Slashdot Mirror
Feds Plot Massive Internet Router Security Upgrade
BobB-nw writes "The U.S. federal government is accelerating its efforts to secure the Internet's routing system, with plans this year for the Department of Homeland Security to quadruple its investment in research aimed at adding digital signatures to router communications. DHS says its routing security effort will prevent routing hijack attacks as well as accidental misconfigurations of routing data. The effort is nicknamed BGPSEC because it will secure the Internet's core routing protocol known as the Border Gateway Protocol (BGP). (A separate federal effort is under way to bolster another Internet protocol, DNS, and it is called DNSSEC.)
Douglas Maughan, program manager for cybersecurity R&D in the DHS Science and Technology Directorate, says his department's spending on router security will rise from around $600,000 per year during the last three years to approximately $2.5 million per year starting in 2009."
This plan to upgrade router security is a plot? Are there some nefarious evil masterminds behind it?
For those of who aren't experts on this sort of thing, will this only increase security at things that are .gov? That's the impression I get but I don't know enough technically to be sure.
I don't know much about security and cost, but the 600k does indeed seem fairly small to me for something like this. Even 2.x million seems like a sizzle in the pan. Can anyone speak to the costs involved?
put all the top workers under full secret service protection and don't fire any one or will may see a under siege 2.
[tinfoil] Sure, and adding signatures to all routers couldn't possibly be trying to make Thomas Paine roll over in his grave, now, could it? [/tinfoil]
[
You're failing to take into account the 2-3 times the project will be extended and the quadrupling in cost. That's just SOP for a government contract. Sad, but true.
That costs a lot less than rolling out new hardware/software.
Engineering is the art of compromise.
A few short years ago we managed to live without the DHS and now we accept them like we don't foot the bill. Just another group of people sucking tax dollars off the American people in the name of protection.
Quack, quack.
Most troubling is that problems like these were basically known about for years but nothing is done until after threats are displayed at sec conferences.
When you're $10.6 trillion dollars in debt, even $600 k shouldn't be considered trivial. That's real money our grandkids will be paying off...
--- Thousands are enslaved every day.
Still peanuts. If you want to really spend other people's money the Dept of the Treasury is the place to be.
The U.S. federal government is accelerating its efforts to secure the Internet's routing system
Did I miss something?
I thought China had all the control.
Couldn't you just not do that? Why do the Feds have to roll out a $600k program because of you? That is taxpayers money for gods sake!
I wouldn't do it (I don't even have an AS to play with anymore), and it's rather more complicated than my explination made out...
I think a possible way to implement this would be a Hierarchical model where IANA has a top-level certificate for the trust and then it signs each regional NICs certificate, and they sign AS's which sign their subnets, then IANA could ask various NICs to revoke the Certificates of AS's that do dodgy things (like advertise subnets that aren't theirs), still it would require alot more overheads in terms of processing and memory than BGP currently requires.
I should also mention, I haven't worked with BGP in around 7 years now.
A Man's ethical behavior should be based effectually on sympathy, education, and social ties -- Albert Einstein
A separate federal effort is under way to bolster another Internet protocol, DNS, and it is called DNSSEC.
That's the name of a set of protocols that predates the DHS, not their effort.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
This is what we need. I am glad that action is being taken on the router and DNS vulnerabilities. These are very serious issues that are a danger to everyones security and privacy. Especially rerouting attacks for download and software is a perfect way to redirect users into downloading virus loaded software, and into giving confidential information to fake websites. Its about time something is done to improve the security of these systems, and they are doing the right things it appears by addressing true threats in ways that improve and protect the users rights and freedoms rather than take them away. Its clear that there are IT experts involved with this rather than politicians. What australia has done is an example of what NOT to do.
we really want to use new protocols from the government. They may put "warrantless wiretap" capabilities in...
So does that mean we are going to buy MORE fake routers from china with hardwired security issues?
well done!!! way to keep the cash rolling i say :-)
all this is economics to me so good job!!
for more cool jobs check out
http://www.jobstaxi.com/
Its a trap! SSBB reference
Had to sorry regulars.
Ease off that hair trigger a bit, eh?
I think you missed something rather fundamental - in the case of PP "dodgy" behavior meant doing illogical things with routing paths, not publishing unpopular or dissenting content!
I have no problem with your religion until you decide it's reason to deprive others of the truth.
Reads made in China Laughs
Build a Man a Fire, and He'll Be Warm for a Day. Set a Man on Fire, and He'll Be Warm for the Rest of His Life.
Watch out for spy-ware, censor-ware and propaganda.
Border Gateway != Core
Now all they have to do is upgrade that damn firewall protecting our air traffic, water distribution, and electrical generation control systems. It's only a matter of time before terroraxxors take over our country and crash planes into each other!
https://www.eff.org/https-everywhere
Or maybe they want the protocol done in a way that NSA CAN subvert any router detouring it's packets through their own computers, sniffing and injecting (cocaine & herion?) to their hearts content.
Just because I'm paranoid doesn't mean they aren't out to get you.
(He says, from his satellite connected hide-away in rural Alberta, 500 km from the nearest chunk of American soil)
Third Career: Tree Farmer Second Career: Computer Geek First Career: Teacher, Outdoor Instructor, Photographer.
I was wondering when they were going to start this. There was a lot of discussion about this a coupl years ago. One of the best ways to upgrade security on the net is to upgrade the routers. You can actually do a lot there, including an easier method to track and stop attacks at their source, as well as identify the originating machines. I hope there is more to the upgrade then stated there. It would be expensive, and some would probably say that there may be some constitutional issues. Hopefully they are including hardware/software to trace the point of origin for these attacks and shut down their proliferation by at least dropping them off the system.
Open Source: Eroding the Digital Divide