The Border Gateway Protocol (BGP) is the routing protocol of the Internet, used to route traffic across the Internet. For that reason, it's a pretty important protocol, and it can also be the hardest one to understand.
From our overview of Internet routing, you should realize that routing in the Internet is comprised of two parts: the internal fine-grained portions managed by an IGP such as OSPF, and the interconnections of those autonomous systems (AS) via BGP.
Who needs to understand BGP?
BGP is relevant to network administrators of large organizations which connect to two or more ISPs, as well as to Internet Service Providers (ISPs) who connect to other network providers. If you are the administrator of a small corporate network, or an end user, then you probably don't need to know about BGP.
BGP basics
The current version of BGP is BGP version 4, based on RFC4271.
BGP is the path-vector protocol that provides routing information for autonomous systems on the Internet via its AS-Path attribute.
BGP is a Layer 4 protocol that sits on top of TCP. It is much simpler than OSPF, because it doesn’t have to worry about the things TCP will handle.
Peers that have been manually configured to exchange routing information will form a TCP connection and begin speaking BGP. There is no discovery in BGP.
Medium-sized businesses usually get into BGP for the purpose of true multi-homing for their entire network.
An important aspect of BGP is that the AS-Path itself is an anti-loop mechanism. Routers will not import any routes that contain themselves in the AS-Path.
Why do you need to understand BGP?
When BGP is configured incorrectly, it can cause massive availability and security problems, as Google discovered in 2008 when its YouTube service became unreachable to large portions of the Internet. What happened was that, in an effort to ban YouTube in its home country, Pakistan Telecom used BGP to route YouTube's address block into a black hole. But, in what is believed to have been an accident, this routing information somehow got transmitted to Pakistan Telecom's Hong Kong ISP and from there got propagated to the rest of the world. The end result was that most of YouTube's traffic ended up in a black hole in Pakistan.
Showing posts with label General IT Knowledge. Show all posts
Showing posts with label General IT Knowledge. Show all posts
Friday, October 23, 2015
Saturday, May 31, 2014
Review of the information security policy
Control
The information security policy should be reviewed at planned intervals or if significant changes
occur to ensure its continuing suitability, adequacy, and effectiveness.
Implementation guidance
The information security policy should have an owner who has approved management responsibility
for the development, review, and evaluation of the security policy. The review should include
assessing opportunities for improvement of the organization’s information security policy and
approach to managing information security in response to changes to the organizational environment,
business circumstances, legal conditions, or technical environment.
The review of the information security policy should take account of the results of management
reviews. There should be defined management review procedures, including a schedule or period of
the review.
The input to the management review should include information on:
a) feedback from interested parties;
b) results of independent reviews;
c) status of preventive and corrective actions;
d) results of previous management reviews;
e) process performance and information security policy compliance;
f) changes that could affect the organization’s approach to managing information security,
including changes to the organizational environment, business circumstances, resource
availability, contractual, regulatory, and legal conditions, or to the technical environment;
g) trends related to threats and vulnerabilities;
h) reported information security incidents ;
i) recommendations provided by relevant authorities.
The output from the management review should include any decisions and actions related to:
a) improvement of the organization’s approach to managing information security and its
processes;
b) improvement of control objectives and controls;
c) improvement in the allocation of resources and/or responsibilities.
A record of the management review should be maintained.
Management approval for the revised policy should be obtained.
The information security policy should be reviewed at planned intervals or if significant changes
occur to ensure its continuing suitability, adequacy, and effectiveness.
Implementation guidance
The information security policy should have an owner who has approved management responsibility
for the development, review, and evaluation of the security policy. The review should include
assessing opportunities for improvement of the organization’s information security policy and
approach to managing information security in response to changes to the organizational environment,
business circumstances, legal conditions, or technical environment.
The review of the information security policy should take account of the results of management
reviews. There should be defined management review procedures, including a schedule or period of
the review.
The input to the management review should include information on:
a) feedback from interested parties;
b) results of independent reviews;
c) status of preventive and corrective actions;
d) results of previous management reviews;
e) process performance and information security policy compliance;
f) changes that could affect the organization’s approach to managing information security,
including changes to the organizational environment, business circumstances, resource
availability, contractual, regulatory, and legal conditions, or to the technical environment;
g) trends related to threats and vulnerabilities;
h) reported information security incidents ;
i) recommendations provided by relevant authorities.
The output from the management review should include any decisions and actions related to:
a) improvement of the organization’s approach to managing information security and its
processes;
b) improvement of control objectives and controls;
c) improvement in the allocation of resources and/or responsibilities.
A record of the management review should be maintained.
Management approval for the revised policy should be obtained.
Virtual Private Networks Security Risks
Security Risks
The key security risk with communications over an insecure network is that sensitive information may be
accessible to unauthorized parties, leading to unauthorized disclosure and/or modification. In addition to the
risks typically associated with local and wide area networking, the typical risks associated with VPNs include:
— insecure implementation through:
• an untested or defective cipher suite,
• a weak shared secret that could be easily guessed,
• poor network topology,
• uncertainty about the security of the remote client,
• uncertainty about the authentication of users,
— uncertainty about the security of the underlying service provider,
— poor performance or availability of service,
— non compliance with regulatory and legislative requirements on the use of encryption in certain countries.
Security Controls
In VPNs, cryptographic techniques are commonly used in networking and/or application protocols to
implement security functionality and services, especially if the network on which the VPN is built is a public
network (for example, the Internet). In most implementations the communications links between the
participants are encrypted to ensure confidentiality, and authentication protocols are used to verify the identity of the systems connected to the VPN. Typically, the encrypted information travels through a secure 'tunnel' that connects to an organization's gateway, with the confidentiality and integrity of the information maintained.
