- techsec-wg - mailman.ripe.net

Again: agenda items for TechSec, RIPE 47, please
by ted＠tednet.nl 23 Dec '03

23 Dec '03

[Quoting Ted Lindgreen, on Nov 27, 12:04, in "[techsec-wg] Agenda ..."] > It's agenda time again. Sofar the only submitted agenda point is the DISI report from Olaf Kolkman. No other items? -- ted

1 0

Announcement DNSSec Training Courses
by RIPE NCC Training 16 Dec '03

16 Dec '03

------- Dear Colleagues, [apologies for duplicate postings] As a service to its members the RIPE NCC offers the DNSSec Training Course. The main objective of the DNSSec Training Course is to provide LIRs with sufficient background to be able to deploy DNSSec in their own organisation as soon as the protocol is standardised. This course also explains the specific procedures set up by the RIPE NCC to to secure the in-addr.arpa zone. The Domain Name System (DNS) is one of the main parts of the Internet infrastructure. At the moment DNS lacks a mechanism to establish the authenticity and integrity of the data it provides. DNSSec is a set of extensions to provide this end-to-end authenticity and integrity. It is currently being developed within the IETF dnsnext Working Group. The protocol is about to be finalised and the code implementing the protocol is available in alpha releases. The DNSSec course consists of two parts: an "Introduction to DNSSec" and a real life demonstration. The "Introduction to DNSSec" will cover: - DNS security threats - DNSSec security mechanisms - DNSSec server protection - DNSSec data protection - Delegation issues - Key management issues - Current developments Examples are based on the BIND name server. Please note that DNSSec is an advanced course. It will: - NOT teach the basics of DNS. - NOT describe how to receive Internet resources from the RIPE NCC not describe how to operate a Local Internet Registry (LIR) The target audience of the course are technical staff of LIRs: e.g. network & system operators, engineers, etc. This course is not intended for administrative or management staff (e.g. Hostmasters). It is assumed that all attendees are familiar with common DNS terminology, have a practical knowledge in operating DNS servers and are interested in learning the concepts and mechanisms that DNSSec offers. The DNSSec course is conducted in the English language and is free of charge, since it is covered by the membership fee. More information about the DNSSec Training Course can be found at: http://www.ripe.net/training/dnssec/ REGISTRATION: You can register for a course at the following URL: http://www.ripe.net/cgi-bin/trainingform.pl.cgi Or by completing the registration form at the end of this e-mail and replying to <training(a)ripe.net> In order to register for a DNSSec Training Course you must be an employee of an LIR and either : - be an LIR contact - be confirmed by an LIR contact. LIR contacts are those employees of an LIR who are registered with the RIPE NCC as authoritative contact persons. It is expected that most of those interested in the DNSSec Training Course will not be an authorative contact persons for their LIR, and therefore will be refused by the course registration "robot". In order to be admitted to the course, a confirmation e-mail must be sent to <training(a)ripe.net>. Please approach the LIR contacts from your organisation personally, since the identity of LIR contacts is confidential, and the RIPE NCC is unable to divulge contact persons for any given LIR. Kind Regards, Training Team RIPE NCC COURSE DATES AND VENUES ======================= Date: Friday 20 February 2004 Time: 0900 - 1700 Location: Salzburg, Austria AND: Date: Friday 26 March 2004 Time: 0900 - 1700 Location: Warsaw, Poland AND: Date: Friday 4 June 2004 Time: 0900 - 1700 Location: Sofia, Bulgaria REGISTRATION FORM ================= %START PART 1 - Registration 1) Your name Enter First name, Last name in full e.g. John Doe Mary-Beth Walton # NAME [ ] 2) Your Registry ID (format: country-code.<name of registry>) # REG [ ] 3) Your e-mail address # EMAIL [ ] 4) Your NIC handle (optional) # NICHANDLE [ ] 5) The course you plan to attend (date and location) # COURSE [ ] %END

