REN Routing Security

[Anita Nikolich <>]

REN Routing Security Wrap Up Aug 16 2018 10 AM CT

Thank you for almost the entire working group attending the final meeting and giving some great input! Please tell me if I captured something incorrectly below. Thanks to so many of you for implementing or starting to implement MANRS.

Though this group wrapped up, don't forget there is an Internet2 Security Working Group. And don't forget the routing security workshop on Monday October 15th at Tech Exchange in Orlando. Finally, if you have any feedback or suggestions on routing security please email myself and/or Paul Howell.

Agenda:

1.      I2 update on MANRS and ARTEMIS.

       Internet2 in process of implementing #1-3 of MANRS by end of 2018.

       Developer of ARTEMIS (UCSD) has put in I2 as one of the early adopters of ARTEMIS as part of an NSF grant submission. If awarded, assistance in setting up would be funded by the grant.

2.      Input for NGI planning from both members and collaborators such as other NRENs. Desire to continue the group or merge with other groups (ie use the Security WG for this purpose) to provide input to NGI planning with regard to routing security & embedded security?

Feedback on call:

1. Embed security into automation tools.
2. Could updated prefix lists have some automation?
3. If an I2 member joins MANRS, I2 should offer monitoring as a service for free as an incentive. BGPMON for example. Or RADB.
4. How to incentivize MANRS submissions? Create a MANRS dashboard for I2 members. 
5. The MANRS Observatory has good date. As more I2 members join, can extract peer pressure for others to join.
6. RIPE has a BGP visualization tool that can pull stats – to shows if you comply with MANRS.
7. Geant pushed it as part of doing best practice on a technical level. AARnet has been doing it for last 10 years! CENIC – good to have exec sponsorship to recognize the importance to carve out responsibilities!
8. (Geant/Rick) What we are doing now is a snapshot in time for MANRS. What about an annual or bi-annual certification? (AARNET/Warrick) Best practices change often, so an iterative process.
9. (CENIC/John Dundas) MANRS (ISOC) can provide an incentive if they published a list of who’s working on it and who's in process of implementing. Can I2 or ISOC show this on a webpage?

3.      Other hot topics from the community? What would you like to see at TechX?

1. (Warrick) FlowSpec as a security tool to help with attacks.

Member MANRS status:

Any lessons learned from those who’ve implemented it? Things to share with the community?

GWU (Andrew) had push back from ISOC on quality of data in IRR. Feedback on RPSL from ISOC: ISOC not requiring it but would like to see it published. Quality of data in IRR is bad – 3^rd party data not good.
Should ask ISOC that if you’re going to run an IRR data source that if you accept 3^rd party data, you should treat as a customer. 

       ESnet (Dale) – longer term, deprecate non registry IRRs. What can community do? Speak louder with one voice as I2! Put pressure on them!

Member Status from Secure Routing WG:

GWU                     Yes

CAAREN               Yes

KANREN               Yes

SOX                        Stiill considering

OARnet                 MANRS #1-3 achievable - #4 not practical nor RPKI. May join as IXP. Might be first in US

CENIC                  By 2018. Pac Wave in negotiations.

UMichigan          TBD

NCREN/MCNC    Intent to do it– RPKI was a huge hurdle

MERIT                   In process.

CEN                        In progress. Fall completion.

WiscNet               Yes

ESnet                    Yes

Geant                   Yes

AARNET               Yes

SURFNET              Yes  (not in WG)

NORDUNet          Yes  (not in WG)

I2                            In progress

 

 

Routing Security WG Members: 

Andrew Gallo 

Brad Fleming 

Bob Stovall 

Bram Peeters 

Cas D'Angelo 

Dale Carder 

Eric Boyd 

John Dundas 

Mark Beadles 

Mark Johnson 

Michael Milliken 

Matt Valenzisi  

Rick Havern 

Ryan Kocsondy 

Warrick Mitchell  

Will Black