Concerns about the security of frame relay networks were posted here
before the (Sun) sendmail bug consumed most of the bandwidth.
Comments about the need to trust the carrier's configuration seemed to
undermine the advertised model of frame relay as a virtual PRIVATE network.
Without stating it explicitly, these comments left the impression that
users should be more concerned with a frame relay network than
with the set of private lines providing the same connectivity.
There is no reason to think that carriers are more likely to connect tail
circuits incorrectly for frame relay than for point-to-point lines.
Although their staff are more familiar with traditional leased line connections,
it is common for the best staff to choose to work on the newest technology.
Circuit connection errors can occur. However, it is unlikely that the
data-link addressing (DLCI) would match between your router config and
the other customers' mistakenly cross-connected line config.
If DLCI configs don't match up, the switches should drop the frames - test
this yourself by deliberately putting "wrong" DLCI definitions in your router.
Above the data-link layer, you should run a proper routable protocol
(IP, CLNP, AppleTalk, IPX, DECnet). Your routers should drop any packets that
don't have the correctly matching network (or area) configuration.
If you are security conscious (else why would you read this list),
don't use the auto-config capabilities router vendors provide.
Then if the configurations don't match up you fail safely.
A new set of issues is introduced if you share your frame relay network
with a business partner. This is not quite as bad as sharing an ethernet
with a partner because it eliminates the eavesdropping potential of a true
broadcast network. Access control in the routers should enforce the
access agreements between parties.
I used to worry that the frame relay switches might make it easier for the
carrier to snoop on a virtual connection. The opposite is true.
Private lines are provisioned with switch equipment which can easily monitor
any circuit. How can you trust that they don't snoop?
Only the economics of competition guarentee that they don't already snoop.
It costs too much, both in risk of exposure and equipment.
To keep these costs up, and the incentive to snoop down, demand and use
higher capacity data services at low prices.
If there are specific security holes in frame relay, tell me right away ;-)
|
|
