January 2003 - Test - lists.nanog.org

Scaled Back Cybersecuruty
by sgorman1＠gmu.edu 14 Jan '03

14 Jan '03

This may be of interst: AP: Bush Expected to Sign Scaled Back Internet Security Plan Washington, DC -- A new Bush administration plan aimed at improving the security of key U.S. computer networks will not be as ambitious as previously indicated, the Associated Press reported on Tuesday. The plan is being closely watched by network security firms in the DC area. A draft of the proposal, called the National Strategy to Secure Cyberspace, obtained by the AP contains only 49 of the 86 initiatives of an earlier version, eliminating such mandates as regular consultations with privacy experts about civil liberties and a call for corporations to improve cybersecurity. Instead, it focuses on the security of federal agencies; it also makes clear that the Defense Department can engage in "cyber warfare" should the U.S. be attacked. The job of improving Internet security, however, would be handled by the new Homeland Security Department, which would launch test attacks against various agencies and seek to improve automated systems that operate water, chemical and electrical networks. Bush is expected to sign the plan in the coming weeks. http://www.washingtonpost.com/wp-dyn/articles/A18662-2003Jan6.html

4 3

Re: Scaled Back Cybersecuruty
by sgorman1＠gmu.edu 14 Jan '03

14 Jan '03

That is the rub. Kind of like targeting treatment for AIDS to those with the most sexual partners - it helps solves the problem but is it worth rewarding irresponsible behaviour. Although not the best analogy, especially since in this case the worst offenders are fortuantely not the best connected. Still think that at some point you need to deal with raising the lowest common denominator. That said it would be good to see something concrete being done like the RFP inclusions. The incentive though should be greater than what is gained by ignoring security currently. Is the government willing to provide enough incentive to change the market place? If RFP's alone can't do it what else could be tried? ----- Original Message ----- From: Avi Freedman <freedman(a)freedman.net> Date: Tuesday, January 14, 2003 9:06 pm Subject: Re: Scaled Back Cybersecuruty > > In article <103014.1607.23062(a)avi.netaxs.com> you wrote: > > : Seems to be a case of prisoners dilema. The security of any one > network: is to some extent at the mercy of all other connected > networks. The > : overall security of the network is only as strong as it's > weakest link. > : In a highly competitive market place there is going to be little > : incentive to invest in security if it will just be compromised > by your > : cost cutting competitors. > > Yes, but: > > - Shouldn't we encourage our tax $ go with preference towards good > network citizens? > > - If only a few of the larger networks started implementing better > practices that engineering groups can't get funded today, we're > still getting better off. > > - Starting at the core, which is who the Feds buy the most IP from, > still makes life a lot simpler if and when we get the "big one" > in terms of cyber-attack. > > I think this is probably better for a BOF (maybe even the security > BOF) discussion, though... > > Avi > > >

2 1

Re: Scaled Back Cybersecuruty
by Avi Freedman 14 Jan '03

14 Jan '03

In article <103014.152131.21746(a)avi.netaxs.com> Pete wrote: : I'm trying to envision an RFP that awards business to one or : a few network operators, but requires that they interoperate : effectively with other operators who don't win any of the : business. I've only got a state-level purchasing : perspective, but I don't see it happening at any level. Let me be more clear :) If the next FTS or if all large Federal IP purchases mandated one of: - Routers must be configured by end of 2003 so that all packets to the control plane must be logically separated from user packets (or demonstrate the ability to take 200mb of attack traffic to the router CPU without having an effect) OR - All single-homed customers must be source-address filtered at ingress or egress. (Becoming multi-homed at ingress as a requirement over time) OR ... You get the idea. Something that IS possible, that matters MOST at the large end of the scale. And if we go a long way towards solving one beasty per year we'll at least be making MORE progress than we've been making to date, which is roughly zero. : Pete. Thanks, Avi

