MANRS Community Report 2021

Mutually Agreed Norms for Routing Security (MANRS) is a global, community-driven initiative. In 2014, a small group of network operators recognized the need to join forces to improve the security and resilience of the Internet’s global routing system, and with support from the Internet Society, MANRS was born.

Since then, the MANRS community has grown and expanded to empower and support not only network operators, but also Internet exchange points (IXPs), content delivery network (CDN) and cloud providers, and equipment vendors to take MANRS actions ^[1] and reduce common routing threats. MANRS would have not been possible without the commitment of our community to strengthen global routing security.

By 2025, MANRS aims to become a self-governed community of participants and partner organizations^[2] that drives global adoption of MANRS actions and improvements in routing security. Efforts towards achieving this goal include providing reliable tools for compliance and measurement such as the MANRS Observatory, building capacity of network engineers through training and fellowship programs, and advocating for policies that strengthen routing security.

MANRS at a Glance

Click to enlarge

In early 2020, the MANRS Advisory Group was established to provide oversight of the MANRS application and auditing processes, enhance MANRS actions by developing conformance criteria, and participate in the selection of MANRS ambassadors and fellows. The MANRS Advisory Group worked with the MANRS community to develop the MANRS Community Charter, which provides guiding principles for the future governance of MANRS. The charter was accepted by the community after several rounds of consultations and came into effect on 1 November 2021.

In accordance with the MANRS Community Charter, the Advisory Group will transition to a Steering Committee comprised of individuals elected by the MANRS community. MANRS elected its first Steering Committee in November 2021 to lead the community towards collective responsibility for the resilience and security of the Internet’s global routing system. The first Steering Committee meeting was held in December bringing together the newly elected members.

If you would like to learn about how your organization can support MANRS, please visit our website or contact us.

Our Impact in 2021

MANRS 2021 Targets Achieved

In 2021, we exceeded the set target of a 10 percent increase in route origin authorization (ROA) creation by MANRS participants, showing they support cryptographic validation of Internet Protocol (IP) address ownership. MANRS participants had a 17 percent increase in valid ROA count between January and December 2021.

We also exceeded the set target of a 5 percent increase in route origin validation (ROV) implementation by MANRS participants, showing they are checking that a given network is authorized to announce routes to a given IP address range. By the end of 2021, 68 network operators, or 9 percent of MANRS participants, were implementing ROV.

Global trend points to a substantial increase in the number of registered ROAs in the past few years, particularly in Europe, Asia-Pacific, and North America. This shows that resource public key infrastructure (RPKI)—a key tool in stopping route leaks and hijacks—is finally lifting off.

MANRS’ Governance Strengthened

The first election of the Steering Committee attracted 34 high-calibre and diverse candidates, which enabled a successful election in November of the following seven members:

• Melchior Aelmans, Juniper Networks
• Nick Hilliard, INEX
• Flavio Luciani, NAMEX
• Arnold Nipper, DE-CIX
• Arturo Servin, Google
• Jeff Tantsura, Microsoft
• Tony Tauber, Comcast

Andrew Gallo (George Washington University) and Warrick Mitchell (Australia’s Academic and Research Network), Advisory Group co-chairs, will also serve on the Steering Committee. A total of 148 participants took part in the voting process.

The Steering Committee members will hold quarterly meetings to: make recommendations on MANRS actions and minimum conformance criteria; supervise the auditing process for new applicants; handle the appeals process from applicants that have been refused approval; make recommendations on the suspension and termination of organizations from MANRS participation that fail to meet the minimum conformance criteria; supervise the incident handling processes; and appoint MANRS advisors who can offer specialist advice or act as liaisons with other communities.

New MANRS Program for Network Equipment Vendors Launched

2021 added a fourth MANRS program to empower and support equipment vendors to take MANRS actions and reduce common routing threats by making sure that network equipment, like routers and switches, has the right features and support. The MANRS Equipment Vendor Program has two mandatory actions and one commitment:

• Action 1 – Provide relevant security features so network operators, IXPs, CDNs, and cloud providers can take MANRS actions to prevent incorrect routing information and IP address spoofing.
• Action 2 – Promote MANRS through training and technical content.
• Commitment to actively participate in the MANRS community to advise members, develop solutions, contribute to routing security resources, and promote MANRS.

The five founding participants are global leaders in network equipment—Arista, Cisco, Huawei, Juniper, and Nokia Arrcus, Inc. joined later with others expected to join soon.

