Artificial Intelligence (AI) has made significant strides in recent years, especially in its ability to imitate human voices with remarkable accuracy. This technological advancement, while offering exciting possibilities in entertainment, customer service, and accessibility, also presents new challenges in the realm of cybersecurity. As we celebrate Cybersecurity Awareness Month, it's crucial to explore the implications of AI-powered voice imitation, commonly referred to as deepfake voice technology, and how it intersects with cybersecurity concerns.

The Rise of AI Voice Imitation Technology

AI voice imitation works by using machine learning algorithms to analyze audio recordings of a person speaking. By processing vocal characteristics—such as tone, pitch, rhythm, and speech patterns—AI systems can generate highly convincing audio that mimics a specific individual’s voice. Tools like Lyrebird, Descript, and Google’s WaveNet have shown how rapidly this technology is evolving. Once restricted to research labs, these tools are now available for commercial use, which opens the door to a wide range of applications—both legitimate and malicious.

While the potential of AI voice technology is undeniable, its darker applications are equally alarming. Cybercriminals are quick to leverage any new technology for malicious purposes, and AI voice imitation is no exception. One of the most concerning trends is the rise of "voice phishing" or "vishing" attacks. Unlike traditional phishing schemes, which involve fraudulent emails or messages, vishing uses AI-generated voices to trick victims into revealing sensitive information.

For instance, cybercriminals can impersonate a company executive or a trusted colleague to request wire transfers, confidential data, or login credentials. In one high-profile case, hackers used AI voice technology to impersonate the CEO of a UK-based company, tricking an employee into transferring over $240,000 to a fraudulent account. This is a clear example of how AI can amplify the risks businesses face in the modern threat landscape.

The Role of Cybersecurity in Combating AI-Driven Threats

In light of these threats, the role of cybersecurity becomes even more critical. As AI voice imitation technology continues to evolve, organizations must adopt proactive measures to safeguard against these types of attacks. Here are a few strategies businesses and individuals can use to protect themselves:

MFA is one of the most effective defenses against social engineering attacks. By requiring multiple forms of verification (e.g., a password and a mobile device code), MFA ensures that even if a hacker mimics a voice convincingly, they cannot easily gain access to sensitive systems or information.

2. Voice Verification and Authentication Solutions

Just as fingerprint and facial recognition are used for security, voice biometrics can help verify the identity of individuals before transactions or sensitive communications. While AI voice imitation can mimic many aspects of human speech, advanced voice recognition technologies can detect subtle variations that may go unnoticed by the human ear.

Cybersecurity Awareness Month serves as a timely reminder that human error remains one of the weakest links in any cybersecurity framework. Regular training sessions that focus on the evolving nature of AI-driven threats, such as vishing, can help employees recognize suspicious activity. Simulating potential attacks, including voice phishing attempts, can prepare staff to handle these situations in real time.

While AI can be a tool for hackers, it can also be a powerful ally for defenders. AI-driven cybersecurity solutions can detect anomalies in communication patterns or behavior, such as unusual requests for fund transfers or access to sensitive data. Implementing machine learning-based detection systems can help identify threats that may have bypassed traditional security protocols.

Governments and industry bodies must also play a role in regulating the use of AI voice technology. Cybersecurity laws and regulations should evolve to address these emerging threats, with clear guidelines on the ethical use of AI. For example, laws could mandate that all AI-generated voice communications be clearly labeled to prevent fraud and impersonation.

Cybersecurity Awareness Month emphasizes the importance of staying ahead of emerging threats, and AI voice imitation is a prime example of a rapidly evolving risk. The solution is not to fear new technology but to integrate robust security measures and foster a culture of vigilance within organizations.

Just as companies have become accustomed to scrutinizing email links for phishing attempts, the same level of caution must now be applied to voice communications. Employees should be trained to verify unusual or sensitive requests, even if they appear to come from a trusted source. Encouraging skepticism and double-checking communication—whether it be via a follow-up email, phone call, or face-to-face conversation—can prevent many AI-driven attacks.

AI voice imitation is a powerful tool that brings both opportunities and risks. For Cybersecurity Awareness Month, it’s essential to recognize the potential dangers of this technology while promoting best practices to combat AI-driven threats. As we continue to innovate, staying one step ahead of cybercriminals is key to ensuring a secure and resilient digital future.

