Internet Security - A Solid Foundation for Sustainable Internet Dev...

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

1
Internet Security
A Solid Foundation for Sustainable Internet Development
Presenter:
Terry Sweetser
Training Delivery Ma...

2
Acknowledgements
Che-Hoo & The Team
APNIC Development

3
3
Internet Security
• A branch of Computer Security or Cybersecurity
• Encompasses the Internet, browser security, websi...

4
4
Security Breaches Are Public News
• Many countries now have laws requiring security breach
notifications
• You don’t n...

5
5
Critical Infrastructure
• Critical Infrastructure uses the internet
• Even companies that don’t consider themselves to...

6
6
Critical Infrastructure
• Many ISPs and data center providers may be hosting CI
without even knowing it
– Do the prote...

7
7
Infrastructure Critical to Your Business
• Even if a company isn’t part of CI, it usually holds
valuable information f...

8
8
The Global Village
• The internet is not a local network, attacks can come
from anywhere
• While some attacks are very...

9
9
Security is a journey, not a destination
• Having the right staff, with the right skills is important
• Attacks and co...

11
11
Security Commitments
• People, Process, Technology
– No Surprise
– Not Optional
• Security Program with continuous e...

12
12
People
• Knowledge and awareness
• Actual people to lead and do the work
• Dedicated resources to increase capabilit...

13
13
Process
• Documented & Actioned policies, procedures and strategy
• Adopt or follow framework i.e. ISO27001, NIST
Cy...

14
14
Technology
• Another big area for investment
• Technical Security Controls to protect assets and
infrastructure
• In...

15
15
Collaboration
• Everybody should play a part and collaborate on Internet security
– Easier said that done though
• T...

16
16
Cyber Security Ecosystem
Network
Operators
Law
Enforcement
Policy Makers /
Governments
Researchers
Vendors
CERTs /
I...

17
17
What Network Operators Care About
• Cost / Performance / Resilience / Interconnections /
Efficiency / Scalability / ...

18
18
DDoS Attacks – A Big Headache
• With enhanced Internet infrastructure from backbones
to edges, there are more and mo...

19
19
BGP Prefix Hijacking – Another Big Headache
• Definition:
– Announcing a more specific
path
– Announcing an address ...

20
20
Best Practices for Network Operators
• More like guidelines for engineers
• On technical and operational parts
• Not...

21
21
BCP46 – Recommended ISP Security Services and
Procedures
• A good summary as of Year 2000
• Computer Security Incide...

22
22
BCP38 – Network Ingress Filtering
• Defeating Denial of Service Attacks which employ IP
Source Address Spoofing
– In...

24
24
Packet Filtering Principles
• Filter as close to the edge as possible
• Filter as precisely as possible
• Filter bot...

25
25
Best Practices for Ingress / Egress Prefix Filtering
• For Ingress Prefix Filtering:
– Don’t accept RFC1918/RFC6890 ...

26
26
Routing Security with RPKI
• RPKI deployment has 2 phases
• ROA is just the beginning
Phase 1: ROA (Signing origin)
...

27
27
BCP185 – RPKI-based Route Origin Validation
• Origin validation needs to be done only by an AS's border routers
• Op...

28
AS0 ROAs
• ROA with origin AS0 instead of a real
ASN
– Routes will be RPKI-invalid when they
would otherwise be RPKI-un...

29
29
IPv6 Security
• The worldwide IPv6 capability is at 39.37%. With nearly 40% of
network traffic using IPv6, protectin...

30
30
IPv6 Security Practices
• Filtering ICMPv6 is not straightforward
– RFC4890: “ICMPv6 Filtering Recommendations”
• Fi...

31
31
MANRS
• Mutually Agreed Norms for Routing Security (MANRS)
• A global initiative to improve security of the Internet...

32
32
DNS Best Practices
• Knowledge-Sharing and Instantiating Norms for DNS
and Naming Security (KINDNS)
• ICANN-supporte...

33
33
DNS Security
• Data exchange or transactions => TSIG, SIG0
• Data accuracy from the right source => DNSSEC
• DNS tra...

34
34
DNSSEC Best Practices
• ICANN DNSSEC Guidebook for ccTLDs
– https://www.icann.org/en/system/files/files/octo-029-12n...

35
35
BCP16 – Selection and Operation of Secondary DNS
Servers
• Authoritative Servers
– Usually one primary/master server...

36
36
BCP126 – Operation of Anycast Services
• Multiple nodes sharing the same IP address
– Coarse distribution of load ac...

37
37
RFC140 – Preventing Use of Recursive Nameservers in
Reflector Attacks
• Due to small query-large response potential ...

38
38
BCP162 – Logging Recommendations for Internet-
Facing Servers
• NAT is being used widely to preserve IPv4 addresses
...

39
39
OWASP Top 10
• Open Web Application Security Project (OWASP) presents
the most critical security risks to web applic...

40
40
Zero Trust
• Zero trust is a security model that assumes that any
device can be compromised.
• This is a shift from ...

41
41
Security Preparedness, Response &
CERTs/CSIRTs
• Security incidents can cause disruption,
destruction & affect reput...

42
42
CERTs/CSIRTs - Different Responsibilities /
Constituencies
National
Enterprise /
Organisation
Sector-
based
Product
...

43
43
NOGs
• Network Operators’ Groups (NOGs) are being established everywhere in Asia Pacific
– To create a community of ...

44
44
APNIC’s Vision & Mission
• Vision:
– “A global, open, stable, and secure Internet”
• Mission:
– To provide essential...

45
45
Internet Development Work at APNIC
• Human Resource Development / Capacity Building
– Training (APNIC Academy), Tech...

46
46
Explore APNIC Academy's most popular courses!
APNIC Academy
• Resource for Learning Internet Infrastructure, Operati...

47
APRICOT 2025 – CfP open now
• The PC is looking for
content for the
conference and
tutorial sessions and
Peering Forum
...

48
48
Final Remarks
• Take security seriously
• Don’t wait for a data breach before
implementing basic best practices
• Hi...

49
49

50
50

Share SlideShare

Facebook
Twitter
LinkedIn

Embed

Size (px)

Show related SlideShares at end

WordPress Shortcode

Link

Share
Email

2024 Trend Updates: What Really Wor... by Search Engine Jou... 532082 views
Storytelling For The Web: Integrate... by Chiara Aliotta 423683 views
Artificial Intelligence, Data and C... by OECD Directorate ... 301571 views
How to Leverage AI to Boost Employe... by SocialHRCamp 130092 views
2024 State of Marketing Report – by... by Marius Sescu 112355 views
Everything You Need To Know About C... by Expeed Software 148044 views

Top clipped slide

View on SlideShare

1 of 48 Ad

1 of 48 Ad