< draft-ietf-opsec-current-practices-01.txt		draft-ietf-opsec-current-practices-02.txt >
	OPSEC M. Kaeo		OPSEC M. Kaeo
	Internet-Draft Double Shot Security, Inc.		Internet-Draft Double Shot Security, Inc.
	Expires: January 18, 2006 July 17, 2005		Expires: January 18, 2006 July 17, 2005
	Operational Security Current Practices		Operational Security Current Practices
	draft-ietf-opsec-current-practices-01		draft-ietf-opsec-current-practices-02
	Status of this Memo		Status of this Memo
	By submitting this Internet-Draft, each author represents that any		By submitting this Internet-Draft, each author represents that any
	applicable patent or other IPR claims of which he or she is aware		applicable patent or other IPR claims of which he or she is aware
	have been or will be disclosed, and any of which he or she becomes		have been or will be disclosed, and any of which he or she becomes
	aware will be disclosed, in accordance with Section 6 of BCP 79.		aware will be disclosed, in accordance with Section 6 of BCP 79.
	Internet-Drafts are working documents of the Internet Engineering		Internet-Drafts are working documents of the Internet Engineering
	Task Force (IETF), its areas, and its working groups. Note that		Task Force (IETF), its areas, and its working groups. Note that
	skipping to change at page 2, line 8 ¶		skipping to change at page 2, line 8 ¶
	This document is a survey of the current practices used in today's		This document is a survey of the current practices used in today's
	large ISP operational networks to secure layer 2 and layer 3		large ISP operational networks to secure layer 2 and layer 3
	infrastructure devices. The information listed here is the result of		infrastructure devices. The information listed here is the result of
	information gathered from people directly responsible for defining		information gathered from people directly responsible for defining
	and implementing secure infrastructures in Internet Service Provider		and implementing secure infrastructures in Internet Service Provider
	environments.		environments.
	Table of Contents		Table of Contents
	1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3		1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3
	1.1 Threat Model . . . . . . . . . . . . . . . . . . . . . . . 3		1.1. Scope . . . . . . . . . . . . . . . . . . . . . . . . . . 3
	1.2 Operational Security Impact from Threats . . . . . . . . . 3		1.2. Threat Model . . . . . . . . . . . . . . . . . . . . . . . 3
	1.3 Document Layout . . . . . . . . . . . . . . . . . . . . . 6		1.3. Attack Sources . . . . . . . . . . . . . . . . . . . . . . 4
	1.4 Definitions . . . . . . . . . . . . . . . . . . . . . . . 6		1.4. Operational Security Impact from Threats . . . . . . . . . 5
	2. Protected Operational Functions . . . . . . . . . . . . . . . 8		1.5. Document Layout . . . . . . . . . . . . . . . . . . . . . 7
	2.1 Device Physical Access . . . . . . . . . . . . . . . . . . 8		1.6. Definitions . . . . . . . . . . . . . . . . . . . . . . . 7
	2.2 Device In-Band Management . . . . . . . . . . . . . . . . 10		2. Protected Operational Functions . . . . . . . . . . . . . . . 9
	2.3 Device Out-of-Band Management . . . . . . . . . . . . . . 14		2.1. Device Physical Access . . . . . . . . . . . . . . . . . . 9
	2.4 Data Path . . . . . . . . . . . . . . . . . . . . . . . . 18		2.2. Device In-Band Management . . . . . . . . . . . . . . . . 11
	2.5 Routing Control Plane . . . . . . . . . . . . . . . . . . 20		2.3. Device Out-of-Band Management . . . . . . . . . . . . . . 15
	2.6 Software Upgrades and Configuration Integrity /		2.4. Data Path . . . . . . . . . . . . . . . . . . . . . . . . 19
	Validation . . . . . . . . . . . . . . . . . . . . . . . . 24		2.5. Routing Control Plane . . . . . . . . . . . . . . . . . . 21
	2.7 Logging Considerations . . . . . . . . . . . . . . . . . . 27		2.6. Software Upgrades and Configuration Integrity /
	2.8 Denial of Service Tracking / Tracing . . . . . . . . . . . 30		Validation . . . . . . . . . . . . . . . . . . . . . . . . 25
	3. Security Considerations . . . . . . . . . . . . . . . . . . . 32		2.7. Logging Considerations . . . . . . . . . . . . . . . . . . 28
	4. Normative References . . . . . . . . . . . . . . . . . . . . . 32		2.8. Filtering Considerations . . . . . . . . . . . . . . . . . 31
	Author's Address . . . . . . . . . . . . . . . . . . . . . . . 32		2.9. Denial of Service Tracking / Tracing . . . . . . . . . . . 32
	A. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 33		3. Security Considerations . . . . . . . . . . . . . . . . . . . 34
	B. Protocol Specific Attacks . . . . . . . . . . . . . . . . . . 34		4. Normative References . . . . . . . . . . . . . . . . . . . . . 34
	Intellectual Property and Copyright Statements . . . . . . . . 36		Appendix A. Acknowledgments . . . . . . . . . . . . . . . . . . . 35
			Appendix B. Protocol Specific Attacks . . . . . . . . . . . . . . 36
			B.1. Layer 2 Attacks . . . . . . . . . . . . . . . . . . . . . 36
			B.2. IPv4 Attacks . . . . . . . . . . . . . . . . . . . . . . . 36
			B.3. IPv6 Attacks . . . . . . . . . . . . . . . . . . . . . . . 37
			Author's Address . . . . . . . . . . . . . . . . . . . . . . . . . 38
			Intellectual Property and Copyright Statements . . . . . . . . . . 39
	1. Introduction		1. Introduction
	Security practices are well understood by the network operators who		Security practices are well understood by the network operators who
	have for many years gone through the growing pains of securing their		have for many years gone through the growing pains of securing their
	network infrastructures. However, there does not exist a written		network infrastructures. However, there does not exist a written
	document that enumerates these security practices. Network attacks		document that enumerates these security practices. Network attacks
	are continually increasing and although it is not necessarily the		are continually increasing and although it is not necessarily the
	role of an ISP to act as the Internet police, each ISP has to ensure		role of an ISP to act as the Internet police, each ISP has to ensure
	that certain security practices are followed to ensure that their		that certain security practices are followed to ensure that their
	network is operationally available for their customers. This		network is operationally available for their customers. This
	document is the result of a survey conducted to find out what current		document is the result of a survey conducted to find out what current
	security practices are being deployed to secure network		security practices are being deployed to secure network
	infrastructures.		infrastructures.
	1.1 Threat Model		1.1. Scope
	The scope for this survey is restricted to security practices that		The scope for this survey is restricted to security practices that
	mitigate exposure to risks with the potential to adversely impact		mitigate exposure to risks with the potential to adversely impact
	network availability and reliability. Securing the actual data		network availability and reliability. Securing the actual data
	traffic is outside the scope of the conducted survey. This document		traffic is outside the scope of the conducted survey. This document
	focuses solely on documenting currently deployed security mechanisms		focuses solely on documenting currently deployed security mechanisms
	for layer 2 and layer 3 network infrastructure devices.		for layer 2 and layer 3 network infrastructure devices. Although
			primarily focused on IPv4, many of the same practices can apply to
			IPv6 networks. Both IPv4 and IPv6 network infrastructures are taken
			into account in this survey.
	1.2 Operational Security Impact from Threats		1.2. Threat Model
	A threat is a potential for a security violation, which exists when		A threat is a potential for a security violation, which exists when
	there is a circumstance, capability, action, or event that could		there is a circumstance, capability, action, or event that could
	breach security and cause harm [RFC2828]. Every operational network		breach security and cause harm [RFC2828].Every operational network is
	is subject to a multitude of threat actions, or attacks, i.e. an		subject to a multitude of threat actions, or attacks, i.e. an assault
	assault on system security that derives from an intelligent act that		on system security that derives from an intelligent act that is a
	is a deliberate attempt to evade security services and violate the		deliberate attempt to evade security services and violate the
	security policy of a system [RFC2828]. These attacks can be sourced		security policy of a system [RFC2828]. All of the threats in any
	in a variety of ways:		network infrastructure is an instantiation or combination of the
			following:
			Reconnaissance: An attack whereby information is gathered to
			ascertain the network topology or specific device information which
			can be further used to exploit known vulnerabilities
			Man-In-The-Middle: An attack where a malicious user impersonates
			either the sender or recipient of a communication stream.
			Protocol Vulnerability Exploitation: An attack which takes advantage
			of known protocol deficiencies to cause inappropriate behavior.
			Message Insertion: This can be a valid message (which could be a
			reply attack,, which is a scenario where a message is captured and
			resent at later time). A message can also be inserted with any of
			the fields in the message being OspoofedO, such as IP addresses, port
			numbers, header fields or even packet content. Flooding is also part
			of this threat instantiation.
			Message Diversion/Deletion: An attack where legitimate messages are
			removed before they can reach the desired recipient or are re-
			directed to a network segment that is normally not part of the data
			path.
			Message Modification: This is a subset of a message insertion attack
			where a previous message has been captured and modified before being
			retransmitted. The message can be captured by using a man-in-the-
			middle attack or message diversion.
			Note that sometimes Denial of service attacks are listed as separate
			categories. A denial of service is a consequence of an attack and
			can be the result of too much traffic (i.e. flooding), or exploting
			protocol expoitation or inserting/deleting/diverting/midifying
			messages.
			1.3. Attack Sources
			These attacks can be sourced in a variety of ways:
	Active vs passive attacks		Active vs passive attacks
	An active attack involves writing data to the network. It is		An active attack involves writing data to the network. It is
	common practice in active attacks to disguise one's address and		common practice in active attacks to disguise one's address and
	conceal the identity of the traffic sender. A passive attack		conceal the identity of the traffic sender. A passive attack
	involves only reading information off the network. This is		involves only reading information off the network. This is
	possible if the attacker has control of a host in the		possible if the attacker has control of a host in the
	communications path between two victim machines or has compromised		communications path between two victim machines or has compromised
	the routing infrastructure to specifically arrange that traffic		the routing infrastructure to specifically arrange that traffic
	skipping to change at page 4, line 50 ¶		skipping to change at page 5, line 43 ¶
	It is nearly impossible to stop insider attacks or unintentional		It is nearly impossible to stop insider attacks or unintentional
	events. However, if appropriate monitoring mechanisms are in place,		events. However, if appropriate monitoring mechanisms are in place,
	these attacks can be as easily detected and mitigated as with any		these attacks can be as easily detected and mitigated as with any
	other attack source. Any of the specific attacks discussed further		other attack source. Any of the specific attacks discussed further
	in this document will elaborate on attacks which are sourced by an		in this document will elaborate on attacks which are sourced by an
	"outsider" and are deliberate attacks. Some further elaboration will		"outsider" and are deliberate attacks. Some further elaboration will
	be given to the feasibility of passive vs active and on-path vs off-		be given to the feasibility of passive vs active and on-path vs off-
	path attacks to show the motivation behind deploying certain security		path attacks to show the motivation behind deploying certain security
	features.		features.
	The threat consequences are the security violations which results		1.4. Operational Security Impact from Threats
	from a threat action, i.e. an attack. These are typically classified
	as follows:		The main concern for any of the potential attack scenarios is the
			impact and harm it can cause to the network infrastructure. The
			threat consequences are the security violations which results from a
			threat action, i.e. an attack. These are typically classified as
			follows:
	(Unauthorized) Disclosure		(Unauthorized) Disclosure
	A circumstance or event whereby an entity gains access to data for		A circumstance or event whereby an entity gains access to data for
	which the entity is not authorized.		which the entity is not authorized.
