A Practical Primer on BGP Security for Network Operators

Route hijacks cost businesses millions annually. This guide walks through the essential BGP security measures every network operator should implement.

1. RPKI (Resource Public Key Infrastructure) RPKI cryptographically binds IP prefixes to their authorized origin ASNs. Implementing Route Origin Authorization (ROA) records is the first line of defense.

2. Route Origin Validation (ROV) Configure your routers to drop or de-preference routes that fail RPKI validation. Most modern BGP implementations support this natively.

3. MANRS Compliance The Mutually Agreed Norms for Routing Security provides a clear framework: prevent propagation of incorrect routing, prevent traffic with spoofed source IP, and facilitate communication.

4. IRR Filtering Maintain accurate IRR (Internet Routing Registry) records and filter routes based on IRR data in conjunction with RPKI.

5. Monitoring Use tools like BGPStream or RIPE's RIS to continuously monitor for unexpected route changes affecting your prefixes.