►
From YouTube: IETF98-TUTORIAL-SECURITYCONSIDERATIONS-20170326-1345
Description
SECURITYCONSIDERATIONS tutorial session at IETF98
B
B
And
so
we're
going
to
do
a
quick
overview
of
some
considerations
for
writing.
So
the
security
considerations
sections
for
rfcs.
It's
not
going
to
be
kind
of
a
hundred
percent
comprehensive,
there's,
no
way
to
do
that
in
in
an
hour
and
just
as
a
quick
note,
I'm
not
going
to
rehash.
What's
in
RFC
3552,
there's
still
good
advice
in
there.
So
go
read
that,
but
it
is
a
little
bit
dated
at
this
point.
D
E
C
C
B
So
every
RFC,
more
or
less,
have
to
have
a
security
consideration
section,
and
that
has
to
cover
the
and
we'll
go
over
this
at
least
somewhat,
but
it
has
to
explain
how
you're
protecting
whatever
protocol
it
is
developing
against
the
threats
that
you've
outlined
and
what
the
measures
are.
Now
that
could
be
a
smaller
enhancement
to
a
larger
protocol,
in
which
case
you
just
really
have
to
cover
your
pieces.
But
you
have
to
understand
what
youre
your
threat
model
looks
like
and
and
what
it
is
you're
doing
to
protect
it.
B
C
Right,
okay,
so
the
basic
document
is
still
pretty
good.
It's
very
old!
We
feel
a
little
relative
low
number
updates
that
have
happened
since
then
is
I,
guess
the
biggest
one
is
Snowden
and
knowing
that
there
are
national
scale
with
actors
scooping
up
all
of
the
information
on
the
internet,
so
they
can
decrypt
it
later
or
analyze
it
later
or
perhaps
in
case
of
wikis,
and
things
like
that.
Do
it
into
my
real
time
as
joe
said,
though,
it's
currently
stalled.
B
So
I
want
to.
If
we
look
at
the
what's
in
3552,
we
have
a
an
attack
model
that
differentiates
between
kind
of
passive
attackers.
Active
attackers,
and
one
of
the
things
we
want
to
under
you
know
explain
to
people
is
use.
An
attack
model
understand
what
the
attack
model
is
against.
Your
system,
define
what
its
boundaries
are
and
and
then
describe
how
your
protocol
is
protected
against
those
things.
So
here's
an
attack
model
there
are
others,
you
could
use
stride.
You
could
use
a
number
of
other
ones.
B
This
is
a
the
cyber
kill
chain
and
I'm
going
to
talk
about
why
this
is
kind
of
relevant
to
what
we
see
is
some
set
of
current
activity
again
that
that's
against
attacks
happening
kind
of
now,
and
these
are
the
phases
that
we
view
in
this
model
that
an
attacker
is
going
to
go
through
right.
So
they're
going
to
do
reconnaissance
on
your
network
they're
going
to
do
development.
Potentially,
that's
the
secure
works
modification
weaponization
of
the
of
whatever
they're
going
to
inject
into
your
system.
B
Do
delivery,
which
means
that
might
be
an
email
that
could
be
a
physical
type
of
attack
of
convincing
somebody
put
a
USB
key
into
a
system.
That's
inside
your
perimeter,
whatever
it
takes
to
do
the
delivery.
At
that
point,
we
then
start
to
do
the
exploitation
we
install
the
next
phase
of
it.
We
have
commanded
control
inside
the
system
and
then
we're
going
to
do
whatever
our
actual
objective
was.
B
B
So
that's
that's
a
model,
that's
really
good
against
an
attacker
who
really
wants
to
establish
persistence
in
your
network
who's
going
to
spend
a
long
time
observing
your
network.
You
know
kind
of
really
developing
a
customized
exploit
and
do
do
the
kind
of
attack,
but
it
might
not
be
sufficient
for
all
types
of
attacks,
there's
a
much
more
simple
case,
that's
kind
of
prevalent,
so
here's
some
data
from
the
verizon
data
breach
report
and
I'm
going
to
step
outside
the
video
recording
for
a
moment
and
kind
of
point
it
slide.
B
But
so
what
we're
kind
of
seeing
here
is
this
tells
you
this
is
seconds
minutes
hours,
days,
weeks
months
for
an
intruder
coming
into
your
network,
and
what
this
says
is
that-
and
this
is
the
time
to
start
exfiltrating,
and
so
what
we
see
is
in
the
previous
model,
what
I
just
described
as
the
kill
chain
model,
we
have
an
attacker
who's
going
to
spend
a
lot
of
time,
surveilling
your
network,
building,
a
customized
implant
and
exploiting
your
network.
That's
not
necessarily
always
true.
B
What
we
see
now
is
a
lot
of
smash
and
grab
taking
place
as
well.
So
attackers
penetrate
the
network
from
the
time
that
one
of
your
users
clicks
on
that
mistaken
attachment
inside
there.
It's
minutes
before
they're,
starting
to
exfil
data
out
of
your
network
and
they're
doing
it
in
brazen
ways
such
that
they
don't
really
concerned.
If
your
defenses
detect
that
they're
excellent,
that
data
they're
just
hoping
they
can
get
enough
out
of
your
network
fast
enough,
that
it
doesn't
make
a
difference.
C
So
another
kind
of
attack
again,
which
we've
seen
since
this
building
document
Soudan
document
thumb,
is
pervasive
and
passive
they're
just
watching
they,
for
whatever
the
day
is,
and
it
could
be
your
competition,
it
could
be
national
scale,
it
could
be
government,
it
could
be
agents
trying
to
disrupt
government
functions
but
they're
doing
pervasive
Margaret
watching
everything
within
an
area
a
domain.
It
could
be
a
particular
bgp
cluster.
C
It
could
be
entire
internet
depending
on
how
much
money
they
have
to
throw
at
it
and
it's
collecting,
if
not
there,
if
not
just
the
content
or
not
the
content,
but
the
metadata.
For
example,
a
my
company
uses.
We
use
signal
for
inter
messaging
right
and
if
they
want
to
take
out
all
the
arca.
My
people
here
don't
care
what
the
message
is
and
what
restaurant
were
going
to
tonight
at
seven
o'clock
for
dinner.
