The Honor System of 1989
When BGP was invented, the internet was a small community of universities and government research labs. Everyone knew everyone. The protocol was built on implicit trust: "If you tell me you know how to reach Google, I believe you."
Think of it like a small town where everyone leaves their front door unlocked. That works fine when you know all your neighbors. It fails catastrophically when the town grows to eight billion people.
Today, the internet is a hostile environment. Relying on this blind trust leads to massive outages and security breaches. There are two categories of failure:
- Accidents: A network engineer makes a typo and accidentally claims they own the entire internet. Their router starts attracting traffic it cannot handle, and large portions of the internet go dark.
- Malice: An attacker intentionally claims they own a bank's IP range to intercept traffic — reading emails, stealing credentials, or silently dropping connections.
Advanced BGP Security is about retrofitting the internet with authentication mechanisms and defensive tools to stop both categories. The two primary technologies are RPKI (which proves who owns what) and BGP Flowspec (which distributes firewall rules at internet scale). This lesson covers both from first principles.