3 2

Re: Scaled Back Cybersecuruty
by sgorman1＠gmu.edu 14 Jan '03

14 Jan '03

Seems to be a case of prisoners dilema. The security of any one network is to some extent at the mercy of all other connected networks. The overall security of the network is only as strong as it's weakest link. In a highly competitive market place there is going to be little incentive to invest in security if it will just be compromised by your cost cutting competitors. If this is the case then the question is what kind of intervention is necessary to prevent a prisoners dilema and allow something like a Nash Equilibrium - the bar scene in A Beautiful Mind where they fight over the hottie blonde... Basically where a set of strategies for security are arranged so that each player believes that it is doing the best it can (most personal gain) given the strategies of the other players. The current state appears to be that many providers do little to nothing to provide for security, so each player adjust their strategy accordingly resulting in the prisoners dilema. It seems to get beyond this you have to bring up the lowest common denominator so that strategy is not based on networks doing nothing. How do you get the worst offenders to improve the lowest common denominator. Purchasing requirements, subsidies, taxes, regulation??? Maybe a bunch of economic voodoo, but might be a different way of looking at the issue. ----- Original Message ----- From: Pete Kruckenberg <pete(a)kruckenberg.com> Date: Tuesday, January 14, 2003 8:16 pm Subject: Re: Scaled Back Cybersecuruty > > On 14 Jan 2003, Vijay Gill wrote: > > > Avi Freedman <freedman(a)freedman.net> writes: > > > >> Perhaps the Feds (and maybe states) could use their purchasing > power>> to effect change. Short of that, or regulation, the I > don't see how > >> the serious issues we have with the 'net will get resolved. > > > > People do. I've been beating this particular horse for a > > while now, and we are starting to deploy the capex > > hammer. I suggest others start to do the same. See my > > presentation at the eugene nanog. > > I can see how purchasing power may motivate a vendor (and > maybe lots of individual vendors) to fix their own problems, > develop better products, or be more responsive. > > I'm trying to envision an RFP that awards business to one or > a few network operators, but requires that they interoperate > effectively with other operators who don't win any of the > business. I've only got a state-level purchasing > perspective, but I don't see it happening at any level. > > Is spending really an effective hammer (or gun) to make > people work together if they aren't otherwise motivated to? > Behavior related to the '96 Telecom Act doesn't inspire > confidence. > > Can technical solutions be an effective band-aid for a > complex poli-socio-economic problem like this? > > Pete. > > >

1 0

Re: Scaled Back Cybersecuruty
by Avi Freedman 14 Jan '03

14 Jan '03

In article <103014.14855.19429(a)avi.netaxs.com> Vijay the Budget Master wrote: : Avi Freedman <freedman(a)freedman.net> writes: :> Perhaps the Feds (and maybe states) could use their purchasing power :> to effect change. Short of that, or regulation, the I don't see how :> the serious issues we have with the 'net will get resolved. :> :> I suppose that the "problem" is likely that people don't understand :> what a nice actually well-written worm could/would do if it were :> targeted at the infrastructure. : People do. I've been beating this particular horse for a while now, : and we are starting to deploy the capex hammer. I suggest others start : to do the same. See my presentation at the eugene nanog. : /vijay Many networks of sizable import have no capex budget, though - or sometimes very little if no engineering resources. They all pay attention to sales - and especially to RFIs and RFQs from the Feds, though. Avi

2 1

Re: Operating on a "war footing" (was Re: Violation of Acceptable Use Policies)
by Steven M. Bellovin 14 Jan '03

14 Jan '03

See Mapping and Visualizing the Internet. Bill Cheswick, Hal Burch, and Steve Branigan, Usenix 2000 general conference (San Diego), http://www.cheswick.com/ches/papers/mapping.ps.gz which includes some measurements of Yugoslavia's Internet sites. --Steve Bellovin, http://www.research.att.com/~smb (me) http://www.wilyhacker.com (2nd edition of "Firewalls" book)

1 0

Verizon QOS??
by Gerald 14 Jan '03

14 Jan '03

Does there exist a Verizon QOS group for chronic network issues? I was told there used to be a chronic issues group that would review long term problems and facilitate long term solutions. I am seeing new lows in quality of service from Verizon for one of our customers, and the few people I have been able to talk to claim ignorance/inability to permanently resolve the problem. Any help or suggestions is appreciated. I'd prefer not to go into this particular network issue on the list in the interest of our customer. Gerald