C
Right
they'll
just
know
that
they
can
track
all
the
communications
and
figure
out
who
all
the
people
are
in
target
them,
free,
the
further
surveillance
or
physical
harm
or
whatever
it
is.
So
when
people
say
it's
just
metadata,
it's
not.
It
reveals
a
surprising
amount
of
information
about
the
people
being
observed
and
that's
something
we
really
have
to
consider
when
you're
writing
considerations,
no,
not
just
the
content
of
the
messages,
but
message
headers.
If
you
will.
B
And
so
this
is
somewhat
covered
in
the
current
draft,
but
we
really
want
to
have
change
the
conversation
about
what
a
passive
attacker
versus
an
active
attacker
is
right.
So
you
know,
under
the
generalized
threat
model
here
right,
passive
attackers
can
see
everything
exchanged
outside
of
your
defined
border,
so
I
kind
of
want
to
re-emphasize
that
it's
really
important
when
we
do
a
security
review
to
understand
what
the
boundary
is
between
what
you
consider
inbounds
and
out
of
bounds.
B
Now
the
security
Directorate
when
doing
review,
may
disagree
with
your
assessment
of
what
your
border
is
because
I
know
that
I've
complained
about
that.
But
at
least
then
we
can
be
talking
about
the
same
thing
as
to
where
the,
where
the
lines
are
right.
So
if
it's
a
you
know
pervasive,
they
can
build
a
comprehensive
behavioral
model
doing
passive
and
then
also,
if
you
have
a
you,
know,
really
good
passive,
then
things
like
you
know,
offline
attacks.
So
you
know
how
long
does
your
crypto
key
last
before
you
cycle
it
for
a
passive
attacker?
B
You
assume
that
they
have
infinite
compute
resources
or
some
version
of
that
offline,
and
they
can
do
an
offline
attack
right.
Active
attackers
can
inject
packets
into
the
network.
So
that
means
that
any
packet
you
send
between
you
and
what
other
endpoint
you're
you're
communicating
with
they
can
inject
another
packet
with
that
they
can
edit
the
packet
that
you've
sent
all
of
those
kinds
of
the
tax
right.
So
you
know
this
is
this:
this
differentiation
doesn't
necessarily
quite
cover
things
like
denial
service,
but
it's
important
to
understand
what
those
two
differences
on.
C
So
security
considerations,
the
impacts
you
want
to
make
it
clear
as
much
as
possible.
You
know
what
it
is
you
are
claiming
to
protect
or
what
it
is.
You
are
worried
about
actually
and
what
it
is
you're
not
worried
about
so
say,
for
example,
now
we
are
not
worried
about
passive
surveillance
of
every
packet
on
the
network.
Well,
that
probably
wouldn't
fly
anymore,
but
saying
we're
not
worried
about
correlating
messages
from
a
cell
phone
to
at
home
versus
a
cell
phone
at
work.
Well,
it's
got
the
same
caller
number
anyway.
C
So
that's
probably
okay,
so
you
want
to
make
sure
that
the
security
reviewer
and/or
reviewers
because
they'll
be
at
least
two.
They
understand
your
document,
what
it
is
you're
trying
to
draw
as
your
security
perimeter
what's
inside
that
counts
and
it
is
being
protected
and
then,
where
this
perimeter
is
going
to
sit
if
it's
on
the
general
internet,
that's
one
thing:
if
it's
only
intended
to
run
behind
the
enterprise
or
something
else
protected
by
carrier-grade
NAT,
that
might
be
slightly
different,
develop
the
attack
scenario
early
on
at
the
beginning.
C
What
are
the
things
you're
trying
to
prevent?
What
are
the
things
you
think
attackers
can
build?
Then
I'll
put
a
plug
in
for
the
certificate.
Transparency
has
a
security
architecture
document.
It
goes
really
into
great
detail
describing
all
of
the
parties
in
the
protocol
and
what
happens
if
this
one
goes
rogue
or
that
one
goes
rogue
and
what
the
after-effects
are
now
that
grew
until
whole,
separate
RFC
and
I.
C
Don't
think
most
documents
need
that,
but
understanding
who
the
parties
are
on
the
in
the
communications
and
what
happens
if
somebody
is
corrupted
spied
on
or
otherwise
led
down
the
wrong
path.
I
guess
also
know
also
it's
good
to
know
what
doesn't
apply.
Okay,
you
can
say,
for
example,
oh,
we
are
only
using
TLS,
13
or
message
exchange,
and
then
you
don't
have
to
worry
about
the
whole
crypto
stuff
right.
You
just
do
it
by
indirection.
B
Alright,
so
so
these
are
the
set
of
things
that
we're
actually
going
to
cover
as
we
kind
of
go
through
this
update.
So
this
may
not
hit
some
concern
you
have.
If
you
want,
you
can
come
complain
to
me
afterwards.
You
can
blame
all
this
part
on
me,
but
we're
going
to
kind
of
go
over
communication
security.
So
that's
going
to
be
some
amount
of
passive,
but
data
collection,
soft
middle
networks.
B
So
the
kind
of
the
design
point
of
someone
breaks
into
your
perimeter
device
and
then
once
they're
that
far
it's
kind
of
game
on
DNS
and
its
role
in
security
overall
and
then
Internet
of
Things.
And
if
we
have
time
I'll
talk
a
little
bit
about
fishing
only
because
it
still
works
and
it's
fun
to
talk
about.
B
Ok,
so
communication
security,
so
passive
attacks
collect
huge
amounts
of
information.
I
think
everybody
in
the
room
should
be
pretty
familiar
with
that,
and
some
of
the
reasons
why
this
effective
right,
because
Pete
humans
are
very
much
creatures
of
habit,
I
can
bet
the
vast
majority
of
you
get
into
the
office
every
day.
Pull
up
your
computer.
Maybe
you
check
your
email
first
thing.
B
Maybe
you
check
a
couple
of
websites,
the
first
thing,
but
you
probably
check
the
same
websites,
the
first
thing
when
you
come
in
and
you
probably
do
a
specific
affair,
lee
common
order
between
going
your
email
or
your
web.
We
don't
need
to
know
what
the
address
you
know.
