View
2
Download
0
Category
Preview:
Citation preview
Better routing security through concerted action
1
Andrei Robachevsky
robachevsky@isoc.org
NANOG 75
BGP is unsecure – what’s missing?
2
Tools
Data
Incentives
There is a problem
3
• 12,600 total incidents (either outages or attacks, like route leaks and hijacks)
• About 4.4% of all Autonomous Systems on the Internet were affected
• 2,737 Autonomous Systems were a victim of at least one routing incident
• 1,294 networks were responsible for 4739 routing incidents
Source: https://www.bgpstream.com/
7864, 62%
4739, 38%
Twelve months of routing incidents (2018)
Outage Routing incident
Statistics of routing incidents generated from BGPStream data
Caveats:
• Sometimes it is impossible to distinguish an attack from a legitimate (or consented) routing change
• CC attribution is based on geolocation MaxMind's GeoLite City data set
But:
• Using the same methodology we should get a pretty accurate picture of the dynamics
4
2 years in review (2017, 2018)
There is a problem (comp. 2017)
5
• 12,600 ( 9.6%) total incidents (either outages or attacks, like route leaks and hijacks)
• About 4.4% ( 1%) of all Autonomous Systems on the Internet were affected
• 2,737 (. 12%) Autonomous Systems were a victim of at least one routing incident
• 1,294 ( 17%) networks were responsible for 4739 routing incidents
Source: https://www.bgpstream.com/
16495, 62%
10043, 38%
Routing incidents (2017-2018)
Outage Routing incident
Potential victims
6
Source: https://www.bgpstream.com/
1244
397
239
339
157
141
116
168106
Incidents with a victim in a country, Top 10
US BR RU BD IN GB DE CN HK
3.74.2
3.4
29.1
6.94.4
4.3
16.2
12.1
% of networks affected by an incident
US BR RU BD IN GB DE CN HK
Potential victims: 2017 2018
7
0
5
10
15
20
25
30
35
US BR IN RU BD IR GB DE HK CN
Changes in % of victimized network in country
2017 2018
Potential culprits 2018
8
Source: https://www.bgpstream.com/
1.13.1
1.8
2.6
2.7
2.1
7.5
3.3
1.4
5.5
Percent of AS's in a country responsible for a routing incident (a route leak or hijack)
US
BR
RU
DE
IN
GB
HK
NL
UA
CN
1.1%
2.1%
5.0%
0.0%
3.4%
2.8%
3.0%
2.8%3.3%
1.6%
1.6%
2.4%
1.6%
3.3%
1.2%1.9%
4.5%
Percent of AS's in a country responsible for a routing incident
Australia and New ZealandMelanesiaMicronesiaPolynesiaEastern AsiaSouth-eastern AsiaCentral AsiaWestern AsiaSouthern AsiaEastern EuropeSouthern EuropeWestern EuropeNorthern EuropeLatin America and the CaribbeanNorthern AmericaNorthern AfricaSub-Saharan Africa
Positive dynamics
9
0
1
2
3
4
5
6
7
8
9
10
US BR RU IN BD ID DE IR GB HK
% of AS's in a country responsible for a routing incident
2017 2018
BGP is unsecure – what’s missing?
10
Tools
Data
Incentives
Action
Action – who can make an impact?
• edge and access networks• transit providers• content and cloud• IXPs IX
Content Cloud
Transit
EDGE
IX
Content Cloud
Transit
The Edge
12
Impact• Implement egress controls (reduce risk of leaking routes)• Register routing information (enable RP to validate, reduce the risk of the
hijack)• Demand security standard from the upstream (reduce risks of incidents)
EDGE
The Transit
13
IX
Content Cloud
Transit
EDGE
Impact• Implement ingress controls (customer cone, avoid leaks and hijacks)• Ensure correctness of routing information (AS-SET, also semantically)
The Content/Cloud
14
IX
Content Cloud
Transit
EDGE
Impact• Implement egress controls• Implement ingress controls
• Register routing information (enable RP to validate, reduce the risk of the hijack)
The eXchange
15
IX
Content Cloud
Transit
EDGE
Impact• Implement ingress controls on RS (multilateral peering)• Promote culture of routing hygiene in their communities
The playing field
16
• Each player can contribute to routing security (and big time to its insecurity)
• Most of them would like to have a more secure routing system
• Most of them have little incentive• One’s network security is in the hands of others
We have a typical collective action problem
Two neighbours may agree to drain a meadow, which they possess in common; because it is easy for them to know each others mind; and each must perceive, that the immediate consequence of his failing in his part, is, the abandoning the whole project. But it is very difficult, and indeed impossible, that a thousand persons should agree in any such action; it being difficult for them to concert so complicated a design, and still more difficult for them to execute it; while each seeks a pretext to free himself of the trouble and expense, and would lay the whole burden on others.[Hume, David. A Treatise of Human Nature]
17
Can this problem be solved without regulation?
