DOCSLIB.ORG

The Politics of Internet Security Private Industry and the Future of the Web

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
The Politics of Internet Security Private Industry and the Future of the Web CYBER STATECRAFT INITIATIVE THE POLITICS OF INTERNET SECURITY PRIVATE INDUSTRY AND THE FUTURE OF THE WEB Justin Sherman Scowcroft Center for Strategy and Security The Scowcroft Center for Strategy and Security works to develop sustainable, nonpartisan strategies to address the most important security challenges facing the United States and the world. The Center honors General Brent Scowcroft’s legacy of service and embodies his ethos of nonpartisan commitment to the cause of security, support for US leadership in cooperation with allies and partners, and dedication to the mentorship of the next generation of leaders. Cyber Statecraft Initiative The Cyber Statecraft Initiative works at the nexus of geopolitics and cybersecurity to craft strategies to help shape the conduct of statecraft and to better inform and secure users of technology. This work extends through the competition of state and non-state actors, the security of the internet and computing systems, the safety of operational technology and physical systems, and the communities of cyberspace. The Initiative convenes a diverse network of passionate and knowledgeable contributors, bridging the gap among technical, policy, and user communities. Atlantic Council CYBER STATECRAFT SCOWCROFT CENTER INITIATIVE FOR STRATEGY AND SECURITY THE POLITICS OF INTERNET SECURITY PRIVATE INDUSTRY AND THE FUTURE OF THE WEB Justin Sherman ISBN-13: 978-1-61977-125-3 © Justin Sherman Cover: Concept image of cables and connections for data transfer in the digital world. Credit: iStock. This report is written and published in accordance with the Atlantic Council Policy on Intellectual Independence. The author is solely responsible for its analysis and recommendations. The Atlantic Council and its donors do not determine, nor do they necessarily endorse or advocate for, any of this report’s conclusions. October 2020 #ACcyber THE POLITICS OF INTERNET SECURITY: PRIVATE INDUSTRY AND THE FUTURE OF THE WEB TABLE OF CONTENTS Executive Summary �������������������������������������������������������������������������������������������������������������������������������������������� 1 1: Introduction ...................................................................................................................................................... 2 2: Mapping Private Sector Influence on the Internet: Starting with Internet Protocols ������������4 3: Routing and the Border Gateway Protocol .......................................................................................... 8 3.1 How the BGP Works .............................................................................................................................. 8 3.2 How the BGP Malfunctions and Gets Exploited ........................................................................ 9 3.3 Influencing the BGP’s Security. .......................................................................................................13 4: Addressing and the Domain Name System .......................................................................................16 4.1 How the DNS Works.............................................................................................................................16 4.2 How the DNS Gets Exploited ..........................................................................................................16 4.3 Influencing the DNS’s Security .......................................................................................................18 Recommendations and Conclusion...........................................................................................................22 About the Author ..............................................................................................................................................24 Acknowledgments ...........................................................................................................................................24 IV ATLANTIC COUNCIL #ACcyber THE POLITICS OF INTERNET SECURITY: PRIVATE INDUSTRY AND THE FUTURE OF THE WEB EXECUTIVE SUMMARY he private sector’s influence on the Internet’s that US policymakers better understand this private sector shape and behavior—and, therefore, its security— influence on the Internet so it can help shape incentives for is enormous yet understudied. This infrastructural security. influence, spanning companies like Internet Tservice providers and cloud services providers, is also This report examines two protocols as examples of private underappreciated in US policy. The US government was the sector influence over presently vulnerable systems key to the exclusive driver of Internet development for its first twenty- Internet’s function: the Border Gateway Protocol (BGP), used four years, and states continue to shape the Internet today to route Internet traffic, and the Domain Name System (DNS), through regulation, capacity-building, and direct participation used to address Internet traffic. These two case studies detail in Internet processes. But Internet governance is now largely how the protocols work, why they are vulnerable or error- privatized. This report argues that the US private sector’s prone, and what the private sector can do about it. This report unique influence on global Internet infrastructure gives it an uses empirical data on attacks and current protections. opportunity and responsibility to improve Internet security, and that the US government should better collaborate with This report concludes with