We
don't
need
to
know
necessarily
what
the
content
of
what
you're
going
to
look
at
is
to
know
that
you
came
into
the
office.
B
We
just
need
to
know
that
you
go
look
at
these
specific
sites
in
order
every
morning
to
know
that
you're
there
and
that's
the
metadata
problem,
because
humans
are
creatures
of
habit.
You
leaked
that
information.
Just
at
the
metadata
level,
just
by
knowing
IP
addresses
in
succession
we
can.
We
can
get
that
right.
So,
that's
you
know
the
metadata
level
of
what's
leaking
out
of
the
network.
That's
going
to
tell
us
a
lot
of
information.
B
That's
part
of
that
metadata
right,
so
we
can
really
enhance
metadata
analysis
with
just
some
really
minimal
packet
inspection
and
a
little
bit
more
active
material.
So
I
could
do
everything
I
described
just
a
moment
ago,
just
with
IP
addresses
and
port
numbers.
If
I
add
a
little
bit
of
information
to
say,
look
at
what's
inside
the
packets,
I
can
get
a
lot
more
information,
then
right
just
just
banner
grabbing
of
the
protocols.
I'll
learn
a
whole
lot
more
about.
So
these
are
things
from
a
passive
collection.
You
really
and
information.
B
It
gets
even
better
from
a
passive
observation
point
of
view
that
if
there
are
active
middle
boxes
in
there,
so
if
you
have
an
active
middle
box
in
the
path
and
I
can
control
some
other
point
in
the
network.
I
can
make
sure
that
the
active
middle
box,
which
may
be
doing
behavioral
changes
to
the
to
the
communication,
such
as
minimizing
graphics
and
that
kind
of
stuff,
by
understanding
what
kind
of
operating
system
and
host
you
have
in
your
hand
along
the
way.
B
So
if
it
knows
that
you
have
an
Android
device
on
a
limited
connection,
link
and
the
middle
box
is
going
to
change
what
it
asks
for
along
the
way.
I
can
use
that
information
from
a
passive
point
of
view
to
understand
what
target
operating
system
and
screen
size
and
all
of
that
kind
of
stuff
from
your
device
along
the
way.
So
the
middle
boxes
are
going
to
potentially
leak
information
about
your
connection
as
well.
A
C
The
ITF
right,
obviously
they
do
things
that
many
people
find
useful
and
many
people
have
bought
and
like
many
of
them
are,
they
have
also
led
to
and
ossification
in
many
people's
minds
and
so
we're
looking
at
things
like
quick.
This
major
new
effort,
which
is
it
would
be
designing
a
whole
new
transport,
except
that
we
have
to
tunnel
it
inside
UDP
right
so
well.
C
C
This
chart
oops,
they
jump
yeah
I,
don't
think,
there's
anything
here,
just
to
emphasize
anything
new
from
what
we
just
said.
The
last
two
bullets
minimizing
the
clear
information
exchange.
Obviously
some
of
that
has
to
be
in
the
clear
for
network
routing
Chris
mentioned
you
know:
source
destination,
IP
import
right,
knee
that
52
portable
to
get
package
from
here
to
there,
but
everything
else
you
should
try
to
encrypt
as
much
as
possible.
Pls
13
is
looking
and
encrypting
most
of
the
initial
exchanges,
not
all
of
it.
C
Unfortunately,
quick
is
looking
at
also
encrypting
it,
and
then
there
are
people
who
come
in
from
the
hardware
community
who
say
well,
I
need
or
the
mobile
operators
who
say
I
need
to
see
what
some
of
this
stuff
is.
So
I
can
shape
the
traffic's
to
minimize
the
resource
consumption
on
my
networks
or
on
my
devices
right,
and
so,
if
you're
going
to
disable
how
to
prevent
that,
you
need
to
have
a
good
story
and
explain
what
the
trade-offs
are
ya.
C
If
you
can
make
anything
through
the
side,
channel,
people
will
find
it
and
it'll
show
up
in
WikiLeaks
sure
soft
middle
networks.
This
is
the
the
malamar
of
networks
right.
It's
got
this
hard
crispy
shell,
on
the
outside
and
inside
it's
just
all
soft
and
gooey
and
tasty.
There
was
a
I
forget
who
are
comic
was,
but
he
had
like
there's
a
polar
bear,
he's
reaching
down
inside
an
igloo
and
go
boy.
Once
you
get
past
the
shell,
these
guys
are
delicious,
and
so
that's
a
problem
right.
C
People
put
a
lot
of
strength
or
a
lot
of
resources
and
both
financial
and
computing
I'm
protecting
the
perimeter,
and
they
don't
worry
about
as
much
about
protecting
the
inside
what
happens
I.
You
know
typical
examples
on
the
financial
community.
You
know
the
night
cleaning
staff
comes
in
and
plugs
in
a
laptop
right
or
you
look
at
what
mr.
robot
or
some
of
these
other
shows
right.
You
just
plug
in
this
USB
stick
on
the
net.
You
know
you're
good,
to
go
on
because
you've
got
nothing
partitioned
internally.
B
Yeah,
so
so
just
kind
of
keep
going
with
that
right
I
mean
the
the
problem.
There
is,
if
you
can
get
on
to
that
outer
perimeter.
Those
outer
perimeter
defenses
you're
good.
Once
you
have
that
toehold
in
the
network,
you
can
move
laterally
laterally
through
that
network
to
get
to
almost
any
resource.
B
You
want
to
right,
and
that's
that's
really
the
big
problem,
and
so,
if
you
have
your
all
of
your
authorization
systems,
all
of
those
domains,
kind
of
tied
together
and
easily
accessible
under
that
same
that
same
kind
of
soft
middle,
then
you're
really
going
to
lose.
That's
really.
The
kind
of
the
game
over
they'll
have
complete
access
to
to
everything
right
and
that's
understanding
the
trust
relationships
that
you've
built
inside
that
network
and
to
go
ahead.
The
next
slide
yeah
so.
B
To
keep
going
so
right,
so
in
your
in
your
security
considerations,
section
if
you're
making
assumptions
that
that's
not
the
case
or
what
the
case
is,
what
the
trust
relationships
necessary
for
your
authorization
model,
your
authentication
model.
No,
it
stated
right.