By adopting strong authentication measures, leveraging advanced AI for threat detection, and fostering a culture of security awareness, businesses can safeguard themselves against the next wave of cyberattacks.

Learn how AI voice imitation technology poses new cybersecurity risks, including voice phishing attacks, and discover strategies to protect your organization during Cybersecurity Awareness Month.

AI Voice Imitation and Cybersecurity: A New Frontier for Cybersecurity Awareness Month

Aaron Liccione

IT Engineer

It’s nearly impossible to avoid using passwords these days. It seems like everything requires one—unlocking my phone, my Wi-Fi, my email, and bank account all need passwords. Heck, there’s even a password to unlock my apartment complex’s parking lot gate before I leave for work in the morning. I need to use three passwords just to start my day! 

(I still haven’t figured out a way to put a password on my leftovers in the fridge to keep pesky roommates out, but we’ll skip that for now.)

The first digital passwords were created in 1961, and they’ve been a staple of cybersecurity ever since. But here in 2024, I think passwords have really started to show their age. Password crackers used by hackers have become so advanced in recent years, especially with the rise of artificial intelligence, that it’s quite concerning. 

For example, a six-character password that includes numbers, uppercase and lowercase letters, and symbols can be cracked almost instantly by targeted scripts. Of course, longer passwords improve security: a ten-character password with the same features might take up to 5 months to crack, but this is still relatively quick. 

Besides the ease with which passwords can be breached, let’s not forget the difficulty of memorizing, storing, and routinely changing them. I don’t know about you, but I’ve signed up for way too many services over the last 5 years to create a unique password for each one. I’ve resorted to using a password manager to keep track of all this data. 

When you register an account on a public website or app, the 'Register with Passkey' option generates a public-private key pair that is linked to your device. The private key never leaves your device, ensuring it remains secure. Your device uses this private key to respond to authentication challenges from remote servers, eliminating the need for you to remember a traditional password. 

Unlike traditional passwords, which are sent over the internet to authenticate your identity, passkeys work differently. When you attempt to log in, the remote server sends a challenge to your device. Your device uses the private key to respond to this challenge, and the server verifies the response using the public key. If a hacker intercepts your public key, it is useless without the private key stored on your device. 

So why isn’t everyone using passkeys already? 

Companies like Google, Microsoft, and Apple are familiar with this form of authentication and have used it internally for years. The challenge lies in how to introduce passkeys to the public in a way that is well-received and widely adopted. Just like you’re reading this blog post to learn more about passkeys, it indicates that many people are still unfamiliar with how they work. Hopefully, we’ll see more educational campaigns from these companies soon to help raise awareness. 

Whether you use passwords or passkeys, one thing is certain: cybersecurity is a constant battle to stay safe online. 

Interested in learning more about cybersecurity solutions offered by Stellar? Click 

The rise of passkeys to simplify security access.

Goodbye Passwords, Hello Passkeys!

In today's fast-paced and ever-evolving business landscape, organizations are constantly seeking innovative solutions to enhance their IT infrastructure, optimize costs, and support a dynamic workforce. Desktop as a Service (DaaS) has emerged as a compelling choice for businesses looking to achieve these goals. DaaS offers a cloud-based virtual desktop infrastructure that provides a range of benefits, from cost efficiency and scalability to enhanced security and support for remote work. Here, we explore the top three reasons why adopting DaaS can be a game-changer for your organization.

DaaS offers a powerful solution for modern businesses seeking to enhance their IT infrastructure. If you're ready to harness the transformative potential of DaaS and drive innovation and productivity in your workplace, contact us today. Our experts are here to help you seamlessly implement DaaS and take your business to the next level. Reach out now to learn more about how we can support your journey to a more flexible, secure, and efficient IT environment.

Learn how Desktop as a Service (DaaS) offers a secure, reliable solution for anywhere, anytime access.

Top Three Reasons to Use Desktop as a Service (DaaS)

In an age where digital threats are omnipresent, the necessity of a reliable cybersecurity remediation partner cannot be overstated. Among the myriad options available, Stellar stands out as a beacon of trust and efficacy. Here's why Stellar should be your preferred choice for cybersecurity remediation:

 Stellar boasts a stellar track record (pun intended) in cybersecurity remediation. With years of experience and a history of successful interventions, we have earned the trust of numerous organizations across diverse sectors. Our portfolio of case studies and testimonials speaks volumes about our ability to deliver results when it matters most.

