Subject: [RPSEC] RE: RPSEC digest, Vol 1 #57 - 1 msg

From: [email-masked]
Date: Mon, 30 Sep 2002 09:51:03 +0100

I do not believe that we want to provide complete prevention, that will be
impossible for the simple fact that the infrastructure that underpins all
these development are insecure by design and furthermore, to use the
theoretical postulation of risk management, the objective will be to reduce
the frequency of breaches and thus minimise the impact if a breach does
occur. Hence the need to have built in robustness that allow the various
network components to adapt to changing needs - in terms of intrusions
detection and malicious attacks.

Regards

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
Sent: 27 September 2002 17:00
To: [email-masked]
Subject: RPSEC digest, Vol 1 #57 - 1 msg

Send RPSEC mailing list submissions to
	[email-masked]

To subscribe or unsubscribe via the World Wide Web, visit
	https://www1.ietf.org/mailman/listinfo/rpsec
or, via email, send a message with subject or body 'help' to
	[email-masked]

You can reach the person managing the list at
	[email-masked]

When replying, please edit your Subject line so it is more specific
than "Re: Contents of RPSEC digest..."

Today's Topics:

   1. New here (Pandit, Ameya Dilip (UMKC-Student))

--__--__--

Message: 1
Date: Thu, 26 Sep 2002 22:11:11 -0500
From: "Pandit, Ameya Dilip (UMKC-Student)" <[email-masked]>
To: <[email-masked]>
Subject: [RPSEC] New here

This is a multi-part message in MIME format.

------_=_NextPart_001_01C265D3.87E08975
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

All,
=20
I am pursuing my research in the field of routing/network security at =
the University of Missouri - KC. Just got subscribed to this group. My =
work involves in providing robustness to routing protocols (typically =
Link State) and OSPF in particular.=20
=20
My view of robustness is some kind of intrusion detection and =
impersonation/modification avoidance. Is this group concentrating on =
providing intrusion detection schemes to the existing routing protocols =
or are we on a track of providing complete prevention only.=20
=20
Any feedback would be welcome.=20
=20
Thanks !!
Ameya

------_=_NextPart_001_01C265D3.87E08975
Content-Type: text/html;
	charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD><TITLE>Message</TITLE>
<META content=3D"text/html; charset=3Diso-8859-1" =
http-equiv=3DContent-Type>
<META content=3D"MSHTML 5.00.3315.2870" name=3DGENERATOR></HEAD>
<BODY>
<DIV><FONT face=3DArial size=3D2><SPAN=20
class=3D962470603-27092002>All,</SPAN></FONT></DIV>
<DIV><FONT face=3DArial size=3D2><SPAN=20
class=3D962470603-27092002></SPAN></FONT>&nbsp;</DIV>
<DIV><FONT face=3DArial size=3D2><SPAN class=3D962470603-27092002>I am =
pursuing my=20
research in the field of routing/network security at the University of =
Missouri=20
- KC. Just got subscribed to this group. My work involves in providing=20
robustness to routing protocols (typically Link State) and OSPF in =
particular.=20
</SPAN></FONT></DIV>
<DIV><FONT face=3DArial size=3D2><SPAN=20
class=3D962470603-27092002></SPAN></FONT>&nbsp;</DIV>
<DIV><FONT face=3DArial size=3D2><SPAN class=3D962470603-27092002>My =
view of=20
robustness is some kind of <EM>intrusion detection </EM>and=20
<EM>impersonation/modification </EM>avoidance. Is this group =
concentrating on=20
providing intrusion detection schemes to the existing routing protocols =
or are=20
we on a track of providing complete <EM>prevention </EM>only.=20
</SPAN></FONT></DIV>
<DIV><FONT face=3DArial size=3D2><SPAN=20
class=3D962470603-27092002></SPAN></FONT>&nbsp;</DIV>
<DIV><FONT face=3DArial size=3D2><SPAN class=3D962470603-27092002>Any =
feedback would=20
be welcome. </SPAN></FONT></DIV>
<DIV><FONT face=3DArial size=3D2><SPAN=20
class=3D962470603-27092002></SPAN></FONT>&nbsp;</DIV>
<DIV><FONT face=3DArial size=3D2><SPAN class=3D962470603-27092002>Thanks =

!!</SPAN></FONT></DIV>
<DIV><FONT face=3DArial size=3D2><SPAN=20
class=3D962470603-27092002>Ameya</SPAN></FONT></DIV></BODY></HTML>
=00
------_=_NextPart_001_01C265D3.87E08975--

--__--__--

_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec

End of RPSEC Digest
_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec

---

From: "Senthilkumar Ayyasamy" <[email-masked]>
Date: Mon, 30 Sep 2002 15:53:45 -0500

>detection and malicious attacks.
   Although intrusion detection and other techniques (solution space) is 
totally out of scope for rpsec, their have been lot of research around 
intrusion detection techniques and some proposals are like solutions 
searching for a problem. Thats why, it is difficult to involve some 
engineering effort (IETF) for IDS schemes. But, output of this group by 
means of requirements and threat models, will help foster research in 
routing & IDS for solving some of the current routing vulnerabilities.
  As for as link state and IDS are concerned, one should be careful  about 
the context. When we talk of security for routing protocols, it is usually 
in control plane. But, most of the IDS implementations for link state 
protocols ( for ex: felix wu's Ji-Nao distributed IDS for link state 
protocols) are management plane work. So, it is more of MIB work with all 
application level agents. But, recently, people are also working on 
backscatter analysis (not DDoS characterization) for Intrusion 
detection/OSPF.

  Then, what is germane to this group? threat models for intra-domain 
routing stuff. Analysis of various fail-stop and byzatine failures which 
lead to lot of vulnerabilities in link state systems. Most of the fail-stop 
failures can be minimized by murphy's digital signature method. The question 
is: what are the vulnerabilities which stand unaffected even with all those 
security mechanisms and MD5 protection schemes?
Most of the protocol security breaches associated with metrics, sequence no 
and age can be prevented by means of keyed-MD5 authentication. So, what are 
the remaining problems which stands to be solved? what are threats due to 
compromised routers, intruding routing process and routing protocol 
poisoning which still stands rigid with all our protection mechanisms? A 
look into security focus vulnerability list will tell you most are just 
configuration or implementation problems. So, one of our work will also be 
listing all these vulnerabilities associated with link state protocols.

- Senthil.

_________________________________________________________________
Chat with friends online, try MSN Messenger: http://messenger.msn.com