Re: [v6ops] Fwd: (IETF I-D): Implications of IPv6 Addressing on Security Operations (Fwd: New Version Notification for draft-gont-opsec-ipv6-addressing-00.txt)

On Mon, Feb 6, 2023 at 10:28 PM Fernando Gont <fgont@si6networks.com> wrote:

> Folks,
>
> FYI, this one is targeted at opsec, but might be of interest to this group:
>
> * TXT:
> https://www.ietf.org/archive/id/draft-gont-opsec-ipv6-addressing-00.txt
> * HTML:
> https://www.ietf.org/archive/id/draft-gont-opsec-ipv6-addressing-00.html
>
> Thanks!
>
> Regards,
> Fernando
>
>
>
>
> -------- Forwarded Message --------
> Subject: (IETF I-D); Implications of IPv6 Addressing on Security
> Operations (Fwd: New Version Notification for
> draft-gont-opsec-ipv6-addressing-00.txt)
> Date: Fri, 3 Feb 2023 01:28:17 -0300
> From: Fernando Gont <fgont@si6networks.com>
> To: opsec@ietf.org
>
> Hi, All,
>
> I happened to participate in an IPv6 deployment meeting with some large
> content provider. Eventually there was a discussion about how to
> mitigate some attacks using block-lists, and they argued that they ban
> offending addresses (/128 for the IPv6 case), following IPv4 practices.
> While they had already deployed IPv6, some of the associated
> implications arising from the increased address space seemed to be
> non-obvious to them.
>
> A few things that may be useful to add:

Using data enrichment such as correlation of address to behavior (i.e. use
of a passive system to look for patterns in addressing to behavior) may
decrease false positives. This is how we determine if we should or should
not filter ephemeral addresses, both v4 and v6, and it works well. It does
not lend itself to reputation lists in the larger sense, but over time it
will absolutely show patterns and curves in behavior to specific blocks
just like in IPv4.

Adding in some data about the detrimental effects of  over-filtering, and
the very real possibility of creating DoS events based on too many routes
in the blackhole table, etc. Easy enough to alleviate with filters, but
also leaves a bit of exposure in doing so (as you mentioned in the filter
FIFO addressing behavior).

Having blackhole behavior or filter behavior that is expected to be
ephemeral and increasing in duration may aid in some of the resource and
minimize false positive impact. e.g. IP resource misbehaves, it is filtered
for n minutes and then unblocked. second offense is 15 minutes, third
offense is a day, whatever, you get the point. This is, again, how orgs I
have worked with for years have chosen to do things it works well for those
use cases.

Operationally I have never felt that reputation lists are terribly useful,
personally (likely due to the old RBL days and pain caused by them), but
having them there as a guide is sometimes useful.

> So that's what motivated the publication of this document.
>
> * TXT:
> https://www.ietf.org/archive/id/draft-gont-opsec-ipv6-addressing-00.txt
> * HTML:
> https://www.ietf.org/archive/id/draft-gont-opsec-ipv6-addressing-00.html

FWIW, I didn't read it as implying that SLAAC was undesirable, but I did
only give it a quick skim.

>
>
> Comments welcome!
>
> Thanks,
> Fernando
>
>
>
>
> -------- Forwarded Message --------
> Subject: New Version Notification for
> draft-gont-opsec-ipv6-addressing-00.txt
> Date: Thu, 02 Feb 2023 19:48:40 -0800
> From: internet-drafts@ietf.org
> To: Fernando Gont <fgont@si6networks.com>, Guillermo Gont
> <ggont@si6networks.com>
>
>
> A new version of I-D, draft-gont-opsec-ipv6-addressing-00.txt
> has been successfully submitted by Fernando Gont and posted to the
> IETF repository.
>
> Name:           draft-gont-opsec-ipv6-addressing
> Revision:       00
> Title:          Implications of IPv6 Addressing on Security Operations
> Document date:  2023-02-02
> Group:          Individual Submission
> Pages:          8
> URL:
> https://www.ietf.org/archive/id/draft-gont-opsec-ipv6-addressing-00.txt
> Status: https://datatracker.ietf.org/doc/draft-gont-opsec-ipv6-addressing/
> Htmlized:
> https://datatracker.ietf.org/doc/html/draft-gont-opsec-ipv6-addressing
>
>
> Abstract:
>     The increased address availability provided by IPv6 has concrete
>     implications on security operations.  This document discusses such
>     implications, and sheds some light on how existing security
>     operations techniques and procedures might need to be modified
>     accommodate the increased IPv6 address availability.
>
>
>
>
> The IETF Secretariat
>
>
> _______________________________________________
> v6ops mailing list
> v6ops@ietf.org
> https://www.ietf.org/mailman/listinfo/v6ops
>
ᐧ