Subject: [Isis-wg] Security Section for ISIS MIB

From: "Parker, Jeff" <[email-masked]>
Date: Wed, 14 Dec 2005 13:03:23 -0500

The next phase of the MIB Dr. review is the security section.  The current
prose reads, in part

                        Since the MIB controls a device which routes
   packets, all writeable attributes have the potential to disrupt
   network operations if improperly modified and may require protection
   against unauthorized write access.

(Full text is provided below)

The security reviewers have requested a breakdown rather than a blanket
statement, discussing the threats in greater detail.

I have taken the 64 writable attributes, and sorted them into a number of
bins.  The initial feedback from the reviewers for this breakdown is
positive.  While I plan to work on the prose describing each category, I
write today to give you the general breakdown for your comment.  I'm looking
for comments that

    a) Some categories are moot.  (i.e. Bringing down one adjacency
       is no better than bringing down all: combine these two)

    b) Categories are missing: you forget threat Mumbo-Jumbo

    c) Items are miss-filed.  (i.e. The reason isisCircLevelHelloMultiplier
       needs to be secure is...)

I hope to submit something early next week.  I do not plan to modify any of
the names or descriptions of the MIB as it exists today.  This is only about
changes to the prose in the security section.

- jdp

////////////////////////////////////

I do not see any threat from these attributes
        isisCircExtDomain OBJECT-TYPE
        isisCircIfIndex OBJECT-TYPE
        isisCircLevelHelloMultiplier OBJECT-TYPE
        isisCircType OBJECT-TYPE
 
Threats
DA    Drop an Adjacency
DAP   Drop all peers
DSN Drop SubNetwork
SN    Split the network
IO    Intermittent outages
RT    Redirect Traffic
CLNS  Issue for CLNS networks
DC    Delay Convergence
AD    Avoid Detection
PU    Prevent Updates
HL    Hijack LAN

Avoid Detection
AD      isisSysNotificationEnable OBJECT-TYPE
     By turning off Traps, we can do damage without alerting NetMgmt
     
CLNS Parameters 
    Of interest to OSI Networking
CLNS    isisRAAddrPrefix OBJECT-TYPE
CLNS    isisRAAdminState OBJECT-TYPE
CLNS    isisRAExistState OBJECT-TYPE
CLNS    isisRAMapType OBJECT-TYPE
CLNS    isisRAMetric OBJECT-TYPE
CLNS    isisRAMetricType OBJECT-TYPE
CLNS    isisRASNPAAddress OBJECT-TYPE
CLNS    isisRASNPAMask OBJECT-TYPE
CLNS    isisRASNPAPrefix OBJECT-TYPE
CLNS    isisRAType OBJECT-TYPE
CLNS    isisSysPollESHelloRate OBJECT-TYPE

Drop an Adjacency
    By changing attributes that are used to peer, we
    can bring a link down
DA      isisCirc3WayEnabled OBJECT-TYPE
DA      isisCircAdminState OBJECT-TYPE
DA      isisCircExistState OBJECT-TYPE
DA      isisCircLevelDRHelloTimer OBJECT-TYPE
DA      isisCircLevelHelloTimer OBJECT-TYPE
DA      isisCircLevelType OBJECT-TYPE
DA      isisCircSmallHellos OBJECT-TYPE

Drop All Adjacencies
    These attributes can be used to break some or all adjacencies
    In the case of System ID, the adjacency will be restored in most
    cases.  However, it will subject the network to worse stress
DAP     isisSysLevelType OBJECT-TYPE
DAP     isisManAreaAddrExistState OBJECT-TYPE
DAP     isisSysAdminState OBJECT-TYPE
DAP, IO isisSysID OBJECT-TYPE

Delay Convergence
      These attributes can be used to slow convergence
DC      isisCircLevelCSNPInterval OBJECT-TYPE
DC      isisCircLevelLSPThrottle OBJECT-TYPE
DC      isisCircLevelMinLSPRetransInt OBJECT-TYPE
DC      isisCircLevelPartSNPInterval OBJECT-TYPE
DC      isisSysWaitTime OBJECT-TYPE

Drop Subnetwork
    Stop advertising a subnetwork reachable on one interface
DSN     isisCircPassiveCircuit OBJECT-TYPE

Hijack LAN
    If we have compromised a router, we can use this to lie about
    the topology of a LAN
HL      isisCircLevelISPriority OBJECT-TYPE