CDN and Cloud Providers Improve Routing Security with Expanded and Improved MANRS Actions

MANRS launched the CDN and Cloud Providers Program in 2020, setting a baseline for routing security actions they should take. Within months, participants realized they could raise the bar to make the program stronger and produce a bigger impact on the Internet. Participants from Akamai, Amazon, Azion, Cloudflare, Comcast, Facebook/Meta, Google, Microsoft, Netflix, Verisign, and Vultr formed a taskforce to strengthen the actions and ask more of each other and their colleagues.

In March, the MANRS community adopted the taskforce’s recommendations, and the expanded actions officially became part of the MANRS CDN and Cloud Providers Program. The updated actions set higher expectations for routing security by strengthening filtering controls and clarifying their implementation guidelines, encouraging more concrete technical and operational commitments, and facilitating coordination among participants.

The two primary enhancements are:

• Fostering RPKI as the primary technology for validation of routing information on a global scale – CDN and cloud providers commit to use ROV as part of their filtering policy for peering relationships and register all their prefixes in RPKI.
• Improving consistency of route validation based on route objects published in an Internet Routing Registry (IRR), so that peers face a consistent requirement when interconnecting with any MANRS CDN or cloud provider – This defines a standard process for collecting all necessary routing information to build an effective filtering policy. In particular, it standardizes the procedure of expanding the AS-SET object, which is used to document the downstream customers of a peer network.

To support the implementation of these commitments, the taskforce developed new guidelines for managing ROAs for operators of RPKI services. It introduced best practices centered around consistent validity, consistent application programming interfaces (APIs), health metrics for RPKI infrastructure, and change integration with routing plane.

MANRS Community Reach and Engagement Broadened

To further broaden the MANRS community, four MANRS Primers were developed for policymakers, business executives, IT executives, and computer security incident response teams (CSIRTs). The primers are available in three languages—English, French, and Spanish. These primers explain in simple language what routing security is, why it matters to different groups, and how MANRS can help.

In the effort to improve engagement with the MANRS community, MANRS moved the implementation guides, policy briefs, and program actions to GitHub, which allows the community to edit these documents. To streamline this process, a GitHub management tutorial was arranged that was very well attended by the community.

Continuous Improvement of the MANRS Observatory and Development of New Tools

The MANRS Observatory, launched in August 2019, is an online tool that monitors Internet routing security by aggregating data from trusted sources into a user-friendly dashboard for viewing routing incidents and checking general routing health. The Observatory brings increased transparency to routing operations, and sheds light on trends in routing security globally, regionally, and for individual networks so that improvements are made based on evidence.

The MANRS Observatory dashboard gives a high-level overview of the state of routing security, MANRS readiness, and statistics for specific regions and economies. MANRS readiness indicates how well MANRS actions are implemented and is calculated using a set of metrics for each action, computed from different data sources. The Observatory dashboard is open to the public, but MANRS participants can access detailed statistics and reports for specific networks. Partner accounts are available for individuals or organizations to support efforts in promoting MANRS and routing security.

In 2021, MANRS continued to add new data sources and features to improve the Observatory based on community and user feedback. The updated version 3.1 includes:

• Addition of a new data source on routing mis-originations—the Global Routing Intelligence Platform (GRIP)—to identify Border Gateway Protocol (BGP) security incidents, including sophisticated prefix hijacking attacks and misconfigurations.
• A toggle switch allowing users to select data source for routing mis-origination incidents—BGPStream or GRIP—and a detailed report that presents information from both sources, allowing users to compare the data and get a more informative picture of how their networks operate.
• The ability to validate data and provide user feedback. For each of the routing mis-origination incidents there is a small icon with a comment box, opening a dialog to respond to that incident. Feedback allows MANRS to implement controls to reduce the number of false positives (when a legitimate BGP announcement is marked as a routing incident).
• Improvements to the public user interface, including clearer layout of the overview page, expanded contextual help, trend arrows in MANRS readiness scores, and pop-up information when hovering over the world map.
• New features for MANRS participants, including pagination and data exports, and improved partner accounts.

In addition, MANRS launched the ROA Stats Tool to help network operators and researchers see the state of RPKI around the world by providing an overview of ROAs, valids, and invalids created by country or by Autonomous System Number (ASN), with data updated daily. It gives a snapshot of the current situation, but also a historical view of ROAs and validation. Complementing the ROA Stats Tool, the Internet Initiative Japan Research Lab launched a visualization tool, created by MANRS fellow, Romain Fontugne, for looking at ROAs, valids, and invalids, among other data.