 When faced with a security incident, time is of the essence. Stellar understands this urgency and prides itself on its lightning-fast response times. Our dedicated team of cybersecurity experts is on standby 24/7, ready to spring into action at a moment's notice. With Stellar at your side, you can rest assured that help is always just a phone call away.

 Cyber threats come in all shapes and sizes, each requiring a unique approach for remediation. Stellar's team comprises seasoned professionals with specialized expertise in various domains of cybersecurity. Whether it's malware analysis, forensic investigation, or network security, we have the skills and knowledge needed to tackle even the most formidable adversaries.

 Stellar takes a holistic approach to cybersecurity remediation, addressing both the technical and procedural aspects of security. Our comprehensive strategy encompasses everything from vulnerability assessments to employee training, ensuring that no stone is left unturned in fortifying your defenses. With Stellar, you can rest assured that every facet of your cybersecurity posture is being diligently attended to.

 Navigating the complex landscape of cybersecurity regulations and compliance requirements can be daunting. Fortunately, Stellar is well-versed in these matters and can help steer your organization towards compliance with ease. Whether it's SOC 2 Type II, HIPAA, PCI DSS or CMMC we have the expertise needed to ensure that your cybersecurity practices align with regulatory standards.

 Cyber threats are constantly evolving, and so too must your cybersecurity defenses. Stellar understands the importance of staying one step ahead of the curve and is committed to continuous improvement. Through regular assessments, proactive security measures, and ongoing training, we help keep your organization resilient in the face of emerging threats.

In conclusion, Stellar stands out as a trusted cybersecurity remediation partner for organizations seeking to fortify their defenses against digital threats. With a proven track record, rapid response times, specialized expertise, and a holistic approach to remediation, we offer peace of mind in an uncertain cyber landscape. By choosing Stellar, you're not just investing in a service provider – you're investing in the security and resilience of your organization.

Discover why Stellar is the ultimate choice for cybersecurity remediation

Why Stellar Should Be Your Trusted Cybersecurity Remediation Partner

As the digital landscape continues to evolve, the convergence of social hacking and artificial intelligence (AI) presents a formidable challenge to cybersecurity professionals worldwide. Social hacking, the art of manipulating human psychology to gain unauthorized access to sensitive information, has long been a potent threat. Meanwhile, AI, with its ability to analyze vast datasets, mimic human behavior, and automate tasks, has ushered in a new era of cyber threats and opportunities. Understanding the intersection of these two phenomena is crucial for mitigating risks and fortifying defenses in an increasingly interconnected world.

At its core, social hacking exploits the innate cognitive biases and emotional responses of individuals to bypass traditional security measures. Techniques such as phishing, pretexting, and impersonation leverage human trust, curiosity, and authority to deceive unsuspecting victims. With the advent of AI, these tactics have become more sophisticated and scalable than ever before.

AI-powered social hacking presents a dual-edged sword, offering both benefits and challenges to cyber attackers and defenders alike. On one hand, AI enables attackers to automate the creation and dissemination of convincing phishing emails, chatbots, and deepfake videos, amplifying the reach and effectiveness of their campaigns. Moreover, machine learning algorithms can analyze vast amounts of personal data scraped from social media profiles and online activity to craft highly targeted and persuasive messages tailored to individual victims.

Conversely, AI also holds promise as a tool for enhancing cybersecurity defenses. Advanced AI algorithms can analyze network traffic patterns, detect anomalies, and identify potential security breaches in real-time. Additionally, AI-powered chatbots and virtual assistants can educate users about common social engineering tactics, simulate phishing attacks to train employees, and provide timely warnings about suspicious activities.

However, the proliferation of AI in both offensive and defensive cybersecurity strategies introduces new complexities and ethical considerations. As AI algorithms become more adept at mimicking human behavior and generating convincing fake content, distinguishing between genuine communications and sophisticated manipulations becomes increasingly challenging. Moreover, the use of AI for surveillance and predictive analytics raises concerns about privacy, consent, and the potential for algorithmic bias and discrimination.

To address these challenges, cybersecurity professionals must adopt a holistic approach that combines technological innovation with human-centric strategies. Beyond deploying AI-driven solutions, organizations must prioritize employee education and awareness training to recognize and resist social engineering attacks. Encouraging a culture of skepticism, verification, and responsible use of technology is essential for mitigating the risks posed by AI-powered social hacking.

