3.3.1.2 Network Security Securing one’s network is necessary to protect the network and others in the Internet ecosystem. This includes filtering spoofed traffic and volumetric attack traffic, both incoming and outgoing, from their networks. Outgoing spoofed and attack traffic may lead to IP address reputation problems for the originating network, but will often lead to more direct negative impacts on other networks in the Internet ecosystem. ISOC’s Anti-Spam Toolkit16 provides best practices for policymakers, network operators, and users to better secure their networks from the threat of spam. The Toolkit also provides links to outside resources on spam and combating unwanted traffic. M3AAWG’s Anti-bot Code of Conduct17 for Internet service providers advises ISPs to engage in education, detection, notification, remediation, and collaboration. The Code of Conduct promotes the essential principles of awareness, responsibility, cooperation, and upholding the fundamental rights and Internet properties. 3.3.1.3 Essential Security Practices Secure protocols should be used in products and services supporting Internet infrastructure. For instance, TLS (transport layer security) is a cryptographic protocol that should be employed to protect web services. TLS encrypts data exchanged in an HTTP transaction and cryptographically identifies one or more of the parties engaged in a transaction. Privacy and identity are fundamental elements of secure Internet infrastructure. Operators must also ensure software critical to Internet infrastructure is being effectively managed for security vulnerabilities. Only software that is being maintained by a vendor or an open source community should be deployed in Internet infrastructure. Operators should employ a patching policy that prioritizes the mitigation of software vulnerabilities, despite the inherent risk to up-time. Operators may also build a software vulnerability management program granting responsibility for the continued mitigation of software vulnerabilities to an individual or institution. A lack of institutional accountability for software vulnerability management is a common reason why many organizations fail to patch appropriately. 3.3.2 Establish and Maintain Cooperation and Collaboration Beyond their participation in the national multistakeholder structures outlined in Section 3.2.2, ISPs and network operators have a responsibility to coordinate and collaborate with one another, their customer organizations, and other stakeholders. ISPs and network operators should: • • • • • Encourage cooperation and collaboration with customer organizations, local and regional governments, and regulators in preventing, detecting and mitigating routing incidents Facilitate global operational communication and coordination between network operators Actively participate in ISP associations such as national and regional network operator groups and fora Create mechanisms for information sharing with other providers regarding fiber cuts, so as to make quick fixes and speed up maintenance Cooperate with law enforcement and regulatory agencies during the investigation and prosecution of cybercrime or other illegal activities 3.4 Institutional/Organizational Level Executive leadership and accountability for cyber-related issues is required. An executive leader in every organization should be responsible for the information security of the organization. In that role, the executive leader can allocate resources for, and promote, an organizational cyber security culture. Security practices for organizations that utilize ICTs not only have a strong impact on the organizations themselves, but also on the wider Internet ecosystem. It 16 17 See http://www.internetsociety.org/spamtoolkit See https://www.m3aawg.org/abcs-for-ISP-code internetsociety.org Internet Infrastructure Security Guidelines for Africa 19