Strategic Advocacy in Targeted Regions and Countries

The MANRS community, including ambassadors and fellows, was engaged in about 150 events during 2021 at global, regional, and local levels. MANRS’ online global advocacy efforts through webinars, social media platforms, and online events, such as a series of five webinars during RPKI Week, MANRS Community Meetings, and Tech Talks resulted in significant engagement with the community. RPKI Week was attended by more than 500 participants. MANRS also participated in global and regional events like the ENISA Telecom Security Forum, FIRST Conference on Computer Security Incident Handling, FIRST & AfricaCERT Virtual Symposium for Africa and Arab Regions, and RightsCon.

In 2021, MANRS collaborated more closely with participants, partners, and Internet Society members to organize webinars and other events. At the regional level, MANRS continued to work closely with all five Regional Internet Registries (RIRs) in Africa (AfriNIC), Asia-Pacific (APNIC), North America (ARIN), Latin American and the Caribbean (LACNIC), and Europe (RIPE NCC), as well as with regional network operator groups such as those in Africa (AfNOG), Asia-Pacific (APNOG), the Caribbean (CaribNOG), North America (NANOG), the Pacific (PacNOG), and South Asia (SANOG), and with global and regional partners like the Arab States Research and Education Network (ASREN), Cybersecurity Tech Accord, EURO-IX, NAMEX, Network Startup Resource Center (NSRC), and SAMENA Telecommunications Council.

At RPKI Week, for example, MANRS partnered with all five RIRs and launched how-to videos with their help. At the 2021 OMREN Technology Summit in May, a gathering of national research and education networks (NRENs) organized by the Oman Research and Education Network (OMREN), MANRS was recognized as one of the best practices for NRENs and cited multiple times during the event. It was mentioned by David Wilde, Chief Technology Officer of Australia’s Academic and Research Network, as the first recommendation for NRENs to protect themselves. Jim Ghadbane, President and Chief Executive Officer of CANARIE, Canada said that he hopes all NRENs would implement MANRS actions to help secure networks. MANRS hosted a booth at the event and received interest from regional networks and the community.

MANRS deepened engagement with the International Telecommunication Union (ITU), and contributed to capacity building in Africa for the newly approved ITU standard titled, “Framework for the operation and services of Cyber Defence Centres/CSIRTs”. In Africa, MANRS also conducted workshops with UbuntuNet Alliance, the regional research and education network organization for Eastern and Southern Africa.

In Asia-Pacific, MANRS continued to engage with the Asia-Pacific Regional Internet Conference on Operational Technologies (APRICOT), Asia-Pacific Regional Internet Governance Forum (APrIGF), Asia-Pacific Telecommunity (APT), and Pacific Islands Telecommunications Association (PITA).

MANRS also targeted advocacy in specific countries such as China, India, Lao PDR, Mongolia, Nigeria, Oman, Sweden, Tuvalu, UK, Uruguay, and USA. Advocacy efforts were targeted at a diverse range of stakeholders including governmental and non-governmental organizations, the private sector, research and education networks, and the technical community. For example, in Lao PDR, Mongolia, and Tuvalu, MANRS in collaboration with APT organized high-level sessions on IXPs and routing security in August with governments. MANRS also participated in national network operator and IXP events through collaborations with bdNOG, cmNOG, HKNOG, INNOG, KeNOG, MexNOG, phNOG, RSNOG, SAFNOG, SomNOG, UKNOF, and VNIX-NOG, among others.

MANRS has actively used its website and social media in advocacy through Facebook, Twitter, and YouTube since 2014, and in early 2021, started engagements on LinkedIn garnering over 900 followers in less than a year. By the end of 2021, we had a total of 3,429 followers on Twitter (1,372 of whom joined in 2021), we posted 427 tweets and had 6,100 engagements. The MANRS Twitter account was verified (blue checked) in October 2021, gaining a mark of notability and credibility, and further strengthening MANRS’ brand and following.

On the MANRS website our team, partners, ambassadors, fellows, and MANRS advocates posted a total of 38 blogs. There were several major routing incidents in 2021, including in February, April, and October, and the MANRS community took these opportunities to advocate for MANRS actions.

MANRS’ Virtual Training Boosted

As travel restrictions persisted in 2021 due to COVID-19, MANRS worked with partners to strengthen our virtual training platform and delivery to help develop the next generation of routing security experts. MANRS delivered four rounds of the moderated five-week MANRS online workshop using a new learning management system with hands-on lab training. MANRS also supported global and regional training workshops on routing security, such as the annual APRICOT events that normally offer the unique combination of interacting with peers from different economies, learning from industry leaders, and sharing and resolving technical issues together. However, offering these same benefits in a virtual environment was challenging. At APRICOT 2021, MANRS partnered with APNOG and NSRC to offer multiple streams of virtual tutorial setup with hands-on experience that provided a mentoring-like environment for the participants to benefit from industry experts. The training platform allowed participants to manage their own virtual machines and enable experiential learning.