Furthermore, collaboration between cybersecurity experts, AI researchers, policymakers, and ethicists is essential for developing robust frameworks and guidelines that promote the responsible and ethical use of AI in cybersecurity practices. By fostering interdisciplinary dialogue and knowledge sharing, we can harness the transformative potential of AI while safeguarding against its misuse and unintended consequences.

The convergence of social hacking and AI represents a paradigm shift in the cybersecurity landscape. While AI offers unprecedented opportunities for both attackers and defenders, its integration into social engineering tactics introduces new challenges and complexities. By embracing a proactive and multidisciplinary approach, we can harness the power of AI to strengthen cybersecurity defenses and safeguard against emerging threats in an increasingly interconnected world.

 Discover AI's impact on social hacking in cybersecurity.

The Nexus of Social Hacking and AI: Redefining Cybersecurity Challenges

Christine Davis

Director, Marketing

Stellar is honored to be named one of the Pioneer Top 250 on 

CRN's MSP 500 list refers to an annual list compiled by CRN, a media brand of The Channel Company, a leading source for news and analysis in the IT channel. The MSP 500 list specifically recognizes Managed Service Providers (MSPs) in the information technology industry.

The list is divided into different categories, such as the MSP Elite 150, recognizing large, data center-focused MSPs; the MSP Pioneer 250, highlighting companies with a business model heavily weighted toward managed services; and the MSP Security 100, recognizing companies that specialize in providing managed services for cybersecurity.

Each year, CRN compiles this list to showcase the leading service providers in the managed services space, and it serves as a valuable resource for businesses looking to engage with trusted and proficient MSPs for their IT needs.
⁠
⁠"Inclusion on CRN's 2024 Managed Service Provider List as a Pioneer Top 250 is not just a recognition; it's an affirmation of our unwavering commitment to innovation, excellence, and client-centric solutions," said Stellar's CEO, Wayne Johnson.  "This honor is a testament to the collective dedication of our team, showcasing that in the ever-evolving landscape of technology, we stand at the forefront, pioneering the future of managed services with passion, expertise, and a relentless pursuit of excellence."

Read more about what our CEO, Wayne Johnson, is saying about the 

CRN MSP 500 2024.jpg

Stellar awarded Pioneer 250 on CRN's MSP 500 List for 2024

Stellar recognized as Pioneer 250 on CRN's 2024 MSP 500 List

VMware, now under Broadcom, has marked a significant milestone with a series of announcements aimed at simplifying its product portfolio and transitioning to a subscription-based model. These changes, shaped by customer and partner feedback, are designed to provide enhanced value, continuous innovation, and a more straightforward engagement process for all stakeholders.

 is the dramatic simplification of its product portfolio to two foundational offers (plus add ons). Responding to feedback about complexity, the company aims to streamline offerings across all divisions, making it easier for customers to navigate and extract maximum value from VMware solutions.

Transition from Perpetual to Subscription Licenses

A major shift involves the complete transition from perpetual licenses to subscription licenses. The sale of perpetual licenses, Support and Subscription (SnS) renewals for perpetual offerings, and HPP/SPP (generic) credits will cease (effective dates will vary). This move aligns with industry trends, offering customers continuous innovation, faster time to value, and predictable investments.

To help prepare for these changes, Stellar can assist in assessing your current state with VMware infrastructure and management products. This includes reviewing the inventory of perpetual licenses, understanding refresh cycles, and becoming familiar with available subscription offers. 

Understanding the most recent announcements around offerings and pricing models from VMware by Broadcom

VMware by Broadcom Unveils Transformational Changes for Simplicity and Innovation

National Cyber Security Awareness Month: ⁠Elevating Employee Vigilance Against Ever-Evolving Threats

October is recognized as National Cyber Security Awareness Month, a critical reminder for businesses and individuals alike about the importance of staying safe and secure online. With cyber threats continually evolving, one of the most potent defenses remains, surprisingly, human vigilance.  It’s crucial for organizations to take proactive measures to stay ahead of these threats and ensure data remains secure. 

Phishing Campaigns: Deceptively Simple, Devastatingly Effective


One of the most common and successful forms of cyberattacks is email phishing. These are deceptive emails that trick recipients into clicking malicious links, downloading infected attachments, or divulging personal or company information.

A particularly devious form of phishing is spear-phishing, where the attacker customizes the email to a specific individual or organization, often using details that make the message seem genuine. 


