How do large internet entities such as internet service providers (ISPs), cloud providers and national networks communicate with each other? They use border gateway protocol (BGP).

The problem is that, as noted by Bleeping Computer, BGP security is lacking. The protocol was developed in the late 1980s, when data security wasn’t top of mind for emerging internet entities. As a result, BGP hijacks are now, as Wired put it, “the internet’s biggest security hole.” This prompted two government agencies — the National Institute of Standards and Technology (NIST) and the Department of Homeland Security (DHS) — to team up and develop a new set of security standards to close border gateway loopholes.

Breaking Borders

So what’s in a BGP breach? The idea is to subvert BGP’s purpose. When one large network needs to route data to another, BGP tells routers which IP blocks are available on the destination network and which are the most reliable.

Fraudsters can compromise this process by advertising available IP blocks that don’t actually exist on legitimate networks. Data is then sent directly to attacker-controlled routers and servers.

Even worse, BGP lacks basic security services. Enterprises may not be aware that data security has been compromised because no errors would have been reported. Information is sent somewhere without incident — the destination is simply altered.

Joining Forces for BGP Security

NIST and DHS are no strangers to teaming up. As noted by the official NIST website, the two agencies are jointly sponsoring the 2018 Global City Teams Challenge, which aims to improve the security, resiliency and reliability of smart city systems.

For BGP security, NIST and DHS created the Secure Inter-Domain Routing (SIDR) framework, which has been in development for several years but just recently began rolling out on the Internet Engineerinng Task Force (ITEF) portal. To effectively secure BGP routing, SIDR leverages three components:

  • Resource Public Key Infrastructure (RPKI). This allows providers that hold large blocks of internet addresses to stipulate which networks can announce a direct address block connection, reducing the chance of cybercriminal networks calling the shots.
  • BGP Origin Validation. Using RPKI information, routers can filter out route announcements that aren’t from authorized locations.
  • BGP Path Validation. Also called BGPsec, the idea here is to use digital router signatures to ensure that traffic only crosses authorized networks. This kind of path monitoring should help eliminate the ability of attackers to carry out undetected hijacks.

This isn’t a matter of scaling up existing BGP security — it’s about creating a solid foundation after the fact. The NIST/DHS effort gives organizations a starting point for BGP security that, if widely implemented, should help eliminate the majority of border gateway attacks.

More from

Tequila OS 2.0: The first forensic Linux distribution in Latin America

3 min read - Incident response teams are stretched thin, and the threats are only intensifying. But new tools are helping bridge the gap for cybersecurity pros in Latin America.IBM Security X-Force Threat Intelligence Index 2023 found that 12% of the security incidents X-force responded to were in Latin America. In comparison, 31% were in the Asia-Pacific, followed by Europe with 28%, North America with 25% and the Middle East with 4%. In the Latin American region, Brazil had 67% of incidents that X-Force…

Cost of a data breach 2023: Geographical breakdowns

4 min read - Data breaches can occur anywhere in the world, but they are historically more common in specific countries. Typically, countries with high internet usage and digital services are more prone to data breaches. To that end, IBM’s Cost of a Data Breach Report 2023 looked at 553 organizations of various sizes across 16 countries and geographic regions, and 17 industries. In the report, the top five costs of a data breach by country or region (measured in USD millions) for 2023…

The Growing Risks of Shadow IT and SaaS Sprawl

4 min read - In today's fast-paced digital landscape, there is no shortage of apps and Software-as-a-Service (SaaS) solutions tailored to meet the diverse needs of businesses across different industries. This incredible array of options has revolutionized how we work, providing cost-effective and user-friendly tools that streamline tasks and boost productivity. However, this ever-expanding application ecosystem comes with its challenges: namely, shadow IT and SaaS sprawl. According to a recent study by Entrust, 77% of IT professionals are concerned about shadow IT becoming a…

Are you ready to build your organization’s digital trust?

4 min read - As organizations continue their digital transformation journey, they need to be able to trust that their digital assets are secure. That’s not easy in today’s environment, as the numbers and sophistication of cyberattacks increase and organizations face challenges from remote work and insider behavior. Digital trust can make your organization’s digital transformation stronger. A lack of digital trust can do irreparable harm. However, according to ISACA’s State of Digital Trust 2023 report, too many organizations struggle to define and implement…