Re: I-D.ietf-v6ops-cpe-simple-security-09

[Cameron Byrne <[e-mail]>]

On Sat, Mar 20, 2010 at 3:55 PM, Fred Baker <[e-mail]> wrote:
>>>> Rate-limiting unsolicited inbound connections rather than rejecting them provides greater end-to-end transparency while still providing protection against address and port scanning attacks as well as overloading of slow links or devices within the home.
>>>>
>>> SIlly question. Why do you believe that? An address or port scanning attack is not intended to overload a network, it is intended to find an address port that can be used or attacked.
>> The sentence is referencing two different things. One, the possibility that uninvited packets might overload some device or slow link (something I consider unlikely, but has been identified as a concern by some), the other is, indeed, designed to make blind port and address scanning less likely to succeed in a given amount of time.
>>
>> - Mark
>>>  Making the scan take more time doesn't prevent it from reaching its target. In what way does rate limiting an address or port scan provide protection?
>
> With all due respect, when I set up security for my home or office, and when Cisco InfoSec sets up security for its home offices (of which mine is one), they're not asking about making an attack take ten minutes vs five. They're asking about preventing an attack from succeeding. Now, we can discuss the logic of the notion that "the bad guys are out there and the good guys are in here", but given the assumption, we need to be rational about the threats we are trying to prevent from succeeding.
>

Agreed, rate-limiting does not add value in this scope.  We know that
IPv6 is hard to scan successfully, and we know that rate limiting it
on the CPE won't protect the external link from becoming saturated
during an attack.  From the service provider perspective, rate
limiting causes inconsistency in services (some packets get through in
this sample test but not in the next sample test) and thus injects
greater complexity for the folks trying to troubleshoot. I prefer
consistent and deterministic behavior.  I would say the principle of
default-deny and least privilege are philosophically correct in
general, but i am not sure it needs to be applied in simple CPE.  I
believe most current host OS software ships these days with default
deny, and authorized administrators and applications can open the
proper ports when needed.  If the trend is default-deny on the host
which is "application aware", we do not need default-deny on the
simple CPE which is not application aware.

Cameron