	Deception		Deception
	A circumstance or event that may result in an authorized entity		A circumstance or event that may result in an authorized entity
	receiving false data and believing it to be true.		receiving false data and believing it to be true.
	skipping to change at page 6, line 8 ¶		skipping to change at page 7, line 5 ¶
	a malicious user who has the capability to eavesdrop on traffic.		a malicious user who has the capability to eavesdrop on traffic.
	First, he may listen in on traffic for a while to do some		First, he may listen in on traffic for a while to do some
	reconnaissance work and ascertain which IP addresses belonged to		reconnaissance work and ascertain which IP addresses belonged to
	specific devices such as routers. Were this miscreant to obtain		specific devices such as routers. Were this miscreant to obtain
	information such as a router password sent in cleartext, he can then		information such as a router password sent in cleartext, he can then
	proceed to compromise the actual router. From there, the miscreant		proceed to compromise the actual router. From there, the miscreant
	can launch various active attacks such as sending bogus routing		can launch various active attacks such as sending bogus routing
	updates to redirect traffic or capture additional traffic to		updates to redirect traffic or capture additional traffic to
	compromise other network devices.		compromise other network devices.
	1.3 Document Layout		1.5. Document Layout
	This document is a survey of current operational practices that		This document is a survey of current operational practices that
	mitigate the risk of being susceptible to any threat actions. As		mitigate the risk of being susceptible to any threat actions. As
	such, the main focus is on the currently deployed security practices		such, the main focus is on the currently deployed security practices
	used to detect and/or mitigate attacks. The top-level categories in		used to detect and/or mitigate attacks. The top-level categories in
	this document are based on operational functions for ISPs and		this document are based on operational functions for ISPs and
	generally relate to what is to be protected. This is followed by a		generally relate to what is to be protected. This is followed by a
	description of which attacks are possible and the security practices		description of which attacks are possible and the security practices
	currently deployed which will provide the necessary security services		currently deployed which will provide the necessary security services
	to help mitigate these attacks. These security services are		to help mitigate these attacks. These security services are
	skipping to change at page 6, line 48 ¶		skipping to change at page 7, line 45 ¶
	a combination of these services. For example, AAA can offer user		a combination of these services. For example, AAA can offer user
	authentication, user authorization and audit / logging services while		authentication, user authorization and audit / logging services while
	SSH can provide data origin authentication, data integrity and data		SSH can provide data origin authentication, data integrity and data
	confidentiality. The services offered are more important than the		confidentiality. The services offered are more important than the
	actual protocol used. Each section ends with an additional		actual protocol used. Each section ends with an additional
	considerations section which explains why specific protocols may or		considerations section which explains why specific protocols may or
	may not be used and also gives some information regarding		may not be used and also gives some information regarding
	capabilities which are not possible today due to bugs or lack of ease		capabilities which are not possible today due to bugs or lack of ease
	of use.		of use.
	1.4 Definitions		1.6. Definitions
	RFC 2119 Keywords
			RFC 2119 Keywords
	The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL		The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL
	NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL"		NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL"
	in this document are to be interpreted as described in [RFC2119].		in this document are to be interpreted as described in [RFC2119].
	The use of the RFC 2119 keywords is an attempt, by the editor, to		The use of the RFC 2119 keywords is an attempt, by the editor, to
	assign the correct requirement levels ("MUST", "SHOULD",		assign the correct requirement levels ("MUST", "SHOULD",
	"MAY"...). It must be noted that different organizations,		"MAY"...). It must be noted that different organizations,
	operational environments, policies and legal environments will		operational environments, policies and legal environments will
	generate different requirement levels.		generate different requirement levels.
	2. Protected Operational Functions		2. Protected Operational Functions
	2.1 Device Physical Access		2.1. Device Physical Access
	Device physical access pertains to protecting the physical location		Device physical access pertains to protecting the physical location
	of the layer 2 or layer 3 network infrastructure device. Although it		of the layer 2 or layer 3 network infrastructure device. Although it
	is important to have contingency plans for natural disasters such as		is important to have contingency plans for natural disasters such as
	earthquakes and floods which can cause damage to networking devices,		earthquakes and floods which can cause damage to networking devices,
	this is out-of-scope for this document. Here we concern ourselves		this is out-of-scope for this document. Here we concern ourselves
	with protecting access to the physical location and how a device can		with protecting access to the physical location and how a device can
	be further protected from unauthorized access if the physical		be further protected from unauthorized access if the physical
	location has been compromised, i.e protecting the console access.		location has been compromised, i.e protecting the console access.
	2.1.1 Threats / Attacks		2.1.1. Threats / Attacks
	If any intruder gets physical access to a layer 2 or layer 3 device,		If any intruder gets physical access to a layer 2 or layer 3 device,
	the entire network infrastructure can be under the control of the		the entire network infrastructure can be under the control of the
	intruder. At a minimum, the intruder can take the compromised device		intruder. At a minimum, the intruder can take the compromised device
	out-of-service, causing network disruption, the extent of which		out-of-service, causing network disruption, the extent of which
	depends on the network topology. A worse scenario is where the		depends on the network topology. A worse scenario is where the
	intruder can use this device to crack the console password and have		intruder can use this device to crack the console password and have
	complete control of the device, perhaps without anyone detecting such		complete control of the device, perhaps without anyone detecting such
	a compromise, or to attach another network device onto a port and		a compromise, or to attach another network device onto a port and
	siphon off data with which the intruder can ascertain the network		siphon off data with which the intruder can ascertain the network
	topology and take control of the entire network.		topology and take control of the entire network.
	The threat of gaining physical access can be realized in a variety of		The threat of gaining physical access can be realized in a variety of
	ways even if critical devices are under high-security. There still		ways even if critical devices are under high-security. There still
	occur cases where attackers have impersonated maintenance workers to		occur cases where attackers have impersonated maintenance workers to
	gain physical access to critical devices that have caused major		gain physical access to critical devices that have caused major
	outages and privacy compromises. Insider attacks from authorized		outages and privacy compromises. Insider attacks from authorized
	personnel also pose a real threat and must be adequately recognized		personnel also pose a real threat and must be adequately recognized
	and dealt with.		and dealt with.
	2.1.2 Security Practices		2.1.2. Security Practices
	For physical device security, equipment is kept in highly restrictive		For physical device security, equipment is kept in highly restrictive
	environments. Only authorized users with card key badges have access		environments. Only authorized users with card key badges have access
	to any of the physical locations that contain critical network		to any of the physical locations that contain critical network
	infrastructure devices. These card-key systems keep track of who		infrastructure devices. These card-key systems keep track of who
	accessed which location and at what time.		accessed which location and at what time.
	All console access is always password protected and the login time is		All console access is always password protected and the login time is
	set to time out after a specified amount of inactivity - typically		set to time out after a specified amount of inactivity - typically
	between 3-10 minutes. Individual users are authentication to get		between 3-10 minutes. Individual users are authentication to get
	basic access. For privileged (i.e. enable) access, a second		basic access. For privileged (i.e. enable) access, a second
	authentication step needs to be completed. Typically all console		authentication step needs to be completed. Typically all console
	access is provided via an out-of-band (OOB) management infrastructure		access is provided via an out-of-band (OOB) management infrastructure
	which is discussed in the section on OOB management.		which is discussed in the section on OOB management.
	2.1.3 Security Services		2.1.3. Security Services
	The following security services are offered through the use of the		The following security services are offered through the use of the
	practices described in the previous section:		practices described in the previous section:
	o User Authentication - All individuals who have access to the		o User Authentication - All individuals who have access to the
	physical facility are authenticated. Console access is		physical facility are authenticated. Console access is
	authenticated.		authenticated.
	o User Authorization - An authenticated individual has implicit		o User Authorization - An authenticated individual has implicit
	authorization to perform commands on the device. Console access		authorization to perform commands on the device. Console access
	is usually granted via at least two privilege levels:		is usually granted via at least two privilege levels:
	authorization for performing a basic set of commands vs		authorization for performing a basic set of commands vs
	authorization for performing all commands.		authorization for performing all commands.
	o Data Origin Authentication - Not applicable		o Data Origin Authentication - Not applicable
	o Access Control - Not applicable		o Access Control - Not applicable
	o Data Integrity - Not applicable		o Data Integrity - Not applicable
	o Data Confidentiality - Not applicable		o Data Confidentiality - Not applicable
	o Auditing / Logging - All access to the physical locations of the		o Auditing / Logging - All access to the physical locations of the
	infrastructure equipment is logged via electronic card-key		infrastructure equipment is logged via electronic card-key
	systems. All console access is logged (refer to the OOB		systems. All console access is logged (refer to the OOB
	management section for more details)		management section for more details)
	o DoS Mitigation - Not applicable		o DoS Mitigation - Not applicable
	2.1.4 Additional Considerations		2.1.4. Additional Considerations
	Physical security is relevant to operational security practices as		Physical security is relevant to operational security practices as
	described in this document mostly from a console access perspective.		described in this document mostly from a console access perspective.
	Most ISPs provide console access via an OOB management infrastructure		Most ISPs provide console access via an OOB management infrastructure
	which is discussed in the OOB management section of this document.		which is discussed in the OOB management section of this document.
	The physical and logical authentication and logging systems should be		The physical and logical authentication and logging systems should be
	run independently of each other and reside in different physical		run independently of each other and reside in different physical
	locations.		locations.
	Social engineering plays a big role in many physical access		Social engineering plays a big role in many physical access
	compromises. Most ISPs have set up training classes and awareness		compromises. Most ISPs have set up training classes and awareness
	programs to educate company personnel to deny physical access to		programs to educate company personnel to deny physical access to
	people who are not properly authenticated or authorized to have		people who are not properly authenticated or authorized to have
	physical access to critical infrastructure devices.		physical access to critical infrastructure devices.
	2.2 Device In-Band Management		2.2. Device In-Band Management
	In-band management is generally considered to be device access where		In-band management is generally considered to be device access where
	the control traffic takes the same data path as the data which		the control traffic takes the same data path as the data which
	traverses the network. In many environments, device management for		traverses the network. In many environments, device management for
	layer 2 and layer 3 infrastructure devices is deployed as part of an		layer 2 and layer 3 infrastructure devices is deployed as part of an
	out-of-band management infrastructure although there are some		out-of-band management infrastructure although there are some
	instances where it is deployed in-band as well. Presently, the		instances where it is deployed in-band as well. Presently, the
	mechanisms used for in-band management are via virtual terminal		mechanisms used for in-band management are via virtual terminal
	access (i.e. Telnet or SSH), SNMP, or HTTP. In all large ISPs that		access (i.e. Telnet or SSH), SNMP, or HTTP. In all large ISPs that
	were interviewed, HTTP management is never used and is explicitly		were interviewed, HTTP management is never used and is explicitly
	disabled. Note that file transfer protocols (TFTP, FTP, SCP) will		disabled. Note that file transfer protocols (TFTP, FTP, SCP) will be
	be covered in the 'Software Upgrades and Configuration Integrity/		covered in the 'Software Upgrades and Configuration Integrity/
	Validation' section.		Validation' section.
