Is Static Routing More Secure Than Dynamic Routing?
In static vs dynamic routing, I said that static routing is potentially more secure than dynamic routing.
Let’s discuss this a bit more because there is little supporting information about why static routes are seen as more secure. And I’m not sure I agree that they are.
Static Routes Are Not Advertised Over The Network
This seems to be the main argument for static routes being more secure.
You can’t send traffic to a destination you don’t have a route for. Restricting what routes are visible in different parts of your network can have a security benefit.
Perhaps the thinking is that since static routes aren’t automatically advertised over the network, it is more secure as networks are unreachable without someone manually configuring a route.
In contrast, dynamic protocols tend to advertise all the networks they know of. This isn’t surprising since that is the reason routing protocols exist.
Does this mean that static routing is more secure? My opinion is no, for two main reasons:
- Dynamic protocols can be configured to limit where routes are advertised, achieving a similar outcome.
- There is a risk of static routes becoming redundant or obsolete as the network evolves. Having these routes send traffic in the wrong direction could be more of a problem than having the routes visible in the first place.
Rogue Routing Information
Another concern with dynamic routing may be rogue routing information. Someone could attach a device to the network and send rogue route advertisements.
For this to be an effective attack, your routing devices would have to listen to these advertisements and pay attention to them.
Two things have already gone wrong here. First, if a bad actor has connected another routing device to your network, you may have other concerns beyond them trying to interact with your routing.
Secondly, why are your routers listening to rogue advertisements? Routing protocols support authentication and you should use it to prevent this type of situation.
I would slightly agree that static routing could be more secure here, but there are mitigations in dynamic protocols to overcome this issue.
Dynamic Routing Could Get Bad Routing Information
The benefit of dynamic routing is that our routing is, well, dynamic.
What if a route is received and that route breaks network connectivity? This could look like:
- A new route is received that causes a routing loop.
- A new, more specific route, that accidentally black holes traffic.
- Sub-optimal routing could occur causing poor performance.
All of these could also be caused by adding a new static route as well, or not removing an old static route. The only difference with dynamic protocols is the issues could potentially be triggered by a routing update from an external routing neighbor.
The mitigation for this last point is really down to having a good routing policy in place and using the right protocol(s) for sharing routes with external parties.
Dynamic Routing Increases Attack Surface
Perhaps the argument is that dynamic routing protocols increase the attack surface. Your devices are now listening for routing updates and someone could try:
- To compromise your router.
- Send you bad routing information.
- Somehow DoS the router by crashing the routing protocol.
Reluctantly, I have to agree with this. Running a dynamic routing protocol does indeed cause your router to listen for routing updates.
There have been numerous cases on the Internet of BGP routing hi-jacks where one party advertises routes that belong to another organization. Or a large or malformed BGP update causes some routers to either crash or tear down the BGP sessions, leading to a lot of routing instability until the route causing the issues is no longer advertised.
But the key thing here is context. At the scale of the Internet, a dynamic protocol is the only suitable solution. Even if BGP or a specific implementation of BGP has an issue or a security concern, it will still be used. The only option is to fix the issue or improve the process.
Someone Might Sniff Your Routing Updates
There is the idea that if someone can sniff your routing updates, they will potentially be able to work out the topology of your network. This additional knowledge could assist them in further attacking the network.
While this might be true, it overlooks the much larger issue. If a bad actor is in a position to sniff your routing updates, surely they can also sniff the rest of the network traffic traveling over that network link.
Context again matters. Are the routing updates being sniffed between you and your ISP? If so this is a non-issue. You want people to know you’re advertising these routes anyway. Or is this sniffing the routing updates within your own network?
You could technically argue static routes don’t have this issue, but I don’t think this is a valid argument for them being more secure.
Routing Between Organizations
What about routing between organizations. In this case we’re likely to use either static routes or BGP.
If suitable routing policy is applied on BGP, then the security is about the same, as we can filter what routes we send or receive. Also, when it comes to routing between organizations, you presumably trust the other party to not behave badly.
The other concern here is another party trying to use your network as transit to somewhere else, like the Internet, for example. Even if you only advertise your own address space to them, they could still add a default route on their equipment pointing to your network. This is not something you can prevent with either static or dynamic routes.
Instead, you deal with the traffic itself, not the routing information. This may mean implementing an ACL or firewall filter on your router or having the traffic pass through a firewall where an appropriate security policy can be applied.
Conclusion
Are static routes more secure than dynamic routes? My opinion is yes, but only by a small margin.
Does it matter if static routes are more secure? Only in certain situations. The decision to use static or dynamic routing should be based on your needs, not on whether one method is inherently more secure than the other.