In November 2013 we launched, in partnership with BGPmon, a new project called the Routing Resilience Survey. This effort is based on collecting incident data related to routing resilience from an operator's point of view. This approach allows us not only to filter out false positives – for instance, legitimate configuration changes – but also to record the impact and the severity of the incident. With more than 300 ASNs now reporting, this presentation shows some early results of the survey.

1. www.internetsociety.org
Resilience of the Internet routing –
a network operator’s view

2. How “risky” is the global routing system?
How often incidents happen?
– Routing Resilience Measurements Workshop
http://www.internetsociety.org/doc/report-routing-resiliency-measurements-
workshop
– Frequency very much depends on the threshold for false positives
What is the impact?
– Data are missing, sensitive or not collected at all
– Risk assessment is a guess at best
Is your network affected?
– Detect incidents
– Eliminate false positives
– Assess the impact
Are you adequately protected?

3. https://www.internetsociety.org/rrs/

4. Data collection
Network Information
– Once, during the initial sign up.
– Network type, connectivity, and practices used in mitigating routing
security incidents. It should take approximately 10-15 minutes to fill out
the registration form.
Data related to routing security incidents via an automated
monitoring effort
– On first login a “historical” overview will be presented, listing detected
suspicious events over last 6-12 months
– After that once a week newly detected suspicious events are collected
and displayed in the portal
– Participants are asked to validate and classify these events
§ Impact: severe, moderate, insignificant, not an incident
§ Detection: monitoring system, customer call, this alert

5. Evidence based risk analysis
64500
64500
64500
64500
64500
64500

6. Evidence based risk analysis
64500
64500
64500
64500
64500
64500
Check and Classify

7. Confidentiality concerns
We understand the sensitivity of some of the data
involved in this effort. Therefore, the Internet Society is
committed to ensuring participant-specific information
remains confidential.
All data collected is stored on Internet Society servers.
Any information or analyses shared beyond a specific
network will be fully anonymized.

8. Some statistics: participation
4 months
24 participants
311 networks
442 events registered
264 events classified
0
50
100
150
200
250
300
350
Networks
Participants

9. 0"
5"
10"
15"
20"
25"
30"
35"
40"
8/28/11"
9/28/11"
10/28/11"
11/28/11"
12/28/11"
1/28/12"
2/28/12"
3/28/12"
4/28/12"
5/28/12"
6/28/12"
7/28/12"
8/28/12"
9/28/12"
10/28/12"
11/28/12"
12/28/12"
1/28/13"
2/28/13"
3/31/13"
4/30/13"
5/31/13"
6/30/13"
7/31/13"
8/31/13"
9/30/13"
10/31/13"
11/30/13"
12/31/13"
1/31/14"
Unknown"
Not"an"incident"
Insignificant"
Moderate"
Severe"
Impact severity

10. Impact severity (II)
1%#3%#
6%#
42%#
48%# Severe#
Moderate#
Insignifcant#
Unknown#
Not#an#incident#

11. How did you learn about the event?
NMS$Alert$
Customer$Call$
RRS$Alert$
Not$an$incident$

12. Interested in Participating?
If you decide to participate, please send a request for
the creation of your account to rrs-admin@isoc.org.
In the request please indicate
– your AS number and
– e-mail address for notifications.
You may also include AS numbers of your customers for
which you would like to monitor and classify related
security incidents.