a set of actionable recommendations those actors and leverage that influence. for US policymakers. The US government should add Internet protocol security best practices to federal procurement rules, This argument matters because Internet insecurity is a targeting major players with outsized influence on Internet national security issue for the United States and every infrastructure. The US government should also leverage other nation. Internet insecurity is also a selling point for the its public-private partnerships to convene forward-looking several authoritarian countries seeking to undermine trust discussions about the next set of Internet protocol security in the free and open Internet model and replace it with a challenges. This report recommends that the US government state-controlled, “sovereign” version. The US private sector, require Internet protocol protections for federal agencies. It through its influence on the Internet’s technology, protocols, recommends private sector dialogues on threat data sharing standards, and operational practices, has an opportunity for Internet protocol attacks. And it recommends a concerted and responsibility to address these problems by reshaping US reinvestment in cyber diplomacy at the State Department the Internet to make it more secure—but many firms are not to help establish state norms of nonaggression against key maximally using their influence to do so. It is critically important parts of the Internet’s infrastructure. ATLANTIC COUNCIL 1 #ACcyber THE POLITICS OF INTERNET SECURITY: PRIVATE INDUSTRY AND THE FUTURE OF THE WEB 1: INTRODUCTION he private sector plays a crucial role in defining the space is enormous yet incompletely studied and could be changing shape of the Internet, especially its security. better leveraged in US government policy. Any renewed US strategy to secure cyberspace must recognize and leverage this private sector influence, As some elements of the US government2 work to increase the Twhich spans everything from undersea fiber optic cables and security of the Internet and its users—journalists, diplomats, the management of Internet exchange points to the definition businesses, citizens—they must address the influence of Internet standards and the management of cryptographic of the private sector on global Internet security. Internet keys. Internet protocols for packet addressing and routing insecurity is a national security issue for the United States are a useful way to examine how the private sector and the and every other nation. It has become even more important US government can collaborate to improve global Internet during the COVID-19 pandemic as citizens, businesses, and security. Where the private sector may not maximally use its governments massively increase online activity that must influence to shape these digital behaviors for security, the US be secured. Internet insecurity is also a selling point for government can incentivize firms to do so. many authoritarian countries which seek to promote a state- controlled replacement for the current Internet. Many private Governments influence the shape of the global Internet today companies have influence over Internet infrastructure, and by diverse means: laws around online content takedowns, thus the power to improve Internet security, but are not commercial encryption, and data localization; interactions with maximally using it—which is where the US government can standard-setting bodies like the Internet Engineering Task provide better incentives. Force (IETF) and norm-setting bodies like the United Nations Group of Government Experts (UN GGE); and, more directly, Internet protocols for packet addressing and routing are a via the procurement and construction of public infrastructure. prime point of this influence. They are defined by the Internet Through regulation, standard-setting, diplomatic negotiations, Engineering Task Force (IETF), a multistakeholder body overseas capacity-building and investment, trade agreements, composed of many
Load more

Recommended publications
  • Securing Interdomain Network Routing with Resource Public Key Infrastructure (RPKI)
    Securing Interdomain Network Routing with Resource Public Key Infrastructure (RPKI) A Technical Paper prepared for SCTE•ISBE by Mark Goodwin IP Design Engineer Cox Communications, Inc 6305-B Peachtree Dunwoody Rd, Atlanta, GA 30328 404-269-8267 [email protected] © 2019 SCTE•ISBE and NCTA. All rights reserved. Table of Contents Title Page Number Table of Contents .................................................................................................................................... 2 1. Introduction .................................................................................................................................... 4 2. Motivations .................................................................................................................................... 4 2.1. BGP Security Analysis ....................................................................................................... 4 3. RPKI Components ......................................................................................................................... 6 3.1. Certificate Authority (CA) ................................................................................................... 7 3.2. Resource Certificate .......................................................................................................... 7 3.3. Route Origin Authorizations (ROAs)................................................................................... 8 3.4. RPKI Validating Cache .....................................................................................................
