Subject: [RPSEC] a link to my threat draft

From: [email-masked]
Date: Tue, 12 Nov 2002 14:06:00 -0500 (EST)

I've been asked to put the draft I wrote up somewhere accessible.
Putting it on our ftp site was easier (bureaucratically) than putting
it on the web site, so you can reach it at:
ftp://ftp.tislabs.com/pub/rpsec/draft-murphy-threat-00.txt

--Sandy
_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Wed, 13 Nov 2002 14:51:21 +0100 (CET)

> ftp://ftp.tislabs.com/pub/rpsec/draft-murphy-threat-00.txt

	The RPSEC working group is addressing security requirements of routing
	protocols, not the security requirements of routers or of operations of
	routing systems.  Therefore, this draft specifically does not address
	threats to routers (hacking, denial of service flooding attacks, etc.)
	or to specific routing protocol implementations (bugs, etc.).

From the charter:

	The RPSEC working group is charged with the following tasks:

	- Document threat models for routing systems
	- Document security requirements for routing systems
	- Provide a common area for discussion between security and routing
	  experts on the topic of securing the routing system

Building an ultrasecure protocol and running it on flimsy boxes doesn't
help. Building extremely secure routers and then run vulnerable
protocols on them doesn't either. There must be an integrated approach.

One very important question is: what amount of damage do we think is
acceptable when an attack is launched from the inside, either by someone
with legitimate access to a router, or when a router is compromised? Ie
do we want our cops to walk around in their bullet proof vests at the
police station in case another cop starts shooting, or are they supposed
to be safe inside? Both approaches have their advantages, but this
question exists on a more fundamental level than just routing _protocol_
security.

About the rest of the draft: it is a good enumeration of all possible
bad things that can happen, but each exists in a vacuum. Which threats
are so easy to eliminate that we shouldn't waste time focussing on them?
Which are so hard to eliminate we shouldn't even bother trying? What
kind of damage can we expect?

Iljitsch