The gateway then identifies the remote user and lets the user access only the information they are authorized
to receive. Thus, a VPN is a mechanism based on protocol tunneling - treatment of one complete protocol (the client protocol) as a simple stream of bits and wrapping it up in another (the carrier protocol). Normally, the VPN carrier protocol provides security (confidentiality and integrity) to the client protocol(s). In considering the use of VPNs, the architectural aspects that should be addressed include:
— endpoint security,
— termination security,
— malicious software protection,
— authentication,
— intrusion detection,
— security gateways (including firewalls),
— network design,
— other connectivity,
— split tunneling,
— audit logging and network monitoring,
— technical vulnerability management.
The key security risk with communications over an insecure network is that sensitive information may be
accessible to unauthorized parties, leading to unauthorized disclosure and/or modification. In addition to the
risks typically associated with local and wide area networking, the typical risks associated with VPNs include:
— insecure implementation through:
• an untested or defective cipher suite,
• a weak shared secret that could be easily guessed,
• poor network topology,
• uncertainty about the security of the remote client,
• uncertainty about the authentication of users,
— uncertainty about the security of the underlying service provider,
— poor performance or availability of service,
— non compliance with regulatory and legislative requirements on the use of encryption in certain countries.
Security Controls
In VPNs, cryptographic techniques are commonly used in networking and/or application protocols to
implement security functionality and services, especially if the network on which the VPN is built is a public
network (for example, the Internet). In most implementations the communications links between the
participants are encrypted to ensure confidentiality, and authentication protocols are used to verify the identity of the systems connected to the VPN. Typically, the encrypted information travels through a secure 'tunnel' that connects to an organization's gateway, with the confidentiality and integrity of the information maintained.
The gateway then identifies the remote user and lets the user access only the information they are authorized
to receive. Thus, a VPN is a mechanism based on protocol tunneling - treatment of one complete protocol (the client protocol) as a simple stream of bits and wrapping it up in another (the carrier protocol). Normally, the VPN carrier protocol provides security (confidentiality and integrity) to the client protocol(s). In considering the use of VPNs, the architectural aspects that should be addressed include:
— endpoint security,
— termination security,
— malicious software protection,
— authentication,
— intrusion detection,
— security gateways (including firewalls),
— network design,
— other connectivity,
— split tunneling,
— audit logging and network monitoring,
— technical vulnerability management.
IT Networking Roles and Responsibilities
The roles and responsibilities that should be instigated associated with network security management are as
follows. (It should be noted that, depending upon the size of the organization, these roles may be combined.)
Senior management:
— define the organization's security objectives,
— initiate, approve, publish, and impose the organization's security policy, procedures and rules,
— initiate, approve, publish, and impose the organization's acceptable usage policy,
— ensure security and acceptable usage policies are enforced,
Network management:
— develop detailed network security policy,
— implement the network security policy,
— implement the acceptable usage policy,
— manage the interface with external stakeholders / external service providers to ensure conformance with
internal and external network security policies,
Network Security team:
— acquire, develop, test, check and maintain security components and tools,
— maintain security tools and components to follow closely the evolution of threats (e.g. updating virus
signature files),
— update security relevant configurations (e.g. access control lists ) according to changing business needs,
Network administrators:
— install, update, use and protect network security services and components,
— carry out the necessary daily tasks to apply the security specifications, rules, and parameters required by
the security policies in force,
— take appropriate measures to assure the protection of network security components (e.g. back-ups,
monitoring network activity, responding to security incidents or alarms, etc.),
Network users:
— communicate their security requirements,
— comply with corporate security policy,
— comply with corporate acceptable usage policies for network resources,
— report network security incidents,
— provide feedback on network security effectiveness,
Auditors (internal and/or external):
— review and audit (e.g. periodically test the effectiveness of network security),
— check compliance of systems with network security policy,
— check and test compatibility of operating security rules with the current business requirements and legal
restrictions (e.g. lists granted for network accesses).
follows. (It should be noted that, depending upon the size of the organization, these roles may be combined.)
Senior management:
— define the organization's security objectives,
— initiate, approve, publish, and impose the organization's security policy, procedures and rules,
— initiate, approve, publish, and impose the organization's acceptable usage policy,
— ensure security and acceptable usage policies are enforced,
Network management:
— develop detailed network security policy,
— implement the network security policy,
— implement the acceptable usage policy,
— manage the interface with external stakeholders / external service providers to ensure conformance with
internal and external network security policies,
Network Security team:
— acquire, develop, test, check and maintain security components and tools,
— maintain security tools and components to follow closely the evolution of threats (e.g. updating virus
signature files),
— update security relevant configurations (e.g. access control lists ) according to changing business needs,
Network administrators:
— install, update, use and protect network security services and components,
— carry out the necessary daily tasks to apply the security specifications, rules, and parameters required by
the security policies in force,
— take appropriate measures to assure the protection of network security components (e.g. back-ups,
monitoring network activity, responding to security incidents or alarms, etc.),
Network users:
— communicate their security requirements,
— comply with corporate security policy,
— comply with corporate acceptable usage policies for network resources,
— report network security incidents,
— provide feedback on network security effectiveness,
Auditors (internal and/or external):
— review and audit (e.g. periodically test the effectiveness of network security),
— check compliance of systems with network security policy,
— check and test compatibility of operating security rules with the current business requirements and legal
restrictions (e.g. lists granted for network accesses).
Subscribe to:
Posts (Atom)