    [Show full text]
  • North Korean Cyber Capabilities: in Brief
    North Korean Cyber Capabilities: In Brief Emma Chanlett-Avery Specialist in Asian Affairs Liana W. Rosen Specialist in International Crime and Narcotics John W. Rollins Specialist in Terrorism and National Security Catherine A. Theohary Specialist in National Security Policy, Cyber and Information Operations August 3, 2017 Congressional Research Service 7-5700 www.crs.gov R44912 North Korean Cyber Capabilities: In Brief Overview As North Korea has accelerated its missile and nuclear programs in spite of international sanctions, Congress and the Trump Administration have elevated North Korea to a top U.S. foreign policy priority. Legislation such as the North Korea Sanctions and Policy Enhancement Act of 2016 (P.L. 114-122) and international sanctions imposed by the United Nations Security Council have focused on North Korea’s WMD and ballistic missile programs and human rights abuses. According to some experts, another threat is emerging from North Korea: an ambitious and well-resourced cyber program. North Korea’s cyberattacks have the potential not only to disrupt international commerce, but to direct resources to its clandestine weapons and delivery system programs, potentially enhancing its ability to evade international sanctions. As Congress addresses the multitude of threats emanating from North Korea, it may need to consider responses to the cyber aspect of North Korea’s repertoire. This would likely involve multiple committees, some of which operate in a classified setting. This report will provide a brief summary of what unclassified open-source reporting has revealed about the secretive program, introduce four case studies in which North Korean operators are suspected of having perpetrated malicious operations, and provide an overview of the international finance messaging service that these hackers may be exploiting.
    [Show full text]
  • Speaker Bios
    Quad9 public domain name service moves to Switzerland for maximum internet privacy protection Press conference, February17 2021 Short bios of speakers Bill Woodcock Chairman of the Quad9 Foundation Council Bill is the executive director of Packet Clearing House, the international non- governmental organization that builds and supports critical Internet infrastructure, including Internet exchange points and the core of the domain name system. Since entering the Internet industry in 1985, Bill has helped establish more than three hundred Internet exchange points. In 1989, Bill developed the anycast routing technique that now protects the domain name system. Bill serves on the board of directors of the M3AA Foundation, and was on the board of the American Registry for Internet Numbers for fifteen years. Now, Bill’s work focuses principally on the security and economic stability of critical Internet infrastructure. [email protected] John Todd General Manager, Quad9 John Todd has been involved with the Quad9 project since inception in 2016, and has been working with DNS since 1989. His background in ISP, server hosting, satellite- based data systems, VoIP, and other large-scale network infrastructure have constantly incorporated the DNS as an underlying technology that forms the basis of his experience. [email protected] Version: February 17, 2021 1/2 Tom Kleiber Managing Director, SWITCH Tom Kleiber has been Managing Director of SWITCH since 1 January 2021. Previously, he held various leadership positions in large and medium-sized corporations. For example, as CEO of the ICT services provider connectis AG with 350 employees, at Siemens, Alcatel and as a member of the Management Board of Microsoft Switzerland.
    [Show full text]
  • Nber Working Paper Series the Impact of the General
    NBER WORKING PAPER SERIES THE IMPACT OF THE GENERAL DATA PROTECTION REGULATION ON INTERNET INTERCONNECTION Ran Zhuo Bradley Huffaker kc claffy Shane Greenstein Working Paper 26481 http://www.nber.org/papers/w26481 NATIONAL BUREAU OF ECONOMIC RESEARCH 1050 Massachusetts Avenue Cambridge, MA 02138 November 2019 The authors are grateful to the Doctoral Office at Harvard Business School for financial support for field work. This research is partially supported by NSF OAC-1724853, NSF C-ACCEL OIA-1937165, U.S. AFRL FA8750-18-2-0049. The views and conclusions do not necessarily represent those of the Air Force Research Laboratory, the U.S. Government, or the National Bureau of Economic Research. NBER working papers are circulated for discussion and comment purposes. They have not been peer-reviewed or been subject to the review by the NBER Board of Directors that accompanies official NBER publications. © 2019 by Ran Zhuo, Bradley Huffaker, kc claffy, and Shane Greenstein. All rights reserved. Short sections of text, not to exceed two paragraphs, may be quoted without explicit permission provided that full credit, including © notice, is given to the source. The Impact of the General Data Protection Regulation on Internet Interconnection Ran Zhuo, Bradley Huffaker, kc claffy, and Shane Greenstein NBER Working Paper No. 26481 November 2019 JEL No. L00,L51,L86 ABSTRACT The Internet comprises thousands of independently operated networks, where bilaterally negotiated interconnection agreements determine the flow of data between networks. The European Union’s General Data Protection Regulation (GDPR) imposes strict restrictions on processing and sharing of personal data of EU residents. Both contemporary news reports and simple bilateral bargaining theory predict reduction in data usage at the application layer would negatively impact incentives for negotiating interconnection agreements at the internet layer due to reduced bargaining power of European networks and increased bargaining frictions.
