Dan York

Just a guy in Vermont trying to connect all the dots...

Author's posts

News Release Announcing MANRS – And Asking Network Operators To Sign Up!

MANRS logo square 150 pxWe are pleased to announce that the MANRS document was officially launched this morning, November 6, 2014.

Or read the text below…  and better yet, check out the list of participants and then sign up!


NETWORK OPERATORS AROUND THE WORLD DEMONSTRATE THEIR COMMITMENT TO A SECURE AND RESILIENT INTERNET

Mutually Agreed Norms for Routing Security (MANRS) recommendations provide a coordinated approach to improve global routing system

[Washington, D.C., USA and Geneva, Switzerland] – 6 November 2014 – Leading network operators around the world today announced that they have implemented a package of recommended measures that help improve the security and resilience of the global Internet.

Working together, network operators have developed a tightly defined set of concrete actions to improve the global Internet routing system. The recommendations, called Mutually Agreed Norms for Routing Security (MANRS) recognize the interdependent nature of the global routing system and integrate best current practices related to routing security and resilience. More network operators from across the globe are encouraged to sign onto the movement and participate by visiting the website and completing the form.

Organized by the Internet Society, and building on the demonstrated success of coordinated industry activities such as World IPv6 Day and World IPv6 Launch, MANRS represents a significant step forward towards building a more resilient and secure Internet infrastructure.

“The security of the Internet as a network of networks often relies on specific collaborative action. This initiative increases the security of the Internet by improving resiliency and stability of the underlying routing infrastructure,” commented Olaf Kolkman, the Internet Society’s Chief Internet Technology Officer. “Participating network operators committed to the MANRS initiative are taking actions that address problems with incorrect routing information and spoofed traffic, demonstrating their collective responsibility to a healthy and secure Internet ecosystem. We encourage and look forward to other network operators around the world publicly taking these steps.”

Participating network operators have taken one or several of the expected actions defined by the MANRS framework. These include preventing propagation of incorrect routing information, preventing traffic with spoofed IP addresses, and facilitating global operational communication and coordination between network operators. Committed network operators are:

● CERNET

● Claranet

● Comcast

● KPN

● Level 3

● NTT

● RUNNet

● SpaceNet

● SURFnet

Several of the participating network operators commented on their actions and today’s announcement:

“Adherence to MANRS is an important commitment that operators make back to the Internet community. Together we aim to remove the havens from which miscreants maintain the freedom and anonymity to attack our network and our customers.”
– David Freedman, Claranet Group

”Comcast is committed to helping drive improvements to the reliability of the Internet ecosystem. We are thrilled to be engaged with other infrastructure participants across the spectrum and around the globe in pursuit of these goals.”
– Jason Livingood, Vice President, Internet Services, Comcast

“Good network routing practice is the fundamental requirement for trust between providers, and ultimately creates a safer and stronger Internet for customers. KPN is committed to providing secure and trustworthy communications, and by joining partners in MANRS, we continue to improve security and resiliency for all.”
– Jaya Baloo, Chief Information Security Officer, KPN

“As one of the most connected Internet providers in the world, security of the Internet is top-of-mind at Level 3 Communications. We are dedicated to supporting and protecting the Internet ecosystem and work each day to safeguard customers’ critical communications. The Internet is a shared responsibility, and only through these important collaborative efforts can we continue to ensure the protection of this collective infrastructure.”
– Dale Drew, Senior Vice President, Chief Security Officer at Level 3 Communications

“SURFnet is a big supporter of these initiatives to make the Internet more secure. Committing to the actions as outlined in the MANRS document will make routing on the Internet safer. This impacts every day usage of the Internet and helps with a free, open, and more secure Internet for all users.”
– Erik Huizer, CTO, SURFnet

For more information about MANRS and the Routing Resilience Manifesto visit:

http://www.manrs.org

About the Internet Society

The Internet Society (www.internetsociety.org) is the trusted independent source for Internet information and thought leadership around the world. It is also the organizational home for the Internet Engineering Task Force (IETF). With its principled vision, substantial technological foundation and its global presence, the Internet Society promotes open dialogue on Internet policy, technology, and future development among users, companies, governments, and other organizations. Working with its members and Chapters around the world, the Internet Society enables the continued evolution and growth of the Internet for everyone.

Media Contact
Greg Wood
wood@isoc.org
+1-703-439-2145

Meet The Deploy360 Team at IETF 91

If you will be at IETF 91 next week in Honolulu, please do say hello to members of the Deployment & Operationalization (DO) team within the Internet Society.  We are the team behind this Deploy360 website and three of us will be there at IETF 91:

You can expect to find us in the sessions related to IPv6, DNSSEC, routing security and network operations, as well as others related to the topics we cover here on Deploy360.  If you’d like to meet with us, please send an email to deploy360@isoc.org and if you don’t know what we look like, this photo may help:

DO Team 2013

DO Team – left-to-right: Chris Grundemann, Dan York, Megan Kruse, Jan Žorž

See you in Hawaii!

Rough Guide to IETF 91: DNSSEC, DANE and DNS Security

IETF 91 will once again be busy for those of us interested in DNSSEC, DANE and DNS security in general. Two of the major DNS-related working groups, DNSOP and DANE, are both meeting with busy agenda and a new working group called DPRIVE will be meeting to talk about DNS privacy concerns. There are naturally other items related to DNSSEC and "DNS security" in general scattered throughout the week - here is what the week looks like...

NOTE: If you are unable to attend IETF 91 in person, there are multiple ways to participate remotely and listen to these sessions.