1 0

Agenda items for TechSec, RIPE 47, please
by ted＠tednet.nl 27 Nov '03

27 Nov '03

Hi, It's agenda time again. Please submit your favourite items. -- ted

1 0

Announcement DNSSec Training Courses
by RIPE NCC Training 13 Nov '03

13 Nov '03

------- Dear Colleagues, [apologies for duplicate postings] As a service to its members the RIPE NCC offers the DNSSec Training Course. The main objective of the DNSSec Training Course is to provide LIRs with sufficient background to be able to deploy DNSSec in their own organisation as soon as the protocol is standardised. This course also explains the specific procedures set up by the RIPE NCC to to secure the in-addr.arpa zone. The Domain Name System (DNS) is one of the main parts of the Internet infrastructure. At the moment DNS lacks a mechanism to establish the authenticity and integrity of the data it provides. DNSSec is a set of extensions to provide this end-to-end authenticity and integrity. It is currently being developed within the IETF dnsnext Working Group. The protocol is about to be finalised and the code implementing the protocol is available in alpha releases. The DNSSec course consists of two parts: an "Introduction to DNSSec" and a real life demonstration. The "Introduction to DNSSec" will cover: - DNS security threats - DNSSec security mechanisms - DNSSec server protection - DNSSec data protection - Delegation issues - Key management issues - Current developments Examples are based on the BIND name server. Please note that DNSSec is an advanced course. It will: - NOT teach the basics of DNS. - NOT describe how to receive Internet resources from the RIPE NCC not describe how to operate a Local Internet Registry (LIR) The target audience of the course are technical staff of LIRs: e.g. network & system operators, engineers, etc. This course is not intended for administrative or management staff (e.g. Hostmasters). It is assumed that all attendees are familiar with common DNS terminology, have a practical knowledge in operating DNS servers and are interested in learning the concepts and mechanisms that DNSSec offers. The DNSSec course is conducted in the English language and is free of charge, since it is covered by the membership fee. More information about the DNSSec Training Course can be found at: http://www.ripe.net/training/dnssec/ REGISTRATION: You can register for a course at the following URL: http://www.ripe.net/cgi-bin/trainingform.pl.cgi Or by completing the registration form at the end of this e-mail and replying to <training(a)ripe.net> In order to register for a DNSSec Training Course you must be an employee of an LIR and either : - be an LIR contact - be confirmed by an LIR contact. LIR contacts are those employees of an LIR who are registered with the RIPE NCC as authoritative contact persons. It is expected that most of those interested in the DNSSec Training Course will not be an authorative contact persons for their LIR, and therefore will be refused by the course registration "robot". In order to be admitted to the course, a confirmation e-mail must be sent to <training(a)ripe.net>. Please approach the LIR contacts from your organisation personally, since the identity of LIR contacts is confidential, and the RIPE NCC is unable to divulge contact persons for any given LIR. Kind Regards, The RIPE NCC Training Team COURSE DATES AND VENUES ======================= Date: Tuesday 17 February 2004 Time: 0900 - 1700 Location: Teheran, Iran AND: Date: Friday 20 February 2004 Time: 0900 - 1700 Location: Salzburg, Austria AND: Date: Friday 26 March 2004 Time: 0900 - 1700 Location: Warsaw, Poland REGISTRATION FORM ================= %START PART 1 - Registration 1) Your name Enter First name, Last name in full e.g. John Doe Mary-Beth Walton # NAME [ ] 2) Your Registry ID (format: country-code.<name of registry>) # REG [ ] 3) Your e-mail address # EMAIL [ ] 4) Your NIC handle (optional) # NICHANDLE [ ] 5) The course you plan to attend (date and location) # COURSE [ ] %END