	2.2.1 Threats / Attacks		2.2.1. Threats / Attacks
	For in-band device management, passive attacks are possible if		For in-band device management, passive attacks are possible if
	someone has the capability to intercept data between the management		someone has the capability to intercept data between the management
	device and the managed device. The threat is possible if a single		device and the managed device. The threat is possible if a single
	infrastructure device is somehow compromised and can act as a network		infrastructure device is somehow compromised and can act as a network
	sniffer or if it is possible to insert a new device which acts as a		sniffer or if it is possible to insert a new device which acts as a
	network sniffer.		network sniffer.
	Active attacks are possible for both on-path and off-path scenarios.		Active attacks are possible for both on-path and off-path scenarios.
	For on-path active attacks, the situation is the same as for a		For on-path active attacks, the situation is the same as for a
	passive attack, where either a device has to already be compromised		passive attack, where either a device has to already be compromised
	or a device can be inserted into the path. For off-path active		or a device can be inserted into the path. For off-path active
	attacks, the attack is generally limited to message insertion or		attacks, the attack is generally limited to message insertion or
	modification.		modification.
	2.2.1.1 Confidentiality Violations		2.2.1.1. Confidentiality Violations
	Confidentiality violations can occur when a miscreant intercepts		Confidentiality violations can occur when a miscreant intercepts
	confidential data that has been sent in cleartext. This includes		confidential data that has been sent in cleartext. This includes
	interception of usernames and passwords with which an intruder can		interception of usernames and passwords with which an intruder can
	obtain unauthorized access to network devices. It can also include		obtain unauthorized access to network devices. It can also include
	other information such as logging or configuration information if an		other information such as logging or configuration information if an
	administrator is remotely viewing local logfiles or configuration		administrator is remotely viewing local logfiles or configuration
	information.		information.
	2.2.1.2 Offline Cryptographic Attacks		2.2.1.2. Offline Cryptographic Attacks
	If username/password information was encrypted but the cryptographic		If username/password information was encrypted but the cryptographic
	mechanism used made it easy to capture data and break the encryption		mechanism used made it easy to capture data and break the encryption
	key, the device management traffic could be compromised. The traffic		key, the device management traffic could be compromised. The traffic
	would need to be captured either by eavesdropping on the network or		would need to be captured either by eavesdropping on the network or
	by being able to divert traffic to a malicious user.		by being able to divert traffic to a malicious user.
	2.2.1.3 Replay Attacks		2.2.1.3. Replay Attacks
	For a replay attack to be successful, in-band management traffic		For a replay attack to be successful, in-band management traffic
	would need to first be captured either on-path or diverted to an		would need to first be captured either on-path or diverted to an
	attacker to later be replayed to the intended recipient.		attacker to later be replayed to the intended recipient.
	2.2.1.4 Message Insertion/Deletion/Modification		2.2.1.4. Message Insertion/Deletion/Modification
	Data can be manipulated by someone in control of intermediary hosts.		Data can be manipulated by someone in control of intermediary hosts.
	Forging data is also possible with IP spoofing, where a remote host		Forging data is also possible with IP spoofing, where a remote host
	sends out packets which appear to come from another, trusted host.		sends out packets which appear to come from another, trusted host.
	2.2.1.5 Man-In-The-Middle		2.2.1.5. Man-In-The-Middle
	A man-in-the-middle attack attacks the identity of a communicating		A man-in-the-middle attack attacks the identity of a communicating
	peer rather than the data stream itself. The attacker intercepts		peer rather than the data stream itself. The attacker intercepts
	traffic that is sent from an in-band management system to the		traffic that is sent from an in-band management system to the
	networking infrastructure device and traffic that is sent from the		networking infrastructure device and traffic that is sent from the
	network infrastructure device to the in-band management system.		network infrastructure device to the in-band management system.
	2.2.2 Security Practices		2.2.2. Security Practices
	All in-band management access to layer 2 and layer 3 devices is		All in-band management access to layer 2 and layer 3 devices is
	authenticated. The user authentication and authorization is		authenticated. The user authentication and authorization is
	typically controlled by a AAA server (i.e. RADIUS and/or TACACS+).		typically controlled by a AAA server (i.e. RADIUS and/or TACACS+).
	Credentials used to determine the identity of the user vary from		Credentials used to determine the identity of the user vary from
	static username/password to one-time username/password scheme such as		static username/password to one-time username/password scheme such as
	Secure-ID. Static username/passwords are expired after a specified		Secure-ID. Static username/passwords are expired after a specified
	period of time, usually 30 days. Every authenticated entity via AAA		period of time, usually 30 days. Every authenticated entity via AAA
	is an individual user for greater granularity of control. In some		is an individual user for greater granularity of control. In some
	deployments, The AAA servers used for in-band management		deployments, The AAA servers used for in-band management
	authentication/authorization/accounting are on separate out-of-band		authentication/authorization/accounting are on separate out-of-band
	networks to provide a demarcation for any other authentication		networks to provide a demarcation for any other authentication
	functions.		functions.
	For backup purposes, there is often a single local database entry for		For backup purposes, there is often a single local database entry for
	authentication which is known to a very limited set of key personnel.		authentication which is known to a very limited set of key personnel.
	It is usually the highest privilege level username/password		It is usually the highest privilege level username/password
	combination, which in most cases is the same across all devices.		combination, which in most cases is the same across all devices.
	This local device password is routinely regenerated once every 2-3		This local device password is routinely regenerated once every 2-3
	months and is also regenerated immediately after an employee who had		months and is also regenerated immediately after an employee who had
	access to that password leaves the company or is no longer authorized		access to that password leaves the company or is no longer authorized
	to have knowledge of that password.		to have knowledge of that password.
	Each individual user in the AAA database is configured with specific		Each individual user in the AAA database is configured with specific
	authorization capability. Specific commands are either individually		authorization capability. Specific commands are either individually
	denied or permitted depending on the capability of the device to be		denied or permitted depending on the capability of the device to be
	accessed. Multiple privilege levels are deployed. Most individuals		accessed. Multiple privilege levels are deployed. Most individuals
	are authorized with basic authorization to perform a minimal set of		are authorized with basic authorization to perform a minimal set of
	skipping to change at page 12, line 46 ¶		skipping to change at page 13, line 44 ¶
	All in-band device management access is audited and any violations		All in-band device management access is audited and any violations
	trigger alarms which initiate automated email, pager and/or telephone		trigger alarms which initiate automated email, pager and/or telephone
	notifications. AAA servers keeps track of the authenticated entity		notifications. AAA servers keeps track of the authenticated entity
	as well as all the commands that were carried out on a specific		as well as all the commands that were carried out on a specific
	device. Additionally, the device itself logs any access control		device. Additionally, the device itself logs any access control
	violations (i.e. if an SSH request comes in from an IP address which		violations (i.e. if an SSH request comes in from an IP address which
	is not explicitly permitted, that event is logged so that the		is not explicitly permitted, that event is logged so that the
	offending IP address can be tracked down and investigations made as		offending IP address can be tracked down and investigations made as
	to why it was trying to access a particular infrastructure device)		to why it was trying to access a particular infrastructure device)
	2.2.3 Security Services		2.2.3. Security Services
	The following security services are offered through the use of the		The following security services are offered through the use of the
	practices described in the previous section:		practices described in the previous section:
	o User Authentication - All individuals are authenticated via AAA		o User Authentication - All individuals are authenticated via AAA
	services.		services.
	o User Authorization - All individuals are authorized via AAA		o User Authorization - All individuals are authorized via AAA
	services to perform specific operations once successfully		services to perform specific operations once successfully
	authenticated.		authenticated.
	skipping to change at page 13, line 36 ¶		skipping to change at page 14, line 33 ¶
	o Auditing / Logging - Using AAA provides an audit trail for who		o Auditing / Logging - Using AAA provides an audit trail for who
	accessed which device and which operations were performed.		accessed which device and which operations were performed.
	o DoS Mitigation - Using packet filters to allow only specific IP		o DoS Mitigation - Using packet filters to allow only specific IP
	addresses to have access to the infrastructure devices. This		addresses to have access to the infrastructure devices. This
	limits but does not prevent spoofed DoS attacks directed at an		limits but does not prevent spoofed DoS attacks directed at an
	infrastructure device. Often OOB management is used to lower that		infrastructure device. Often OOB management is used to lower that
	risk.		risk.
	2.2.4 Additional Considerations		2.2.4. Additional Considerations
	Password selection for any in-band device management protocol used is		Password selection for any in-band device management protocol used is
	critical to ensure that the passwords are hard to guess or break		critical to ensure that the passwords are hard to guess or break
	using a brute-force attack.		using a brute-force attack.
	IPsec is considered too difficult to deploy and the common protocol		IPsec is considered too difficult to deploy and the common protocol
	to provide for confidential in-band management access is SSH. There		to provide for confidential in-band management access is SSH. There
	are exceptions for using SSH due to equipment limitations since SSH		are exceptions for using SSH due to equipment limitations since SSH
	may not be supported on legacy equipment. Also, in the case where		may not be supported on legacy equipment. Also, in the case where
	the SSH key is stored on a route processor card, a re-keying of SSH		the SSH key is stored on a route processor card, a re-keying of SSH
	skipping to change at page 14, line 17 ¶		skipping to change at page 15, line 13 ¶
	In instances where Telnet access is used, the logs on the AAA servers		In instances where Telnet access is used, the logs on the AAA servers
	are more verbose and more attention is paid to them to detect any		are more verbose and more attention is paid to them to detect any
	abnormal behavior. The jumphosts themselves are carefully controlled		abnormal behavior. The jumphosts themselves are carefully controlled
	machines and usually have limited access. Note that Telent is NEVER		machines and usually have limited access. Note that Telent is NEVER
	allowed to an infrastructure device except from specific jumphosts;		allowed to an infrastructure device except from specific jumphosts;
	i.e. packet filters are used to ensure that Telnet is only allowed		i.e. packet filters are used to ensure that Telnet is only allowed
	from specific IP addresses.		from specific IP addresses.
	With thousands of devices to manage, some ISPs have created automated		With thousands of devices to manage, some ISPs have created automated
	mechanisms to authenticate to devices. Kerberos is used to automate		mechanisms to authenticate to devices. Kerberos is used to automate
	the authentication process. An individual would first log in to a		the authentication process. An individual would first log in to a
	Kerberized UNIX server using SSH and generate a Kerberos 'ticket'.		Kerberized UNIX server using SSH and generate a Kerberos 'ticket'.
	This 'ticket' is generally set to have a lifespan of 10 hours and is		This 'ticket' is generally set to have a lifespan of 10 hours and is
	used to automatically authenticate the individual to the		used to automatically authenticate the individual to the
	infrastructure devices.		infrastructure devices.
	In instances where SNMP is used, some legacy devices only support		In instances where SNMP is used, some legacy devices only support
	SNMPv1 which then requires the provider to mandate its use across all		SNMPv1 which then requires the provider to mandate its use across all
	infrastructure devices for operational simplicity. SNMPv2 is		infrastructure devices for operational simplicity. SNMPv2 is
	primarily deployed since it is easier to set up than v3.		primarily deployed since it is easier to set up than v3.
