Subject: Re: [Lsvr] security against what?

From: "Van De Velde, Gunter (Nokia - BE/Antwerp)" <[email-masked]>
Date: Tue, 4 Sep 2018 08:16:33 +0000

Hi All,

Holiday season is over, maybe time to progress the discussion about DC security properties.

Any constructive comments regarding the below "crude guess as a straw" from Randy?

Brgds,

Gunter VdV
LSVR WG co-chair

-----Original Message-----
From: Lsvr <[email-masked]> On Behalf Of Randy Bush
Sent: Tuesday, July 31, 2018 06:10
To: Little Strange Very Real <[email-masked]>
Subject: [Lsvr] security against what?

at the montréal meeting, a few datacener operators said they were seriously concerned about security.  befofe thinking about any solution space, i am interested in the basic question, what is the threat model?

here is my crude guess as a straw

    not so much intentional mitm by an attacker

    strange/unauthorized device plugs into a port.  92.3% of the problems
    will be a miswire.  datacenter clos miswires are a major issue.

    someone plugs a (accidentally) poisoned laptop into a clos port.

clue bat from the ops, please.

randy

_______________________________________________
Lsvr mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/lsvr

---

From: Erik Kline <[email-masked]>
Date: Tue, 4 Sep 2018 17:49:46 +0900

Is recommending 802.1x possible/sufficient (given the description in
Randy's strawperson comment)?
On Tue, 4 Sep 2018 at 17:16, Van De Velde, Gunter (Nokia - BE/Antwerp)
<[email-masked]> wrote:
> OPSEC mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/opsec

---

From: Randy Bush <[email-masked]>
Date: Tue, 04 Sep 2018 02:58:28 -0700

> Randy's strawperson comment)?

it's a long way to that radius server

randy

---

From: Christopher Morrow <[email-masked]>
Date: Tue, 4 Sep 2018 10:08:47 -0400

'datacenter operators' == "hyperscale web wonkers" ?
or 'datacenter operators' == 'colo provider' ('the planet' not 'equinix' -
and 'the planet' is now 'someone else' but...)

---

From: Tony Przygienda <[email-masked]>
Date: Tue, 4 Sep 2018 07:24:56 -0700

agreed, very interestig discussion if it can be had. the miswire/rogue
laptop was what I heard muttered since a bit. whether solution is
authenticated address asignment (what if they show up with static?), some
mac security, insisting on some flavor of L3 adjacency with authentication
and so on seemed to be in the eye of the beholder ;-) ... There are some
ideas around ND in groups like 6lo btw. other flavor was link snooping &
there MACSEC is probably a viable answer.

yes, operators please ...

thanks

--- tony

On Mon, Jul 30, 2018 at 9:10 PM Randy Bush <[email-masked]> wrote:

> at the montréal meeting, a few datacener operators said they were
> seriously concerned about security.  befofe thinking about any solution
> space, i am interested in the basic question, what is the threat model?
>

---

From: Randy Bush <[email-masked]>
Date: Tue, 04 Sep 2018 08:38:02 -0700

> 'datacenter operators' == "hyperscale web wonkers" ?

i asked in lsvr, which is what i guess you woud call hyperscale.  lsvr
also tends toward decentralized,

> and 'the planet' is now 'someone else' but...)

1x would seem especially inapporpriate here as there is no
centralisation of authority.

>> it's a long way to that radius server

with coffee, i might expand a bit.  during turn up of new links and
devices, it may not be easy to get to a distant 1x authority.

randy

---

From: Christopher Morrow <[email-masked]>
Date: Tue, 4 Sep 2018 12:04:21 -0400

> also tends toward decentralized,
sorry: 'decentralized' means what here?

> centralisation of authority.

So, in a large datacenter where randos are able to walk around and affect
change to my cage's in/outs (and potentially clamp mitm/etc gear without my
knowledge) there's a different 'security concern' than there is in a
building I wholey own and operate behind several layers of physical
security and such.

If all of your "datacenter deployment" is inside a single cage in a
colocation building you MAY be "safe", but if you span cage spaces (who
ever decided on day-one in a building that they only would ever need 640kb
ram/squarefeet/kw/etc?) you are potentially sending your 'routing
protocols' over links outside of your immediate security perimeter.

That seems rather scary... like kinda really scary, actually...
I wonder how often people consider: "security of the data in the datacenter
(at rest or in flight)" but forget about the routing system which is
intrinsic to the operation of that datacenter?

> devices, it may not be easy to get to a distant 1x authority.
I'd point out that if you put business critical dependencies 'far away' you
are a competitor I'd love to have? :)
Ideally once you figure out your deployment scenario and drive down all the
dependency tree branches you figure out who/what needs to be "local" to the
deployment, and how to live in a state where that dependency is unfulfilled
for part of the turnup/repair/turndown workflows.  Right?

---

From: Randy Bush <[email-masked]>
Date: Tue, 04 Sep 2018 11:17:00 -0700

>> i asked in lsvr, which is what i guess you woud call hyperscale.
>> lsvr also tends toward decentralized,

for example, compare jupiter rising to bgp-spf; both of which i think
are super cool

>>> or 'datacenter operators' == 'colo provider' ('the planet' not
>>> 'equinix' and 'the planet' is now 'someone else' but...)
> So, in a large datacenter where randos are able to walk around and
> affect change to my cage's in/outs (and potentially clamp mitm/etc
> gear without my knowledge) there's a different 'security concern' than
> there is in a building I wholey own and operate behind several layers
> of physical security and such.

there are probably threats shared between the two, oh frabjious joy.
but i suspect the intersection is far smaller than the union.

> colocation building you MAY be "safe", but if you span cage spaces
> (who ever decided on day-one in a building that they only would ever
> need 640kb ram/squarefeet/kw/etc?) you are potentially sending your
> 'routing protocols' over links outside of your immediate security
> perimeter.

yes, in which case one worries about those monkeys in the middle more
than ever

> That seems rather scary... like kinda really scary, actually...  I
> wonder how often people consider: "security of the data in the
> datacenter (at rest or in flight)" but forget about the routing system
> which is intrinsic to the operation of that datacenter?

we would be out of work were it not for the naïve :)

> I'd point out that if you put business critical dependencies 'far
> away' you are a competitor I'd love to have? :)
> Ideally once you figure out your deployment scenario and drive down
> all the dependency tree branches you figure out who/what needs to be
> "local" to the deployment, and how to live in a state where that
> dependency is unfulfilled for part of the turnup/repair/turndown
> workflows.  Right?

sure.  but at the moment, i am trying to tease out the lsvr ops' threat
models.

randy

---

From: Christopher Morrow <[email-masked]>
Date: Wed, 5 Sep 2018 01:16:18 -0400

> for example, compare jupiter rising to bgp-spf; both of which i think
oh! decentralized routing decision vs

> but i suspect the intersection is far smaller than the union.
ok.

> yes, in which case one worries about those monkeys in the middle more
yup.

> we would be out of work were it not for the naïve :)
it's not really just 'naive' as much as shifting sands of requirements and
sudden successes :)

> sure.  but at the moment, i am trying to tease out the lsvr ops' threat
ok, i'll be quiet now and see what other people think are problematic :)