Re: I-D.ietf-v6ops-cpe-simple-security-09

[Mark Smith <[e-mail]>]

On Sat, 20 Mar 2010 15:55:52 -0700
Fred Baker <[e-mail]> wrote:

> >>> Rate-limiting unsolicited inbound connections rather than rejecting them provides greater end-to-end transparency while still providing protection against address and port scanning attacks as well as overloading of slow links or devices within the home.
> >>>     
> >> SIlly question. Why do you believe that? An address or port scanning attack is not intended to overload a network, it is intended to find an address port that can be used or attacked.
> > The sentence is referencing two different things. One, the possibility that uninvited packets might overload some device or slow link (something I consider unlikely, but has been identified as a concern by some), the other is, indeed, designed to make blind port and address scanning less likely to succeed in a given amount of time.
> > 
> > - Mark
> >>  Making the scan take more time doesn't prevent it from reaching its target. In what way does rate limiting an address or port scan provide protection?
> 
> With all due respect, when I set up security for my home or office, and when Cisco InfoSec sets up security for its home offices (of which mine is one), they're not asking about making an attack take ten minutes vs five. They're asking about preventing an attack from succeeding. Now, we can discuss the logic of the notion that "the bad guys are out there and the good guys are in here", but given the assumption, we need to be rational about the threats we are trying to prevent from succeeding.
> 

One thing that does seem to be missing from the draft is a specific
list of threats it is attempting to mitigate i.e. a threat model. With
luck, that sort of list would end up on the outside of the cardboard
box the CPE comes in, so that when people buy the CPE, they don't
assume the device is taking care of "all security", and therefore don't
have to bother with any other security measures.





>