It
makes
it
a
lot
easier
to
understand.
It
may
not
need
to
go
into
every
draft,
but
make
sure
you
understand
what
the
attack
model
is
and
how
you
were
authenticated
and
securing
your
your
model
right,
I'm.
B
You
know
if
you're,
if
you're
planning
something
that
uses
an
enterprise
security
system
which
is
going
to
have
you
know,
kind
of
a
larger
authentication
system,
or
if
this
is
designed
for
something
for
home,
where
it's
going
to
be
a
lot
lighter
right
and
to
that
extent
you
want
to
employ
at
least
privilege
into
your
design
as
much
as
possible.
So
if
something
doesn't
have
to
have
kind
of
the
full
privilege
in
various
layers
of
your
protocol,
your
stack,
then
they
don't
need
to
have
kind
of
the
full
access
yeah.
C
Just
one
on
the
first
bullet,
so
we
often
talk
about
how
the
IETF
doesn't
really
do,
authentication
and
authorization
right.
It
just
wants
to
get
the
bites
from
here
to
there,
whatever
long,
whatever
path
and
as
quickly
as
possible,
but
there
are
facilities,
components
they
do
care
and
they
do
integrate
bring
into
the
model.
C
Third-Party
agents
such
as
you
know,
WebRTC
as
a
rendezvous
point
tran
term
stun,
whatever
they
are,
they
all
have
the
concept
of
an
introducer,
and
so,
if
you're
doing
something
like
that
certificate,
transparency
has
the
logs
and
then
a
lot
of
monitors,
who
you
know
a
watch,
the
Watchers.
So
if
you're
building
one
of
these
kinds
of
protocols,
keep
in
mind
that
there
are
multiple
parties.
B
H
C
The
first
one
is
sort
of
easier:
don't
leave
your
honor.
Have
you
restate
your
second
question,
but
soft
middle,
because
you've
got
a
very
hard
exterior
and
a
perimeter
to
keep
it
all
the
attackers
outside.
But
if
an
attacker
gets
in
it's
game
over
right
and
we've
seen
that
with
officer
Office
of
Management
and
Budget
it
we
saw
it
with
our
essay
for
people
who
know
they've
got
past
some
of
the
border
guards
and
we're
able
to
just
sit
there
for
weeks
or
months,
collecting
data
and
excavation.
C
So
that's
the
idea
that
if
you
drew
a
series
of
concentric
circles-
and
maybe
they
have
a
core
set
of
trusting
machines
in
the
enterprise
that
they,
your
authentication
authorization
and
you've,
got
the
workstations
on
everybody's
desk
and
then
you've
got
the
DMZ
protecting
everybody.
That
layer
in
the
middle
is
the
soft
and
crunchy.
H
B
No
popular
it
is,
we
certainly
talk
about
it.
When
we
go
do
kind
of
incident
response
a
lot
and
say
you
know
you
know
getting
a
little
off-topic,
but
you
know
you
really
should
be
using
more
segmented
design
to
to
segregate
out
different
departments
and
that
kind
of
stuff
with
authorization
domains
within
an
enterprise
network,
and
instead,
what
we
see
here
often
at
enterprises
that
have
been
infiltrated
is
they
have
a
flat
design
on
the
inside
and
everything
is
dependent
on
being
able
to
protect
that
that
perimeter.
We
call
that
the
soft
middle.
D
D
Was
pretty
much
in
the
beginning?
Sorry
for
jumping
back
there's
one
point
about
active
attacks:
I
think
might
be
good
to
to
highlight
and
to
raise
awareness
about,
and
that
is
mix
and
match
attax
and
delay
attacks
and
message
reordering
effects,
because
in
IOT
networks
this
can
be
very,
very
disasterous
when
the
attacker
just
switches
to
legitimate
packets
or
delays
that
a
big
G,
timid,
packets
and
send
it
sends
it
later.
And
things
like
that.
I
Javonni
SI
bien
just
a
small
comment
when
you're
talking
about
before
metadata
I
think
me:
well,
maybe
one
idea
we
could
follow
it
to
just
simply
follow
bush
and
I
our
terminology
metadata
is
data
simple,
get
across
all
the
nobody
has
any
doubt
anymore.
What
you're
talking
about
so
I
think
you're,
more
explicit
about
it,
would
make
it
easier
for
people
finished
in
metadata.
Is
data
okay,.
C
E
I
think
the
Oghma
I
think
a
useful
definition
for
the
difference
is
that
that
the
data
is
the
stuff
that
I
really
want
to
send
and
metadata
is
the
stuff
that
I
don't
really
want
to
send.
But
the
network
needs
a
network
or
the
application
needs
to
send
just
to
get
my
data
across.
So
it's
like
the
content
of
my
email
and
then
all
that
bunch
of
headers
I,
don't
care
about
the
bunch
of
headers,
but
email
won't
work
without
the
bunch
of
headers,
so
the
bunch
of
headers
is
metadata.
It's
good
put
vs.
E
Yeah
and
that's
obviously
wrong
yeah
so
about
the
soft
middle
and
think
the
reason
for
that,
for
that
is
the
usually
a
security
team
and
the
networking
team
and
the
networking
team
want
to
be
free
to
do
whatever
they
want
to
deploy.
Whatever
way
they
want.
They
don't
want
the
security
team
10
and
no
you
can
you
have
two
segments
here.
You
have
to
put
a
firewall
here.
E
The
security
team
can
get
all
the
perimeter
they
can
put
as
much
firewalls
and
ideas
and
proxies
and
whatever
they
want
on
the
perimeter,
because
that
doesn't
bother
the
networking
people,
but
networking
people
don't
want
them
to
interfere
and
I.
Don't
have
any
idea
how
the
ITF
and
have
any
influence
on
that
political,
internal
problem
that
lots
of
enterprises
have
yeah.
J
B
C
Ok,
so
a
couple
words
about
DNS
its
rendezvous
protocol
I
want
to
talk
to
dub
dub
dub
IETF,
our
org
and
I
have
to
translate
that
into
an
IP
address,
a
set
of
numbers
for
our
pets
or
thirty,
two
octets
I
mean,
and
it
lets
me
then
communicate
the
name,
translation
that
it
maps
from
human,
mostly
human,
readable
names
right
I
can
still
remember
when
the
first
URL
appeared
on
a
TV
ad
I'm.
