Subject: Re: [OPSEC] pccw as17557 leak...

From: "Paul Ferguson" <[email-masked]>
Date: Thu, 28 Feb 2008 06:34:45 GMT

- -- Roland Dobbins <[email-masked]> wrote:

>> (meaning: it is appalling how many networks don't do even the
>> most basic bogon filtering)
>
>Right.  So if there's no technological solution, then in what domain  
does the solution, if any, lie?  And if there is no technological  
solution, then how can this WG make a contribution to said solution,  
assuming one is possible?

I'm really not sure. Really.

That is the point I'm trying to make, since ISPs have historically
been resistive to IETF "Best Current Practices" (e.g. BCP38 is a
prime example).

Coming at this from a security perspective, the ISP landscape is
a very challenging one -- every ISP is a "one-off" wanting to do
things there own way, in their own time, and in their own interests.

My primary concern here is that if ISP don't get a grip on these
sorts of issues as a community, some other entity may force their
hand on it regionally/nationally (read: unwise government meddling).

It is in their interests, and ours, and the Internet community
at-large, to figure something out -- but again, I don't harbor a
lot of faith in some technological solution to this problem. It just
doesn't lend itself to that avenue, for various reasons.

Just to highlight a couple of issues with technological approaches,
there are:

- - CA for BGP-authenticated prefix announcements;
- - Lack of x.509 of other trusted CA;
- - Wide-spread adoption;
- - Vendor implementation;
- - Computational and real-time processor overhead

...among others, which may take years to sort out.

So, realistically we need operational & procedural priorities here.

- - ferg

--
"Fergie", a.k.a. Paul Ferguson
 Engineering Architecture for the Internet
 fergdawg(at)netzero.net
 ferg's tech blog: http://fergdawg.blogspot.com/

_______________________________________________
OPSEC mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/opsec

---

From: David Barak <[email-masked]>
Date: Wed, 27 Feb 2008 22:58:18 -0800 (PST)

> So, realistically we need operational & procedural

From my perspective, I'd like to make it harder to make a mistake.  Preventing an attack requires an order of magnitude more effort, but if we can get a little bit of incremental progress, I'd see that as a success.

Would you agree that improving the resilience to mistakes is on the right side of the 80/20 rule?

David Barak
Need Geek Rock?  Try The Franchise: 
http://www.listentothefranchise.com

      ____________________________________________________________________________________
Be a better friend, newshound, and 
know-it-all with Yahoo! Mobile.  Try it now.  http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