cansecwest/core06
Jim DeLeskie & Danny McPherson
Title: Protecting the Infrastructure

The talks title was protecting the core infrastructure. For the most part, this was a talk about routers and to call ONLY routers core infrastructure is misleading. Yes, it is core but so is SONET, RADIUS, DNS, NTP, and so on. This talk should have been called “Best Practice Security for Cisco Routers”.

Management, Control, and Data Planes were explained. Ingress Filter, Unicast Reverse Path Forwarding, Tracebacks, iACL (infrastructure Access control lists), CEF accounting, Netflow/Sflow/*flow, blackhole routing, and so on. For someone who had never designed or administrated a large IP network, this talk had a LOT of value. McPherson was someone who when I was learning the ins and outs of BGP4 throughout the 90’s, his books and postings to the NANOG mailing-list were vital in my education. I should also toss in that anyone who had been to a NANOG conference in the past few years, you would have gotten this content. Good content for someone who does not understand the threat and countermeasures involved in securing the routing infrastructure (which almost by default is Cisco).

Please take note that this threat is very real. Service Providers are the most effected and as a consequence more educated about these measures; Enterprise networks are less educated about these measures and countermeasures. In any case, getting educated is the very first step in managing these risks.

One last note, the material covered in this talk is about 3 or 4 years old which means that your adversary has known of all these methods for a while. If this material is new to you, either you learned of these attacks the hard way (ie you were the victim of it) or consider yourself lucky that you learned of it via this con and now you can setup the appropriate security countermeasures.

At the end of the presentation, they presented some interesting stats. They said that in their bi-annual sampling, the trend is that victims are taking preventative measures and becoming more educated. The one issue that stuck out was a stat that 29% of their sampling did not believe law enforcement could help the victim. Sad. If this is true, law enforcement should take an active role in changing this image. Like Cosmo said in the movie “Sneakers”, it is not about who has more bullets, it is about who controls the information.