So
many
here,
and
so
we
were
all
aware
of
these
kinds
of
names
into
network
endpoints.
C
It
is
a
distributed
database.
Various
people
all
around
the
world
contribute
their
little
part
of
the
knowledge
and
for
the
most
part,
it's
the
communication
between
the
person
asking
the
client
or
the
air
resolver
and
the
authoritative
or
the
recursive
guy
at
the
end
is
providing
the
answer.
There's
no
real
security,
it
just
sort
of
works
because
people
haven't
messed
with
it
too
much,
not
a
great
state
to
be
in
there's
a
lot
of
work
going
on
in
the
DNS
community.
About
this
it
is
like
trying
to
turn
an
aircraft
carrier
right.
C
You
got
to
proceed
very
slowly
and
watch
out.
You
don't
hit
any
rocks,
but
it
because
almost
every
machine,
that's
on
the
Intel,
every
machine
it's
on
the
internet
is
going
to
use
it
and
a
large
portion
of
the
servers
on
there
are
participating
and
it's
plaintiffs,
both
the
protocol
and
the
data
that's
in
there
and
that
can
be
secured
nowadays.
That
can
be
secured
nowadays,
but
isn't
why
to
itself
they're.
B
Battery's
dead
I
just
want
to
touch
a
little
bit
more
on
on
some
of
these
other
records
right,
so
server
records,
and
you
know
how
how
DNS
plays
into
509
certificates
right.
So
server
records
are
great.
You
can
look
up
what
your
LDAP
controller
or
your
ad
is
on
your
local
network.
So
when
you
plug
in
your
your
favorite
computer
to
your
enterprise
network,
it
does
that
request
and
then
after
it
learns
it
memorizes
that
answer
and
when
you
leave
your
enterprise
network
and
go
to
your
favorite
hotel.
It
still
asks
for
that
answer.
B
So,
wherever
you
work,
when
you
walk
into
that
hotel
and
connect
to
its
what
you
know,
it's
public
Wi-Fi
network,
your
machine
is
asking
for
your
ad
name
and
not
the
public
version.
It's
actual
ad
name
in
your
enterprise,
so
DNS
really
has
a
lot
of
information
in
there
and
you're
probably
leaking
information
about
how
your
enterprise
is
configured
every
time
you
leave
the
building
and
the
other
part
about
that
is.
B
We
are,
everybody
should
probably
be
familiar
with.
The
active
attacks
against
DNS
I
mean
cache.
Poisoning
always
gets
a
lot
of
play
whenever
it
happens.
We
know
about
the
Kaminski
attack,
which
you,
the
linchpin
of
security,
to
DNS.
Requests
in
the
response
is
the
randomized
request
number,
and
if
you
can
intercept
that
you
can
you
can
give
back
any
answer
you
want
by
injecting
a
packet
with
whatever
response
you
want
before
the
the
actual
dns
server
does
right.
So
that's
pretty
much
a
race
condition.
It's
built
into
the
protocol,
that's
how
the
protocol
works.
B
So
that's
that's
one
big
problem
with
DNS.
That
said,
we
have
some.
We
have
some
drafts.
We
well
they're,
not
even
drafts
right.
We
have
some
some
RFC's
on
doing
DNS
over
pls
we
have
DNS
SEC,
which
signs
the
DNS
responses,
which
means
that
you
can
check
to
see.
If
the
response
is
really
the
correct
response,
we
need
those
to
be
more
deployed
than
they
are
today,
all
right
so
dropping
below
that
set.
We
have
passive
observation
right.
B
So,
as
we
just
kind
of
mentioned,
the
vast
majority
of
DNS
really
happens
in
the
in
the
clear
text.
You
know
just
by
observing
something
like
someone
going
to
read:
amazon
com.
You
can
tell
that
they're
reading
their
Kindle
books,
so
you
know
a
little
bit
more
about
who
who
the
user
is
and
some
of
the
services
they
use.
B
If
you
want
to
know
what
antivirus
somebody
an
enterprise
is
using,
if
you
can
see
its
dns,
just
wait
for
the
lookups
that
tell
you
what
antivirus
vendor
it
looks
up
on
a
semi-regular
basis,
and
now
you
know
what
signature
set
to
test
your
exploit
against.
If
we
go
the
whole
way
back
to
the
kill
chain,
so
observing
DNS
really
tells
you
a
lot
of
information.
C
So,
as
a
result,
you
know
when
you're
using
DNS
in
your
protocol
is
most
of
them.
Do
you
have
to
understand?
You
know
what
the
how
Pat
compact
the
sand
is,
that
you're
building
your
foundation
up
right,
so
security
considerations,
subject
to
all
the
weaknesses
of
DNS.
Now,
if
you're
using
TLS
and
go
certificate
that
you
can
in
max
that
name
against
what
you
thought,
the
name
was
that
you're
connecting
to
that
will
work.
That's
the
Toyota
tight
if
you've
got
a
range
opportunity
to
have
pre-shared
keys
or
passwords
across.
C
So
if
you're
doing
you
know
a
simply
very
simple
password
protocol,
you
don't
want
to
send
the
password
to
the
server
because
you'll
know
where
you
identifying
the
server.
You
want
to
serve
this
under
your
challenge
and
then
you
can
do
something
of
that
or
or
keep
it
stored.
You
know
in
the
hash,
DNS
SEC
with
a
validating
client.
There
are
a
few.
There
are
many
true
believers
about
DNS
SEC.
It's
going
to
come
deployed
any
day.
Now
there
is
a
DNS
over
TLS.
C
There
is
also
folks
are
looking
at
how
to
get
privacy
privacy
for
DNS.
If
I
know
the
name,
I
know
what
you're
doing
in
many
cases
and
in
some
cases
it
may
not
matter
in
most
of
the
I
think
the
most
of
the
people
who
come
to
IETF
meetings,
their
governments
don't
care
too
much.
But
there
are
government's
where,
if
you
went
to
a
great
deal
of
website,
you
could
be
in
trouble.
If
you
went
to
you
know
an
age
research
site
in
Kenya
or
something.