	2.3 Device Out-of-Band Management		2.3. Device Out-of-Band Management
	Out-of-band management is generally considered to be device access		Out-of-band management is generally considered to be device access
	where the control traffic takes a separate path as the data which		where the control traffic takes a separate path as the data which
	traverses the network. Console access is always architected via an		traverses the network. Console access is always architected via an
	OOB network. SNMP management is also usually carried out via that		OOB network. SNMP management is also usually carried out via that
	same OOB network infrastructure.		same OOB network infrastructure.
	2.3.1 Threats / Attacks		2.3.1. Threats / Attacks
	For OOB device management, passive attacks are possible if someone		For OOB device management, passive attacks are possible if someone
	has the capability to intercept data between the management device		has the capability to intercept data between the management device
	and the managed device. The threat is possible if a single		and the managed device. The threat is possible if a single
	infrastructure device is somehow compromised and can act as a network		infrastructure device is somehow compromised and can act as a network
	sniffer or if it is possible to insert a new device which acts as a		sniffer or if it is possible to insert a new device which acts as a
	network sniffer.		network sniffer.
	Active attacks are possible for both on-path and off-path scenarios.		Active attacks are possible for both on-path and off-path scenarios.
	For on-path active attacks, the situation is the same as for a		For on-path active attacks, the situation is the same as for a
	passive attack, where either a device has to already be compromised		passive attack, where either a device has to already be compromised
	or a device can be inserted into the path. For off-path active		or a device can be inserted into the path. For off-path active
	attacks, the attack is generally limited to message insertion or		attacks, the attack is generally limited to message insertion or
	modification.		modification.
	2.3.1.1 Confidentiality Violations		2.3.1.1. Confidentiality Violations
	Confidentiality violations can occur when a miscreant intercepts any		Confidentiality violations can occur when a miscreant intercepts any
	of the OOB management data that has been sent in cleartext. This		of the OOB management data that has been sent in cleartext. This
	includes interception of usernames and passwords with which an		includes interception of usernames and passwords with which an
	intruder can obtain unauthorized access to network devices. It can		intruder can obtain unauthorized access to network devices. It can
	also include other information such as logging or configuration		also include other information such as logging or configuration
	information if an administrator is remotely viewing local logfiles or		information if an administrator is remotely viewing local logfiles or
	configuration information.		configuration information.
	2.3.1.2 Offline Cryptographic Attacks		2.3.1.2. Offline Cryptographic Attacks
	If username/password information was encrypted but the cryptographic		If username/password information was encrypted but the cryptographic
	mechanism used made it easy to capture data and break the encryption		mechanism used made it easy to capture data and break the encryption
	key, the OOB management traffic could be compromised. The traffic		key, the OOB management traffic could be compromised. The traffic
	would need to be captured either by eavesdropping on the network or		would need to be captured either by eavesdropping on the network or
	by being able to divert traffic to a malicious user.		by being able to divert traffic to a malicious user.
	2.3.1.3 Replay Attacks		2.3.1.3. Replay Attacks
	For a replay attack to be successful, the OOB management traffic		For a replay attack to be successful, the OOB management traffic
	would need to first be captured either on-path or diverted to an		would need to first be captured either on-path or diverted to an
	attacker to later be replayed to the intended recipient.		attacker to later be replayed to the intended recipient.
	2.3.1.4 Message Insertion/Deletion/Modification		2.3.1.4. Message Insertion/Deletion/Modification
	Data can be manipulated by someone in control of intermediary hosts.		Data can be manipulated by someone in control of intermediary hosts.
	Forging data is also possible with IP spoofing, where a remote host		Forging data is also possible with IP spoofing, where a remote host
	sends out packets which appear to come from another, trusted host.		sends out packets which appear to come from another, trusted host.
	2.3.1.5 Man-In-The-Middle		2.3.1.5. Man-In-The-Middle
	A man-in-the-middle attack attacks the identity of a communicating		A man-in-the-middle attack attacks the identity of a communicating
	peer rather than the data stream itself. The attacker intercepts		peer rather than the data stream itself. The attacker intercepts
	traffic that is sent from an OOB management system to the networking		traffic that is sent from an OOB management system to the networking
	infrastructure device and traffic that is sent from the network		infrastructure device and traffic that is sent from the network
	infrastructure device to the OOB management system.		infrastructure device to the OOB management system.
	2.3.2 Security Practices		2.3.2. Security Practices
	OOB is done via a terminal server at each location. SSH access is		OOB is done via a terminal server at each location. SSH access is
	used to get to the terminal server from where sessions to the devices		used to get to the terminal server from where sessions to the devices
	are initiated. Dial-in access is deployed as a backup if the network		are initiated. Dial-in access is deployed as a backup if the network
	is not available.		is not available.
	All OOB management access to layer 2 and layer 3 devices is		All OOB management access to layer 2 and layer 3 devices is
	authenticated. The user authentication and authorization is		authenticated. The user authentication and authorization is
	typically controlled by a AAA server (i.e. RADIUS and/or TACACS+).		typically controlled by a AAA server (i.e. RADIUS and/or TACACS+).
	Credentials used to determine the identity of the user vary from		Credentials used to determine the identity of the user vary from
	static username/password to one-time username/password scheme such as		static username/password to one-time username/password scheme such as
	Secure-ID. Static username/passwords are expired after a specified		Secure-ID. Static username/passwords are expired after a specified
	period of time, usually 30 days. Every authenticated entity via AAA		period of time, usually 30 days. Every authenticated entity via AAA
	is an individual user for greater granularity of control. Note that		is an individual user for greater granularity of control. Note that
	often the AAA server used for OOB management authentication is a		often the AAA server used for OOB management authentication is a
	separate physical device from the AAA server used for in-band		separate physical device from the AAA server used for in-band
	management user authentication.		management user authentication.
	For backup purposes, there is often a single local database entry for		For backup purposes, there is often a single local database entry for
	skipping to change at page 17, line 18 ¶		skipping to change at page 18, line 14 ¶
	All OOB device management access is audited. The AAA server keeps		All OOB device management access is audited. The AAA server keeps
	track of the authenticated entity as well as all the commands that		track of the authenticated entity as well as all the commands that
	were carried out on a specific device. Additionally, the device		were carried out on a specific device. Additionally, the device
	itself logs any access control violations (i.e. if an SSH request		itself logs any access control violations (i.e. if an SSH request
	comes in from an IP address which is not explicitly permitted, that		comes in from an IP address which is not explicitly permitted, that
	event is logged so that the offending IP address can be tracked down		event is logged so that the offending IP address can be tracked down
	and investigations made as to why it was trying to access a		and investigations made as to why it was trying to access a
	particular infrastructure device)		particular infrastructure device)
	2.3.3 Security Services		2.3.3. Security Services
	The security services offered for device OOB management are nearly		The security services offered for device OOB management are nearly
	identical to those of device in-band management. Due to the critical		identical to those of device in-band management. Due to the critical
	nature of controlling and limiting device access, many ISPs feel that		nature of controlling and limiting device access, many ISPs feel that
	physically separating the management traffic from the normal customer		physically separating the management traffic from the normal customer
	data traffic will provide an added level of risk mitigation and limit		data traffic will provide an added level of risk mitigation and limit
	the potential attack vectors. For OOB management, the security		the potential attack vectors. For OOB management, the security
	services offered through the use of the practices described in the		services offered through the use of the practices described in the
	previous section are:		previous section are:
	skipping to change at page 18, line 14 ¶		skipping to change at page 19, line 8 ¶
	o Auditing / Logging - Using AAA provides an audit trail for who		o Auditing / Logging - Using AAA provides an audit trail for who
	accessed which device and which operations were performed.		accessed which device and which operations were performed.
	o DoS Mitigation - Using packet filters to allow only specific IP		o DoS Mitigation - Using packet filters to allow only specific IP
	addresses to have access to the infrastructure devices. This		addresses to have access to the infrastructure devices. This
	limits but does not prevent spoofed DoS attacks directed at an		limits but does not prevent spoofed DoS attacks directed at an
	infrastructure device. However, the risk is lowered by using a		infrastructure device. However, the risk is lowered by using a
	separate physical network for management purposes.		separate physical network for management purposes.
	2.3.4 Additional Considerations		2.3.4. Additional Considerations
	Password selection for any OOB device management protocol used is		Password selection for any OOB device management protocol used is
	critical to ensure that the passwords are hard to guess or break		critical to ensure that the passwords are hard to guess or break
	using a brute-force attack.		using a brute-force attack.
	IPsec is considered too difficult to deploy and the common protocol		IPsec is considered too difficult to deploy and the common protocol
	to provide for confidential OOB management access is SSH. There are		to provide for confidential OOB management access is SSH. There are
	exceptions for using SSH due to equipment limitations since SSH may		exceptions for using SSH due to equipment limitations since SSH may
	not be supported on legacy equipment. Also, in the case where the		not be supported on legacy equipment. Also, in the case where the
	SSH key is stored on a route processor card, a re-keying of SSH would		SSH key is stored on a route processor card, a re-keying of SSH would
	skipping to change at page 18, line 47 ¶		skipping to change at page 19, line 41 ¶
	allowed to an infrastructure device except from specific jumphosts;		allowed to an infrastructure device except from specific jumphosts;
	i.e. packet filters are used at the console server and/or		i.e. packet filters are used at the console server and/or
	infrastructure device to ensure that Telnet is only allowed from		infrastructure device to ensure that Telnet is only allowed from
	specific IP addresses.		specific IP addresses.
	In instances where SNMP is used, some legacy devices only support		In instances where SNMP is used, some legacy devices only support
	SNMPv1 which then requires the provider to mandate its use across all		SNMPv1 which then requires the provider to mandate its use across all
	infrastructure devices for operational simplicity. SNMPv2 is		infrastructure devices for operational simplicity. SNMPv2 is
	primarily deployed since it is easier to set up than v3.		primarily deployed since it is easier to set up than v3.
	2.4 Data Path		2.4. Data Path
	This section refers to how traffic is handled which traverses the		This section refers to how traffic is handled which traverses the
	network infrastructure device. The primary goal of ISPs is to		network infrastructure device. The primary goal of ISPs is to
	forward customer traffic. However, due to the large amount of		forward customer traffic. However, due to the large amount of
	malicious traffic that can cause DoS attacks and render the network		malicious traffic that can cause DoS attacks and render the network
	unavailable, specific measures are sometimes deployed to ensure the		unavailable, specific measures are sometimes deployed to ensure the
	availability to forward legitimate customer traffic.		availability to forward legitimate customer traffic.
	2.4.1 Threats / Attacks		2.4.1. Threats / Attacks
	Any data traffic can potentially be attack traffic and the challenge		Any data traffic can potentially be attack traffic and the challenge
	is to detect and potentially stop forwarding any of the malicious		is to detect and potentially stop forwarding any of the malicious
	traffic. The deliberately sourced attack traffic can consist of		traffic. The deliberately sourced attack traffic can consist of
	packets with spoofed source and/or destination addresses or any other		packets with spoofed source and/or destination addresses or any other
	malformed packet which mangle any portion of a header field to cause		malformed packet which mangle any portion of a header field to cause
	protocol-related security issues (such as resetting connections,		protocol-related security issues (such as resetting connections,
	causing unwelcome ICPM redirects, creating unwelcome IP options or		causing unwelcome ICPM redirects, creating unwelcome IP options or
	packet fragmentations).		packet fragmentations).
