Re: I-D.ietf-v6ops-cpe-simple-security-09

[Mark Townsley <[e-mail]>]

On 3/21/10 4:00 AM, Cameron Byrne wrote:
> On Sat, Mar 20, 2010 at 3:55 PM, Fred Baker<[e-mail]>  wrote:
>    
>>>>> Rate-limiting unsolicited inbound connections rather than rejecting them provides greater end-to-end transparency while still providing protection against address and port scanning attacks as well as overloading of slow links or devices within the home.
>>>>>
>>>>>            
>>>> SIlly question. Why do you believe that? An address or port scanning attack is not intended to overload a network, it is intended to find an address port that can be used or attacked.
>>>>          
>>> The sentence is referencing two different things. One, the possibility that uninvited packets might overload some device or slow link (something I consider unlikely, but has been identified as a concern by some), the other is, indeed, designed to make blind port and address scanning less likely to succeed in a given amount of time.
>>>
>>> - Mark
>>>        
>>>>   Making the scan take more time doesn't prevent it from reaching its target. In what way does rate limiting an address or port scan provide protection?
>>>>          
>> With all due respect, when I set up security for my home or office, and when Cisco InfoSec sets up security for its home offices (of which mine is one), they're not asking about making an attack take ten minutes vs five. They're asking about preventing an attack from succeeding. Now, we can discuss the logic of the notion that "the bad guys are out there and the good guys are in here", but given the assumption, we need to be rational about the threats we are trying to prevent from succeeding.
>>
>>      
> Agreed, rate-limiting does not add value in this scope.  We know that
> IPv6 is hard to scan successfully, and we know that rate limiting it
> on the CPE won't protect the external link from becoming saturated
> during an attack.  From the service provider perspective, rate
> limiting causes inconsistency in services (some packets get through in
> this sample test but not in the next sample test) and thus injects
> greater complexity for the folks trying to troubleshoot. I prefer
> consistent and deterministic behavior.  I would say the principle of
> default-deny and least privilege are philosophically correct in
> general, but i am not sure it needs to be applied in simple CPE.  I
> believe most current host OS software ships these days with default
> deny, and authorized administrators and applications can open the
> proper ports when needed.  If the trend is default-deny on the host
> which is "application aware", we do not need default-deny on the
> simple CPE which is not application aware.
>    
I agree with you, Cameron. The idea of rate-limiting is a compromise 
between this opinion and what is in the draft now. I'd be more than 
happy with what you propose here.

- Mark
> Cameron
>
>