Internet2 Network Security SIG

["Brock, Anthony W" <>]

Thank you all for a great meeting last week!

 

We covered several topics and it looks like some interesting projects are on the horizon. Here are my notes:

 

2018 Internet2 Global Summit

Security WG

 

-          Introductions

-          uRPF

o   Internet2 has been investigating possible uRPF solutions for their environment

§  Started with basic management ACLs

§  Is now rolling out uRPF in logging mode to track data

§  Mostly seeing asymmetric traffic

o   Indiana University

§  Strict uRPF at client edge

§  Loose uRPF at border

o   Oregon State University

§  Some strict uRPF at client edge

§  Loose uRPF, RTBH and ACLs at border

o   Internet2 will report back concerning how much traffic crossing their network is spoofed

o   Internet2 will investigate the potential for notifying connectors/campuses when they source spoofed traffic

-          Flowspec

o   Internet2 is in the process of configuring a pilot.

o   The pilot is expected to start around the beginning on June.

o   Anyone interested in participating should contact Karl or Paul at Internet2

o   Items that need to be addressed:

§  How will Internet2 validate injected entries?

§  How will entries be logged/recorded for posterity?

§  How will entries be aged and removed? What is the feedback loop to the advertising connector/campus?

§  (What is the/Will there be a) feedback loop to connectors/campuses that sourced the traffic triggering creation of an entry?

§  What are the limits for number entries?

o   Potential solutions/examples:

§  The Flowspy at GÉANT.

§  Firewall on demand.

-          REN Routing Security group

o   This is a collaboration among various RENs (Internet2, GÉANT, Jisc, etc.)

o   The group has met twice.

o   Current focus is on the Mutually Agreed Norms for Routing Security (MANRS - https://www.manrs.org/)

o   The idea is to generate interest at the top levels of management, freeing time and resources for technical staff to prioritize activities such as RPKI

-          RPKI

o   This project is now being driven by the REN Routing Security group

o   I2 will keep the Security WG informed and, in the future, may be looking for their assistance in rolling something out

-          BGP hijacking (prefix hijacking)

o   Some members have recently suffered this type of attack

o   Solution:

§  The first step is monitoring; BGPmon or similar services

§  Some members have successfully worked around this through disaggregation, although this will not work for prefixes longer than a /24

 

Tony