Presenter: Mark Elkins Topic: Things not getting done

Things not getting done Mark Elkins AfriNIC-17

Technical solutions exist and are universally accepted, yet... 1)DNSSEC 2)IPv6 enablement 3)Telnet elimination 4)Egress filtering of routes

DNSSEC The Domain Name System (DNS) set of security extensions which provide some additional levels of security atop DNS This refers both to: – signing zones – operating validating servers ( Using DNSSEC aware applications (dnssec validator) DNSSEC Training ( DANE: DNS-Based Authentication of Named Entities (SSL, SMTP, S/MIME, XMPPetc)

IPv6 Enablement Production implementation of the IPv6 protocol including public accessibility, routing, and availability of all IPv4 public services over IPv6. Get an allocation from AfriNIC (Its often free) Dual Stack your core, Peering and Transit Dual Stack Web, Nameservers and Dual stack your customers

Telnet elimination Should be eliminated in favour of more secure protocols like SSH Consider a similar treatment for – POP3/IMAP –

Egress Filtering of Routes Implementation of security policies at the router level, restricting traffic between networks which do not meet routing policy (BCP38). – Filter to only allow your networks to leave your network

Technical solutions exist but fair minded people debate the need 1)Route Registry 2)Secure HTTP (HTTPS) 3)Route Aggregation 4)Mail Submission

Route Registry Database of routing objects, provided by the RIRs and other organizations, for configuring routers and establishing/maintaining routing policy. – Possible starting point for RPKI

HTTPs Hypertext Transfer Protocol Secure is a preferred communication protocol over the Internet when compared to HTTP alone. We need to encourage implementation by applications. – Combine with DNSSEC and DANE

Route aggregation Active management of routes, routing slots, routing policy, and prefixes to structure IP address blocks into a hierarchical manner optimizing Classless Inter-Domain Routing (CIDR).

Mail Submission Securing the origination of s by blocking port 25 (SMTP) and only accepting s on port 587 (submission) which can be both authenticated (user/passwd) and encrypted (SSL/TLS) – Effectively eliminate SPAM generation from mail robots