<html theme="default-light" iconset="color"><head>
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
</head><body style="font-family: Calibri; font-size: 14px;"
text="#485663"><div style="font-size: 14px;font-family: Calibri;">Hi
Wout,<br><br>I'm concerned about this approach to networking security
for a numbers of reasons.<br><br>1. Mixing unrelated technologies<br><br>RPKI
and DNSSEC are fundamentally different technologies with different
applications in the networking stack. I don't think it's productive to
mix the two together in the same discussion space because their aims and
outcomes are significantly different.<br><br>2. It's unclear what is
being proposed<br><br>DNSSEC can be deployed at a resolver level, or at a
domain level or at the registrars.� The use cases for each of these
scenarios vary widely.<br><br>At the domain level, as Michele mentioned,
DNSSEC is a notoriously brittle and complex protocol and while it may
be relevant and appropriate for institutions or large enterprises, it's
not really appropriate for smaller organisations or individuals which
comprise the majority of registered domains.<br><br>Further up the chain
at registrars and registries, it's also complex, as the recent .ru
outage showed. Smaller registrars may easily end up causing more damage
than they secure, and there would be good arguments for DNSSEC not to be
a mandatory component of registrar service.<br><br>RPKI can be
"deployed" as either creating ROA objects, or else by implementing RPKI
policy at the networking level using validators and routing policies.
Again, these are two entirely different things with different security
goals and outcomes, but there is no clear indication of what the IS3C
consultation is actually promoting.<br><br>Overall, RPKI can be helpful
to address certain styles of accidental network configuration, but it is
not a technology which can be used to protect against dedicated
security threat actors.<br><br>3. Over-focusing on individual security
elements<br><br>Security management is a wide-ranging process-oriented
mechanism rather than an outcome of applying specific security-related
technology components.� There would be no reason not to include
assessment of RPKI or DNSSEC as part of a more general information
security management assessment assessment process, but in the scale of
things, they are individual components of a larger security management
whole, and operationally they are by no means among the more important
components for most organisations.<br><br>4. Unclear what the focus
outcome is intended to be<br><br>There isn't a clear problem statement
or any indication about why it's more important to prioritise RPKI and
DNSSEC over other discrete technology building blocks. For example, in
terms of routing security, the MANRS programs provide a useful and well
accepted set of compliance items, of which RPKI is one of the optional
components, i.e. not even mandatory (disclosure: I am a MANRS SC member,
but this email reflects my personal opinions).<br><br>The thing that
will help the Internet's overall security is adherence to Internet good
practice documents, and at the next level, adoption and compliance with
general security management frameworks (there are plenty of these).
Hyper-focus on individual line items will distract attention away from
these aims and the outcome of focusing on individual security items in
the way that this consultation suggests is likely to come at the cost of
the whole.<br><br>Nick<br><br><span>Wout de Natris wrote on 11/03/2024
10:00:</span><br><blockquote type="cite"
cite="mid:DB9P191MB169205FA3AD136849DBCA6F2C2272@DB9P191MB1692.EURP191.PROD.OUTLOOK.COM"><meta
http-equiv="Content-Type" content="text/html; charset=windows-1252">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
<div class="elementToProof" style="font-family: Calibri, Helvetica,
sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Dear colleagues,</div>
<div class="elementToProof" style="font-family: Calibri, Helvetica,
sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<p class="elementToProof" style="margin-top: 0px; margin-bottom: 0px;"><span
style="font-family: Arial, sans-serif; font-size: 11pt; color: rgb(0,
0, 0);">IGF DC IS3C invites you to participate in the consultation on
positively enhancing the deployment of two
Internet standards: DNSSEC and RPKI. You are invited to answer either
of these questions: Do the arguments used to favor a positive decision,
convince you to order deployment within your organisation or from your
service provider? / Do they assist you to convince
decision takers in your organisation to invest in security by design?
You are invited to share your views and arguments with IS3C�s expert
team and have been granted commenting rights in this document to do so.
The consultation runs from
</span><span style="font-family: Arial, sans-serif; font-size: 11pt;
color: rgb(0, 0, 0); font-weight: 700;">11 March to 12PM UTC, Friday 5
April 2024</span><span style="font-family: Arial, sans-serif; font-size:
11pt; color: rgb(0, 0, 0);">. Your contribution
will be taken into consideration when finalising the text before
publication this spring. Here is the link to the Google Doc:</span></p>
<div><span style="font-family: Calibri, Helvetica, sans-serif;
font-size: 12pt; color: rgb(0, 0, 0);"><br>
</span></div>
<p style="direction: ltr; line-height: 1.38; margin-top: 0pt;
margin-bottom: 0pt;">
<span style="font-family: Arial, sans-serif; font-size: 11pt; color:
rgb(0, 0, 0); font-weight: 700;"><a
href="https://docs.google.com/document/d/1YYq3ie9D03L1Z5ssgPbWKV5becUgNw0h7_fmm9xGWKs/edit?usp=sharing"
id="OWA47599b1c-6b58-8aee-5aa6-2c284efaf383" class="OWAAutoLink"
style="margin-top: 0px; margin-bottom: 0px;" data-auth="NotApplicable"
moz-do-not-send="true">https://docs.google.com/document/d/1YYq3ie9D03L1Z5ssgPbWKV5becUgNw0h7_fmm9xGWKs/edit?usp=sharing</a></span></p>
<div class="elementToProof" style="font-family: Calibri, Helvetica,
sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="background-color: rgb(255, 255, 255);">
<div class="elementToProof"><span style="font-family: Calibri,
Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">We hope to
receive your views so we can present the most convincing arguments to
deploy DNSSEC, RPKI and all other security-related
Internet standards and ICT best practices. (FYI, this project us
sponsored by ICANN and RIPE NCC.)</span></div>
<div><span style="font-family: Calibri, Helvetica, sans-serif;
font-size: 12pt; color: rgb(0, 0, 0);"><br>
</span></div>
<div><span style="font-family: Calibri, Helvetica, sans-serif;
font-size: 12pt; color: rgb(0, 0, 0);">Kind regards,</span></div>
<div><span style="font-family: Calibri, Helvetica, sans-serif;
font-size: 12pt; color: rgb(0, 0, 0);"><br>
</span></div>
<div><span style="font-family: Calibri, Helvetica, sans-serif;
font-size: 12pt; color: rgb(0, 0, 0);">Wout de Natris</span></div>
<div><span style="font-family: Calibri, Helvetica, sans-serif;
font-size: 12pt; color: rgb(0, 0, 0);"><br>
</span></div>
<div><span style="font-family: Calibri, Helvetica, sans-serif;
font-size: 14pt; color: rgb(237, 92, 87);">IS3C: Making the Internet
more secure and safer</span></div>
</div>
<br><fieldset class="mimeAttachmentHeader"></fieldset><br></blockquote></div></body></html>