Subject: Re: [OPSEC] [Lsvr] security against what?

From: "Van De Velde, Gunter (Nokia - BE/Antwerp)" <[email-masked]>
Date: Tue, 4 Sep 2018 08:16:33 +0000

Hi All,

Holiday season is over, maybe time to progress the discussion about DC security properties.

Any constructive comments regarding the below "crude guess as a straw" from Randy?

Brgds,

Gunter VdV
LSVR WG co-chair

-----Original Message-----
From: Lsvr <[email-masked]> On Behalf Of Randy Bush
Sent: Tuesday, July 31, 2018 06:10
To: Little Strange Very Real <[email-masked]>
Subject: [Lsvr] security against what?

at the montréal meeting, a few datacener operators said they were seriously concerned about security.  befofe thinking about any solution space, i am interested in the basic question, what is the threat model?

here is my crude guess as a straw

    not so much intentional mitm by an attacker

    strange/unauthorized device plugs into a port.  92.3% of the problems
    will be a miswire.  datacenter clos miswires are a major issue.

    someone plugs a (accidentally) poisoned laptop into a clos port.

clue bat from the ops, please.

randy

_______________________________________________
Lsvr mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/lsvr

---

From: Erik Kline <[email-masked]>
Date: Tue, 4 Sep 2018 17:49:46 +0900

Is recommending 802.1x possible/sufficient (given the description in
Randy's strawperson comment)?
On Tue, 4 Sep 2018 at 17:16, Van De Velde, Gunter (Nokia - BE/Antwerp)
<[email-masked]> wrote:
> OPSEC mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/opsec

---

From: Randy Bush <[email-masked]>
Date: Tue, 04 Sep 2018 02:58:28 -0700

> Randy's strawperson comment)?

it's a long way to that radius server

randy

---

From: Christopher Morrow <[email-masked]>
Date: Tue, 4 Sep 2018 10:08:47 -0400

'datacenter operators' == "hyperscale web wonkers" ?
or 'datacenter operators' == 'colo provider' ('the planet' not 'equinix' -
and 'the planet' is now 'someone else' but...)

---

From: Randy Bush <[email-masked]>
Date: Tue, 04 Sep 2018 08:38:02 -0700

> 'datacenter operators' == "hyperscale web wonkers" ?

i asked in lsvr, which is what i guess you woud call hyperscale.  lsvr
also tends toward decentralized,

> and 'the planet' is now 'someone else' but...)

1x would seem especially inapporpriate here as there is no
centralisation of authority.

>> it's a long way to that radius server

with coffee, i might expand a bit.  during turn up of new links and
devices, it may not be easy to get to a distant 1x authority.

randy

---

From: Christopher Morrow <[email-masked]>
Date: Tue, 4 Sep 2018 12:04:21 -0400

> also tends toward decentralized,
sorry: 'decentralized' means what here?

> centralisation of authority.

So, in a large datacenter where randos are able to walk around and affect
change to my cage's in/outs (and potentially clamp mitm/etc gear without my
knowledge) there's a different 'security concern' than there is in a
building I wholey own and operate behind several layers of physical
security and such.

If all of your "datacenter deployment" is inside a single cage in a
colocation building you MAY be "safe", but if you span cage spaces (who
ever decided on day-one in a building that they only would ever need 640kb
ram/squarefeet/kw/etc?) you are potentially sending your 'routing
protocols' over links outside of your immediate security perimeter.

That seems rather scary... like kinda really scary, actually...
I wonder how often people consider: "security of the data in the datacenter
(at rest or in flight)" but forget about the routing system which is
intrinsic to the operation of that datacenter?

> devices, it may not be easy to get to a distant 1x authority.
I'd point out that if you put business critical dependencies 'far away' you
are a competitor I'd love to have? :)
Ideally once you figure out your deployment scenario and drive down all the
dependency tree branches you figure out who/what needs to be "local" to the
deployment, and how to live in a state where that dependency is unfulfilled
for part of the turnup/repair/turndown workflows.  Right?

---

From: Randy Bush <[email-masked]>
Date: Tue, 04 Sep 2018 11:17:00 -0700

>> i asked in lsvr, which is what i guess you woud call hyperscale.
>> lsvr also tends toward decentralized,

for example, compare jupiter rising to bgp-spf; both of which i think
are super cool

>>> or 'datacenter operators' == 'colo provider' ('the planet' not
>>> 'equinix' and 'the planet' is now 'someone else' but...)
> So, in a large datacenter where randos are able to walk around and
> affect change to my cage's in/outs (and potentially clamp mitm/etc
> gear without my knowledge) there's a different 'security concern' than
> there is in a building I wholey own and operate behind several layers
> of physical security and such.

there are probably threats shared between the two, oh frabjious joy.
but i suspect the intersection is far smaller than the union.

> colocation building you MAY be "safe", but if you span cage spaces
> (who ever decided on day-one in a building that they only would ever
> need 640kb ram/squarefeet/kw/etc?) you are potentially sending your
> 'routing protocols' over links outside of your immediate security
> perimeter.

yes, in which case one worries about those monkeys in the middle more
than ever

> That seems rather scary... like kinda really scary, actually...  I
> wonder how often people consider: "security of the data in the
> datacenter (at rest or in flight)" but forget about the routing system
> which is intrinsic to the operation of that datacenter?

we would be out of work were it not for the naïve :)

> I'd point out that if you put business critical dependencies 'far
> away' you are a competitor I'd love to have? :)
> Ideally once you figure out your deployment scenario and drive down
> all the dependency tree branches you figure out who/what needs to be
> "local" to the deployment, and how to live in a state where that
> dependency is unfulfilled for part of the turnup/repair/turndown
> workflows.  Right?

sure.  but at the moment, i am trying to tease out the lsvr ops' threat
models.

randy

---

From: Christopher Morrow <[email-masked]>
Date: Wed, 5 Sep 2018 01:16:18 -0400

> for example, compare jupiter rising to bgp-spf; both of which i think
oh! decentralized routing decision vs

> but i suspect the intersection is far smaller than the union.
ok.

> yes, in which case one worries about those monkeys in the middle more
yup.

> we would be out of work were it not for the naïve :)
it's not really just 'naive' as much as shifting sands of requirements and
sudden successes :)

> sure.  but at the moment, i am trying to tease out the lsvr ops' threat
ok, i'll be quiet now and see what other people think are problematic :)