Sink Hole Routing 2.9.1. Sink Hole Routing
To be added. Sink hole routing refers to injecting a more specific route for any
known attack traffic which will ensure that the malicious traffic is
redirected to a valid subnet or specific IP address where it can be
analyzed.
2.8.2 Black-Hole Triggered Routing 2.9.2. Black-Hole Triggered Routing
To be added. Black-hole triggered routing is a technique where the BGP routing
protocol is used to propagate static routes which in turn redirects
attack traffic to the null interface where it is effectively dropped.
This technique is often used in large routing infrastructures since
BGP can propagate the information in a fast effective manner as
opposed to using any packet-based filtering techniques on hundreds or
thousands of routers.
2.8.3 Unicast Reverse Path Forwarding 2.9.3. Unicast Reverse Path Forwarding
Unicast Reverse Path Forwarding (uRPF) is a mechanism for validating Unicast Reverse Path Forwarding (uRPF) is a mechanism for validating
whether an incoming packet has a legitimate source address or not. whether an incoming packet has a legitimate source address or not.
It has two modes: strict mode and loose mode. In strict mode, uRPF It has two modes: strict mode and loose mode. In strict mode, uRPF
checks whether the incoming packet has a source address that matches checks whether the incoming packet has a source address that matches
a prefix in the routing table, and whether the interface expects to a prefix in the routing table, and whether the interface expects to
receive a packet with this source address prefix. If the incoming receive a packet with this source address prefix. If the incoming
packet fails the unicast RPF check, the packet is not accepted on the packet fails the unicast RPF check, the packet is not accepted on the
incoming interface. Loose mode uRPF is not as specific and the incoming interface. Loose mode uRPF is not as specific and the
incoming packet is accepted if there is any route in the routing incoming packet is accepted if there is any route in the routing
table for the source address. table for the source address.
uRPF is not used on interfaces that are likely to have routing uRPF is not used on interfaces that are likely to have routing
asymmetry, meaning multiple routes to the source of a packet. asymmetry, meaning multiple routes to the source of a packet.
Usually for ISPs, uRPF is placed at the customer edge of a network. Usually for ISPs, uRPF is placed at the customer edge of a network.
2.8.4 Rate Limiting 2.9.4. Rate Limiting
Details of rate limiting Rate limiting refers to allocating a specific amount of bandwidth or
packets per second to specific traffic types. This technique is
widely used to mitigate well-known protocol attacks such as the TCP-
SYN attack where a large number of resources get allocated for
spoofed TCP traffic. Although this technique does not stop an
attack, it can lessen the damage and impact on a specific service.
3. Security Considerations 3. Security Considerations
This entire document deals with current security practices in large This entire document deals with current security practices in large
ISP environments. As a synopsis, a table is shown below which ISP environments. As a synopsis, a table is shown below which
summarizes the operational functions which are to be protected and summarizes the operational functions which are to be protected and
the security services which currently deployed security practices the security services which currently deployed security practices
offer: [ Table to be added ] offer: [ Table to be added ]
4. Normative References 4. Normative References
skipping to change at page 32, line 25 skipping to change at page 35, line 5
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997. Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC2828] Shirey, R., "Internet Security Glossary", RFC 2828, [RFC2828] Shirey, R., "Internet Security Glossary", RFC 2828,
May 2000. May 2000.
[RFC3552] Rescorla, E. and B. Korver, "Guidelines for Writing RFC [RFC3552] Rescorla, E. and B. Korver, "Guidelines for Writing RFC
Text on Security Considerations", BCP 72, RFC 3552, Text on Security Considerations", BCP 72, RFC 3552,
July 2003. July 2003.
Author's Address
Merike Kaeo
Double Shot Security, Inc.
520 Washington Blvd. #363
Marina Del Rey, CA 90292
U.S.A.
Phone: +1 310 866 0165
Email: merike@doubleshotsecurity.com
Appendix A. Acknowledgments Appendix A. Acknowledgments
The editor gratefully acknowledges the contributions of: George The editor gratefully acknowledges the contributions of: George
Jones, who has been instrumental in providing guidance and direction Jones, who has been instrumental in providing guidance and direction
for this document and the insighful comments from Ross Callon and the for this document and the insighful comments from Ross Callon and the
numerous ISP operators who supplied the information which is depicted numerous ISP operators who supplied the information which is depicted
in this document. in this document.
Appendix B. Protocol Specific Attacks Appendix B. Protocol Specific Attacks
This section will enumerate many of the traditional protocol based This section will enumerate many of the traditional protocol based
attacks which have been observed over the years to cause malformed attacks which have been observed over the years to cause malformed
packets and/or exploit protocol deficiencies. packets and/or exploit protocol deficiencies.
B.1. Layer 2 Attacks
o ARP Flooding o ARP Flooding
B.2. IPv4 Attacks
o IP Stream Option o IP Stream Option
o IP Address Spoofing o IP Address Spoofing
o IP Source Route Option o IP Source Route Option
o IP Short header o IP Short header
o IP Malformed Packet o IP Malformed Packet
skipping to change at page 36, line 5 skipping to change at page 37, line 36
o SYN with IP Spoofing (Land Attack) o SYN with IP Spoofing (Land Attack)
o SYN and FIN bits set o SYN and FIN bits set
o TCP port scan attack o TCP port scan attack
o UDP spoofed broadcast echo (Fraggle Attack) o UDP spoofed broadcast echo (Fraggle Attack)
o UDP attack on diag ports (Pepsi Attack) o UDP attack on diag ports (Pepsi Attack)
B.3. IPv6 Attacks
Any of the above-mentioned IPv4 attacks could be used in IPv6
networks with the exception of any fragmentation and broadcast
traffic, which operate differently in IPv6.
Today, IPv6 enabled hosts are starting to be used to create IPv6
tunnels which can effectively hide botnet and other malicious traffic
if firewalls and network flow collection tools are not capable of
detecting this traffic.
Author's Address
Merike Kaeo
Double Shot Security, Inc.
520 Washington Blvd. #363
Marina Del Rey, CA 90292
U.S.A.
Phone: +1 310 866 0165
Email: merike@doubleshotsecurity.com
Intellectual Property Statement Intellectual Property Statement
The IETF takes no position regarding the validity or scope of any The IETF takes no position regarding the validity or scope of any
Intellectual Property Rights or other rights that might be claimed to Intellectual Property Rights or other rights that might be claimed to
pertain to the implementation or use of the technology described in pertain to the implementation or use of the technology described in
this document or the extent to which any license under such rights this document or the extent to which any license under such rights
might or might not be available; nor does it represent that it has might or might not be available; nor does it represent that it has
made any independent effort to identify any such rights. Information made any independent effort to identify any such rights. Information
on the procedures with respect to rights in RFC documents can be on the procedures with respect to rights in RFC documents can be
found in BCP 78 and BCP 79. found in BCP 78 and BCP 79.
 End of changes. 89 change blocks. 
122 lines changed or deleted 243 lines changed or added

This html diff was produced by rfcdiff 1.27, available from http://www.levkowetz.com/ietf/tools/rfcdiff/