1 0

CWDM Optical Mux
by Alex Rubenstein 14 Jan '03

14 Jan '03

Hi. It's me again, on my eternally quest for information. This time, it's about CWDM Muxes. Assume that I have a Cisco CMUX system (dark out the back, handing off CWDM waves in the front). Who knows of a small, easy, cheap system that can take a CWDM wavelength in, and mux a few oc12's onto it? Perhaps oc48-cwdm out the back? -- Alex Rubenstein, AR97, K2AHR, alex(a)nac.net, latency, Al Reuben -- -- Net Access Corporation, 800-NET-ME-36, http://www.nac.net --

1 0

Re: NYT on Thing.net (fwd)
by Paul Wouters 14 Jan '03

14 Jan '03

(Zenon isn't on Nanog and asked me to forward this) Paul ---------- Forwarded message ---------- Date: Mon, 13 Jan 2003 20:59:06 +0100 From: Zenon Panoussis <oracle(a)provocation.net> Cc: Kurt Erik Lindqvist <kurtis(a)kurtis.pp.se>, batz <batsy(a)vapour.net>, nanog(a)merit.edu To: Paul Wouters <paul(a)xtdnet.nl> Subject: Re: NYT on Thing.net Paul Wouters wrote: > > For those who do not know, Flashback is a Swedish e-zine, that had about a > million subscribers. The longer away from the sea, the bigger the fish get. Something in the order of a hundred thousand is more correct, which is still quite a lot in a country of eight million. > Things were even brought into court, where the judge ruled It never made court. The prosecutor deemed the material fully legal and refused to prosecute. Three times. > In short, UUnet corporate policy stood above Swedisch law........ Constitution guarantees freedom of speech. > This is exactly why ISP's should not be allowed to have these "we will > disconnect you at our sole discretion" clauses. You can't forbid them. Private enterprises have (and should have) every right to manage their own business as they want. Just as it would be both unethical and unconstitutional to oblige the KRO (Dutch broadcasting corporation owned by the catholic church) to broadcast porn, it would be a violation of the ISPs' right to property and negative right of association (the right to not enter into contract) to force them to carry what they don't want. Your "solution" is dictatorial in the name of freedom. The way I see it, the problem is not in the clauses of ISPs, but in their numbers. The closer you get to the backbone, the fewer carriers you will find. There is no competition in these matters and no alternative. With this as my basis, I would say that there are two possible solutions: 1. A public network on which private ISPs operate, something like public roads and railways on which private trucks and trains run and/or 2. A much stricter anti-trust control in telecommunications, making impossible the serial mergers and oligopolies that we now see. >>First of all, in my opinion (and this seems to be pretty common), a >>company should be free to choose who they sign contracts and business >>deals with. > Only within reason. You cannot excludes based on various reasons, such > as religion, believes, race, sex, etc. Most countries have laws against > such discrimination. And so does Sweden. Political conviction could be added to religion, sex etc, by I strongly doubt that that would solve the problem. For one, there is no objective way to distinguish between politics and moral, or even taste. For another, such as ISP responsibility for user content has developed, ISPs can give purely financial and fully valid reasons for refusing content: "the mere risk of us getting sued costs us money and by keeping all controversy away, legal or not, we get a lower insurance premium". Finally, since racial and ethnic discrimination was criminalised in Sweden in 1987, not even a handful of people have been convicted, despite a general level of ethnical and racial discrimination that's comparable to or higher than that in Germany. Says something about the efficiency of these laws. >>if I believe that having him as a client >>will harm other business relations (out of competitive claims etc) or >>similar issues, I should be in my full right to deny signing a contract. > You should not! You will open yourself to threats from all your customers. > Your big customers will end up deciding your company's policy. This is BAD! > Canceling a customer that has done nothing wrong, is just ethically and > morally wrong. You might as well condone the Great Firewall of China. In principle you are right, both morally and from a long-term business point of view. In practice, sadly, things work differently. You could just as well substitute "don't exploit your workers", "don't ruin the environment", "don't fiddle with your taxes" and a million other such rules for "don't let your customers make your policies", but most people look at trimestral, or at the most annual, results and don't believe any more in supreme judgement and hell. > As a simple example, say you are hosting www.shell.se, and Greenpeace > asks you for hosting. You agree, and then Shell (by far a much bigger > and profitable customer for you) tells you it will go elsewhere if you do > not cancel your hosting agreement with Greenpeace. Now, your company's > reason is VERY valid, it is in the company's financial interest to cancel > Greenpeace. And since Greenpeace has done nothing wrong, you can only > cancel them based on "in sole discretion". Bad example. Greenpeace might be a small customer, but it's a customer with muscle. If this happened and Greenpeace got the wind of it, both Shell and the ISP would live to regret it. The people who need protection from having their civil rights arbitrarily curtailed by corporations are the small ones who lack muscle. In a world where only muscle counts, be it financial, political or other, there are only two ways for the small ones to make themselves valid: cooperation and guerilla tactics. We have seen both on the net, both have had their successes and their failures. Since guerilla tactics by definition cannot be institutionalised, I would add 3. End-user cooperatives providing ISP services and bundling the financial muscle of their members, cooperatives of small ISPs stepping into the backbone business. to my two possible solutions above. >>Now, getting these two claims to work together is the tricky balance. > You cannot. You want to discriminate based on your company's interest > first, and your customers' rights second. By doing so, you are not > better then those big bullying customers of yours yourself. "Good" and "bad" doesn't count in business. Money does, and money is not only green. Bad publicity is money lost. Lawsuits is money lost. A high ethical stance is good publicity and money gained; we have a perfect example of this in xs4all. However, as with everything else, the market doesn't stand still and there is no perfect recipy of how much good or bad karma will get you most money. When most ISPs are bad in the sense that we are now discussing, it will be profitable to be good. Again, upstream is the problem; too few carriers, all of them having too similar interests. The internet was made to be decentralised, have no possible single (or even main) point of failure and repair its own damages. MCI/Worldcom ruined that. You could indeed say that MCI/Worldcom ruined the internet. That's where you need to start fixing it. Z

