Address Allocation for Private Internets

Rekhter, Yakov; Moskowitz, Ben; Karrenberg, D.; Groot, G. J. de; Lear, Eliot

doi:10.17487/rfc1918

Cited by 396 publications

(189 citation statements)

References 3 publications

Supporting

Mentioning

173

Contrasting

Unclassified

Order By: Relevance

“…For example in [67,12,54,64,35,49], best practice recommendations tend to be countermeasure-centric and do not consider explicitly the threats and vulnerabilities within their text-based description. Fenz et.…”

Section: Implicit Threats and Vulnerabilities In Best Practice Catalomentioning

confidence: 99%

“…For example, bogon firewall rules [35,49,67] are best-practice protection against spoofing-threats for internal servers and end-user workstations, while NIST recommend multiple countermeasures over an n-tier network hosting a Web-server [64]. This knowledge-base is searchable-a suitable countermeasure can be found for a given threat-and provides the basis for autonomic security configuration.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Management of security policy configuration using a Semantic Threat Graph approach

Foley

Fitzgerald

2011

JCS

View full text Add to dashboard Cite

Managing the configuration of heterogeneous enterprise security mechanisms is a complex task. The effectiveness of a configuration may be constrained by poor understanding and/or management of the overall security policy requirements, which may, in turn, unnecessarily expose the enterprise to known threats. This paper proposes a threat management based approach, whereby knowledge about the effectiveness of mitigating countermeasures is used to guide the autonomic configuration of security mechanisms. This knowledge is modeled in terms of Semantic Threat Graphs, a variation of the traditional Threat/Attack Tree, extended in order to relate semantic information about security configuration with threats, vulnerabilities and countermeasures. An ontology-based approach to representing and reasoning over this knowledge is taken. A case study based on Network Access Controls demonstrates how threats can be analysed and how automated configuration recommendations can be made based on catalogues of countermeasures. These countermeasures are drawn from best-practice standards, including NIST, IETF and PCI-DSS recommendations for firewall configuration.

show abstract

Section: Implicit Threats and Vulnerabilities In Best Practice Catalomentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Management of security policy configuration using a Semantic Threat Graph approach

Foley

Fitzgerald

2011

JCS

View full text Add to dashboard Cite

show abstract

“…For example, it is considered best practice that NAC 's implement anti-spoofing bogon rules as described by [11,12,13] to protect its internal servers and end-user work stations. As a consequence, a NAC policy should prohibit incoming packets claiming to originate from the internal network.…”

Section: Configuration Recommendation Synthesismentioning

confidence: 99%

“…For example, bogon firewall rules [11,12,13] are best-practice protection against spoofing-threats for internal servers and end-user workstations, while NIST recommend multiple countermeasures over an n-tier network hosting a Web-server [14]. This knowledge-base is searchable-a suitable countermeasure/policy can be found for a given threatand provides the basis for autonomic security configuration.…”

Section: Introductionmentioning

confidence: 99%

An Approach to Security Policy Configuration Using Semantic Threat Graphs

Foley

Fitzgerald

2009

Data and Applications Security XXIII

View full text Add to dashboard Cite

Abstract. Managing the configuration of heterogeneous enterprise security mechanisms is a wholly complex task. The effectiveness of a configuration may be constrained by poor understanding and/or management of the overall security policy requirements, which may, in turn, unnecessarily expose the enterprise to known threats. This paper proposes a threat management approach, whereby knowledge about the effectiveness of mitigating countermeasures is used to guide the autonomic configuration of security mechanisms. This knowledge is modeled in terms of Semantic Threat Graphs, a variation of the traditional Threat/Attack Tree, extended in order to relate semantic information about security configuration with threats, vulnerabilities and countermeasures. An ontology-based approach to representing and reasoning over this knowledge is taken. A case study on Network Access Controls demonstrates how threats can be analyzed and how automated configuration recommendations can be made based on catalogues of best-practice countermeasures.

show abstract

“…For allocated blocks that are involved in prefix appearance, each of them contributes 5-6 new prefixes regardless of the age. While for allocated blocks involved in prefix disappearance, each of them corresponds to 4-6 removed prefixes 4 .…”

Section: B Composition Of Table Growth Contributed By New Allocationmentioning

confidence: 99%

Impact of IPv4 address allocation practice on BGP routing table growth

Xu¹,

Meng²,

Zhang³

et al.

2002 14th International Conference on Ion Implantation Technology Proceedings (IEEE Cat. No.02EX505)

View full text Add to dashboard Cite

Abstract-Rapid BGP routing table growth has been a main concern for the operation of the Internet in recent years. In this paper, we study how current IPv4 address allocation practice affects the BGP table growth. The practice includes both the newlymade allocations and two address policies, i.e., allocation size and minimum allocation size. We first found that the address blocks allocated during the past five years contributed to more than 71% of the BGP table growth within the same period. Moreover, contributions made by allocated address blocks quickly become static after the allocation. Based on this observation, we propose an empirical model to emulate the table growth. We next study the impact of two address policies and show that while the "allocation size" policy is observed to have visible impact on the growth, there is no clear evidence that the "minimum allocation size" policy, designed for slowing down the table size increase, has suppressed the growth. We finally discuss how the address policies could have better controlled the BGP table growth.

show abstract

Address Allocation for Private Internets

Cited by 396 publications

References 3 publications

Management of security policy configuration using a Semantic Threat Graph approach

Management of security policy configuration using a Semantic Threat Graph approach

An Approach to Security Policy Configuration Using Semantic Threat Graphs

Impact of IPv4 address allocation practice on BGP routing table growth

Contact Info

Product

Resources

About