C
I
don't
mean
any
cultural,
biases,
I'm,
just
picking
out
places
were
or
homosexuality
in
Singapore,
where
we're
going
to
meet
next
time.
So
there
are
places
where
just
knowing
what
somebody
is
doing
is
risky
to
that
person,
and
therefore
you
want
to
make
sure
that
you
don't
add
to
the
risk
of
the
end
users.
Okay,
so
understand
the
information
leakage
understand
the
risks
and
the
trust
relationship.
Most
people
with
the
home
network
are
captive
to
their
ISPs
DNS.
C
For
a
long
time,
it
used
to
be
a
fad
that,
if
you
type
the
bogus
address
in
the
browser
bar,
you
get
an
ad
from
your
isp
godaddy
this
domain
for
sale,
because
what
they
did
is
they
said.
Oh
this
name
doesn't
exist.
I'll
send
you
over
to
here
are
my
captive
ad
server,
so
understanding
who
the
parties
are
and
who
is
controlled
by
him
or
whose
worldview
is
controlled
by
who
is
another
consideration?
Keep
involved
I.
I
Just
went
on
and
on
Guinness
javonni's
idea,
yeah
I'm
just
worried
about
as
well
did
those
attacks
on
the
DNS
because
they
make
a
perfect
target.
We
have
seen
if
you
take
down
Guinness
providers
like
the
classic
dine
tech,
Twitter
Netflix
all
had
problems
too
so
I
know
you
guys
didn't
talk
before
about
D
does.
But
it's
a
problem
like
ENS
is
a
perfect
place
for
do
those.
Yes,
so.
B
If
that's
a
pretty
interesting
one
and
considering
I
mean
most
of
the
protections
that
can
reasonably
be
taken
and
you
look
kind
of
dying,
you
know
they
were
pretty
well
armored
to
an
attack
like
that.
Yet
it
still
succeeded
right
and
in
DNS
is
the
lynches,
the
rendezvous
protocol
that
ties
these
things
together
and
so
we'll
touch
on
that,
if
I
actually
make
it
through
the
Internet
of
Things
talk
about
like
please
stop
putting
bad
influence
on
the
net
yeah
sure
it
never.
B
J
A
side
note:
when
you
see
layers
what
you
dos
attacks
could
be
targeted.
It
can
be
a
bandwidth,
it
could
be
an
application
layer
right,
but
it
also
can
be,
of
course,
tcp/ip
stack
and
point
tcp/ip
stack,
but
last
but
not
least,
the
infrastructure,
all
the
SICU
penza
forwards
and
process
the
packets,
because
you
can
also
be
attacked
its.
J
It
is
frequently
attacked
if
you're
any
network
it
can
bring
your
you
have
a
doubt
competing
like
all
the
routers,
essentially
so
even
in
payless
layer
will
fall
apart,
but
as
in
all
competitions
of
armor
vs
sabbath
charge.
It's
always
attackers
go
where
it's
softer
right
now,
we're
well
fortified
on
application,
layer
and
badly
spice
reasonably
well,
but
I
expect
that
tax
on
infrastructure
will
rise
in
numbers
in
next
decade
dramatically.
So
it's
important
to
consider
how
we
protect
infrastructure.
B
Ok,
but
so
I'm,
yet
so
I'm
going
to
caveat
the.
Neither
one
of
us
are,
you
know,
routing
experts,
so
you
know
you
can
sump
the
chump
at
the
mic
right
now,
but
so
here's
another
piece
of
you
know
kind
of
routing
right
so
that
the
basic
version
you
know
we,
you
know
autonomous
systems,
advertise
their
little
slice
of
heaven
to
the
world
via
bgp
right,
and
so
you
know
it
takes
that
prefix.
It
goes
upstream
in
the
current
version
of
the
world
right.
B
The
real
thing
here
is:
we
have
a
bunch
of
reasonably
good
recommendations
and
best
practices
about
how
to
deal
with
routing
and
routing
filtering
and
that
isn't
even
getting
into
some
of
the
some
of
the
other
parts,
but
from
a
security
research
point
of
view,
we
would
really
appreciate
if
folks
would
actually
start.
You
know
executing
some
of
the
guidance
a
little
bit
more
go
to
the
next
slide
yeah.
So
so
just
a
handful
of
fun
routing
events
that
you
know
kind
of
related
to.
B
B
China
telecom
sends
out
37,000
prefixes
in
15
minutes
hijacking
large
parts
of
the
internet
through
China.
The
spectacular
point
about
that
one
is
if,
in
china
telecom's
case,
they
actually
have
the
bandwidth
to
absorb
the
onslaught
that
came
from
advertising
all
of
those
and
routed
it
back
out
successfully.
B
So
China
Telecom
actually
absorbed
it
sent
it
back
out.
People
did
notice,
but
in
that
15
minutes
china
telecom
actually
rerouted
the
internet
through
China
and
back
out
without
losing
data
more
or
less
and
now
for
the
parts
of
please
filter
your
the
advertisements,
because
it's
actually
malicious
is
in
February
2009-14
2014,
Canadian
ISP
was
a
hack
and
it
was
used
to
redirect
traffic
from
ISPs
selectively
in
generally,
in
short
segments
of
like
30
seconds.
It
was
used
to
do
that
to
interrupt
Bitcoin
in
Bitcoin
mining.
B
B
So
I
mean
this
stuff
really
does
happen.
There's
some
comprehensive
databases
out
there.
I
don't
really
put
it
in
here,
but
you
know
route
views
which
does
some
pretty
comprehensive
capturing
of
BGP.
Unfortunately,
that's
going
to
be
able
to
let
you
look
back
and
see
after
the
fact
what
happened
so
we'll
be
able
to
understand
the
attacks
and
that
kind
of
stuff
does
nothing
about
preventing
them
now
right
and
so
what
can
we
do
to
prevent
them?
Now?
We
can
do
a
lot
better
in
filtering
bgp
sec.
It's
a
hard
adoption
problem.
J
Can
also
do
moniteur
roads
globally
and
find
all
the
route
leaks
and
close
to
real
time.
Critics
from
right
CC
do
exactly
that.
Well,
we
also
do
that
and
I
believe
this
university
research
team,
with
hazel
area
at
atalia,
also
does
very
interesting
research
in
terms
of
detection
in
next
real
time.