3 2

Re: NYT on Thing.net
by Kurt Erik Lindqvist 14 Jan '03

14 Jan '03

> (I think I am close to get a notice from Susan so this will be my last posting on this to Nanog) > > The upstream (Air2net?) basically shrugged their shoulders. Fries > went to the upstream's upstream while at the same time he mounted Air2net was a transit customer of KPNQwest (and not a reseller as Flashback claimed) and it was to them Flashback turned when they got cut off the first time. Air2net however only had presence in Gothenburg and wanted to connect their customer to KQs network, which we refused (actually first we did not know this was Flashback). Flashback then turned directly to KQ but we declined to offer services. Then he went on to other ISPs. Worth noting is that KQ didn't impose any restrictions on transit customers, but none of the (then very few though) transit customers accepted Flashback as customer. > Karlskrona city lawyer, the Swedish association of ISPs (I forget > its name; something like the Dutch NLIP, a non-mandatory, SOF, I am the current chairman. > non-regulatory private body in which all major and many minor > ISPs are represented) took up the issue. At first they issued > some kind of statement saying that they had all agreed to refuse > nazi content and anybody carrying it. Later they took that back > and refused to comment. Since they are a private body, nobody > can force them to show their minutes (and nobody has leaked them > so far). The end result was that not one single ISP was willing > to host Flashback and Axelsson got a rather remarkable collection > of subterfuges, "not in, he'll will call you" from people who > never called, unreplied letters and the like. > To my knowledge SOF have never issued a joint statement on anything except the Swedish Spam-law. I was not at that SOF meeting but the minutes are public and on the web. From what I know the subject was discussed very briefly and never made it into the minutes (which I agree is bad though). Flashback made complaints to a number of government bodies, all of who cleared the issue. I do not recollect that this would have been due to "not enough evidence" but I don't have the copies of the notes anymore. Anyway, this discussion will always be biased one way or the other. I think that summary of Zenons and my mails probably is as close to the truth as you will get. Conclusions will depend on your political views and on which side of the table you sit. The topic that started this was discussions on ISPs role on judging content. The Swedish ISPs have had more reason to discuss recently due to child-porn, neo-nazi web-sites and TV decoders than we ever had with Flashback. - kurtis -

1 0