What Is BGP Security?

BGP determines how traffic finds its way across the internet between networks. It was designed for a smaller, more trusting internet and operates largely on the assumption that networks announce routes honestly.

The consequence is that a network announcing a route it has no right to can attract traffic destined for someone else — either by mistake or deliberately.

Hijacks and leaks

A hijack is a network announcing address space it does not control, drawing traffic toward itself. It can be used to intercept traffic, to obtain certificates by proving control of a domain, or simply to disrupt.

A route leak is announcing routes learned from one peer to another in violation of policy, which pulls traffic through a network not intended to carry it. Most incidents are configuration errors rather than attacks, and the effect on availability is the same.

Because these propagate globally in minutes, the consequences extend well beyond the network that made the mistake.

What the defences are

Route origin authorisation lets an address holder publish cryptographically which network is entitled to announce their space, and validation lets others reject announcements that contradict it. Adoption has grown substantially and it now prevents a meaningful share of accidental hijacks.

Filtering between peers remains the practical foundation: accepting only the routes a peer is expected to announce, with maximum prefix limits so a misconfiguration is contained rather than propagated.

What an enterprise can actually do

Most organisations do not run BGP and are affected by it rather than operating it. The useful actions are to publish route origin authorisations for any address space you hold, ask your providers whether they perform validation, and monitor for announcements of your prefixes by networks that should not be making them.

Where you do run BGP, filtering and prefix limits are the controls that prevent your network contributing to the next widely reported incident.

Monitoring is the accessible control

Most organisations cannot prevent a hijack of their address space — that depends on other networks validating — but they can detect one. Public route monitoring services alert when a prefix is announced by an unexpected network, usually within minutes.

Detection matters because response is possible. Contacting upstream providers and the offending network resolves most incidents, and the majority are misconfigurations whose owners will fix them once informed.

Without monitoring, a hijack is typically discovered through user reports of unreachable services, by which point it has been in effect for some time and the traffic has already gone somewhere else.

For most enterprises the practical summary is short: you are exposed to this and you do not operate it. Publish route origin authorisations if you hold address space, ask providers about validation during procurement, monitor for hijacks of your prefixes, and ensure your incident plan includes a routing scenario — because the response involves phone calls to providers rather than anything technical.

A common mistake worth avoiding

Where to start

Find out whether route origin authorisations exist for any address space registered to your organisation. If you hold address space and have never published them, that is a concrete and inexpensive improvement.

See DNS security for the adjacent infrastructure concern. GuardsArm runs security program reviews.