Paying attention to the email addresses of incoming emails is crucial. Cybercriminals often use email addresses that look similar to legitimate ones, with subtle misspellings or domain changes. For example, 

Man-in-the-Middle (MitM) Website Attacks.
⁠

Beyond email, cybercriminals deploy website-based attacks, like the man-in-the-middle (MitM) attacks. In a MitM attack, a hacker secretly intercepts and relays communication between two parties. When applied to websites, this might mean capturing login details when a user believes they are accessing a legitimate site.

External Sender Warning Banners: A Simple Yet Effective Measure


Given the sheer volume of phishing attempts, many organizations have found success in implementing a straightforward tool: external sender warning banners. These banners alert users when an email originates from outside the company, urging them to double-check the content before taking any action.

While it might seem simple, this visual cue can make the difference, reminding users to pause, review, and ensure they're not about to become the next victim of a cyber-attack.


Cyber Security Awareness Month is an opportune time for businesses to evaluate and elevate their cybersecurity posture. Central to this is recognizing that while technology plays a pivotal role, the human element—armed with the right knowledge and training—can be the most robust line of defense against cyber threats. 

Learn about  combating phishing campaigns, spotting deceptive emails, and defending against man-in-the-middle website attacks for National Cybersecurity Awareness Month.

October is National Cyber Security Awareness Month

Stellar Technologies Successfully Completes a SOC 2 Assessment to Further Data Security

At Stellar Technologies (“Stellar”), we continually invest in security best practices to ensure that our client’s data stays safe and secure. As a part of an on-going effort, we are excited to
announce that we’ve successfully completed our SOC 2 report.  

, a technology-enabled security and compliance firm trusted by more than 4,000 global organizations to help mitigate cybersecurity risks. 

 “Stellar’s SOC 2 report validates its commitment to data security and protection, as well as compliance with critical standards to mitigate cybersecurity threats.”  

 and what does it mean for Stellar?  In this article, we will walk you through the ins and outs of a SOC 2 report and how the report symbolizes trust to clients.

 addresses risks associated with the handling and access of data, and can be used by a variety of organizations of any size (e.g. SaaS, colocation, data hosting, etc.) Rather than a cybersecurity assessment that evaluates specific technical configurations, a SOC 2 report focuses more on how an organization implements and manages controls to mitigate the identified risks to the different parts of an organization.

⁠The 

, which are used to identify various risks (points of focus) an organization should consider addressing. Based on the TSCs the organization selects to be in-scope, the third-party compliance and audit firm (in our case, 

) evaluates whether the organization has the appropriate
policies, procedures and controls in place to manage the identified risks effectively.

There are five Trust Services Criteria. The first criteria, Security, must be included with every SOC 2 report and is referred as the “Common Criteria”.  The remaining four are optional to include:

In order to pass a SOC 2 examination and receive a letter of attestation successfully, it means an organization is addressing controls in areas such as information security, access control, vendor management, system backup, business continuity and disaster relief, 


Organizations of all sizes and industries can benefit from a SOC 2 Examination, as the audit can be performed for any organization that provides a variety of services to its customers. A SOC 2 report highlights the controls in place that protect and secure an organization’s system or services used by its customers. The scope of a SOC 2 Examination extends beyond the
systems that have a financial impact, reaching all systems and tools used in
support of the organization’s system or services. 



Today, many organizations outsource their business operations and services to third-party vendors, possibly putting client data at risk. For this reason, organizations request that their vendors achieve SOC 2 compliance to demonstrate rigorous IT security standards.  Some 

Know your data is safe and secure with Stellar


⁠Stellar will make the SOC 2 report available to current or potential customers upon execution of a non-disclosure agreement.  We hope the steps we have taken help you and your IT teams remain confident in knowing that your data is secure with Stellar.  To learn more about our security policies and initiatives, please contact our 


⁠In an age where cyber threats evolve daily, Stellar’s Managed Security Services offer peace of mind. With Stellar by your side, you’re fortified by top-tier security measures, from proactive threat hunting to real-time monitoring and instant response. We act as your vigilant sentinels, ensuring that your data, assets, and reputation remain uncompromised. For more information about Stellar, visit:  