	2.4.2 Security Practices		2.4.2. Security Practices
	Filtering and rate limiting are the primary mechanism to provide risk		Filtering and rate limiting are the primary mechanism to provide risk
	mitigation of malicious traffic rendering the ISP services		mitigation of malicious traffic rendering the ISP services
	unavailable. However, filtering and rate limiting of data path		unavailable. However, filtering and rate limiting of data path
	traffic is deployed in a variety of ways depending on how automated		traffic is deployed in a variety of ways depending on how automated
	the process is and what the capabilities and performance limitations		the process is and what the capabilities and performance limitations
	of existing deployed hardware are.		of existing deployed hardware are.
	The ISPs which do not have performance issues with their equipment		The ISPs which do not have performance issues with their equipment
	follow BCP38 [BCP38] guidelines. Null routes and black-hole		follow BCP38 [BCP38] guidelines. Null routes and black-hole
	skipping to change at page 19, line 42 ¶		skipping to change at page 20, line 39 ¶
	implemented if there is no performance limitations on the devices.		implemented if there is no performance limitations on the devices.
	Netflow is used for tracking traffic flows but there is some concern		Netflow is used for tracking traffic flows but there is some concern
	whether sampling is good enough to detect malicious behavior.		whether sampling is good enough to detect malicious behavior.
	Unicast RPF is not consistently implemented. Some ISPs are in		Unicast RPF is not consistently implemented. Some ISPs are in
	process of doing so while other ISPs think that the perceived benefit		process of doing so while other ISPs think that the perceived benefit
	of knowing that spoofed traffic comes from legitimate addresses are		of knowing that spoofed traffic comes from legitimate addresses are
	not worth the operational complexity. Some providers have a policy		not worth the operational complexity. Some providers have a policy
	of implementing uRPF at link speeds of DS3 and below.		of implementing uRPF at link speeds of DS3 and below.
	2.4.3 Security Services		2.4.3. Security Services
	o User Authentication - Not applicable		o User Authentication - Not applicable
	o User Authorization - Not applicable		o User Authorization - Not applicable
	o Data Origin Authentication - When IP address filtering per BCP38		o Data Origin Authentication - When IP address filtering per BCP38
	and uRPF are deployed at network edges it can ensure that any		and uRPF are deployed at network edges it can ensure that any
	spoofed traffic comes from at least a legitimate IP address and		spoofed traffic comes from at least a legitimate IP address and
	can be tracked.		can be tracked.
	skipping to change at page 20, line 20 ¶		skipping to change at page 21, line 16 ¶
	o Data Integrity - Not applicable		o Data Integrity - Not applicable
	o Data Confidentiality - Not applicable		o Data Confidentiality - Not applicable
	o Auditing / Logging - Filtering exceptions are logged for potential		o Auditing / Logging - Filtering exceptions are logged for potential
	attack traffic.		attack traffic.
	o DoS Mitigation - Black-hole triggered filtering and rate-limiting		o DoS Mitigation - Black-hole triggered filtering and rate-limiting
	are used to limit the risk of DoS attacks.		are used to limit the risk of DoS attacks.
	2.4.4 Additional Considerations		2.4.4. Additional Considerations
	For layer 2 devices, MAC address filtering and authentication is not		For layer 2 devices, MAC address filtering and authentication is not
	used. This is due to the problems it can cause when troubleshooting		used. This is due to the problems it can cause when troubleshooting
	networking issues. Port security becomes unmanageable at a large		networking issues. Port security becomes unmanageable at a large
	scale where 1000s of switches are deployed.		scale where 1000s of switches are deployed.
	Rate limiting is used by some ISPs although other ISPs believe it is		Rate limiting is used by some ISPs although other ISPs believe it is
	not really useful since attackers are not well behaved and it doesn't		not really useful since attackers are not well behaved and it doesn't
	provide any operational benefit over the complexity. Rate limiting		provide any operational benefit over the complexity. Rate limiting
	may be improved by developing flow-based rate-limiting capabilities		may be improved by developing flow-based rate-limiting capabilities
	skipping to change at page 20, line 43 ¶		skipping to change at page 21, line 39 ¶
	Lack of consistency regarding the ability to filter, especially with		Lack of consistency regarding the ability to filter, especially with
	respect to performance issues cause some ISPs to not implement BCP38		respect to performance issues cause some ISPs to not implement BCP38
	guidelines for ingress filtering. One such example is at edge boxes		guidelines for ingress filtering. One such example is at edge boxes
	where you have up to 1000 T1's connecting into a router with an OC-12		where you have up to 1000 T1's connecting into a router with an OC-12
	uplink. Some deployed devices experience a large performance impact		uplink. Some deployed devices experience a large performance impact
	with filtering which is unacceptable for passing customer traffic		with filtering which is unacceptable for passing customer traffic
	through. Where performance is not an issue, the ISPs make a tradeoff		through. Where performance is not an issue, the ISPs make a tradeoff
	between management versus risk.		between management versus risk.
	2.5 Routing Control Plane		2.5. Routing Control Plane
	The routing control plane deals with all the traffic which is part of		The routing control plane deals with all the traffic which is part of
	establishing and maintaining routing protocol information.		establishing and maintaining routing protocol information.
	2.5.1 Threats / Attacks		2.5.1. Threats / Attacks
	Attacks on the routing control plane can be both from passive or		Attacks on the routing control plane can be both from passive or
	active sources. Passive attacks are possible if someone has the		active sources. Passive attacks are possible if someone has the
	capability to intercept data between the communicating routing peers.		capability to intercept data between the communicating routing peers.
	This can be accomplished if a single routing peer is somehow		This can be accomplished if a single routing peer is somehow
	compromised and can act as a network sniffer or if it is possible to		compromised and can act as a network sniffer or if it is possible to
	insert a new device which acts as a network sniffer.		insert a new device which acts as a network sniffer.
	Active attacks are possible for both on-path and off-path scenarios.		Active attacks are possible for both on-path and off-path scenarios.
	For on-path active attacks, the situation is the same as for a		For on-path active attacks, the situation is the same as for a
	skipping to change at page 21, line 24 ¶		skipping to change at page 22, line 19 ¶
	attacker impersonating a legitimate routing peer and exchanging		attacker impersonating a legitimate routing peer and exchanging
	routing information. Unintentional active attacks are more common		routing information. Unintentional active attacks are more common
	due to configuration errors, which cause legitimate routing peers to		due to configuration errors, which cause legitimate routing peers to
	feed invalid routing information to other neighboring peers.		feed invalid routing information to other neighboring peers.
	For off-path active attacks, the attacks are generally limited to		For off-path active attacks, the attacks are generally limited to
	message insertion or modification which can divert traffic to		message insertion or modification which can divert traffic to
	illegitimate destinations and cause traffic to never reach its		illegitimate destinations and cause traffic to never reach its
	intended destination.		intended destination.
	2.5.2 Confidentiality Violations		2.5.2. Confidentiality Violations
	Confidentiality violations can occur when a miscreant intercepts any		Confidentiality violations can occur when a miscreant intercepts any
	of the routing update traffic. This is becoming more of a concern		of the routing update traffic. This is becoming more of a concern
	because many ISPs are classifying addressing schemes and network		because many ISPs are classifying addressing schemes and network
	topologies as private and proprietary information. It is also a		topologies as private and proprietary information. It is also a
	concern because the routing protocol packets contain information that		concern because the routing protocol packets contain information that
	may show ways in which routing sessions could be spoofed or hijacked.		may show ways in which routing sessions could be spoofed or hijacked.
	This in turn could lead into a man-in-the-middle attack where the		This in turn could lead into a man-in-the-middle attack where the
	miscreants can insert themselves into the traffic path or divert the		miscreants can insert themselves into the traffic path or divert the
	traffic path and violate the confidentiality of user data.		traffic path and violate the confidentiality of user data.
	2.5.3 Offline Cryptographic Attacks		2.5.3. Offline Cryptographic Attacks
	If any cryptographic mechanism was used to provide for data integrity		If any cryptographic mechanism was used to provide for data integrity
	and confidentiality, an offline cryptographic attack could		and confidentiality, an offline cryptographic attack could
	potentially compromise the data. The traffic would need to be		potentially compromise the data. The traffic would need to be
	captured either by eavesdropping on the network or by being able to		captured either by eavesdropping on the network or by being able to
	divert traffic to a malicious user. Note that by using		divert traffic to a malicious user. Note that by using
	cryptographically protected routing information, the latter would		cryptographically protected routing information, the latter would
	require the cryptographic key to already be compromised anyway so		require the cryptographic key to already be compromised anyway so
	this attack is only feasible if a device was able eavesdrop and		this attack is only feasible if a device was able eavesdrop and
	capture the cryptographically protected routing information.		capture the cryptographically protected routing information.
	2.5.4 Replay Attacks		2.5.4. Replay Attacks
	For a replay attack to be successful, the routing control plane		For a replay attack to be successful, the routing control plane
	traffic would need to first be captured either on-path or diverted to		traffic would need to first be captured either on-path or diverted to
	an attacker to later be replayed to the intended recipient.		an attacker to later be replayed to the intended recipient.
	2.5.5 Message Insertion/Deletion/Modification		2.5.5. Message Insertion/Deletion/Modification
	Routing control plane traffic can be manipulated by someone in		Routing control plane traffic can be manipulated by someone in
	control of intermediate hosts. In addition, traffic can be injected		control of intermediate hosts. In addition, traffic can be injected
	by forging IP addresses, where a remote router sends out packets		by forging IP addresses, where a remote router sends out packets
	which appear to come from another, trusted router. If enough traffic		which appear to come from another, trusted router. If enough traffic
	is injected to be processed by limited memory routers it can cause a		is injected to be processed by limited memory routers it can cause a
	DoS attack.		DoS attack.
	2.5.6 Man-In-The-Middle		2.5.6. Man-In-The-Middle
	A man-in-the-middle attack attacks the identity of a communicating		A man-in-the-middle attack attacks the identity of a communicating
	peer rather than the data stream itself. The attacker intercepts		peer rather than the data stream itself. The attacker intercepts
	traffic that is sent from one routing peer to the other and		traffic that is sent from one routing peer to the other and
	communicates on behalf of one of the peers. This can lead to		communicates on behalf of one of the peers. This can lead to
	diversion of the user traffic to either an unauthorized receiving		diversion of the user traffic to either an unauthorized receiving
	party or cause legitimate traffic to never reach its intended		party or cause legitimate traffic to never reach its intended
	destination.		destination.
