How do you handle BGP security incidents and coordinate with other network operators and authorities?

1 Detect and analyze incidents

The first step to handle BGP security incidents is to detect and analyze them. You need to monitor your BGP routers and peers, as well as external sources, such as BGP looking glasses, route servers, or security reports, to identify any anomalies or suspicious events. You also need to collect and examine relevant data, such as BGP messages, logs, traceroutes, or packet captures, to determine the root cause, scope, and impact of the incident.

2 Mitigate and resolve incidents

The second step to handle BGP security incidents is to mitigate and resolve them. You need to take appropriate actions, such as filtering, withdrawing, or announcing routes, to restore normal traffic and prevent further damage. You also need to apply best practices, such as prefix filtering, RPKI validation, or BGPsec, to enhance your BGP security and prevent recurrence of similar incidents.

3 Communicate and coordinate with others

The third step to handle BGP security incidents is to communicate and coordinate with others. You need to inform and collaborate with your peers, upstreams, downstreams, or customers, as well as relevant authorities, such as CERTs, ISPs, or registries, to share information, report incidents, or request assistance. You also need to follow established protocols, such as MANRS, or use common tools, such as PeeringDB, IRR, or RIPE Atlas, to facilitate communication and coordination.

4 Document and review incidents

The fourth step to handle BGP security incidents is to document and review them. You need to record and archive all the details, actions, and outcomes of the incident, as well as any feedback or lessons learned. You also need to review and evaluate your BGP security policies, procedures, and performance, and identify any gaps, weaknesses, or improvements.

5 Educate and train yourself and others

The fifth step to handle BGP security incidents is to educate and train yourself and others. You need to keep yourself updated and informed about the latest BGP security trends, threats, and solutions. You also need to train and educate your staff, peers, or customers about BGP security best practices, standards, and tools.

6 Participate and contribute to the community

The sixth step to handle BGP security incidents is to participate and contribute to the community. You need to join and engage with BGP security forums, groups, or events, such as NANOG, RIPE, or FIRST, to exchange knowledge, experience, and feedback. You also need to contribute and support BGP security initiatives, projects, or research, such as BGPMon, CAIDA, or Cymru, to improve the overall BGP security and resilience.

7 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?