In Latin America and the Caribbean, MANRS, LAC-IX, and LACNIC worked together to promote the implementation of MANRS actions for the region’s IXPs through webinars and training courses. LACNIC created a training plan made up of a series of four, two-hour modules for IXPs, covering the use of BGP, RPKI, DNS, and IPv6 at IXPs.

Engagement with Internet Society Chapters and Partners in Training and Events

In 2021, a milestone was achieved when the Internet Society Sudan Chapter, which runs the country code top-level domains (ccTLDs), became the first chapter to join MANRS.

MANRS collaborated with other Internet Society chapters and partners in accelerating our capacity building efforts in Benin and Cameroon. The Benin Chapter launched a routing security initiative with the goal of supporting network operators in securing Internet routing by applying MANRS actions. In Cameroon, the Cameroon Chapter organized a series of webinars on routing security, and in partnership with the Cameroon IXP (CAMIX) and the National Agency for Information and Communications Technology (ANTIC), held a training workshop for network operators on MANRS and routing security during November and December.

In addition, awareness of MANRS was raised through the Internet Society chapters in Bolivia, Chennai (India), Mumbai (India), Honduras, Norway, Panama, and Uganda together with MANRS ambassadors and fellows.

Community Spotlight

The MANRS community is comprised of participants, partners, ambassadors, and fellows.

As of 31 December, there were 750 MANRS participants made up of network operators, IXPs, CDNs, cloud providers, and equipment vendors implementing MANRS actions. The network operators secure customer-provider interconnections, equipment vendors ensure network equipment has the right features and support, while IXPs, CDNs, and cloud providers create a secure network peering environment and encourage good routing practices from their members, customers, and partners. MANRS partners do not necessarily operate networks but actively support MANRS goals. We are pleased to welcome four new partners in 2021—Nautilus Mediterranean Exchange (NAMEX), North American Network Operators Group (NANOG), Qrator Labs, and SAMENA Telecommunications Council—and a total of 162 new MANRS participants.

Here are what some of the participants and partners have said about MANRS in 2021.^[3]

Equipment Vendors^[4]

Network Operators^[5]

IXPs^[6]

CDN and Cloud Providers^[7]

Partners^[8]

MANRS Ambassadors and Fellowship Program

The MANRS Ambassadors and Fellowship Program that was launched in 2020 held its second edition in 2021, bringing together 5 ambassadors and 13 fellows. Ambassadors are representatives from current MANRS participants who provide mentorship, guidance, and feedback to fellows in the routing security community. In 2021, two of the ambassadors—Ram Krishna Pariyar and Zobair Khan—served as fellows in 2020.

Meet the 2021 Ambassadors

Steven Wallace

(Research)

Rogério Muhate

(Training)

Zobair Khan

(Training)

Fredrik Korsbäck

(Training)

Ram Krishna Pariyar

(Policy)

Fellows are emerging leaders who believe that routing security is essential and are ready to contribute to its improvement. The fellowship allows individuals to bring new perspectives, innovative ideas, and research experience into the MANRS work to improve routing security. Ambassadors and fellows from different countries, representing all continents, work together in three areas—training, research, and policy—to train diverse communities on good routing practices, research ways to secure routing, and survey the global policy landscape, respectively.

Meet the 2021 Fellows

Training

Musa Stephen Honlue

Ben Kyemba Kitimbo

Naveen Karaparambil Lakshman

Daniel Mondragon

Kunal Krishnil Raj

Emmanuel Serrano Piña

Policy

Russell James Bean

Christopher Lee Bovee de Soto

Rebecca Emmanuel Ryakitimbo

Research

Romain Fontugne

Chris Kane

Dibya Khatiwada

Cyrus Mbitau Njoka

The training team of ambassadors and fellows actively raised awareness and conducted webinars, online tutorials, and training workshops in collaboration with MANRS partners and participants, Internet Society chapters, and network operator groups. In some events, fellows from the 2020 cohort also participated.

In 2021, MANRS launched a sponsorship program bringing on board sponsors to support the MANRS Ambassador and Fellowship Program. A total of US$26,700 was raised from APNIC, APRICOT, LACNIC, Akamai, and China Telecom to support the program.