18
Norms may provide a solution in some cases• Need to agree on values. And behaviors that support these values
Common Value• Resilient and secure global routing system
Behaviors• Do not accept and propagate others mistakes (Validate what you accept from the neighbors)• Protect your neighbors from your own mistakes (avoid policy violations)
• Do not hijack
• Do not leak
• Enable others to validate
From Behaviors to Norms
19
Widely accepted as a good practice
Not exactly a least common denominator, but not too high either
Visible and Measurable
CoordinationFacilitate global
operational communication and
coordination between network operators
Maintain globally accessible up-to-date contact information in
common routing databases
Anti-spoofingPrevent traffic with spoofed source IP
addresses
Enable source address validation for at least single-homed stub
customer networks, their own end-users, and
infrastructure
Network operators
FilteringPrevent propagation of
incorrect routing information
Ensure the correctness of your own announcements and announcements from
your customers to adjacent networks with prefix and
AS-path granularity
Global Validation
Facilitate validation of routing information on a
global scale
Publish your data, so others can validate
20
IXPs
Action 1Prevent
propagation of incorrect routing
information
This mandatory action requires
IXPs to implement filtering of route
announcements at the Route Server based on routing information data
(IRR and/or RPKI).
21
Action 2Promote
MANRS to the IXP membership
IXPs joining MANRS are expected to
provide encouragement or assistance for their
members to implement
MANRS actions.
Action 3Protect the
peering platform
This action requires that the
IXP has a published policy of traffic not allowed
on the peering fabric and
performs filtering of such traffic.
Action 4Facilitate global
operational communication
and coordination
The IXP facilitates communication
among members by providing
necessary mailing lists and member
directories.
Action 5Provide
monitoring and debugging tools to the members.
The IXP provides a looking glass for
its members.
Content (work in progress)
Action 1Prevent
propagation of incorrect routing
information
Ingress and egress filtering
22
Action 2Prevent traffic with spoofed
source IP addresses
Action 3Facilitate global
operational communication
and coordination
Action 4Facilitate
validation of routing
information on a global scale
Action 5Promote MANRS
Action 6Provide
monitoring and debugging tools
to peering partners
23
Mutually Agreed Norms for Routing Security
MANRS provides baseline recommendations in the form of Actions• Distilled from common behaviors – BCPs, optimized for low cost and low risk of deployment• With high potential of becoming norms
MANRS builds a visible community of security minded operators• Social acceptance and peer pressure
Why join MANRS?• Improve your security posture and reduce the
number and impact of routing incidents
• Demonstrate that these practices are reality
• Join a community of security-minded operators working together to make the Internet better
• Use MANRS as a competitive differentiator 24
25
Is MANRS taking off?
1015 17
2023 24 25
28 3033
3740 41
43 45 46 47 48 49 5054 55
60
6570
75
80
90
97
106
112
120
130
6-Nov-1
4
6-Dec-1
4
6-Jan-1
5
6-Feb-1
5
6-Mar-1
5
6-Apr-1
5
6-May-1
5
6-Jun-1
5
6-Jul-1
5
6-Aug-1
5
6-Sep-1
5
6-Oct-
15
6-Nov-1
5
6-Dec-1
5
6-Jan-1
6
6-Feb-1
6
6-Mar-1
6
6-Apr-1
6
6-May-1
6
6-Jun-1
6
6-Jul-1
6
6-Aug-1
6
6-Sep-1
6
6-Oct-
16
6-Nov-1
6
6-Dec-1
6
6-Jan-1
7
6-Feb-1
7
6-Mar-1
7
6-Apr-1
7
6-May-1
7
6-Jun-1
7
6-Jul-1
7
6-Aug-1
7
6-Sep-1
7
6-Oct-
17
6-Nov-1
7
6-Dec-1
7
6-Jan-1
8
6-Feb-1
8
6-Mar-1
8
6-Apr-1
8
6-May-1
8
6-Jun-1
8
6-Jul-1
8
6-Aug-1
8
6-Sep-1
8
6-Oct-
18
6-Nov-1
8
6-Dec-1
8
6-Jan-1
9
MANRS – increasing adoption
26
MANRS Implementation Guide
27
A resource to help Operators implement MANRS Actions.
• Based on Best Current Operational Practices deployed by network operators around the world
• https://www.manrs.org/bcop/
• Has received recognition from the RIPE community by being published as RIPE-706
MANRS Training Tutorials
28
6 training tutorials based on information in the Implementation Guide. A test at the end of each tutorial. https://www.manrs.org/tutorials
About to begin training moderators for online classes (43 applications received!)
MANRS Hands-on Lab
29
The prototype lab is ready, finalizing the production version.
• Cisco
• Juniper
• Mikrotik
Can be used as a
standalone lab or as
an end-exam
MANRS Member Report and MANRS Observatory
30
MANRS Member Report and MANRS Observatory
31
MANRS Member Report and MANRS Observatory
32
33
• Open a browser on any laptop, tablet or smartphone• Go to slido.com• Enter the event code #L206
Is there a path to Norms?: a poll
only togethermanrs.org
#ProtectTheCore
MANRS Video: https://www.youtube.com/embed/nJINk5p-HEE
34
Recommended