Presenter: Mark Elkins
Topic: Things not getting done
Things not getting done
Mark [email protected]
Technical solutions exist and are universally accepted, yet...
1)DNSSEC
2)IPv6 enablement
3)Telnet elimination
4)Egress filtering of routes
DNSSEC● The Domain Name System (DNS) set of
security extensions which provide some additional levels of security atop DNS
● This refers both to:– signing zones– operating validating servers (http://dnssec.co.za)
● Using DNSSEC aware applications (dnssec validator)
● DNSSEC Training (http://dnstraining.coza.net.za)
DANE: DNS-Based Authentication of Named Entities (SSL, SMTP, S/MIME, XMPPetc)
IPv6 Enablement
Production implementation of the IPv6 protocol including public accessibility, routing, and availability of all IPv4 public services over IPv6.
● Get an allocation from AfriNIC (Its often free)● Dual Stack your core, Peering and Transit● Dual Stack Web, Nameservers and E-Mail● Dual stack your customers
Telnet elimination
● Should be eliminated in favour of more secure protocols like SSH
● Consider a similar treatment for– POP3/IMAP– E-Mail
Egress Filtering of Routes
Implementation of security policies at the router level, restricting traffic between networks which do not meet routing policy (BCP38).– Filter to only allow your networks to leave your
network
Technical solutions exist but fair minded people debate the need
1)Route Registry
2)Secure HTTP (HTTPS)
3)Route Aggregation
4)Mail Submission
Route Registry
Database of routing objects, provided by the RIRs and other organizations, for configuring routers and establishing/maintaining routing policy.– Possible starting point for RPKI
HTTPs
Hypertext Transfer Protocol Secure is a preferred communication protocol over the Internet when compared to HTTP alone. We need to encourage implementation by applications.– Combine with DNSSEC and DANE
Route aggregation
Active management of routes, routing slots, routing policy, and prefixes to structure IP address blocks into a hierarchical manner optimizing Classless Inter-Domain Routing (CIDR).
Mail Submission
Securing the origination of e-mails by blocking port 25 (SMTP) and only accepting e-mails on port 587 (submission) which can be both authenticated (user/passwd) and encrypted (SSL/TLS)– Effectively eliminate SPAM generation from mail
robots
Top Related