ICANN Supports MANRS

Others within the Internet ecosystem are recognizing and supporting MANRS, such as the Internet Corporation for Assigned Names and Numbers (ICANN) that is responsible for the management and oversight of the coordination of the Internet’s domain name system (DNS) and its unique identifiers. For instance, in ICANN’s Final Report of the DNS Security Facilitation Initiative Technical Study Group in 2021, MANRS is included as one of their recommendations:

Challenges and Lessons Learned

2021 saw some major routing incidents that MANRS analyzed and drew lessons from, including the major Facebook/Meta outage that affected all its platforms and billions of people, a BGP hijack by Vodafone Idea, a route leak by Cablevisión, and an attempt to hijack Twitter. These incidents demonstrate the importance of BGP filtering and creation of ROAs that protects prefixes from hijack attempts.

Even though ROA adoption is picking up in some regions, as indicated at the start of the report (Figure 1), the adoption rate is generally very low. With only 34 percent valid ROAs across the globe, there is a need to clear misconceptions related to RPKI to increase ROA adoption. Through numerous events, training workshops, blogs, and social media posts, MANRS has emphasized the importance of implementing effective route filtering based on verifiable information about which networks are legitimately authorized to originate which number resources (AS numbers and IP prefixes), as well as the importance of having well-established and well-advertised communication channels to quickly resolve issues when they happen. MANRS participants have shown good support towards RPKI and more than 61 percent of the resources have valid ROAs, but greater efforts to strategically and collaboratively promote RPKI and accelerate ROA adoption are needed.

Within MANRS, measuring and monitoring participants’ conformance with MANRS actions was a challenge. The Steering Committee has formed a working group to formalize ongoing conformance testing, which will be measured and published for all MANRS participants on a monthly basis in 2022.

Looking Ahead

In 2022, MANRS will continue to advocate participation among network operators, IXPs, CDNs, cloud providers, and equipment vendors, and their uptake in implementing routing security measures with the following targets:

• A 15 percent increase in ROA creation by MANRS participants compared to 2021, showing they support cryptographic validation of IP address ownership.
• A 5 percent increase in ROV implementation by MANRS participants compared to 2021, showing they are checking that a given network is authorized to announce routes to a given IP address range.
• A 25 percent reduction in the number of MANRS participants that become nonconforming after joining.

Also in 2022, we will continue to provide ongoing support to transition MANRS to a community-designed and community-led effort. We will continue to offer leadership initiatives, such as the MANRS Ambassador and Fellowship Program, build strategic partnerships to expand our outreach and engage with different communities, and enhance capacity in routing security among network engineers around the world. Continuous improvements to the MANRS Observatory are also envisaged in 2022. Routing security is vital to the future and stability of the Internet. Join us in securing the global Internet for everyone.

Endnotes

[1] MANRS actions are the compulsory and recommend actions that MANRS participants should be taking to improve the security and resilience of the Internet global routing system. There are defined actions for network operators, IXPs, CDN and cloud providers, and equipment vendors.

[2] Partner organizations do not operate a network but actively support MANRS goals. https://manrs.org/about/partners/

[3] For more testimonials, see https://manrs.org/about/testimonials/

[4] https://www.internetsociety.org/news/press-releases/2021/arista-cisco-huawei-juniper-and-nokia-launch-new-manrs-equipment-vendor-program-to-improve-routing-security-worldwide/; https://www.internetsociety.org/news/press-releases/2021/arista-cisco-huawei-juniper-and-nokia-launch-new-manrs-equipment-vendor-program-to-improve-routing-security-worldwide/; and https://www.globenewswire.com/news-release/2021/12/16/2353744/0/en/Arrcus-Joins-MANRS-to-Help-Improve-Internet-Routing-Security.html

[5] https://manrs.org/2021/09/sudan-the-first-internet-society-chapter-to-join-manrs/; https://www.prnewswire.com/news-releases/all-china-telecom-backbone-networks-accepted-by-manrs-301302160.html; and https://manrs.org/isps/participants/entry/1866/

[6] https://manrs.org/ixps/ixp-participants/entry/1762/; https://manrs.org/ixps/ixp-participants/entry/1917/; and https://manrs.org/ixps/ixp-participants/entry/1718/

[7] https://securityboulevard.com/2021/01/digital-ocean-minds-its-manrs-alongside-other-service-providers/; https://manrs.org/cdn-cloud-providers/participants/entry/1744/; and https://cacm.acm.org/magazines/2021/8/254299-fixing-the-internet/fulltext

[8] https://blog.qrator.net/en/partnership-with-manrs_152/; https://www.canarie.ca/canadas-national-research-and-education-network-bolsters-security/; and https://manrs.org/2021/05/greater-manrs-alignment-will-benefit-the-us-research-and-education-community/