A-LIGN is the only end-to-end cybersecurity compliance solutions provider with readiness to report compliance automation software paired with professional audit services, trusted by more than 4,000 global organizations to help mitigate cybersecurity risks. A-LIGN uniquely delivers a single-provider holistic approach as a licensed CPA firm to SOC 1 and SOC 2 Audit services, accredited ISO 27001, ISO 27701 and ISO 22301 Certification Body, HITRUST CSF Assessor firm, accredited FedRAMP 3PAO, authorized CMMC C3PAO, PCI Qualified Security Assessor Company, and PCI SSC registered Secure Software Assessor Company. Working with growing businesses to global enterprises, A-LIGN’s experts and its compliance automation platform, A-SCEND, are transforming the compliance experience. For more information, visit 

21972-312_SOC_NonCPA.png

Stellar Technologies Successfully Completes a SOC 2 Assessment to Further Data Security

Matt Love

Chief Operating Officer

Over the weekend, Cloudflare released a tool called 

, to "track deployments and filtering of invalid routes by the major networks". The release has managed to get some notoriety (both positive and controversial) — more than one might expect for such a technical topic.

If you haven't seen or heard of the website, this is what it looks like as of April 20, 2020:

2020-04-20-is-bgp-safe-yet-1.png

Looks kind of alarming, doesn't it? In case you're not familiar with some of the terminology being thrown around, let's review these concepts. If you're already familiar with BGP & RPKI technologies, feel free to 

BGP is the dynamic routing protocol that quite literally runs the internet. ISPs, cloud providers, and larger enterprises use BGP to advertise their networks to one another, which is how anything on the internet knows how to get to anything else. Take the below example:

$ traceroute -a -n www.google.com
 1  [AS22773] 172.19.10.126
 2  [AS22773] 10.96.48.1
 3  [AS22773] 100.125.108.70
 4  [AS22773] 100.99.28.32
 5  [AS22773] 68.1.4.252
 6  [AS22773] 68.105.30.142
 7  [AS15169] 108.170.247.129
 8  [AS15169] 108.170.247.193
 9  [AS15169] 216.239.41.4510
10 [AS15169] 108.170.234.41

In this traceroute, the highlighted hop 7 shows where BGP is happening. AS22773, or Cox Communications (my home's ISP), directly interconnects with AS15169, or Google. My home network can reach Google through this interconnection, which is commonly referred to as a 

As you can probably imagine, there's a lot more to BGP than this, very little of which is in-scope for this article. There are lots of great resources out there to learn more about BGP and internet peering; 

, is a security mechanism introduced via 

To understand RPKI, one must first understand the problem it's trying to solve: 

 controversial website actually does a fantastic job of illustrating what BGP Hijacking is:

2020-04-20-is-bgp-safe-yet-2.png

In a nutshell, an attacker can advertise networks they don't own to ISPs and cause traffic to web resources within those networks to route through the attacker's network. This can lead to the web resources appearing completely down, or worse, the traffic can be intercepted and sent on to its original destination with the end-user being none the wiser.

, but it's up to the network operators and providers to prevent it.

 is a certificate system which may be used by an organization to cryptographically sign which networks they own, and from where they should originate. These certificates are called 

There are two primary requirements to ensure RPKI is effective:

A BGP-operating organization must sign and issue ROAs for their networks, which are validated and maintained by Regional Internet Registries. While this is a critical first step, it doesn't solve any problems by itself.

For this organization's ROAs to do anyone any good, internet providers upstream from the organization have to reject any route advertisements that are signed by the organization, but advertised by someone else.

 should only originate from Google (AS15169) via their ROAs, and 

 is suddenly advertised from an attacker (whether maliciously or by mistake), internet providers should reject the route so that the traffic is never sent to the attacker:

2020-04-20-is-bgp-safe-yet-3.png

You might be wondering why a provider would accept a route to a network they don't own in the first place. This is an important question! 

Network providers should never accept route advertisements from customers or peers unless the organization is authorized to advertise that prefix

. Unfortunately, it's impossible to enforce such a statement on a global scale.

RPKI's goal is to provide a mechanism through which participating networks can prevent these hijacks from happening, or at least reduce their impact.

If you've read the above background information, or are already familiar with these technologies, you can see that RPKI adoption is an important step to improving the security of the internet. The discussion has been ongoing in the community for nearly a decade. Many content providers (like Cloudflare) have championed the implementation of RPKI, and some major internet carriers have recently taken a major step by rejecting RPKI-invalid route advertisements from ever entering their networks (

To date, Cloudflare has been doing fantastic work related to routing security in the internet operator community; they're probably the largest vocal advocate of RPKI adoption in the world. However, the release of 

 has been very controversial in the community, and with good reason.

