Re: survey of isp security practices

[Bora Akyol <bora@cisco.com>]

Thanks for putting this together, some comments inline.

Bora

On 11/9/04 4:03 AM, "Merike Kaeo" <kaeo@merike.com> wrote:

> I  missed the cut-off for submitting a 00-draft for the survey of
> current isp security practices document but would like to at least send
> out the proposed outline so that people interested in contributing can
> comment to the list.  Anything that is glaringly missing?
> 
> - merike
> 
> 
> Table of Contents
> 
>     1.  Introduction
>     2.  Problem Statement
>     3.  Device Access Security
>       3.1   Threat Description
>       3.2   Best Current Practice
>         3.2.1   Logical access
What is logical access (ssh?)

>         3.2.2   Console Access
>         3.2.3   HTTP
>         3.2.4   SNMP

Would like to add API based access to the management interfaces.

>     4.  Authentication / Authorization
>       4.1   Threat Description
>       4.2   Best Current Practice
>         4.2.1   Device Access
>         4.2.2   Routing
>         4.2.3   MAC Address

I think (2) and (3) above are good but their suitability to be classified
under Authentication/Authorization highly depends on what the threat is.

>     5.  Filtering
>       5.1   Threat Description
>       5.2   Best Current Practice
>         5.2.1   General Inbound Traffic Filters
>         5.2.2   General Outbound Traffic Filters
>         5.2.3   Device Access Filters
>         5.2.4   Route Filters
>         5.2.5   MAC Address Filters
>         5.2.6   DoS Mitigation Filtering
>         5.2.7   SinkHole / Blackhole
>         5.2.8   uRPF
>     6.  Logging (accounting)
>       6.1   Threat Description
>       6.2   Best Current Practice
>         6.2.1   What traffic is logged
>         6.2.2   What fields are logged
>         6.2.3   How long are logs kept
>         6.2.4   Local buffer vs syslog (for backup info)
>         6.2.5   Authentication from peer to peer of log files?
>         6.2.6   Integrity check of log files?
>         6.2.7   NTP source considerations
>     7.  Device Integrity
>       7.1   Threat Description
>       7.2   Best Current Practice
>         7.2.1   Device Image Upgrade
>         7.2.2   Device Configuration
>         7.2.3   Management/Logging Information

I don't know it fits under (3) above, but I would like to see a few words
somewhere about core dumps from network devices.


>     8.  Specific Protocol/Service Concerns
>       8.1   Threat Description
>       8.2   Best Current Practice
>         8.2.1   ICMP
>         8.2.2   Generally Unused Services

There is a whole lot more here, SSH, HTTP, SCP, ......
I am wondering if we want to avoid listing specific services here since they
will need to be updated as people come up with new services.

>     9.  Policy/Procedural Considerations
>       9.1   Threat Description
>       9.2   Best Current Practice
>         9.2.1   Equipment Software Update
>         9.2.2   Equipment Configuration Change

(2) Can we add Change and Versioning.