    [Show full text]
  • Bambauer-Macro-V2-Nov 28.Docx (Do Not Delete) 12/12/14 6:26 Pm
    BAMBAUER-MACRO-V2-NOV 28.DOCX (DO NOT DELETE) 12/12/14 6:26 PM FOXES AND HEDGEHOGS IN TRANSITION DEREK E. BAMBAUER* INTRODUCTION .......................................................................................... 1 I. A FLATTER NETWORK ........................................................................... 2 II. UNIVERSAL SERVICE? .......................................................................... 7 III. THE CAST OF CHARACTERS .............................................................. 10 CONCLUSION ........................................................................................... 16 INTRODUCTION The migration from a congeries of communications protocols and technologies to an Internet Protocol-based system is an architectural shift of profound magnitude: it is as though people returned to the city of Babel, abandoning their native tongues for a single lingua franca. Perhaps, after this shift, nothing will be restrained from those who use the Internet.1 And yet, there will inevitably be problems that arise from the shift. Scholars and activists have already raised concerns about equal access to communications capabilities; about the security and resiliency of the new architecture; and about the tension between competing speech interests on the network. One way of thinking about these problems, and potential solutions, is to classify them as either hedgehogs or foxes. The British philosopher Isaiah Berlin suggested that intellectuals can be classified into these two camps, puckishly borrowing from the Greek
    [Show full text]
  • Never Agains IV February 2010
    the Availability Digest www.availabilitydigest.com More Never Agains IV February 2010 It is once again time to reflect on the damage that IT systems can inflict on us mere humans. We have come a long way in ensuring the high availability of our data-processing systems. But as the following stories show, we still have a ways to go. During the last six months, hardware/software and network faults shared responsibility, each causing about one-third of the outages. The rest of the outages were caused by a variety of problems such as power failures, construction mishaps, and hacking. Rackspace Hit with Another Outage Techcrunch, June 20, 2009 – On June 20, Rackspace suffered yet another outage1 due to a power failure. The breaker on the primary utility feed powering one of its nine data centers tripped, causing data center’s generators to start up. However, a field excitation failure escalated to the point that the generators became overloaded. An attempt by Rackspace to fail over to its secondary utility feed failed because the transfer switch malfunctioned. When the data center’s batteries ran out, the data center went down. Failovers do fail. Have a contingency plan no matter the extent of your redundancy. NYSE Suffers Several Outages in Less Than a Month Reuters, July 2, 2009 – On Thursday morning, July 2, brokers on the floor of the New York Stock Exchange found that they could not route orders, causing the NYSE to halt trading in some stocks and to extend the trading day. During the previous month, a software glitch halted trading; and an order-matching problem affected timely order reconciliation.
    [Show full text]
  • Pirates of the Isps: Tactics for Turning Online Crooks Into International Pariahs
    21st CENTURY DEFENSE INITIATIVE CyBER SECuRITy #1 July 2011 Pirates of the ISPs: Tactics for Turning Online Crooks Into International Pariahs Noah Shachtman 1775 Massachusetts Ave., NW Washington, D.C. 20036 brookings.edu Pirates of the ISPs: Tactics for Turning Online Crooks Into International Pariahs Noah Shachtman CyberSeCurity #1 July 2011 21st CENTURY DEFENSE INITIATIVE Acknowledgements every research paper is a group effort, no mat- My Wired.com colleagues—ryan Singel, kevin ter what it says on the byline. this project relied Poulsen, kim Zetter and David kravets—cover more on outside assistance than most. brookings the cybersecurity beat better than anyone. this Senior fellows Peter Singer and ken lieberthal paper would have been impossible without them, were the ones who convinced me to explore the and without brian krebs, master investigator of broad topic of cybersecurity. the panel they as- the online underworld. sembled gave me new insight with every meeting; my colleague allan friedman was an especially bill Woodcock, rick Wesson, Jeff Cooper, tyler invaluable tutor and remarkably generous with Moore, audrey Plonk, Jim lewis, Dmitri alpero- his time. heather Messera and robert o’brien vitch, Paul Nicholas, Jessica herrera-flannigan, provided important research and logistical sup- Jart armin, richard bejtlich, Steve Schleien, Jona- port. My research assistant, adam rawnsley, was than Zittrain and many, many others steered me tireless in his exploration of the minutiae of ev- away from my worst ideas and towards those few erything from tort law to pirate havens. not-so-bad ones. for that, i am deeply in their debt. brookings recognizes that the value it provides to any supporter is in its absolute commitment to quality, independence and impact.
