presenter: mark elkins topic: things not getting done

Presenter: Mark Elkins

Topic: Things not getting done

Things not getting done

Mark ElkinsAfriNIC-17mje@posix.co.za

Technical solutions exist and are universally accepted, yet...

1)DNSSEC

2)IPv6 enablement

3)Telnet elimination

4)Egress filtering of routes

DNSSEC● The Domain Name System (DNS) set of

security extensions which provide some additional levels of security atop DNS

● This refers both to:– signing zones– operating validating servers (http://dnssec.co.za)

● Using DNSSEC aware applications (dnssec validator)

● DNSSEC Training (http://dnstraining.coza.net.za)

DANE: DNS-Based Authentication of Named Entities (SSL, SMTP, S/MIME, XMPPetc)

IPv6 Enablement

Production implementation of the IPv6 protocol including public accessibility, routing, and availability of all IPv4 public services over IPv6.

● Get an allocation from AfriNIC (Its often free)● Dual Stack your core, Peering and Transit● Dual Stack Web, Nameservers and E-Mail● Dual stack your customers

Telnet elimination

● Should be eliminated in favour of more secure protocols like SSH

● Consider a similar treatment for– POP3/IMAP– E-Mail

Egress Filtering of Routes

Implementation of security policies at the router level, restricting traffic between networks which do not meet routing policy (BCP38).– Filter to only allow your networks to leave your

network

Technical solutions exist but fair minded people debate the need

1)Route Registry

2)Secure HTTP (HTTPS)

3)Route Aggregation

4)Mail Submission

Route Registry

Database of routing objects, provided by the RIRs and other organizations, for configuring routers and establishing/maintaining routing policy.– Possible starting point for RPKI

HTTPs

Hypertext Transfer Protocol Secure is a preferred communication protocol over the Internet when compared to HTTP alone. We need to encourage implementation by applications.– Combine with DNSSEC and DANE

Route aggregation

Active management of routes, routing slots, routing policy, and prefixes to structure IP address blocks into a hierarchical manner optimizing Classless Inter-Domain Routing (CIDR).

Mail Submission

Securing the origination of e-mails by blocking port 25 (SMTP) and only accepting e-mails on port 587 (submission) which can be both authenticated (user/passwd) and encrypted (SSL/TLS)– Effectively eliminate SPAM generation from mail

robots