	2.5.7 Security Practices		2.5.7. Security Practices
	Securing the routing control plane takes many features which are		Securing the routing control plane takes many features which are
	generally deployed as a system. MD5 authentication is used by some		generally deployed as a system. MD5 authentication is used by some
	ISPs to validate the sending peer and to ensure that the data in		ISPs to validate the sending peer and to ensure that the data in
	transit has not been altered. Some ISPs only deploy MD-5		transit has not been altered. Some ISPs only deploy MD-5
	authentication at customer's request. Additional sanity checks to		authentication at customer's request. Additional sanity checks to
	ensure with reasonable certainty that the received routing update was		ensure with reasonable certainty that the received routing update was
	originated by a valid routing peer include route filters and the BTSH		originated by a valid routing peer include route filters and the BTSH
	feature [BTSH]. Note that validating whether a legitimate peer has		feature [BTSH]. Note that validating whether a legitimate peer has
	the authority to send the contents of the routing update is a		the authority to send the contents of the routing update is a
	skipping to change at page 23, line 5 ¶		skipping to change at page 23, line 45 ¶
	outgoing prefix filters for peers and upstream neighbors, incoming		outgoing prefix filters for peers and upstream neighbors, incoming
	AS-PATH filter for BGP customers, outgoing AS-PATH filter towards		AS-PATH filter for BGP customers, outgoing AS-PATH filter towards
	peers and upstream neighbors, route dampening and rejecting selected		peers and upstream neighbors, route dampening and rejecting selected
	attributes and communities. Consistency between these policies		attributes and communities. Consistency between these policies
	varies greatly although there is a trend to start depending on AS-		varies greatly although there is a trend to start depending on AS-
	PATH filters because they are much more manageable than the large		PATH filters because they are much more manageable than the large
	numbers of prefix filters that would need to be maintained. Many		numbers of prefix filters that would need to be maintained. Many
	ISPs also do not propagate interface IP addresses to further reduce		ISPs also do not propagate interface IP addresses to further reduce
	attack vectors on routers and connected customers.		attack vectors on routers and connected customers.
	2.5.8 Security Services		2.5.8. Security Services
	o User Authentication - Not applicable		o User Authentication - Not applicable
	o User Authorization - Not applicable		o User Authorization - Not applicable
	o Data Origin Authentication - By using MD5 authentication and/or		o Data Origin Authentication - By using MD5 authentication and/or
	the TTL-hack a routing peer can be reasonably certain that traffic		the TTL-hack a routing peer can be reasonably certain that traffic
	originated from a valid peer.		originated from a valid peer.
	o Access Control - Route filters, AS-PATH filters and prefix limits		o Access Control - Route filters, AS-PATH filters and prefix limits
	are used to control access to specific parts of the network.		are used to control access to specific parts of the network.
	o Data Integrity - By using MD5 authentication a peer can be		o Data Integrity - By using MD5 authentication a peer can be
	reasonably certain that the data has not been modified in transit		reasonably certain that the data has not been modified in transit
	but there is no mechanism to prove the validity of the routing		but there is no mechanism to prove the validity of the routing
	information itself.		information itself.
	o Data Confidentiality - Not implemented		o Data Confidentiality - Not implemented
	o Auditing / Logging - TBD		o Auditing / Logging - Filter exceptions are logged.
	o DoS Mitigation - Many DoS attacks are mitigated using a		o DoS Mitigation - Many DoS attacks are mitigated using a
	combination of techniques including: MD5 authentication, the BTSH		combination of techniques including: MD5 authentication, the BTSH
	feature, filtering routing advertisements to bogons and filtering		feature, filtering routing advertisements to bogons and filtering
	routing advertisements to one's own network.		routing advertisements to one's own network.
	2.5.9 Additional Considerations		2.5.9. Additional Considerations
	So far the primary concern to secure the routing control plane has		So far the primary concern to secure the routing control plane has
	been to validate the sending peer and to ensure that the data in		been to validate the sending peer and to ensure that the data in
	transit has not been altered. Although MD-5 routing protocol		transit has not been altered. Although MD-5 routing protocol
	extensions have been implemented which can provide both services,		extensions have been implemented which can provide both services,
	they are not consistently deployed amongst ISPs. Two major		they are not consistently deployed amongst ISPs. Two major
	deployment concerns have been implementation issues where both		deployment concerns have been implementation issues where both
	software bugs and the lack of graceful re-keying options have caused		software bugs and the lack of graceful re-keying options have caused
	significant network down times. Also, some ISPs express concern that		significant network down times. Also, some ISPs express concern that
	deploying MD5 authentication will itself be a worse DoS attack victim		deploying MD5 authentication will itself be a worse DoS attack victim
	skipping to change at page 24, line 14 ¶		skipping to change at page 25, line 6 ¶
	IPsec is not deployed since the operational management aspects of		IPsec is not deployed since the operational management aspects of
	ensuring interoperability and reliable configurations is too complex		ensuring interoperability and reliable configurations is too complex
	and time consuming to be operationally viable. There is also limited		and time consuming to be operationally viable. There is also limited
	concern to the confidentiality of the routing information. The		concern to the confidentiality of the routing information. The
	integrity and validity of the updates are of much greater concern.		integrity and validity of the updates are of much greater concern.
	There is concern for manual or automated actions which introduce new		There is concern for manual or automated actions which introduce new
	routes and can affect the entire routing domain.		routes and can affect the entire routing domain.
	2.6 Software Upgrades and Configuration Integrity / Validation		2.6. Software Upgrades and Configuration Integrity / Validation
	Software upgrades and configuration changes are usually performed as		Software upgrades and configuration changes are usually performed as
	part of either in-band or OOB management functions. However, there		part of either in-band or OOB management functions. However, there
	are additional considerations to be taken into account which are		are additional considerations to be taken into account which are
	enumerated in this section.		enumerated in this section.
	2.6.1 Threats / Attacks		2.6.1. Threats / Attacks
	Attacks performed on system software and configurations can be both		Attacks performed on system software and configurations can be both
	from passive or active sources. Passive attacks are possible if		from passive or active sources. Passive attacks are possible if
	someone has the capability to intercept data between the network		someone has the capability to intercept data between the network
	infrastructure device and the system which is downloading or		infrastructure device and the system which is downloading or
	uploading the software or configuration information. This can be		uploading the software or configuration information. This can be
	accomplished if a single infrastructure device is somehow compromised		accomplished if a single infrastructure device is somehow compromised
	and can act as a network sniffer or if it is possible to insert a new		and can act as a network sniffer or if it is possible to insert a new
	device which acts as a network sniffer.		device which acts as a network sniffer.
	Active attacks are possible for both on-path and off-path scenarios.		Active attacks are possible for both on-path and off-path scenarios.
	For on-path active attacks, the situation is the same as for a		For on-path active attacks, the situation is the same as for a
	passive attack, where either a device has to already be compromised		passive attack, where either a device has to already be compromised
	or a device can be inserted into the path. For off-path active		or a device can be inserted into the path. For off-path active
	attacks, the attacks are generally limited to message insertion or		attacks, the attacks are generally limited to message insertion or
	modification where the attacker may wish to load illegal software or		modification where the attacker may wish to load illegal software or
	configuration files to an infrastructure device.		configuration files to an infrastructure device.
	2.6.2 Confidentiality Violations		2.6.2. Confidentiality Violations
	Confidentiality violations can occur when a miscreant intercepts any		Confidentiality violations can occur when a miscreant intercepts any
	of the software image or configuration information. The software		of the software image or configuration information. The software
	image may give an indication of exploits which the device is		image may give an indication of exploits which the device is
	vulnerable to while the configuration information can inadvertently		vulnerable to while the configuration information can inadvertently
	lead attackers to identify critical infrastructure IP addresses and		lead attackers to identify critical infrastructure IP addresses and
	passwords.		passwords.
	2.6.3 Offline Cryptographic Attacks		2.6.3. Offline Cryptographic Attacks
	If any cryptographic mechanism was used to provide for data integrity		If any cryptographic mechanism was used to provide for data integrity
	and confidentiality, an offline cryptographic attack could		and confidentiality, an offline cryptographic attack could
	potentially compromise the data. The traffic would need to be		potentially compromise the data. The traffic would need to be
	captured either by eavesdropping on the network or by being able to		captured either by eavesdropping on the network or by being able to
	divert traffic to a malicious user.		divert traffic to a malicious user.
	2.6.4 Replay Attacks		2.6.4. Replay Attacks
	For a replay attack to be successful, the software image or		For a replay attack to be successful, the software image or
	configuration file would need to first be captured either on-path or		configuration file would need to first be captured either on-path or
	diverted to an attacker to later be replayed to the intended		diverted to an attacker to later be replayed to the intended
	recipient.		recipient.
	2.6.5 Message Insertion/Deletion/Modification		2.6.5. Message Insertion/Deletion/Modification
	Software images and configuration files can be manipulated by someone		Software images and configuration files can be manipulated by someone
	in control of intermediate hosts. By forging an IP address and		in control of intermediate hosts. By forging an IP address and
	impersonating a valid host which can download software images or		impersonating a valid host which can download software images or
	configuration files, invalid files can be downloaded to an		configuration files, invalid files can be downloaded to an
	infrastructure device. An invalid software image or configuration		infrastructure device. An invalid software image or configuration
	file can cause a device to hang and become inoperable. Spoofed		file can cause a device to hang and become inoperable. Spoofed
	configuration files can be hard to detect, especially when the only		configuration files can be hard to detect, especially when the only
	added command is to allow a miscreant access to that device by		added command is to allow a miscreant access to that device by
	entering a filter allowing a specific host access and configuring a		entering a filter allowing a specific host access and configuring a
	local username/password database entry for authentication to that		local username/password database entry for authentication to that
	device.		device.
	2.6.6 Man-In-The-Middle		2.6.6. Man-In-The-Middle
	A man-in-the-middle attack attacks the identity of a communicating		A man-in-the-middle attack attacks the identity of a communicating
	peer rather than the data stream itself. The attacker intercepts		peer rather than the data stream itself. The attacker intercepts
	traffic that is sent between the infrastructure device and the host		traffic that is sent between the infrastructure device and the host
	used to upload/download the system image or configuration file. He/		used to upload/download the system image or configuration file. He/
	she can then act on behalf of one or both of these systems.		she can then act on behalf of one or both of these systems.
	If an attacker obtained a copy of the software image being deployed,		If an attacker obtained a copy of the software image being deployed,
	he could potentially exploit a known vulnerability and gain access to		he could potentially exploit a known vulnerability and gain access to
	the system. From a captured configuration file, he could obtain		the system. From a captured configuration file, he could obtain
	confidential network topology information or even more damaging		confidential network topology information or even more damaging
	information if any of the passwords in the configuration file were		information if any of the passwords in the configuration file were
	not encrypted.		not encrypted.
	2.6.7 Security Practices		2.6.7. Security Practices
	Images and configurations are stored on specific hosts which have		Images and configurations are stored on specific hosts which have
	limited access. All access and activity relating to these hosts are		limited access. All access and activity relating to these hosts are
	authenticated and logged via AAA services. When uploaded/downloading		authenticated and logged via AAA services. When uploaded/downloading
	any system software or configuration files, either TFTP, FTP or SCP		any system software or configuration files, either TFTP, FTP or SCP
	can be used. Where possible, SCP is used to secure the data transfer		can be used. Where possible, SCP is used to secure the data transfer
	and FTP is generally never used. All TFTP and SCP access is		and FTP is generally never used. All TFTP and SCP access is
	username/password authenticated and in most environments scripts are		username/password authenticated and in most environments scripts are
	used for maintaining a large number of routers. To ensure the		used for maintaining a large number of routers. To ensure the
	integrity of the configurations, every hour the configuration files		integrity of the configurations, every hour the configuration files
	are polled and compared to the previously polled version to find		are polled and compared to the previously polled version to find
	discrepancies. In at least one environment these tools are		discrepancies. In at least one environment these tools are
	Kerberized to take advantage of automated authentication (not		Kerberized to take advantage of automated authentication (not
	confidentiality).		confidentiality).
