infrastructures. If an attack makes an international link unavailable, local traffic passing through an IXP is not impacted. IXPs are critical to developing a strong and resilient Internet infrastructure. There is a need for an increase in cross-border collaboration between IXPs. Therefore, at a regional level, the African IXP Association (AFIX), which was established to coordinate and exchange knowledge among IXPs, should be supported to do more in this area. AFIX is a platform for sharing experiences and learning amongst the IXPs and operators. 3.2.5 Use Public Institutions to Lead by Example in Cyber Security Governments, as owners and operators of information systems and networks, could lead by example by adopting best practices, using security technologies, satisfying legislative requirements, and through their procurement processes. It is vital that governments understand the importance of integrating cyber security in their strategic ICT plans, keeping in mind that the overall objective is social and economic prosperity, and confidence in the Internet in Africa. Governments should actively promote the use of security standards and best practices in their own infrastructure, by their agencies, and by thirdparty suppliers of government services. Governments can also use their budgets to ensure that appropriate resources, including budget and staff, are allocated to governmental departments and agencies to operate and secure their systems. 3.3 ISP/Operator Level Network operators have a direct role in securing Internet infrastructure as they operate the networks in Africa. A security weakness in one operator’s network not only affects that network, but potentially other networks in Africa, and those across the world. 3.3.1 Establish Baseline Security Addressing Internet infrastructure security challenges requires collaboration and commitment from all stakeholders. In an interconnected world with dependencies spanning multiple networks, nations and continents, it is very important that all participants adhere to at least a minimum level of security – a baseline level which many will immediately surpass, and from which others can build. 3.3.1.1 Routing and Domain Name System Security Network operators should prevent propagation of incorrect routing information; prevent traffic with spoofed source IP addresses; facilitate global operational communication and coordination between network operators; and facilitate validation of routing information on a global scale. IP spoofing, or source address forgery, is often used in denial of service attacks to make defensive filtering more difficult. Network operators should enable DNSSEC validation on their DNS resolvers to ensure the security of DNS. Network operators should also integrate other best current practices related to routing security and resilience in their network management processes.14 One of the global initiatives, MANRS, the Mutually Agreed Norms for Routing Security,15 defines a concise package of minimum but critical measures to meet the above requirements. It also outlines a number of principles and expected actions for network operators to implement to ensure the resilience and security of the global routing system. MANRS was created by members of the network operator community with support from ISOC. 14 15 18 Deploy 360 is a good source of information for ISPs on routing security and securing the DNS, among others (http://www.internetsociety.org/ deploy360/). See https://www.routingmanifesto.org/manrs/ Internet Infrastructure Security Guidelines for Africa internetsociety.org