PLNOG31 - Should only banks follow the example of... (Andrzej Karpiński and Piotr Wojciechowski)

# Overview

Andrzej Karpiński and Piotr Wojciechowski present DDoS protection best practices for medium-sized enterprises based on Polish Financial Supervision Authority (KNF) recommendations. The presentation demonstrates that telecommunications industry expertise in internet connectivity can protect organizations beyond banking sector institutions.

# Key Topics

## Internet Link Architecture Proper internet edge design fundamentally determines organizational resilience to DDoS attacks. The KNF guidance categorizes four link types by characteristics:

**International Transit**: Expensive with limited bandwidth, many hops, high latency, high DDoS attack probability. Entire global internet accessible.

**Domestic Transit**: Paradoxically sometimes more expensive than international, fewer hops, lower latency, significantly lower attack probability. Polish networks total approximately 2,000—enabling rapid national-level detection and mitigation of threats.

**Peering Links**: Very low cost (interface and bandwidth fees only), extremely high throughput, zero hops, minimal latency. Organizations control directly connected sources, making DDoS from peered operators impossible.

**CDN/Resource Links**: Local content caching (YouTube, Facebook, Google) improves user experience and reduces load on paid transit links.

## BGP Routing Strategy Most organizations implement BGP passively—purchasing internet through tenders without understanding routing implications or achieving conscious link management. The presentation advocates strategic BGP management: maintaining full routing tables, selecting operators carefully, implementing community-based filtering, and continuously monitoring prefix changes.

## Operator Selection Operators are service providers, not integrators. Large operators provide superior infrastructure, multiple presence points, BGP community filters, and DDoS scrubbing services. Smaller local operators often lack proper infrastructure and community filtering, making them unsuitable despite lower pricing.

## DDoS Mitigation Techniques Black-holing and null-routing via router null interfaces are cost-effective, network-wide mitigation methods. When properly configured across network nodes, these eliminate harmful traffic at the first ingress point, ideally before reaching target organizations.

## Infrastructure Design Principles Critical services (banking) should operate on dedicated infrastructure separate from general internet connectivity. Physical cable routing documentation and redundancy are essential. Out-of-band management enables recovery during network compromise. Equipment should maintain 10x performance overprovision. Organizations must implement proper device lifecycle management (3-5 year replacement cycles).

# Technical Details

The presentation includes a practical case study testing international disconnect scenarios using BGP communities. Monitoring via University of Portland's BGP prefix tracking project revealed:

- Operators frequently implement community-based filtering inconsistently across their ASes - Hurricane Electric and similar transit providers commonly cause prefix "leaking" (unintended propagation) - Standard community exports are not universally accepted despite RFC compliance - Real-time monitoring reveals operator outages and misconfigurations affecting traffic paths - Proper operator selection enables visibility into connection quality to remote global resources

The speakers advocate for simplified operator-provided tools—a single "kill external" community command—rather than complex, operator-specific configurations requiring constant manual maintenance.

Advanced monitoring enables comparative operator quality assessment by analyzing BGP path changes, detecting anomalies automatically, and reporting performance differences to specific remote destinations.

# Takeaways

1. Design traffic architecture and failure scenarios before selecting operators or links 2. Implement multiple link types from different operators; single-link systems are inherently vulnerable 3. BGP routing strategy protects against DDoS more effectively than edge scrubbing services alone 4. Organizations should demand simplified community filters and kill-switch capabilities from operators 5. BGP prefix monitoring tools validate whether purchased services deliver advertised protection 6. Physical cable routing, equipment selection, and redundancy design justify specialist consulting 7. Continuous monitoring of prefix changes and operator performance enables rapid incident response 8. Poland's limited network count (~2,000) provides natural advantage for rapid national-level DDoS mitigation