    [Show full text]
  • Availability Digest
    the Availability Digest www.availabilitydigest.com Help! My Data Center is Down! Part 3: Internet Outages December 2011 Long gone are the days of the isolated data center. Back then, batch jobs were submitted to update databases and to generate reports. Back then, turn-around times were measured in hours or even days. In today’s competitive environment, IT services are online; and instant response times are expected. What good is a data center if no one can talk to it? Orders can’t be placed or tracked. Medical records can’t be accessed. Online banking comes to a halt. Today’s data centers must be connected. They depend upon the networks that allow users to access them online reliably and with fast response times. In the old days, a company had control over its communication network. It leased lines that it used exclusively for its purposes. If it lost communications, it had direct access to its communication carrier for rapid repair. For critical applications, companies installed redundant communication facilities so that they could continue in operation even in the presence of a communications failure on one of their lines. Not so true today. More and more, companies are relying on the public Internet to connect their users with company data centers. But how reliable is the Internet? In our previous articles in this series, we related horror stories of unimaginable power failures and storage failures that took down the best-designed data centers. In this article, we explore some notable Internet failures that rendered data centers useless even though they were otherwise fully operational.
    [Show full text]
  • Overview of Routing Security Landscape for the Quilt Member Meeting, Winter 2019 Mark Beadles, CISO, Oarnet [email protected] BGP IDLE
    Overview of Routing Security Landscape for the Quilt Member Meeting, Winter 2019 Mark Beadles, CISO, OARnet [email protected] BGP IDLE CONNECT ACTIVE OPEN OPEN SENT CONFIRM ESTAB- LISHED 2/13/2019 Routing Security Landscape - The Quilt 2 Overview of Routing Security Landscape • Background • Threat environment • Current best practices • Gaps 2/13/2019 Routing Security Landscape - The Quilt 3 Background - Definitions • BGP • Border Gateway Protocol, an exterior path-vector gateway routing protocol • Autonomous System & Autonomous System Numbers • Collection of IP routing prefixes under control of a network operator on behalf of a single administrative domain that presents a defined routing policy to the Internet • Assigned number for each AS e.g. AS600 2/13/2019 Routing Security Landscape - The Quilt 4 Background - The BGP Security Problem By design, routers running BGP accept advertised routes from other BGP routers by default. (BGP was written under the assumption that no one would lie about the routes, so there’s no process for verifying the published announcements.) This allows for automatic and decentralized routing of traffic across the Internet, but it also leaves the Internet potentially vulnerable to accidental or malicious disruption, known as BGP hijacking. Due to the extent to which BGP is embedded in the core systems of the Internet, and the number of different networks operated by many different organizations which collectively make up the Internet, correcting this vulnerabilityis a technically and economically challenging problem. 2/13/2019 Routing Security Landscape - The Quilt 5 Background – BGP Terminology • Bogons • Objects (addresses/prefixes/ASNs) that don't belong on the internet • Spoofing • Lying about your address.
