Subject: RE: [Ieprep] draft-ietf-ieprep-requirements-00.txt

From: "Gunn, Janet NE" <[email-masked]>
Date: Wed, 10 Jul 2002 14:57:36 -0400

Senthil,

My point was more that the possibility  of virus attacks makes the
assumption that "the core is overprovisioned and will never be short of
bandwidth for emergency services" a bit less sure.

Janet

-----Original Message-----
From: senthil ayyasamy [mailto:[email-masked]]
Sent: Wednesday, July 10, 2002 12:24 PM
To: [email-masked]; Gunn, Janet NE
Cc: 'Folts Harold'; 'senthil ayyasamy'; ieprep
Subject: Re: [Ieprep] draft-ietf-ieprep-requirements-00.txt

I accept that code-red and nimada had more effect on
the net than disaster events. But, cyberattacks seems
too broad to cover in a WG such as this one. Their are
many better places to discuss them (ICMP traceback,
IPPT, partly by psamp&IPFIX, many CERT initiatives.)
 The only issue of interest to ieprep community is
*differentiating flash crowds/emergency traffic with
DDOS attacks* at the access. I think the present
charter doesnt allow even this one.
--- "Stuart (Stu) Goldman" <[email-masked]> wrote:
> Janet,
> 
> If the purpose of the service is to provide
> emergency communication during a
> disaster, including a terrorist  attack, I don't
> think it makes good sense to
> rule out a coordinated physical attack along with a
> DDoS and virus, etc.  If we
> can think of it, so can the bad guys.

> "Gunn, Janet NE" wrote:
> 
> > Do we also have to consider the possibility of
> "some kind of virus"
> > (terrorist inspired or otherwise) generating a
> large amount of traffic, and
> > "using up" the overprovisioning?
> >
> >  Or is that a red-herring?

__________________________________________________
Do You Yahoo!?
Sign up for SBC Yahoo! Dial - First Month Free
http://sbc.yahoo.com

_______________________________________________
Ieprep mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ieprep

---

From: senthil ayyasamy <[email-masked]>
Date: Wed, 10 Jul 2002 14:32:22 -0700 (PDT)

> bandwidth for emergency services" a bit less sure.
To add some more points :
  Solutions for virus attacks are pretty difficult at
the stage. The virus attack taxonomy has to be defined
well before considering that work. Read the following
recent USENIX paper on how distributed and random the
worm attacks (in our case by bad elements/terrorists)
turn out that their is nill possibility of finding a
solution.
http://www.icir.org/vern/papers/cdc-usenix-sec02/index.html

The below work explains how a worm can make internet
paralyzed within 15 minutes ( possibility).
http://www.cs.berkeley.edu/~nweaver/warhol.html

Coming back to our point, worm/viruses/cyberattacks by
bad elements will SURELY consume the bandwidth and
will have greater impact if it happens on days like
9/11. But, unfortunatley their is no effective
solution to avoid them. So, the only thing that can be
done is make sure emergency traffic gets priority to
other and affected at the least by worms. But it is
still difficult.