Is MPLS Network Really Secure? MPLS truth revealed against security.
The truth is that MPLS offers-
No protection against misconfiguration - Human and machine errors as well as OS bugs can result in MPLS traffic being misrouted.
No protection from attacks within the core - MPLS is vulnerable to all the traditional WAN attack vectors.
No protection or detection of sniffing/snooping - It is impossible to detect if someone is siphoning or replicating data - there is no alarm that goes off if data is being stolen.
No Data Security - The data is left in the clear and can be accessed, replicated, or used by anyone who gains access to it.
The illustration above shows the components of an MPLS header. Note the absence of any security measures within the header itself.
None of these mechanisms provide security.
Also note that the original IP packet is unchanged, which means with MPLS- your data traverses a shared network in the clear.
Hackers and Data Thieves know better!
There are papers and video tutorials readily available on the Internet that provide a cook book approach to sniffing and redirecting MPLS traffic. Heres what Black Hat had to say about MPLS security claims:
Providers say: There are controls around provisioning and management.
Hackers know: Provisioning and management are to data security what traffic lights are to bank robbers - they do not prevent data theft!
Providers say: There are gateways between the Internet and the MPLS network.
Hackers know: Traffic is not accidentally leaking out to the Internet, it is being stolen right off the MPLS backbone!
Providers say: They use Netflow/J-Flow to identify malicious activity.
Hackers know: Post-event notification is not a substitute for prevention!
0 Visitor Reactions & Comments:
Post a Comment