1 0

Draft minutes TechSec, RIPE 46, Amsterdam
by ted＠tednet.nl 26 Sep '03

26 Sep '03

Comments, fixes, additions, etc., either to the list or to the chair <ted(a)tednet.nl> Draft Minutes of Techsec-WG meeting at RIPE46 ================================================== Location: St. Johns II, Krasnopolsky, Amsterdam Chair: Ted Lindgreen Scribe: Maximo Alves/Tim McGinnis Date: 03 September 2003, 16:00 A. Administrative Matters * scribe: Tim McGinnis, backup: Maximo Alves * list of participants: list passed and given to chair after being circulated * agenda * minutes -minutes of last 2 previous tech-sec WG meetings are not online. Action on Chair to chase these down. B. DISI report (20 minutes), Olaf Kolkman, RIPE NCC. Olaf is fairly optimistic that DNSSEC will be rolled out in Q1 of 2004. Other DNS presentations in DNS and NCC-Services WGs on Thursday. NLnet Labs doing experiment with DNSSEC, they have operational experience, and have run workshops to spread knowledge and test protocol in live environments. Key signing tools in development, RIPE NCC courses running monthly. ns.ripe.net has had a DNSSEC experiment, 8 hours to sign the zone, this is largely due to key size. There are memory requirements for DNSSEC. Zonefiles grow, be prepared. Q: George Jones: What is the status of bind regarding the latest DNSSEC protocol changes? Susanne from ISC gave Answer: Some developments, tests and workshops have been done. It should be released soon (Q1). C. Internet draft draft-jones-opsec-01.txt presentation and discussion, George Jones, Mitre. The goal is to secure large scale IP infrastructure devices. Very informative presentation. Presenter asked for feedback and community needs, especially around CLI interface requirements. Comment from room: Yes, I wanted a CLI on all the boxes I adminned in the past, because no CLI meant (in those days) that you can't remotely manage them out-of-band. In-band key management is unsolved. More feedback needed, especially around filtering requirements. Question; most of these things are available commercially, yes? A: No, that why the draft is proposed: to force the vendors to pay more attention to these requirements. Q: BCP status of document itself will it be informational or BCP? A: For pragmatic reasons I intend to separate the unambigious requirements from the less urgent and/or debatable wishes. The former will then go in a BCP and the latter into informational RFC. No definition of what should be logged, firewall and F-secure people are talking about this. Comment from room: You only listed authentication, not authorization things. It would be nice to have a list of messages and what they mean, but proprietary conflicts abound. Many work area tensions being resolved, 4 likely outcomes: 1 nothing 2.publish BCP 3.publish informational RFC 4 go to working grouup Comments from Chair: doc too big, split it into informational and strict requirements is a wise decision. Comments: 01 is better than 00 Comments: 2 issues: Comments: 1. in secure network accountability/auditing is better terminology. Comments: 2. network op has to log traffic AND events A: lets talk D. TF-CSIRT update, Baiba Kaskina, TERENA. They have meetings and training courses held throughout the year IRT object is now in RIPE Db after lots of hard work. Q: Who is 3rd party who you have outsourced to? A: S-CURE B.V. Do you have any relation to the EU Committee for network Security information Agency Yes and no, more yes than no. CSIRT folk talk in Brussels, and in CSIRT meetings sent to comission in July 2003. We hope to have an attendee from Brussels in Amsterdam in Sept 25-26. Jaap Akkerhuis made a comment about the public-private partnetrship with EU. Other comments: EU wants to centralize management of net security. E. Update on Fonkey and PKI related developments at IETF (15 minutes), Yuri Demchenko, NLNetLab Yuri described a system to distibute cryptographic keys and reference attribute information bound by digital signature. Java key management tool is now available. Q: none

1 0

Re: [ncc-services-wg] Incident Response Service (IRS) [was: Unneeded RIPE tasks] (fwd)
by Henk Uijterwaal (RIPE-NCC) 28 Aug '03