Public shaming is rarely a successful or healthy catalyst for change, and Cloudflare's new tool enables potentially under-educated end-users to quickly (2 clicks) call out their service providers for not "implement[ing] BGP safely", which isn't necessarily accurate.

A couple of highly-respected network engineers (

 Cloudflare's own claim to "implement BGP safely", and found some interesting results. They intentionally advertised a network onto the internet — 

 — from an invalid ASN, which should be considered an RPKI-invalid network. Cloudflare's own 

Cloudflare confirms 194.32.71.0/24 is invalid

2020-04-20-is-bgp-safe-yet-4.png

If Cloudflare truly rejects all invalid RPKI networks as they claim to, traffic originating from this network (from the "attacking" source) should be unreachable for Cloudflare. In other words, you shouldn't be able to reach Cloudflare from that network. And yet:

Cloudflare can still reach 194.32.71.0/24

2020-04-20-is-bgp-safe-yet-5.png

This screenshot shows that traffic originating from the "attacker" can reach Cloudflare's network, and that Cloudflare's network has reachability back to the "attacker" network. Another engineer set up a site using 

We love Cloudflare. This site is served over Cloudflare's CDN, we exclusively use their DNS services, and we recommend them to just about all our customers.

 is a well-intentioned, poorly-implemented scare tactic that will only serve to raise RPKI awareness in a negative light, at a very sensitive time in the global internet community due to the COVID-19 pandemic. And, if Cloudflare is going to be the RPKI standards bearer for everyone to follow, shouldn't they implement RPKI correctly themselves?

Cloudflare's method of testing a network's "safe" implementation of BGP is reachability to their network 

, which is intentionally advertised with an invalid ROA. However, reachability to this network isn't a sole indicator of an unsafe BGP implementation. Not all network providers accept a full routing table from their upstream carriers. Indeed, many providers only accept routes local to a particular region, with a default route to cover the rest. In these cases, the provider has no control over its reachability to an RPKI-Invalid network. This further illustrates that the attitude of Cloudflare's 

 tool is not the right approach to fostering the adoption of RPKI.

At Stellar, we place extremely high importance on routing security. You can read more about our routing policies 

We ensure invalid routes never enter our network from customers and peers by only accepting routes that are either a) listed in an 

, b) manually validated by our engineering team, or both.

We also use BGP policies to ensure only routes we or our customers are authorized to advertise ever leave our network.

As a cloud provider, our primary objective in the RPKI ecosystem is to prevent the hijacking of our own networks by a third party. This is accomplished by signing and issuing ROAs, which inform upstream RPKI participants of valid paths for the containing networks. 

At Stellar, we issue ROAs for our address space:

2020-04-20-is-bgp-safe-yet-6.png

> show bgp ipv4 unicast 103.21.244.0/24 bestpath
BGP routing table entry for 103.21.244.0/24, version 24720714
BGP Bestpath: deterministic-med
Paths: (6 available, best #3, table default)
  Advertised to update-groups:
     14
  Refresh Epoch 1
  174 13335, (aggregated by 13335 162.158.140.1)
    38.104.117.177 from 38.104.117.177 (154.26.7.144)
      Origin IGP, metric 2020, localpref 150, weight 200, valid, external, best
      Community: 174:21001 174:22013 14525:0 14525:20 14525:1021 14525:2840 14525:3001 14525:4001 14525:9001
      rx pathid: 0, tx pathid: 0x0

The above is the BGP routing table entry for Cloudflare's intentionally invalid RPKI test network. The fact that it exists in our routing table means that we do not yet reject RPKI-Invalid routes from our upstream providers.

While it's been on our roadmap for some time, we've placed a higher priority on other objectives, such as our customer & peer routing policies, global network redundancy, and making our network faster and more reliable. Additionally, there are very few options available for the server implementation of RPKI - all of them open source. While we fully support and contribute to the open source community, the use of open source software in production networks requires a great deal of testing, validation, and architecture effort to ensure what we implement meets our 

We do plan to implement an RPKI solution to reject invalid routes, but it is still in progress at this time.

Does this really happen?

Comments & Education on Cloudflare's new BGP Tool

Is BGP Safe Yet?

Launch into Stellar's product updates, company news, and educational content on how to leverage the 

The Interstellar Connection

Your Portal to Technology's Future