So this module is about routing
infrastructure security and why do we
even care right isn't that somebody
else's problem well that is the problem
right we all have to look at how we can
make a difference because there are so
many tacks there are so many
vulnerabilities and we don't want to be
part of the problem so historically the
routing infrastructure the network was
not really that interesting to anybody
that was trying to do something
nefarious but in the last few years
there's been more and more focus on the
network infrastructure and also causing
deliberate routing interrupts now while
attackers also need to have
infrastructure up and available they may
try and divert traffic or in extreme
cases they may make some areas of the
network unavailable right neither of
these are acceptable and we have to do
what we can to protect ourselves so
where is the routing infrastructure
vulnerable there are so many optics
around this not as common but they do
exist our active attacks where the
routing infrastructure is actually the
target and somebody is trying to either
blackhole your network and make it
unavailable or divert traffic there's
also software and implementation bugs
and as the saying goes is it a bug or a
feature but if it causes a disruption in
your network obviously it's a bug that's
a problem that you need to look at so
you could have a protocol error the
routing protocol itself initially none
of the routing protocols really took
security into consideration because they
didn't think they had to bgp uses TCP so
you could have some TCP reset issues
right there maybe other protocol issues
that have not yet been discovered so we
always have to have a lookout for that
configuration mistakes are also
something that you really need to take
into account and while it's an
unintentional issue the ramification is
the same as if it were in
intentional attack configuration
mistakes can cause traffic diversion
and/or denial of service now I think
that a key element of any security
incident is how fast you detect and how
fast can you recover so whether or not
it's a if it's a deliberate malicious
attack or configuration mistakes you
need to think about it so what do you
have to think about when you're over all
trying to think through how do I protect
my routing infrastructure well first of
all you have to understand the whole
problem and you do want to think through
what are all the different ways that a
problem could occur so do a risk
analysis make sure though that you spend
a day just thinking through your routing
infrastructure and think about all the
ways that somebody can do harm and then
that will help you think through well
what is the priority for you to protect
that infrastructure and some of the
things to think about are areas
surrounding physical security right
where your device is located can
somebody do harm just by accessing it
physically logical security so how do I
get device access remotely either you
know through the network or even through
some management devices you want to have
procedures in place for if something
happens so looking at what happens if
there is a software vulnerability right
or if somebody deliberately causes a
wrong image to be downloaded on the
router now this does happen years ago
there was a router vendor who was Miss
portrayed ie somebody put an image out
that looked to come from a router vendor
and it actually had malicious software
on it so this is not just something that
our stories that aren't true this really
happens so you really need to make sure
that you understand what are the images
that you download on your routers what
are the configurations and have some
kind of check in place
so you know that they're actually valid
so one of the things to always think
about everybody tells you to use all of
these security functionalities and
features right you want to consider all
of them but not all of them may be
appropriate in your environment and
there are separate sections that videos
that talk about them
I want you to make sure that you always
understand the risk mitigation so
basically what is the control that will
reduce the acceptable risk and you
always want to assess the cost of
certain losses and do not spend more to
protect something than it is actually
worth and you always want to take into
consideration the operational cost how
difficult it is if there's a problem
with the feature of functionality how
quickly can you recover to then get to
normal state so if I were to give you
some pointers in terms of how to
mitigate most threats in your routing
infrastructure here's a five or six
things that I would recommend one make
sure you have physical device security
so that not anybody can get access to
the device and maybe inadvertently
unplug cables this does happen in some
environments you want to restrict access
to networks and protocols so you do want
to have filters in place you want to be
able to define potentially what location
some person can have access to the
device from you also want to attend ik 8
and use good credential management
practices so when you do authentication
you want to make sure that you have
individual users authenticated and make
sure that you also protect all of your
credentials you want to use
cryptographically protected protocols
for all device access so that none of
the credentials are sent in clear-text
you also want to make sure that you shut
down unused interfaces and unneeded
services so that they don't become an
attack vector and critical is audit your
network traffic log exceptions and look
at your logs or create scripts that look
at certain things so one of the things
that I we start with is looking at
unauthenticated access attempts so I
know there many scripts are out there so
typically many devices will have a lot
of logging entries for SSH access with
crazy looking usernames and passwords
right but you never know
whether or not one of those usernames
and passwords can actually work in your
environment and again that ties in to
having really good credential management
and don't have a user name you know tech
ops and a password of one two three four
five and lastly then this ties into the
logs don't forget to use accurate
timestamps for all of your logging all
right this is also very critical and one
thing that I do want to emphasize is you
want to make sure that there's integrity
with your system images and
configuration files there is a tool
called rancid that will periodically
check against modified configuration
files it should be easy to use and you
do want to at least get alerted if
somebody is messing around with your
configuration files and maybe doing
something nefarious
so please do think about securing your
routing infrastructure it will benefit
everybody thank you
you
© Produced by Philip Smith and the Network Startup Resource Center, through the University of Oregon.
Attribution-NonCommercial 4.0 International (CC BY-NC 4.0)
This is a human-readable summary of (and not a substitute for) the license. Disclaimer. You are free to: Share — copy and redistribute the material in any medium or format Adapt — remix, transform, and build upon the material The licensor cannot revoke these freedoms as long as you follow the license terms. Under the following terms: Attribution — You must give appropriate credit, provide a link to the license, and indicate if changes were made. You may do so in any reasonable manner, but not in any way that suggests the licensor endorses you or your use. NonCommercial — You may not use the material for commercial purposes. No additional restrictions — You may not apply legal terms or technological measures that legally restrict others from doing anything the license permits.