    [Show full text]
  • Potential Human Cost of Cyber Operations
    ICRC EXPERT MEETING 14–16 NOVEMBER 2018 – GENEVA THE POTENTIAL HUMAN COST OF CYBER OPERATIONS REPORT ICRC EXPERT MEETING 14–16 NOVEMBER 2018 – GENEVA THE POTENTIAL HUMAN COST OF CYBER OPERATIONS Report prepared and edited by Laurent Gisel, senior legal adviser, and Lukasz Olejnik, scientific adviser on cyber, ICRC THE POTENTIAL HUMAN COST OF CYBER OPERATIONS Table of Contents Foreword............................................................................................................................................. 3 Acknowledgements ............................................................................................................................. 4 Executive summary ............................................................................................................................. 5 Introduction....................................................................................................................................... 10 Session 1: Cyber operations in practice .………………………………………………………………………….….11 A. Understanding cyber operations with the cyber kill chain model ...................................................... 11 B. Operational purpose ................................................................................................................. 11 C. Trusted systems and software supply chain attacks ...................................................................... 13 D. Cyber capabilities and exploits ..................................................................................................
    [Show full text]
  • High Volume of European Network Traffic Re-Routed Through China
    Memo 11/06/2019 - TLP:WHITE High volume of European network traffic re-routed through China Telecom Reference: Memo [190611-1] Date: 11/06/2019 - Version: 1.0 Keywords: BGP, digital infrastructure, China Sources: publicly available information Key Points A routing incident led to 70 000 routes used for European traffic being redirected through China Telecom for over 2 hours. Border Gateway Protocol (BGP) errors are a relatively common issue but usually last just a few minutes. China Telecom has still not implemented some basic routing safeguards to detect and remediate them in a timely manner. Summary On June 6, a routing incident led to over 70 000 routes used for European mobile networks being redirected through China Telecom for over two hours. The incident began at 09:43 UTC when Swiss data centre colocation company Safe Host (AS21217) unintentionally leaked over 70 000 routes to China Telecom (AS4134) in Frankfurt, Germany. China Telecom then announced these routes on to the global internet redirecting large amounts of traffic destined for some of the largest European mobile networks through China Telecom’s network. Some of the most impacted European networks included Swisscom (AS3303) of Switzerland, KPN (AS1136) of Holland, Bouygues Telecom (AS5410) and Numericable-SFR (AS21502) of France. Often routing incidents only last for a few minutes, but in this case, many of the leaked routes were in circulation for over two hours. Comments China Telecom, a major international carrier, has still not implemented neither the basic routing safeguards necessary to prevent propagation of routing leaks nor the processes and procedures necessary to detect and remediate them in a timely manner when they inevitably occur.
    [Show full text]
  • The Relationship Between Local Content, Internet Development and Access Prices
    THE RELATIONSHIP BETWEEN LOCAL CONTENT, INTERNET DEVELOPMENT AND ACCESS PRICES This research is the result of collaboration in 2011 between the Internet Society (ISOC), the Organisation for Economic Co-operation and Development (OECD) and the United Nations Educational, Scientific and Cultural Organization (UNESCO). The first findings of the research were presented at the sixth annual meeting of the Internet Governance Forum (IGF) that was held in Nairobi, Kenya on 27-30 September 2011. The views expressed in this presentation are those of the authors and do not necessarily reflect the opinions of ISOC, the OECD or UNESCO, or their respective membership. FOREWORD This report was prepared by a team from the OECD's Information Economy Unit of the Information, Communications and Consumer Policy Division within the Directorate for Science, Technology and Industry. The contributing authors were Chris Bruegge, Kayoko Ido, Taylor Reynolds, Cristina Serra- Vallejo, Piotr Stryszowski and Rudolf Van Der Berg. The case studies were drafted by Laura Recuero Virto of the OECD Development Centre with editing by Elizabeth Nash and Vanda Legrandgerard. The work benefitted from significant guidance and constructive comments from ISOC and UNESCO. The authors would particularly like to thank Dawit Bekele, Constance Bommelaer, Bill Graham and Michuki Mwangi from ISOC and Jānis Kārkliņš, Boyan Radoykov and Irmgarda Kasinskaite-Buddeberg from UNESCO for their work and guidance on the project. The report relies heavily on data for many of its conclusions and the authors would like to thank Alex Kozak, Betsy Masiello and Derek Slater from Google, Geoff Huston from APNIC, Telegeography (Primetrica, Inc) and Karine Perset from the OECD for data that was used in the report.
    [Show full text]