28 Aug '03

Dear Hank, For your first question, please see Daniel's quote from RIPE271 and further text in his posting earlier today. > >with more details about the IS activity. This paper was discussed at > >RIPE45 and people have been invited to comment on this document on the > >tt-wg(a)ripe.net list. Then the proposed budget: > > The test-Traffic WG, as per its charter states: [...] Speaking as the former chair of the tt-wg: Formally speaking you are right, it is outside the charter of the TT-WG. However, after Daniel's presentation at RIPE45 and subsequent discussion, the question was raised where further comments on the topic could be posted. As the IS activity overlaps between at least 5 different WG's (tt, techsec, services, routing, DNS*) and none of them is exactly the right place for this discussion, we arbitrarily picked the tt-wg list. There haven't been that many postings on the topic as I'd hoped, but comments are still welcome. Henk ------------------------------------------------------------------------------ Henk Uijterwaal Email: henk.uijterwaal(a)ripe.net RIPE Network Coordination Centre WWW: http://www.ripe.net/home/henk P.O.Box 10096 Singel 258 Phone: +31.20.5354414 1001 EB Amsterdam 1016 AB Amsterdam Fax: +31.20.5354445 The Netherlands The Netherlands Mobile: +31.6.55861746 ------------------------------------------------------------------------------ That problem that we weren't having yesterday, is it better? (Big ISP NOC)

1 0

2nd updated agenda TechSec, RIPE 46, Amsterdam
by ted＠tednet.nl 27 Aug '03

27 Aug '03

Changes: C: draft-jones-opsec-00.txt ==> draft-jones-opsec-01.txt D: Item "TF-CSIRT update" inserted E: IETF-related ==> PKI-related A. Administrative Matters - scribe - list of participants - agenda - minutes B. Disi report, Olaf Kolkman - 20 minutes C. Internet draft draft-jones-opsec-01.txt, see http://www.ietf.org/internet-drafts/draft-jones-opsec-01.txt presentation and discussion, George Jones - 20 minutes D. TF-CSIRT update by Baiba Kaskina (TERENA) - 5 minutes E. Update on Fonkey and PKI related developments at IETF Yuri Demchenko - 15 minutes -- ted

1 0

Updated agenda TechSec, RIPE 46, Amsterdam
by ted＠tednet.nl 27 Aug '03

27 Aug '03

Changes: draft-jones-opsec-00.txt ==> draft-jones-opsec-01.txt Item "TF-CSIRT update" inserted. A. Administrative Matters - scribe - list of participants - agenda - minutes B. Disi report, Olaf Kolkman - 20 minutes C. Internet draft draft-jones-opsec-01.txt, see http://www.ietf.org/internet-drafts/draft-jones-opsec-01.txt presentation and discussion, George Jones - 20 minutes D. TF-CSIRT update by Baiba Kaskina (TERENA) - 5 minutes E. Update on Fonkey and IETF related developments at IETF Yuri Demchenko - 15 minutes -- ted

1 0

Agenda TechSec, RIPE 46, Amsterdam
by ted＠tednet.nl 21 Aug '03

21 Aug '03

A. Administrative Matters - scribe - list of participants - agenda - minutes B. Disi report, Olaf Kolkman - 20 minutes C. Internet draft draft-jones-opsec-00.txt, presentation and discussion, George Jones - 20 minutes D. Update on Fonkey and IETF related developments at IETF Yuri Demchenko - 15 minutes -- ted

3 2

What controls do you need to secure your network ?
by George M. Jones 14 Aug '03

14 Aug '03

I will be giving brief overview of the Operational Security Requirements (opsec) IETF draft @ the techsec working group. The basic idea of the draft is to enumerate, in a requirements doc, the list of controls that are needed to operate network infrastructure securely. The second version of the draft is now available @ http://www.port111.com/opsec/draft-jones-opsec-01.txt and should be up in the IETF Internet Drafts Real Soon Now (submitted last night). I would very much like to have input from this community on the requirements. Are there critical capabilities missing ? Are there things that should be removed ? Have you ever tried to test/purchase/operate equipment and found yourself saying "I can't believe the device does not have the ability to [insert basic security feature here]...". We will have some time at the tecsec-wg, but it would also be useful to start discussing things on this list now. Your thoughts ? Thank you, ---George Jones

1 0