Yes,.
B
So
I
can
comment.
So
one
of
the
other
events
that
I
didn't
put
in
here
was
a
leak
I
think
out
of
Brazil
and
if
I'm
incorrectly
implicating
somebody
I
apologized
already
we're
ripe
detected
it
within
you
know
a
minute
or
two
and
that
attack
with
that
was
an
attack.
That
was
a
Miss
configuration
and
that
was
you
know,
stopped
after
maybe
two
minutes
of
activity
where
the
right
monitoring
really
found
it
in
kind
of,
and
and
did
that.
B
You
shouldn't
assume
the
path
the
pack
it
takes
is
reproducible
right,
because
any
kind
of
vgp
advertisement
may,
potentially
you
know
kind
of
you
know,
perturb
those
routing
paths,
such
they're
not
going
to
show
up
again
likely
in
your
lifetime.
So
anytime.
You
think
that
you
can
trace
route
backwards
and
know
how
a
packet
got
to
you,
and
you
know
where
that
attacker
is
yeah.
Stop
thinking
that
way,
that
didn't
likely.
B
The
other
part
about
this
is
you
know,
understanding
that
that
your
network
connectivity,
even
though
a
packet
may
go
from
the
endpoint
you
you
have
to
the
endpoint
you
want
to
go
to
it,
may
be
going
through
places.
You
don't
want
or
don't
think
it's
going
through
based
on
rattling
attacks,
and
you
may
not
be
able
to
see
that
in
asymmetric
cases.
B
J
Would
be
one
beautiful
illustration
how
things
might
get
one
with
BGP,
for
example,
certificate
authorities
for
TLS
the
exercise,
one
particular
never
throughout
each
cake,
you
as
a
person
or
its
business,
which
can
be
exploited
using
vgp,
so
you
can
get
yourself
a
perfectly
valid
certificate
and
the
user
two
men
in
the
middle
so
exact
case
when
people
were
relying
on
something
they
would
sink,
is
fundamental.
It's
secure.
But
in
fact
it's
not.
B
That
that's
amazingly
bad
practice
to
do
that
version.
You
want
this
one:
okay,
so
Internet
of
Things.
So
this
is
just
my
plea
out
there
for
anybody:
who's
building
a
really
small
device
and
putting
it
on
the
Internet
to
control
whatever
you
know,
please
take
out
all
of
the
awfulness.
That
is
these
little
random
things
on
there
that
create
things
like
the
muri
botnet.
G
B
Don't
put
a
backdoor
in
there
that
can't
be
turned
off,
get
rid
of
the
default
passwords
that
are
the
same
across
all
the
devices.
Please
update
your
OS
image
on
some
kind
of
reasonably
regular
basis
when
you
build
your
device,
you
know
please
secure
your
software
updates
and
make
the
device
software
updateable
please
actually
use
crypto.
B
There's
you
know
really
kind
of
two
possible
differentiators
on
Internet
of
Things
devices,
but
far
as
I'm
concerned
from
a
security
point
of
view
right
they
may
have
a
lot
less
computational
power
and
potentially
their
cyber
physical.
So
maybe
this
device
that's
on
the
internet,
actually
can
open
a
door
or
window
or
turn
a
light
on
or
off
you
know.
Maybe
you
can
unlock
your
house,
that's
another
security
issue
and
in
and
of
itself,
but
fundamentally
when
I
look
at
it.
I
want
strong
endpoint
security
in
general.
C
Yeah,
just
just
before
we
get
to
this,
the
thing
I
find
interesting
about
IOT
is
or
any
as
I've
seen,
discussions
about
any
particular
crypto
algorithm
or
a
particular.
You
know
certificate
data
format
or
whatever
it
is.
Somebody
will
come
up
with
a
use
case
in
a
part
number
where
this
piece
is
too
small
to
do
that,
like
all
I
can
handle
is
you
know,
rot13
shift
everything
over
half
and
my
part
only
costs
ten
cents
on
a
camera
that
I'm
only
selling
for
nineteen
dollars.
So
the
economics
really
make
themselves
visible.
C
Criteria
are
also
being
used
in
things
like
cars
right,
we're
starting
to
see
cars
get
over
the
over
the
air,
software
updates
or
vehicle
to
vehicle
communication
is
working
with
here,
mostly
cost
a
lot
more
than
$19
US
dollars
right
whatever
and
have
all
more
than
a
10-cent
part
doing
all
of
the
crypto
work
in
there,
but
they
seem
to
come
from
the
same
mindset
of
people
and
while
a
bad
guy
being
able
to
flip
my
lights
on
it
off
as
annoying
a
bad
guy
being
able
to
cause.
B
C
B
B
Down
the
highway
yeah,
so
one
of
the
other
things
we
really
kind
of
see
as
a
and
this
is
I,
don't
have
a
good
answer
for
you
right,
which
is
kind
of
asymmetric
protocols.
They're
spectacular
for
denial
of
service,
if
I
can
send
a
small
request
to
to
a
service
and
the
response
really
out
sizes
that
that
small
request
and
I
can
point
that
response
at
something
else.
Then
I've
really
amplified
my
ability
to
to
kind
of
do
that
right.
So
no,
oh,
no
he's
telling
me
I
can't
do
it!
That's.
B
Resident
but
that's
exactly
where
I'm
going
right,
which
is
if,
if
you
really
have
the
need
of
building
that
kind
of
asymmetric
protocol,
really
we
want,
we
want
the
authentication.
We
want
the
strength
in
there.
That
makes
it
so
that
you
can't
send
that
response
to
a
spoofed
location
right,
so
don't
create
this
kind
of
amplification
ability
for
folks
right.
C
You
would
be
where
zero
round
trip
in
TLS
13,
because
the
TLS
handshake
is
asymmetric
right.
The
client
connects
the
surest
to
do
some
work,
and
now
you
can
do
in
essence,
UDP
style
attacks
at
the
TCP
level,
where
you
don't
care.
If
the
server
gets
back
to
you,
you
just
want
to
bring
them
down,
and
so
that's
an
issue.
