At the APNIC 44 Cooperation SIG in Taichung, Jesse Sowell presented M3AAWG's efforts to understand abuse dynamics and anti-abuse efforts in the Asia Pacific region, fundamentally asking 'Is there demand for an anti-abuse working group (AAWG) in the AP region?' Based on feedback in the SIG and in hallway conversations, the answer seems be yes. We are proposing BoF to continue this dialog and community development effort.
The first half illustrates the kind of best common operational practices produced by an anti-abuse working group. Severin Walker will present our work on abuse desk operations. The idea behind abuse desk operations goes by a variety of names: service policy enforcement, policy compliance assurance, and fraud remediation to name a few. The fundamental idea behind abuse desk operations is to get bad actors off your network, protecting your users and reducing the costs related to security incidents. We will present the fundamental elements of abuse operations in terms of industry (community) responsibilities, business justification, common categories of incidents, and the incident response timeline. Each phase of the incident response timeline---detection, reporting, evaluation, enforcement, and remediation---is placed in the context of the overall process and illustrated with pragmatic instances of how these processes play out in the real world, including illustrations of how to evaluate data produced by common abuse reporting tools and formats. The presentation concludes with a survey of the common abuse desk activities and the benefits to the organization.
The second half of this BoF is a town hall style discussion on abuse issues in the region. This discussion continues the dialog started in the APNIC 44 Cooperation SIG. We will briefly present anti-abuse working groups as the fora in which the kinds of anti-abuse best common operational practices just presented are developed (much like BCOPs in the network operator world), quickly followed by a discussion with the audience around the types of abuse they are facing on a day-to-day basis. In this discussion, the dialog will explore how abuse dynamics in the AP region are similar to those seen by M3AAWG and, more importantly, where they differ. This discussion will describe where M3AAWG best practices may contribute to resolving these issues and where the AP community can help update anti-abuse best practices to reduce local, regional, and global abuse problems. In the course of this dialog, Severin and Jesse elicit further feedback from the audience to better understand the demand for anti-abuse efforts in the region and how to most effectively develop a self-sustaining anti-abuse working groups in AP.
