[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: survey of isp security practices
On Nov 9, 2004, at 5:52 AM, Pekka Savola wrote:
lOn Tue, 9 Nov 2004, Merike Kaeo wrote:
4. Authentication / Authorization
4.1 Threat Description
4.2 Best Current Practice
4.2.1 Device Access
4.2.3 MAC Address
What do you mean by "Routing" here? The legitimacy of the exchanged
routing update messages?
Yes, peer authentication when exchanging routing updates
This is likely a very different approach than device access auth, so
I'm not sure how well it fits here. (Ditto with MAC address).
Classification is according to security function.....the categoies can
be changed so you would have for example Device Access, Routing as top
level categories and then have filtering, authentication, etc. as
sub-categories for each.
Actually maybe the whole auth section could be part of section 3? Is
there any other significant auth except for login access? Or are you
referring to how BGP MD5 secrets or various IGP secrets are
maintained? Seems like something under Procedural considerations
instead if so..
5.1 Threat Description
5.2 Best Current Practice
5.2.1 General Inbound Traffic Filters
5.2.2 General Outbound Traffic Filters
5.2.3 Device Access Filters
5.2.4 Route Filters
5.2.5 MAC Address Filters
5.2.6 DoS Mitigation Filtering
5.2.7 SinkHole / Blackhole
How does 4.2 compare to 5.2.3 - 5.2.5? Maybe the titles are not
sufficient to convey what exactly you mean in section 4 ?
Categorization is the hardest part :) 4.2 is specific to peer
authentication.....providing with reasonable certainty validation of
correct peer..........filtering is a mechanism of access control
(whether or not you have reasonable validation of address source is
Pekka Savola "You each name yourselves king, yet the
Netcore Oy kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings