Download - Whois - Addressing the Asia Pacifc
Issue Date:
Revision:
Whois that? Addressing the Asia PacificAdam Gosling
Internet Policy Development Consultant, APNIC
PRFP-9
29 June 2016, Port Moresby, Papua New Guinea
Agenda
• What is APNIC?
• APNIC’s role in Cybersecurity
• Delegation and Registration
• Whois Improvements
• Policy SIG discussion
What is APNIC?
What is APNIC?
• The Regional Internet number Registry for the Asia Pacific region
• A neutral, independent, not-for-profit, open membership organization
• A Secretariat with ~ 70-75 staff
• Operating since 1993
• Based in Brisbane, Australia
4
5
APNIC’s Vision
A global, open, stable and secure Internet that serves the entire Asia
Pacific community
What APNIC does
• Number resource management– IPv4 & IPv6, ASN
• Whois Database – public register– Technical & abuse tracking & troubleshooting– Protect against address hijacking
• Information dissemination– APNIC Conferences & events– Publications & Research
• Capacity Building– Training, Technical assistance, & Development
How do we work?
• Events – APNIC / APRICOT Conferences and Regional meetings– Network Operators Groups (NOGs) and Security Conferences
• Training and Technical Assistance Services– https://training.apnic.net
• Collaboration – With International, Regional
& Local Organizations
• Blog & Social Media – https://blog.apnic.net
• Outreach campaigns – Ready to ROA!
APNIC Events
8
201516 economies: PK,
BD, LK, MM, KH, TH, MY, SG, PH, ID, SB, JP, MN, GU, LA, MG
Attendance• Conferences:
1,364• Member outreach
events: 614
ARM, Philippines
APNIC 40
APRICOT 2015
APNIC 40
APRICOT 2016
2016 so far• Conference: 531
(NZ)• Member outreach
events: 186 (NP); 14 (TH)
9
APNIC Training
2016(to date)
• 24 F2F courses held in 15 locations
• 616 F2F trainees
• 456 trainees in 57 eLearning sessions
• Video archives: 101 videos; 377,541 views
10
Technical Assistance
TAS - Thailand TAS - Bangladesh
Support for scalable and resilient networks and best practices in
network operations
• Distribution and registration of resources• Supporting reverse DNS delegation• Managing whois and IRR• Resource Certification• IPv6 deployment• Internet infrastructure security
www.apnic.net/tas
2016 outreach (to date)Indonesia (2 Members)
11
NOG Outreach
BTNOG 1 SANOG 24
MMNOG
SGNOG 2015
MMNOG 2015
www.apnic.net/nog
2016: JANOG (Jan), PHNOG (Jan), SANOG (Jan), bdNOG (Apr)
… and many more to come!
• Technical and APNIC updates
• Hostmaster consultations
• Training sessions
• Sponsorship and logistical support
bdNOG 5
12
RIPE Atlas anchor deployment in Maldives – Dhiraagu staff
Community Development
Supported 5 RIPE Anchor deployments; distributed 120
RIPE Atlas probes
24 fellowships for APNIC 40 including 6 youth fellowships;
24 for APRICOT 2016
Supporting new L-root (ICANN) server instance in
Apia, Samoa
Working with NSRC in New Caledonia and Samoa on IXP
support
SANOG
Probe hosts in the Philippines
MoU signing for L-root
SANOG 27
13
The APNIC Development Program
Supports the growth of the Asia Pacific community by
providing:
• Training and technical assistance
• Infrastructure support
• Grants and awards• Research
14
The APNIC Foundation
Established in Hong Kong to support and expand the APNIC
Development Program
APNIC’s role in Cybersecurity
15
Can APNIC stop network abuse?
• No, because…– APNIC is not an ISP and does not provide network
connectivity to other networks– APNIC does not control Internet routing– APNIC is not a law enforcement agency– APNIC has no industry regulatory power
• What can we do?
Collaboration: Working together
17
Adli Wahid
Craig Ng
Participation in NOGs, CSIRTS and LEA events to
educate and learn
Promoting new initiatives & security best practices
among Members
Internet Investigation Training for LEAs: NZ, SG, BN & ID
Best Current Practices in Security
• Target Audience – IP Network Operators & Internet Service Providers– Regulators and Policy Makers
• Philosophy– Operationally relevant– Up to date
• Topics– Routing security: Resource Public Key Infrastructure (RPKI) – DNS and DNSSEC – Source Address Validation (SAVE) – Whois Database – IRT records– Establishing CSIRTs
19
Security Outreach
Craig Ng
NOGs, CSIRTS and LEA events
PK, CN, HK, KR, JP, PH, SG, MY, ID, AU, LK, MV, TW
Collaboration with JICA and KISA to deliver regional
CERT training
Geoff Huston member of ICANN SSAC
Adli Wahid member of FIRST Board; invited to join INTERPOL Global
Cybercrime Expert Group
www.apnic.net/security
Adli Wahid
RPKI
20
RPKI presentations to NOGs and conferences
‘Ready to ROA’ Campaign – hands-on sessions to help
Members create ROAs
Shirts, stickers, web content to promote campaign
Regional RPKI adoption grown rapidly in past 15 months – 0.8% to 3.24% and rising
www.apnic.net/roa
• 10 face-to-face and eLearning RPKI training courses delivered in 2015
• Offline simulation of production system• Create and revoke ROAs, observe
changes to routing state in lab
Delegation and Registration
21
Delegation Hierarchy Diagram
22
Allocated to APNIC: Maint-by can only be changed by IANA
Allocated to Member: Maint-by can only be changed by APNIC
Sub-allocated to Customer: Maint-by can only be changed by Member
The APNIC Whois Database
• Holds IP address records within the AP region• Can use this database to track down the source of
the network abuse– IP addresses, ASNs, Reverse Domains, Routing policies
• Can find contact details of the relevant network administrators – not the individual users– use administrators log files to contact the individual
involved
Resource Registration
• As part of the membership agreement with APNIC, all members are required to register their resources in the APNIC Whois database.
• Members must keep records up to date:– Whenever there is a change in contacts– When new resources are received– When resources are sub-allocated or assigned
24
Customer Privacy
• Public data– Includes portable addresses (inetnum objects), and other
objects e.g. route objects– Public data: must be visible
• Private data– Can include non-portable addresses (inetnum objects)– Members have the option to make private data visible
• Customer assignments– Can be changed to be public data (public data is an
optional choice)
What can you do?
• Use the APNIC Whois Database to obtain network contact information
• APNIC Whois may or may not show specific customer assignments for the addresses in question– But will show the ISP holding APNIC space
• Contact the network responsible and also its ISP/upstream
• Contact APNIC for help, advice, training or support
• Community discussions can be raised in the APNIC conferences, mailing lists, etc.
Whois improvements
27
Steps we take to ensure Whois accuracy• Member account opening
– verification of corporate existence with corporate registries or regulators (where possible)
• Membership renewal– once a year– email to corporate contact, with payment record– Internet resources revoked if account not paid or
renewed
• Transfer policies– encourage registration of resources– “value” of Internet resources encourage registration
Whois Accuracy Project
29
Simplifying contact update process
Assisting with IRT registration process
Clearer information about PoC in IP address object
Guidelines on using and updating
information in whois
Monthly cleanup program on
referenced objects (12 months+)
Easily report invalid contacts
Improving database and
information accuracy to
provide better user experience
MyAPNIC Improvements
30
Improving major features of MyAPNIC
Authorized contact management
Bulk Whois record management
Reverse DNS management
Route and ROA management
MyAPNIC speed improvement – 24% faster response time
Simplified whois updates
Registration Data Access Protocol
31
Standardizes the query format
Standardizes the response format
Commonly-used technologies
Supports redirection
Internationalization using UTF-8
RDAP Deployed in production 2015
Solves a number of limitations to WHOIS protocol
www.apnic.net/rdap
What if Whois info is invalid?
• Customer assignment information is the responsibility of ISPs– ISPs are responsible for updating their customer network registrations
• Tools such as ‘traceroute’, ‘looking glass’ and RIS may be used to track the upstream provider if needed
• Members (ISPs) are responsible for reporting changes to APNIC – Under formal membership agreement
• Report invalid ISP contacts to APNIC– http://www.apnic.net/invalidcontact – APNIC will contact member and update registration details
Community Discussion
33
Internet Policies
• Policies change to the meet current needs• There is a system in place called the Policy
Development Process– Anyone can participate– Anyone can propose a policy– All decisions & policies documented & freely available to
anyone
• Decisions made in the Policy SIG by consensus of those participating
35
Whois data quality improvement
Community discussion
APNIC 41 SIG MeetingSIG discussion on APNIC whois
data quality improvement
Mailing listChairs send call for further
community participation
Secretariat Initiatives
Improved online toolsContinuous improvement of MyAPNIC online services
Services outreachStaff work with individual Members to check whois
What can be done to improve accuracy?Should operators be punished, or lose their resources?
Have your say: www.apnic.net/policy-sig
Next APNIC Conference
36
APNIC 42 (with bdNOG 6), Dhaka, Bangladesh29 Sep - 6 Oct 2016
conference.apnic.net/42
APNIC Conferences in 2017
• APRICOT 2017 / APNIC 43– Ho Chi Minh City, Vietnam– 20 February to 3 March 2017
• APNIC 44– Taichung, Taiwan– 7 to 14 September 2017
37
Coming soon: APNIC Survey 2016
38
We want your views on APNIC!
Survey opens July – more details soon
Thank youAdam [email protected]@bout_policy