Intermittent Outage
    Subject the network to a series of changes
IO      isisSysLevelMinLSPGenInt OBJECT-TYPE
IO      isisSysLevelSetOverload OBJECT-TYPE
IO      isisSysLevelSetOverloadUntil OBJECT-TYPE
IO      isisSysMaxAge OBJECT-TYPE
IO      isisSysMaxLSPGenInt OBJECT-TYPE

Prevent Updates
    Mesh Groups can be used to delay or prevent updates
    Could also be used to create Intermittent Outages
PU      isisCircMeshGroup OBJECT-TYPE
PU      isisCircMeshGroupEnabled OBJECT-TYPE

Redirect Traffic
    By changing metrics and such, we can push traffic
    to different parts of the network.  This may allow an
    intruder to observe packets
RT      isisSysMaxPathSplits OBJECT-TYPE
RT      isisCircLevelMetric OBJECT-TYPE
RT      isisCircLevelWideMetric OBJECT-TYPE
RT      isisIPRAAdminState OBJECT-TYPE
RT      isisIPRAExistState OBJECT-TYPE
RT      isisIPRAFullMetric OBJECT-TYPE
RT      isisIPRAMetric OBJECT-TYPE
RT      isisIPRAMetricType OBJECT-TYPE
RT      isisIPRANextHop OBJECT-TYPE
RT      isisIPRANextHopType OBJECT-TYPE
RT      isisIPRASNPAAddress OBJECT-TYPE
RT      isisIPRAType OBJECT-TYPE
RT      isisRedistributeAddrExistState OBJECT-TYPE
RT      isisSummAddrExistState OBJECT-TYPE
RT      isisSummAddrFullMetric OBJECT-TYPE
RT      isisSummAddrMetric OBJECT-TYPE
RT, IO  isisSysL2toL1Leaking OBJECT-TYPE

Split the Network
    If the network depends upon Wide Metrics or TE, we can
    use these attributes to remove a router
SN      isisSysLevelMetricStyle OBJECT-TYPE
SN      isisSysLevelOrigLSPBuffSize OBJECT-TYPE
SN      isisSysLevelSPFConsiders OBJECT-TYPE
SN      isisSysLevelTEEnabled OBJECT-TYPE
SN      isisSysReceiveLSPBufferSize OBJECT-TYPE

Intermittant Outage
    We force the network through frequent recomputations
RT, IO  isisSysL2toL1Leaking OBJECT-TYPE
DAP, IO isisSysID OBJECT-TYPE

////////////////////////////////////

(Current text)
7. Security Considerations

   Certain management information defined in this MIB may be considered
   sensitive in some network environments.

   This MIB may be used to manage an IP router, which can be used to
   direct network traffic.  The control of network traffic allows an
   attacker to Deny Service to a region of the network or to forward
   traffic to adversaries.

   There are a number of management objects defined in this MIB that
   have a MAX-ACCESS clause of read-write and/or read-create.  Such
   objects may be considered sensitive or vulnerable in some network
   environments.  The support for SET operations in a non-secure
   environment without proper protection can have a negative effect on
   network operations.  Since the MIB controls a device which routes
   packets, all writeable attributes have the potential to disrupt
   network operations if improperly modified and may require protection
   against unauthorized write access.

   Therefore, authentication of received SNMP requests and controlled
   access to management information should be employed in such
   environments.

   Much of the MIB is used to set or read attributes which are readily
   visible to any intruder who has access to traffic.  None of the
   security attributes are setable or visible through the MIB.  Read
   access to the MIB does not pose additional risks or vulnerabilities.

   SNMP versions prior to SNMPv3 did not include adequate security.
   Even if the network itself is secure (for example by using IPSec),
   even then, there is no control as to who on the secure network is
   allowed to access and GET/SET (read/change/create/delete) the objects
   in this MIB module.

   It is RECOMMENDED that implementers consider the security features as
   provided by the SNMPv3 framework (see [RFC3410], section 8),
   including full support for the SNMPv3 cryptographic mechanisms (for
   authentication and privacy).

   Further, deployment of SNMP versions prior to SNMPv3 is NOT
   RECOMMENDED.  Instead, it is RECOMMENDED to deploy SNMPv3 and to
   enable cryptographic security.  It is then a customer/operator
   responsibility to ensure that the SNMP entity giving access to an
   instance of this MIB module is properly configured to give access to
   the objects only to those principals (users) that have legitimate
   rights to indeed GET or SET (change/create/delete) them.

_______________________________________________
Isis-wg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isis-wg