The Importance of WHOIS Data Accuracy, by Adli Wahid. A presentation given at APRICOT 2016’s APNIC Policy SIG (2) - Improving APNIC Whois Data Quality session on 25 February 2016.

1. 2016#apricot2016
The Importance of WHOIS
Data Accuracy
Adli Wahid
Security Specialist, APNIC

2. 2016#apricot2016
Context
• Security Response (CERTs/CSIRTs) community
perspective
• Feedback gathered from our security outreach activities
(i.e. APCERT members)
3

3. 2016#apricot2016
Security Incidents & Expected Actions
Expected Actions
• Stop ongoing badness
• Take down / Remove
• Fix!
• Share information
Type of Security Incidents
• DDoS, Spam, Bruteforce, Scanning
• DDoS agents, compromised or infected
computers
• Botnet Command & Control
• Phishing / Fraudulent sites
• Vulnerable or Exposed Systems
4

4. 2016#apricot2016
Whois
• Accuracy helps for a start
• Responsiveness
– Stop / Mitigate on going attack
– Reduce impact / exposure of incidents
– Do not have to go through various loops & hoops
• Ideally
– Ability to provide assistance or do something about it
• Reporting invalid contacts
5

5. 2016#apricot2016
Conclusion
• Accuracy – Yes
– But also Responsiveness
• Role of resource holders
– Keeping contact accurate
– Security Awareness
– Policies & Procedures in place
• i.e. incident response, escalation
• Opportunity for outreach
6

6. 2016#apricot2016
Thank You
Adli Wahid
adli@apnic.net
www.apnic.net/security