	Filters are used to limit access to uploading/downloading		Filters are used to limit access to uploading/downloading
	configuration files and system images to specific IP addresses and		configuration files and system images to specific IP addresses and
	protocols.		protocols.
	The software images perform CRC-checks but many ISPs expressed		The software images perform CRC-checks but many ISPs expressed
	interest in having software image integrity validation based on the		interest in having software image integrity validation based on the
	MD5 algorithm for enhanced security. The system binaries use the MD5		MD5 algorithm for enhanced security. The system binaries use the MD5
	algorithm to validate integrity.		algorithm to validate integrity.
	skipping to change at page 26, line 34 ¶		skipping to change at page 27, line 27 ¶
	older software which may not support this functionality,		older software which may not support this functionality,
	configuration files are stored with passwords in readable format. [is		configuration files are stored with passwords in readable format. [is
	this true? are configuration files then protected? if passwords in		this true? are configuration files then protected? if passwords in
	readable format, is the thought that an OOB management network with		readable format, is the thought that an OOB management network with
	SCP will be enough protection? ]		SCP will be enough protection? ]
	Automated security validation is performed on infrastructure devices		Automated security validation is performed on infrastructure devices
	using nmap and nessus to ensure valid configuration against many of		using nmap and nessus to ensure valid configuration against many of
	the well-known attacks.		the well-known attacks.
	2.6.8 Security Services		2.6.8. Security Services
	o User Authentication - All users are authenticated before being		o User Authentication - All users are authenticated before being
	able to download/upload any system images or configuration files.		able to download/upload any system images or configuration files.
	o User Authorization - All authenticated users are granted specific		o User Authorization - All authenticated users are granted specific
	privileges to download or upload system images and/or		privileges to download or upload system images and/or
	configuration files.		configuration files.
	o Data Origin Authentication - TBD		o Data Origin Authentication - Filters are used to limit access to
			uploading/downloading configuration files and system images to
			specific IP addresses.
	o Access Control - Filters are used to limit access to uploading/		o Access Control - Filters are used to limit access to uploading/
	downloading configuration files and system images to specific IP		downloading configuration files and system images to specific IP
	addresses and protocols.		addresses and protocols.
	o Data Integrity - All systems use either a CRC-check or MD5		o Data Integrity - All systems use either a CRC-check or MD5
	authentication to ensure data integrity.		authentication to ensure data integrity.
	o Data Confidentiality - If the SCP protocol is used then there is		o Data Confidentiality - If the SCP protocol is used then there is
	confidentiality of the downloaded/uploaded configuration files and		confidentiality of the downloaded/uploaded configuration files and
	system images.		system images.
	o Auditing / Logging - All access and activity relating to		o Auditing / Logging - All access and activity relating to
	downloading/uploading system images and configuration files are		downloading/uploading system images and configuration files are
	logged via AAA services and filter exception rules.		logged via AAA services and filter exception rules.
	o DoS Mitigation - TBD		o DoS Mitigation - TBD
	2.6.9 Additional Considerations		2.6.9. Additional Considerations
	Where the MD5 algorithm is not used to perform data integrity		Where the MD5 algorithm is not used to perform data integrity
	checking of software images and configuration files, ISPs have		checking of software images and configuration files, ISPs have
	expressed an interest in having this functionality. IPsec is		expressed an interest in having this functionality. IPsec is
	considered too cumbersome and operationally difficult to use for data		considered too cumbersome and operationally difficult to use for data
	integrity and confidentiality.		integrity and confidentiality.
	2.7 Logging Considerations		2.7. Logging Considerations
	Although logging is part of all the previous sections, it is		Although logging is part of all the previous sections, it is
	important enough to be covered as a separate item. The main issues		important enough to be covered as a separate item. The main issues
	revolve around what gets logged, how long are logs kept and what		revolve around what gets logged, how long are logs kept and what
	mechanisms are used to secure the logged information while it is in		mechanisms are used to secure the logged information while it is in
	transit and while it is stored.		transit and while it is stored.
	2.7.1 Threats / Attacks		2.7.1. Threats / Attacks
	Attacks on the logged data can be both from passive or active		Attacks on the logged data can be both from passive or active
	sources. Passive attacks are possible if someone has the capability		sources. Passive attacks are possible if someone has the capability
	to intercept data between the recipient logging server and the device		to intercept data between the recipient logging server and the device
	the logged data originated from. This can be accomplished if a		the logged data originated from. This can be accomplished if a
	single infrastructure device is somehow compromised and can act as a		single infrastructure device is somehow compromised and can act as a
	network sniffer or if it is possible to insert a new device which		network sniffer or if it is possible to insert a new device which
	acts as a network sniffer.		acts as a network sniffer.
	Active attacks are possible for both on-path and off-path scenarios.		Active attacks are possible for both on-path and off-path scenarios.
	For on-path active attacks, the situation is the same as for a		For on-path active attacks, the situation is the same as for a
	passive attack, where either a device has to already be compromised		passive attack, where either a device has to already be compromised
	or a device can be inserted into the path. For off-path active		or a device can be inserted into the path. For off-path active
	attacks, the attacks are generally limited to message insertion or		attacks, the attacks are generally limited to message insertion or
	modification which can alter the logged data to keep any compromise		modification which can alter the logged data to keep any compromise
	from being detected or to destroy any evidence which could be used		from being detected or to destroy any evidence which could be used
	for criminal prosecution.		for criminal prosecution.
	2.7.1.1 Confidentiality Violations		2.7.1.1. Confidentiality Violations
	Confidentiality violations can occur when a miscreant intercepts any		Confidentiality violations can occur when a miscreant intercepts any
	of the logging data which is in transit on the network. This could		of the logging data which is in transit on the network. This could
	lead to privacy violations if some of the logged data has not been		lead to privacy violations if some of the logged data has not been
	sanitized to disallow any data that could be a violation of privacy		sanitized to disallow any data that could be a violation of privacy
	to be included in the logged data.		to be included in the logged data.
	2.7.1.2 Offline Cryptographic Attacks		2.7.1.2. Offline Cryptographic Attacks
	If any cryptographic mechanism was used to provide for data integrity		If any cryptographic mechanism was used to provide for data integrity
	and confidentiality, an offline cryptographic attack could		and confidentiality, an offline cryptographic attack could
	potentially compromise the data. The traffic would need to be		potentially compromise the data. The traffic would need to be
	captured either by eavesdropping on the network or by being able to		captured either by eavesdropping on the network or by being able to
	divert traffic to a malicious user.		divert traffic to a malicious user.
	2.7.1.3 Replay Attacks		2.7.1.3. Replay Attacks
	For a replay attack to be successful, the logging data would need to		For a replay attack to be successful, the logging data would need to
	first be captured either on-path or diverted to an attacker and later		first be captured either on-path or diverted to an attacker and later
	replayed to the recipient. [is reply handled by syslog protocol?]		replayed to the recipient. [is reply handled by syslog protocol?]
	2.7.1.4 Message Insertion/Deletion/Modification		2.7.1.4. Message Insertion/Deletion/Modification
	Logging data could be injected, deleted or modified by someone in		Logging data could be injected, deleted or modified by someone in
	control of intermediate hosts. Logging data can also be injected by		control of intermediate hosts. Logging data can also be injected by
	forging packets from either legitimate or illegitimate IP addresses.		forging packets from either legitimate or illegitimate IP addresses.
	2.7.1.5 Man-In-The-Middle		2.7.1.5. Man-In-The-Middle
	A man-in-the-middle attack attacks the identity of a communicating		A man-in-the-middle attack attacks the identity of a communicating
	peer rather than the data stream itself. The attacker intercepts		peer rather than the data stream itself. The attacker intercepts
	traffic that is sent between the infrastructure device and the		traffic that is sent between the infrastructure device and the
	logging server or traffic sent between the logging server and the		logging server or traffic sent between the logging server and the
	database which is used to archive the logged data. Any unauthorized		database which is used to archive the logged data. Any unauthorized
	access to logging information could lead to knowledge of private and		access to logging information could lead to knowledge of private and
	proprietary network topology information which could be used to		proprietary network topology information which could be used to
	compromise portions of the network. An additional concern is having		compromise portions of the network. An additional concern is having
	access to logging information which could be deleted or modified so		access to logging information which could be deleted or modified so
	as to cover any traces of a security breach.		as to cover any traces of a security breach.
	2.7.2 Security Practices		2.7.2. Security Practices
	Logging is mostly performed on an exception auditing basis when it		Logging is mostly performed on an exception auditing basis when it
	comes to filtering (i.e. traffic which is NOT allowed is logged).		comes to filtering (i.e. traffic which is NOT allowed is logged).
	Typically the data logged will contain the source and destination IP		Typically the data logged will contain the source and destination IP
	addresses and layer 4 port numbers as well as a timestamp. The		addresses and layer 4 port numbers as well as a timestamp. The
	syslog protocol is used to transfer the logged data between the		syslog protocol is used to transfer the logged data between the
	infrastructure device to the syslog server. Many ISPs use the OOB		infrastructure device to the syslog server. Many ISPs use the OOB
	management network to transfer syslog data since there is virtually		management network to transfer syslog data since there is virtually
	no security performed between the syslog server and the device. All		no security performed between the syslog server and the device. All
	ISPs have multiple syslog servers - some ISPs choose to use separate		ISPs have multiple syslog servers - some ISPs choose to use separate
	skipping to change at page 29, line 37 ¶		skipping to change at page 30, line 29 ¶
	the device for log files. This provides a backup mechanism to see		the device for log files. This provides a backup mechanism to see
	what is going on in the network in the event that a device may		what is going on in the network in the event that a device may
	'forget' to do syslog if the CPU is busy.		'forget' to do syslog if the CPU is busy.
	The logs from the various syslog server devices are generally		The logs from the various syslog server devices are generally
	transferred into databases at a set interval which can be anywhere		transferred into databases at a set interval which can be anywhere
	from every 10 minutes to every hour. One ISP uses Rsync to push the		from every 10 minutes to every hour. One ISP uses Rsync to push the
	data into a database and then the information is sorted manually by		data into a database and then the information is sorted manually by
	someone SSH'ing to that database.		someone SSH'ing to that database.
	2.7.3 Security Services		2.7.3. Security Services
	o User Authentication - Not applicable		o User Authentication - Not applicable
	o User Authorization - Not applicable		o User Authorization - Not applicable
	o Data Origin Authentication - Not implemented		o Data Origin Authentication - Not implemented
	o Access Control - Filtering on logging host and server IP address		o Access Control - Filtering on logging host and server IP address
	to ensure that syslog information only goes to specific syslog		to ensure that syslog information only goes to specific syslog
	hosts.		hosts.
	o Data Integrity - Not implemented		o Data Integrity - Not implemented
	o Data Confidentiality - Not implemented
	o Auditing / Logging - TBD		o Data Confidentiality - Not implemented
			o Auditing / Logging - This entire section deals with logging.
	o DoS Mitigation - TBD		o DoS Mitigation - TBD
	2.7.4 Additional Considerations		2.7.4. Additional Considerations
	There is no security with syslog and ISPs are fully cognizant of		There is no security with syslog and ISPs are fully cognizant of
	this. IPsec is considered too operationally expensive and cumbersome		this. IPsec is considered too operationally expensive and cumbersome
	to deploy. Syslog-ng and stunnel are being looked at for providing		to deploy. Syslog-ng and stunnel are being looked at for providing
	better authenticated and integrity protected solutions. Mechanisms		better authenticated and integrity protected solutions. Mechanisms
	to prevent unauthorized personnel from tampering with logs is		to prevent unauthorized personnel from tampering with logs is
	constrained to auditing who has access to the logging servers and		constrained to auditing who has access to the logging servers and
	files.		files.
