So this module is about routing infrastructure security and why do we even care right isn't that somebody else's problem well that is the problem right we all have to look at how we can make a difference because there are so many tacks there are so many vulnerabilities and we don't want to be part of the problem so historically the routing infrastructure the network was not really that interesting to anybody that was trying to do something nefarious but in the last few years there's been more and more focus on the network infrastructure and also causing deliberate routing interrupts now while attackers also need to have infrastructure up and available they may try and divert traffic or in extreme cases they may make some areas of the network unavailable right neither of these are acceptable and we have to do what we can to protect ourselves so where is the routing infrastructure vulnerable there are so many optics around this not as common but they do exist our active attacks where the routing infrastructure is actually the target and somebody is trying to either blackhole your network and make it unavailable or divert traffic there's also software and implementation bugs and as the saying goes is it a bug or a feature but if it causes a disruption in your network obviously it's a bug that's a problem that you need to look at so you could have a protocol error the routing protocol itself initially none of the routing protocols really took security into consideration because they didn't think they had to bgp uses TCP so you could have some TCP reset issues right there maybe other protocol issues that have not yet been discovered so we always have to have a lookout for that configuration mistakes are also something that you really need to take into account and while it's an unintentional issue the ramification is the same as if it were in intentional attack configuration mistakes can cause traffic diversion and/or denial of service now I think that a key element of any security incident is how fast you detect and how fast can you recover so whether or not it's a if it's a deliberate malicious attack or configuration mistakes you need to think about it so what do you have to think about when you're over all trying to think through how do I protect my routing infrastructure well first of all you have to understand the whole problem and you do want to think through what are all the different ways that a problem could occur so do a risk analysis make sure though that you spend a day just thinking through your routing infrastructure and think about all the ways that somebody can do harm and then that will help you think through well what is the priority for you to protect that infrastructure and some of the things to think about are areas surrounding physical security right where your device is located can somebody do harm just by accessing it physically logical security so how do I get device access remotely either you know through the network or even through some management devices you want to have procedures in place for if something happens so looking at what happens if there is a software vulnerability right or if somebody deliberately causes a wrong image to be downloaded on the router now this does happen years ago there was a router vendor who was Miss portrayed ie somebody put an image out that looked to come from a router vendor and it actually had malicious software on it so this is not just something that our stories that aren't true this really happens so you really need to make sure that you understand what are the images that you download on your routers what are the configurations and have some kind of check in place so you know that they're actually valid so one of the things to always think about everybody tells you to use all of these security functionalities and features right you want to consider all of them but not all of them may be appropriate in your environment and there are separate sections that videos that talk about them I want you to make sure that you always understand the risk mitigation so basically what is the control that will reduce the acceptable risk and you always want to assess the cost of certain losses and do not spend more to protect something than it is actually worth and you always want to take into consideration the operational cost how difficult it is if there's a problem with the feature of functionality how quickly can you recover to then get to normal state so if I were to give you some pointers in terms of how to mitigate most threats in your routing infrastructure here's a five or six things that I would recommend one make sure you have physical device security so that not anybody can get access to the device and maybe inadvertently unplug cables this does happen in some environments you want to restrict access to networks and protocols so you do want to have filters in place you want to be able to define potentially what location some person can have access to the device from you also want to attend ik 8 and use good credential management practices so when you do authentication you want to make sure that you have individual users authenticated and make sure that you also protect all of your credentials you want to use cryptographically protected protocols for all device access so that none of the credentials are sent in clear-text you also want to make sure that you shut down unused interfaces and unneeded services so that they don't become an attack vector and critical is audit your network traffic log exceptions and look at your logs or create scripts that look at certain things so one of the things that I we start with is looking at unauthenticated access attempts so I know there many scripts are out there so typically many devices will have a lot of logging entries for SSH access with crazy looking usernames and passwords right but you never know whether or not one of those usernames and passwords can actually work in your environment and again that ties in to having really good credential management and don't have a user name you know tech ops and a password of one two three four five and lastly then this ties into the logs don't forget to use accurate timestamps for all of your logging all right this is also very critical and one thing that I do want to emphasize is you want to make sure that there's integrity with your system images and configuration files there is a tool called rancid that will periodically check against modified configuration files it should be easy to use and you do want to at least get alerted if somebody is messing around with your configuration files and maybe doing something nefarious so please do think about securing your routing infrastructure it will benefit everybody thank you you

Related Documents

Exercises

© Produced by Philip Smith and the Network Startup Resource Center, through the University of Oregon. 

Attribution-NonCommercial 4.0 International (CC BY-NC 4.0)

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.
You are free to:

Share — copy and redistribute the material in any medium or format
Adapt — remix, transform, and build upon the material
The licensor cannot revoke these freedoms as long as you follow the license terms.
Under the following terms:

Attribution — You must give appropriate credit, provide a link to the license, and indicate if changes were made. You may do so in any reasonable manner, but not in any way that suggests the licensor endorses you or your use.
NonCommercial — You may not use the material for commercial purposes.
No additional restrictions — You may not apply legal terms or technological measures that legally restrict others from doing anything the license permits.