J
So
you
said
about
unit
economics
for
IOT
right
and
there
is
just
no
place
for
good
engineering,
but
there
is
a
good
consideration
in
case
of
when
you
compare
it
to
the
car,
so
I
did
really
an
expensive
car
and
the
eunuch
economics
aren't
great,
so
I
have
no
brakes
and
they
take
it
to
the
public
roads.
But
pardon
me
this
is
my
unit
economics.
Should
we
allow
these
cars
on
public
roads
that.
C
So
we
do
see
that
happening
right
now
with
tractors
in
the
Midwest
of
the
u.s.
right,
because
right
there
downloading
an
illegal
firmware
from
the
Ukraine,
because
John
Deere
will
let
them
operate
it.
It's
economics
are
starting
to
really
make
their
presence
known
in
designing
security
stuff.
That's
it
they're
really
interested
is
either
really
interesting
or
cool,
or
it's
just
another
source
of
frustration.
J
B
And
so
just
kind
of
a
quick
comment
on
some
of
the
work
that's
already
going
on
that
they
had
there's
probably
other
working
groups
who
are
tackling
some
part
of
this
or
have
some
interest
in
in
these
topics.
You
know
kind
of
related
to
to
you
know
Internet
of
Things.
What
does
it
mean
to
have
kind
of
a
safe
home
network,
a
safe
small
device?
What's
a
low-power?
How
do
I
do
small
object,
our
small
signing
of
data
so
that
I
can
get
it
to
a
limited,
compute
limited
device?
B
So
there's
a
bunch
of
work
on
there
and
there's
a
lot
of
guidance.
Go
look
at
this
draft
which
I
think
is
either
expiring
or
expired,
but
it's
got
a
group
at
unev
references
of
places
to
go,
get
some
more
guidance
on
on
I'm
like
a
lot
of
these
topics.
I
just
want
to
end
for
all
the
time.
We
have
five
more
minutes
right.
Okay,
all
right.
What
not
to
do
right,
don't
invent
a
new
security
mechanism
unless
you
really
really
have
to
and
then
please
don't
do
go
invent
the
security.
B
A
new
security
bank
is,
you
know,
I'm
all
for
kind
of
the
work
on
pls
and
doing
those
updates,
and
we
should
leverage
the
places
where
we're
building
those
kind
of
secure
components
and
leverage
those
as
much
as
off
as
possible
in
inventing
secure
mechanisms
everywhere
is
a
real
problem
right
and
don't
redefine
security
terms
for
something
else
in
your
draft.
It
drives
at
least
this
person
who's
reviewed
documents,
absolutely
crazy
when
you
decided
that
you're
going
to
have
a
nonce
and
it's
not
a
nonce
things
like
that,
yeah
don't
do
that.
No.
C
So
I'll
be
the
problem
with
the
optimist.
So
what
to
do?
C
The
crypto
forum
is
a
working
group
within
the
IRT
f.c
FRG
a
tight
if
the
door,
for
example,
are
led
by
Alexei
Melnikov
and
Kenny
catterson
Kenny,
that
famous
for
breaking
TLS
over
and
over
and
over
and
over
again
they
will
help,
and
the
first
thing,
if
you
do,
is
you
come
and
say:
look
I
got
this
great,
no
Krypto
algorithm
they'll
tell
you
to
go
away
I
reasonably,
so
the
second
bullet
is
actually
the
one
of
the
most
useful
ones
make
the
crypto
upgradable,
don't
bake
in
a
crypto.
C
You
know
everything
is
done
like
DNS
SEC
does
this
right.
They
picked
one
algorithm
in
one
key
size,
and
so
it
was
a
lot
of
work
to
change
the
keys
use
identifier.
There
are
various
registries
in
the
TLS
work
in
the
elliptic
curve
group
that
Daniel
and
I
co-chair.
They
have
0
IDs
for
things
so
just
making
it
easy
to
roll
stuff
out,
because,
if
you're
successful,
your
protocol
will
exist
for
a
decade
and
three
years
into
it,
somebody
will
find
a
way
to
crack
the
crypto
that
you're
using
ok
think
about
security
early.
C
They
get
into
the
design
think
about
who
the
parties
are
go
to
communicating
what
kind
of
protections
you
want
to
have,
or
you
would
like
to
have,
but
can't
see
a
way
to
solve
right
now,
even
just
putting
down
the
unanswered
questions
early
on
on
the
draft
will
help
and
people
will
volunteer
to
help
you
to
get
that
stuff
out
understand
what
the
boundary
is.
Are
you
working
on
somebody's
laptop?
You
work
in
some
the
stateless
Chromebook,
where
everything
is
often
the
cloud.
C
Are
you
working
in
an
enterprise,
bhai,
aur,
baat,
home
network,
behind
a
nap
and
so
on?
Unleveraged
the
existing
standard
security
track
mechanisms?
I,
don't
know
what
the
question
is,
but
the
answer
is
almost
always
going
to
be
TLS
and
ask
for
help
either
in
the
group
you're
in
or
speak
to
the
security
area
directors
or
send
a
note
to
sag
SI
AG,
which
one
catch
sort
of
the
overall
security
area
group
in
the
ITF.
B
One
minute,
one
minute
so:
fishing
yeah
not
really
a
security
consideration
thing,
but
because
it
still
works,
I
think
if
you
pay
any
attention
to
the
news,
especially
in
the
US,
where
we've
managed
to
fish
the
election.
Yet
clearly,
fishing
still
works.
Please
don't
click
on
the
link
in
your
email.
Please
do
not
open
the
random
attachment,
I've,
really
the
two
random
search
on
the
internet,
for
there
are
some
sites
that
have
fishes
in
general.
I
love
this
one.
B
So
this
is
a
fish
for
american
express
and
in
the
bottom
the
part
that's
circled
in
red
that
it
includes
an
email
address
for
phishing
emails.
I
love
that
so
you're
getting
fished
with
a
fish
complaint
link
in
it,
but
yeah
this.
You
know
if
we
look
at
initial
vectors
into
infections,
email
is
still
really
high
up
on
the
list
and
email
still
really
high
up
on
the
list,
because
email
still
works.
If
you
have
a
large
organization,
you
have
a
thousand
people.
You
only
need
that
one
person
who's
willing
to
click
on
the
link.