	ISPs expressed requirements for more than just UDP syslog. They		ISPs expressed requirements for more than just UDP syslog. They
	would also like more granular and flexible facilities and priorities,		would also like more granular and flexible facilities and priorities,
	i.e. specific logs to specific servers.		i.e. specific logs to specific servers.
	2.8 Denial of Service Tracking / Tracing		2.8. Filtering Considerations
			Although filtering has been covered under many of the previous
			sections, this section will provide some more insights to the
			filtering considerations that are currently being taken into account.
			Filtering is now being categorized into three specific areas: data
			plane, management plane and routing control plane.
			2.8.1. Data Plane Filtering
			Data plane filters control the traffic that traverses through a
			device and affect transit traffic. Most ISPs deploy these kinds of
			filters at the customer facing edge devices to mitigate spoofing
			attacks.
			2.8.2. Management Plane Filtering
			Management filters control the traffic to and from a device. All of
			the protocols which are used for device management fall under this
			category and includes SSH, Telnet, SNMP, NTP, http, DNS, TFTP, FTP,
			SCP and Syslog. This type of traffic is currently filtered per
			interface and is based on any combination of protocol, source and
			destination IP address and source and destination port number. Note
			that logging the filtering rules can today place a burden on many
			systems and more granularity is often required to more specifically
			log the required exceptions.
			IPv6 networks require the use of specific ICMP messages for proper
			protocol operation. Therefore, ICMP cannot be completely filtered to
			and from a device. Instead, granular ICMPv6 filtering is always
			deployed to allow for specific ICMPv6 types to be sourced or destined
			to a network device.
			2.8.3. Routing Control Plane Filtering
			Routing filters are used to control the flow of routing information.
			In IPv6 networks, some providers are liberal in accepting /48Os due
			to the still unresolved multihoming issues. Anything longer than a
			/48 is discarded on EBGP.
			2.9. Denial of Service Tracking / Tracing
	Denial of Service attacks are an ever increasing problem and require		Denial of Service attacks are an ever increasing problem and require
	vast amounts of resources to combat effectively. Some large ISPs do		vast amounts of resources to combat effectively. Some large ISPs do
	not concern themselves with attack streams that are less than 1G in		not concern themselves with attack streams that are less than 1G in
	bandwidth - this is on the larger pipes where 1G is essentially less		bandwidth - this is on the larger pipes where 1G is essentially less
	than 5% of offered load. This is largely due to the large amounts of		than 5% of offered load. This is largely due to the large amounts of
	DDoS traffic which continually requires investigation and mitigation.		DDoS traffic which continually requires investigation and mitigation.
	At last count the number of hosts making up large distributed DoS		At last count the number of hosts making up large distributed DoS
	BOTnets exceeded 1 million hosts.		BOTnets exceeded 1 million hosts.
	New techniques are continually evolving to automate the process of		New techniques are continually evolving to automate the process of
	detecting DoS sources and mitigating any adverse effects as quickly		detecting DoS sources and mitigating any adverse effects as quickly
	as possible. At this time, ISPs are using a variety of mitigation		as possible. At this time, ISPs are using a variety of mitigation
	techniques including: sink hole routing, black-hole triggered		techniques including: sink hole routing, black-hole triggered
	routing, uRPF and rate limiting. Each of these techniques will be		routing, uRPF and rate limiting. Each of these techniques will be
	detailed below.		detailed below.
	2.8.1 Sink Hole Routing		2.9.1. Sink Hole Routing
	To be added.		Sink hole routing refers to injecting a more specific route for any
			known attack traffic which will ensure that the malicious traffic is
			redirected to a valid subnet or specific IP address where it can be
			analyzed.
	2.8.2 Black-Hole Triggered Routing		2.9.2. Black-Hole Triggered Routing
	To be added.		Black-hole triggered routing is a technique where the BGP routing
			protocol is used to propagate static routes which in turn redirects
			attack traffic to the null interface where it is effectively dropped.
			This technique is often used in large routing infrastructures since
			BGP can propagate the information in a fast effective manner as
			opposed to using any packet-based filtering techniques on hundreds or
			thousands of routers.
	2.8.3 Unicast Reverse Path Forwarding		2.9.3. Unicast Reverse Path Forwarding
	Unicast Reverse Path Forwarding (uRPF) is a mechanism for validating		Unicast Reverse Path Forwarding (uRPF) is a mechanism for validating
	whether an incoming packet has a legitimate source address or not.		whether an incoming packet has a legitimate source address or not.
	It has two modes: strict mode and loose mode. In strict mode, uRPF		It has two modes: strict mode and loose mode. In strict mode, uRPF
	checks whether the incoming packet has a source address that matches		checks whether the incoming packet has a source address that matches
	a prefix in the routing table, and whether the interface expects to		a prefix in the routing table, and whether the interface expects to
	receive a packet with this source address prefix. If the incoming		receive a packet with this source address prefix. If the incoming
	packet fails the unicast RPF check, the packet is not accepted on the		packet fails the unicast RPF check, the packet is not accepted on the
	incoming interface. Loose mode uRPF is not as specific and the		incoming interface. Loose mode uRPF is not as specific and the
	incoming packet is accepted if there is any route in the routing		incoming packet is accepted if there is any route in the routing
	table for the source address.		table for the source address.
	uRPF is not used on interfaces that are likely to have routing		uRPF is not used on interfaces that are likely to have routing
	asymmetry, meaning multiple routes to the source of a packet.		asymmetry, meaning multiple routes to the source of a packet.
	Usually for ISPs, uRPF is placed at the customer edge of a network.		Usually for ISPs, uRPF is placed at the customer edge of a network.
	2.8.4 Rate Limiting		2.9.4. Rate Limiting
	Details of rate limiting		Rate limiting refers to allocating a specific amount of bandwidth or
			packets per second to specific traffic types. This technique is
			widely used to mitigate well-known protocol attacks such as the TCP-
			SYN attack where a large number of resources get allocated for
			spoofed TCP traffic. Although this technique does not stop an
			attack, it can lessen the damage and impact on a specific service.
	3. Security Considerations		3. Security Considerations
	This entire document deals with current security practices in large		This entire document deals with current security practices in large
	ISP environments. As a synopsis, a table is shown below which		ISP environments. As a synopsis, a table is shown below which
	summarizes the operational functions which are to be protected and		summarizes the operational functions which are to be protected and
	the security services which currently deployed security practices		the security services which currently deployed security practices
	offer: [ Table to be added ]		offer: [ Table to be added ]
	4. Normative References		4. Normative References
	skipping to change at page 32, line 25 ¶		skipping to change at page 35, line 5 ¶
	[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate		[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
	Requirement Levels", BCP 14, RFC 2119, March 1997.		Requirement Levels", BCP 14, RFC 2119, March 1997.
	[RFC2828] Shirey, R., "Internet Security Glossary", RFC 2828,		[RFC2828] Shirey, R., "Internet Security Glossary", RFC 2828,
	May 2000.		May 2000.
	[RFC3552] Rescorla, E. and B. Korver, "Guidelines for Writing RFC		[RFC3552] Rescorla, E. and B. Korver, "Guidelines for Writing RFC
	Text on Security Considerations", BCP 72, RFC 3552,		Text on Security Considerations", BCP 72, RFC 3552,
	July 2003.		July 2003.
	Author's Address
	Merike Kaeo
	Double Shot Security, Inc.
	520 Washington Blvd. #363
	Marina Del Rey, CA 90292
	U.S.A.
	Phone: +1 310 866 0165
	Email: merike@doubleshotsecurity.com
	Appendix A. Acknowledgments		Appendix A. Acknowledgments
	The editor gratefully acknowledges the contributions of: George		The editor gratefully acknowledges the contributions of: George
	Jones, who has been instrumental in providing guidance and direction		Jones, who has been instrumental in providing guidance and direction
	for this document and the insighful comments from Ross Callon and the		for this document and the insighful comments from Ross Callon and the
	numerous ISP operators who supplied the information which is depicted		numerous ISP operators who supplied the information which is depicted
	in this document.		in this document.
	Appendix B. Protocol Specific Attacks		Appendix B. Protocol Specific Attacks
	This section will enumerate many of the traditional protocol based		This section will enumerate many of the traditional protocol based
	attacks which have been observed over the years to cause malformed		attacks which have been observed over the years to cause malformed
	packets and/or exploit protocol deficiencies.		packets and/or exploit protocol deficiencies.
			B.1. Layer 2 Attacks
	o ARP Flooding		o ARP Flooding
			B.2. IPv4 Attacks
	o IP Stream Option		o IP Stream Option
	o IP Address Spoofing		o IP Address Spoofing
	o IP Source Route Option		o IP Source Route Option
	o IP Short header		o IP Short header
	o IP Malformed Packet		o IP Malformed Packet
	skipping to change at page 36, line 5 ¶		skipping to change at page 37, line 36 ¶
	o SYN with IP Spoofing (Land Attack)		o SYN with IP Spoofing (Land Attack)
	o SYN and FIN bits set		o SYN and FIN bits set
	o TCP port scan attack		o TCP port scan attack
	o UDP spoofed broadcast echo (Fraggle Attack)		o UDP spoofed broadcast echo (Fraggle Attack)
	o UDP attack on diag ports (Pepsi Attack)		o UDP attack on diag ports (Pepsi Attack)
			B.3. IPv6 Attacks
			Any of the above-mentioned IPv4 attacks could be used in IPv6
			networks with the exception of any fragmentation and broadcast
			traffic, which operate differently in IPv6.
			Today, IPv6 enabled hosts are starting to be used to create IPv6
			tunnels which can effectively hide botnet and other malicious traffic
			if firewalls and network flow collection tools are not capable of
			detecting this traffic.
			Author's Address
			Merike Kaeo
			Double Shot Security, Inc.
			520 Washington Blvd. #363
			Marina Del Rey, CA 90292
			U.S.A.
			Phone: +1 310 866 0165
			Email: merike@doubleshotsecurity.com
	Intellectual Property Statement		Intellectual Property Statement
	The IETF takes no position regarding the validity or scope of any		The IETF takes no position regarding the validity or scope of any
	Intellectual Property Rights or other rights that might be claimed to		Intellectual Property Rights or other rights that might be claimed to
	pertain to the implementation or use of the technology described in		pertain to the implementation or use of the technology described in
	this document or the extent to which any license under such rights		this document or the extent to which any license under such rights
	might or might not be available; nor does it represent that it has		might or might not be available; nor does it represent that it has
	made any independent effort to identify any such rights. Information		made any independent effort to identify any such rights. Information
	on the procedures with respect to rights in RFC documents can be		on the procedures with respect to rights in RFC documents can be
	found in BCP 78 and BCP 79.		found in BCP 78 and BCP 79.
End of changes. 100 change blocks.
	135 lines changed or deleted		256 lines changed or added
This html diff was produced by rfcdiff 1.48. The latest version is available from http://tools.ietf.org/tools/rfcdiff/