Working Group #4: Network Security Best Practices March 22, 2012 Presenter: Tony Tauber, Comcast WG #4 Member Via teleconference: Rod Rasmussen, Internet Identity WG #4 Co-Chair

2 Working Group #4: Network Security  Description: This Working Group will examine and make recommendations to the Council regarding best practices to secure the Domain Name System (DNS) and routing system of the Internet during the period leading up to the successful global implementation of the Domain Name System Security Extensions (DNSSEC) and Secure BGP (Border Gateway Protocol) extensions.  Duration: Sept – Mar. 2013

Working Group #4 – Participants  Co-Chairs  Rod Rasmussen – Internet Identity  Rodney Joffe – Neustar  Participants  30 Organizations represented  Service Providers  Network Operators  Academia  Government  IT Consultants 3

Working Group #4 - Current Work Activity  Clarification of Scope  Things we can do “now” – current HW/SW, no changes in protocols or new technologies needed  Focus on things that will be of value even if/when protocol extensions (DNSSEC/Secure Routing) are implemented  Domain Name Service (DNS)  BGP and Inter-Domain Routing  Issues requiring CSRIC membership input: potential overlaps with WG-5 and WG-6 – will monitor and seek advice as necessary 4

Working Group 4 - Work Completed  Preliminary “matrix” of DNS issues including problem space, ISP roles, challenges and started on short list of solutions  Identified candidate issues affecting the routing space (BGP) that can be addressed today via BCP’s and operational updates.  Created workspace for group collaboration and documentation 5

Working Group 4 - Work Completed  Primary DNS issues identified  DNS Cache poisoning attacks  Hacking or misconfiguration of DNS servers  DNS and domain name hijacking  DNS servers used for reflective, DNS amplification DDOS attacks  Rewriting of authoritative DNS responses to other values  Customers infected with DNS manipulating malware  Insecure zone transfers  Routing issues identified  Spoofing of addresses not routed by customer/peer  Hijacking/falsification of IP ownership by customers  Route hijacking via peering partners or on the wider Internet 6

Working Group 4 - Next Steps  Preliminary report to be drafted for June 2012 CSRIC meeting  Flesh out issues/actors/recommendations matrices for DNS and routing  Final agreement within the group on issues to be covered and reported out from the working group  Collection and collation of solutions and practices to provide advisory portion of the report 7

Working Group 4 – Project Timeline  Identify stakeholders; detail problem space and challenges of stakeholders; provide example solutions – June, 2012  Identify full set of potential solutions- September, 2012  Draft report on recommendations for best practices – December, 2012  Final report – March, 2013  Teleconferences bi-weekly – Fridays 1330 Eastern 8