Dan York

12 Days Until ION Tokyo!

ION TokyoION Tokyo is coming up soon on Monday, November 17, 2014!  We’ll be live in the same venue as the Japan IPv6 Summit with an agenda packed full of technical sessions.  To learn more visit our ION Tokyo page at:

http://www.internetsociety.org/deploy360/ion/tokyo2014/

The sessions will include:

  • An IPv6 Case Study from NTT
  • The Business Case for Implementing DNSSEC
  • Best Current Operational Practices Update
  • Panel Discussion – IPv6 in Asia

The event has excellent speakers and we’re looking forward to meeting with network operators, enterprises and many others.

If you are going to be in Tokyo for the Japan IPv6 Summit or for Internet Week Japan, please do join us Monday morning for ION Tokyo!

A Great Amount of DNSSEC / DANE / DNS Activity At IETF 91 Next Week

IETF LogoWhat is happening next week at IETF 91 in Honolulu with regard to DNSSEC, DANE and other “DNS security” topics?

A great amount of activity, it turns out!

So much that my “Rough Guide to IETF 91: DNSSEC, DANE and DNS Security” turned into quite a lengthy article.  Please read that article for the full description, but a quick summary can be:

  • DNSOP will have discussions around “Negative Trust Anchors”, “DNS Cookies” and more.
  • DANE will discuss using DANE for email, and specifically S/MIME, as well as SRV records and a discussion led by me about what we can learn from current deployments of DANE.
  • A brand new DPRIVE working group will be exploring challenges around privacy and confidentiality of DNS queries.
  • TRANS will look at applying Certificate Transparency (CT) mechanism to DNSSEC keys.
  • EPPEXT will discuss how to move a draft forward about secure transfer of DNSSEC-signed domains between registrars.
  • HOMENET and DNSSD will both be looking at different aspects of using DNS with small networks or “Internet of Things” (IoT) environments – and the question of course is how this usage gets secured.

… and again you’ll want to read the full article to understand more.  The key point is that it will be busy for those of us interested in DNS-related issues!   If you are going to be out at IETF 91, please do contact us or find me there.  Odds are pretty good you’ll find me in either the DNS or IPv6 sessions!

And if you want to get started today with DNSSEC, please visit our Start Here page to learn how!

Chinese Translations Of IPv6 And DNSSEC Fact Sheets Now Available For Download

No sooner had I announced that our IPv6 Fact Sheet and our DNSSEC Fact Sheet are both now available in Russian than I learned that the Chinese versions are also now available:

… and I should be able to publish the Arabic versions tomorrow.  All great news for people wanting to make more information about IPv6 and DNSSEC available to people all around the world.

As we noted in our earlier posts about the IPv6 Fact Sheet and about the DNSSEC Fact Sheet, these simple documents are available for you to use in whatever way you wish.  Please feel free to download them and share them widely.

Please do let us know any feedback you have on these documents.  Our goal is to help you get IPv6 and DNSSEC deployed within your organizations and networks.  Please let us know how we can help.

And if you want to get started with IPv6 or DNSSEC, please visit our Start Here page to find resources to help you get started!

chinese-fact-sheet

New MANRS Graphic Available For Usage (And Do You Have A Better Suggestion?)

manrs-300x150Given that it is useful to have a graphic that can be used in articles about this initiative, we created a basic MANRS graphic that you are free to download and use however you see fit under a Creative Commons Attribution 3.0 Unported license.  The graphic is available as a JPEG image in the following formats and sizes:

Rectangle:

Square:

Please note – IF YOU HAVE A BETTER SUGGESTION for a graphic / logo that we can use to promote the MANRS initiative, we’d love to hear from you!  We created this one because we needed something … but we’re definitely open to other ideas.  Ideally we’d like to have a variety of badges and logos along the lines of what was created for the World IPv6 Launch so that supporters can show their support for the MANRS initiative on their websites, blogs, social media, etc.

The Many Colors Of Blue

Here is a quick table of shades of Blue taken from the old X11 color names:

BlueHTML code
SkyBlue#87CEEB
Navy#000080
LightSteelBlue#B0C4DE
PowderBlue#B0E0E6
Blue#0000FF
LightSkyBlue#87CEFA
DeepSkyBlue#00BFFF
CornflowerBlue#6495ED
LightBlue#ADD8E6

Video: Andrei Robachevsky Introduces MANRS At RIPE 69

At the RIPE 69 meeting today in London, Andrei Robachevsky gave a lightning talk about “How Can We Work Together to Improve the Security and Resilience of the Global Routing System?” where he introduced the MANRS document and asked people to join the initiative.  You can view his slides and watch the video of his presentation:

andrei-ripe69If you are interested in being added to the growing list of participants, please sign up!

 

IPv6 Statistics Show Continued Growth – Have You Migrated Your Apps Yet?

IPv6stats–GoogleIt is fun to watch the various IPv6 statistics sites because they continue to show the amazing growth of IPv6 around the world.  The World IPv6 Launch measurements now show Verizon Wireless’ network at 59% IPv6, T-Mobile USA at 43%, AT&T at 25%.  Google’s IPv6 statistics show that traffic into Google web sites globally is about to hit 5%.  And then today Akamai launched new IPv6 trend charts that show IPv6 traffic out of Belgium at 29.2%, from Germany 12% and from Luxembourg and the USA right at 10% with Peru not far behind.

All of this shows that IPv6 deployment is very real!  If you haven’t started migrating your applications so that they will work over IPv6 in addition to IPv4, why not?

Obviously I’d encourage you to buy the book to help understand what you need to do… but you can also view the many IPv6 resources out there on the Internet to learn more!  The key point is that you need to get started NOW!  IPv6 is being deployed globally – will your application work over IPv6?