Slashdot Mirror
Feds Plot Massive Internet Router Security Upgrade
BobB-nw writes "The U.S. federal government is accelerating its efforts to secure the Internet's routing system, with plans this year for the Department of Homeland Security to quadruple its investment in research aimed at adding digital signatures to router communications. DHS says its routing security effort will prevent routing hijack attacks as well as accidental misconfigurations of routing data. The effort is nicknamed BGPSEC because it will secure the Internet's core routing protocol known as the Border Gateway Protocol (BGP). (A separate federal effort is under way to bolster another Internet protocol, DNS, and it is called DNSSEC.)
Douglas Maughan, program manager for cybersecurity R&D in the DHS Science and Technology Directorate, says his department's spending on router security will rise from around $600,000 per year during the last three years to approximately $2.5 million per year starting in 2009."
This plan to upgrade router security is a plot? Are there some nefarious evil masterminds behind it?
For those of who aren't experts on this sort of thing, will this only increase security at things that are .gov? That's the impression I get but I don't know enough technically to be sure.
I don't know much about security and cost, but the 600k does indeed seem fairly small to me for something like this. Even 2.x million seems like a sizzle in the pan. Can anyone speak to the costs involved?
Most troubling is that problems like these were basically known about for years but nothing is done until after threats are displayed at sec conferences.
Couldn't you just not do that? Why do the Feds have to roll out a $600k program because of you? That is taxpayers money for gods sake!
I wouldn't do it (I don't even have an AS to play with anymore), and it's rather more complicated than my explination made out...
I think a possible way to implement this would be a Hierarchical model where IANA has a top-level certificate for the trust and then it signs each regional NICs certificate, and they sign AS's which sign their subnets, then IANA could ask various NICs to revoke the Certificates of AS's that do dodgy things (like advertise subnets that aren't theirs), still it would require alot more overheads in terms of processing and memory than BGP currently requires.
I should also mention, I haven't worked with BGP in around 7 years now.
A Man's ethical behavior should be based effectually on sympathy, education, and social ties -- Albert Einstein
They're not claiming that they invented it, they're just trying to help it along. While DNSSEC has been around a while, the overwhelming majority of zones, including the root zone and .com, are not signed yet. It may look like the US government is late to the party, they're actually ahead of most of the US commercial sector on this one.
So how does this "bolster" DNSSEC? Answer: the government is hoping that a large-scale implementation by a major buyer will push vendors to properly support DNSSEC. Many vendors don't support DNSSEC at all, or only support part of it; Microsoft, for example, only has minimal DNSSEC support. How do you think vendors will respond when .gov customers start telling them "we can't buy your product because it doesn't support DNSSEC. We'll have to go with one of your competitors."
RTFA.
That might pay for a requirements analysis, but that's about it. A real system is going to be much more expensive.
Mea navis aericumbens anguillis abundat
So does that mean we are going to buy MORE fake routers from china with hardwired security issues?
Well, yes, it is about time. Especially as the actual protocols needed were defined a long time ago. (To give you a frame of reference, the DoD were releasing Open Source IPSEC implementations in 1997. Ok, that specific protocol wasn't finalized at that point, but that tells you when the Government was sufficiently capable of and expert at encrypting router communications that they'd admit to it.)
That BGP, DNS and other mission-critical protocols aren't secure even twelve years later says a lot for the extreme lethargy at the level of critical infrastructure. Sure, they can't afford to dive straight in, but since when does the DoD release as Open Source their cutting-edge technology? If they were willing to let potential opponents (such as US citizens) have access, you can be certain they were already considering it old-hat.
It follows that they had the means and capability to install highly reliable, strongly encrypted, strongly authenticated router-to-router and DNS-to-DNS communications within the Internet. Of course, by that time the NSF had sold all the US links to Sprint and assorted other scrap-metal merchants, which is presumably why they never bothered.
It also tells me that the corporate sector is incapable of handling such infrastructure, that the "invisible hand" is too busy playing with itself to worry about such things as security and reliability, that those who believed businesses would be safer hands than universities have been shown to be utterly and completely incorrect.
This is not to say the public sector better. The UK's JANET is hardly a paragon of virtue. It turns out that they're all incompetent, but for different reasons. Businesses know better but want your money at no effort on their part, Governments know better but want your souls at no effort on their part.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
Ease off that hair trigger a bit, eh?
I think you missed something rather fundamental - in the case of PP "dodgy" behavior meant doing illogical things with routing paths, not publishing unpopular or dissenting content!
I have no problem with your religion until you decide it's reason to deprive others of the truth.