RFC 1281

Guidelines for the Secure Operation of the Internet

📅 published November 1991, from ietf

RFC 1281: Guidelines for the Secure Operation of the Internet 🎀

Part 1 of 3 🦋

okay bestie, let's do the title block tea ☕ This is RFC 1281, and it's called Guidelines for the Secure Operation of the Internet. The authors are R. Pethia and B. Fraser from the Software Engineering Institute, plus S. Crocker from Trusted Information Systems, Inc. It's dated November 1991. The category is informational, so it's giving "here's some really solid advice" and not "you MUST do this" 💅 Also, the title block doesn't list anything it obsoletes or updates, so no drama there 🫶

Status of this Memo ✨

okay so this memo is just here to give info to the Internet community 📚 It does not specify an Internet standard, so nobody is being put in a headlock about it 😭 And distribution of this memo is unlimited, so share it with everyone you know 💜

Preamble 🌸

so the whole point of this document is to give a set of guidelines that help keep the Internet secure to operate 🔐 The Internet has grown a lot over time and it is now super diverse. Its participants include government institutions and agencies, academic and research institutions, commercial network and electronic mail carriers, non-profit research centers, and an increasing array of industrial organizations who are mostly just users of the technology 🧚

Even with all that growth, the system still runs on a purely collaborative basis 🤝 Each participating network takes responsibility for its own operation. Service providers, private network operators, users, and vendors all cooperate to keep things working. It's a whole group project, and everyone has to show up 🍓

It's important to recognize that the voluntary nature of the Internet is both its strength and, perhaps, its most fragile aspect 🥺 Rules of operation are a lot like rules of etiquette: they're voluntary and, mostly, unenforceable. The exception is where they happen to match up with national laws, and breaking those can lead to prosecution ⚖️

A common set of rules for the successful and increasingly secure operation of the Internet can, at best, be voluntary 🙈 That's because the laws of various countries are not uniform when it comes to data networking. Honestly, the guidelines below can only be voluntary too 💀

BUT here's the lowkey plot twist: joining the Internet is optional, so it's also fair to argue that any Internet rules of behavior are part of the bargain for joining 👑 Failing to follow them, apart from whatever legal infrastructure is available, can be grounds for sanctions. So it's not just vibes, bestie 💅

Introduction 🌈

these guidelines are for the entire Internet community 🫶 That means users, hosts, local, regional, domestic, and international backbone networks, and vendors who supply operating systems, routers, network management tools, workstations, and other network components. Everybody's in the group chat 💬

Security is understood to include a few main things ✨

protection of the privacy of information
protection of information against unauthorized modification
protection of systems against denial of service
protection of systems against unauthorized access

okay so these guidelines cover six main points 🔥 They get repeated and elaborated in the next section. There's also a bibliography of computer and network related references at the end of this document, for the reader to use 📖 Iykyk, it's a whole reading list 🎀

Security Guidelines 🔐

Here are the six points, bestie 💖

Users are individually responsible for understanding and respecting the security policies of the systems (computers and networks) they are using. Users are individually accountable for their own behavior. Own your choices, babe 👑
Users have a responsibility to employ available security mechanisms and procedures for protecting their own data. They also have a responsibility for assisting in the protection of the systems they use 🛡️
Computer and network service providers are responsible for maintaining the security of the systems they operate. They are further responsible for notifying users of their security policies and any changes to these policies 📣
Vendors and system developers are responsible for providing systems which are sound and which embody adequate security controls 🧱
Users, service providers, and hardware and software vendors are responsible for cooperating to provide security. It's giving teamwork, and I'm obsessed 🫶
Technical improvements in Internet security protocols should be sought on a continuing basis. At the same time, personnel developing new protocols, hardware, or software for the Internet are expected to include security considerations as part of the design and development process 🌟 Basically, security isn't an afterthought, it's part of the main character plan 💅

Elaboration ✨

okay bestie, this is where RFC 1281 gets into the nitty gritty 💅 there are six responsibility points, and each one spells out who has to do what to keep the Internet secure 🔐

(1) users are individually responsible for understanding and respecting the security policies of the systems (computers and networks) they use 🫶 they're individually accountable for their own behavior. Users are responsible for their own behavior, period. weaknesses in a system are not a license to break into or abuse it 🙅‍♀️ users are expected to know the security policies of any computers and networks they access and to stick to them. one clear result: unauthorized access to a computer or use of a network is explicitly a violation of Internet rules of conduct, no matter how weak the protection of those computers or networks is 💀

the legal side is getting way more attention worldwide 🌍 several countries have recently passed laws on this (e.g., United Kingdom, Australia). in the United States, the Computer Fraud and Abuse Act of 1986, Title 18 U.S.C. section 1030 makes it a crime, in certain situations, to access a Federal interest computer (federal government computers, financial institution computers, and a computer which is one of two or more computers used in committing the offense, not all of which are located in the same state) without authorization. most of the 50 states in the U.S have similar laws ⚖️

also, users are individually responsible for all use of resources assigned to them, so sharing accounts and access to resources is strongly discouraged 🙈 but since access is assigned by individual sites and network operators, the specific rules for sharing accounts and protecting access are necessarily a local matter 🗺️

(2) users have a responsibility to use the available security mechanisms and procedures to protect their own data 🔒 they also have a responsibility to help protect the systems they use 🫶

users are expected to handle account privileges responsibly and follow site procedures for the security of their data as well as that of the system. for systems that rely on password protection, users should pick good passwords and change them periodically 🔑 using file protection mechanisms properly (e.g., access control lists) to define and maintain appropriate file access control is also part of this responsibility 📂

(3) computer and network service providers are responsible for maintaining the security of the systems they operate 🏢 they're also responsible for notifying users of their security policies and any changes to those policies 📢

a provider may manage resources on behalf of users within an organization (e.g., provision of network and computer services at a university) or may serve a larger, external community (e.g., a regional network provider) 🌐 these resources may include host computers employed by users, routers, terminal servers, personal computers, or other devices that have access to the Internet 🖥️

because the Internet itself is neither centrally managed nor operated, responsibility for security rests with the owners and operators of the subscriber components of the Internet 🌈 even if there were a central authority for this infrastructure, security would necessarily be the responsibility of the owners and operators of the systems that are the primary data and processing resources of the Internet 🧠

there are tradeoffs between stringent security at a site and ease of use (e.g., stringent measures may complicate user access to the Internet) ⚖️ if a site chooses to run an unprotected, open system, it may be providing a platform for attacks on other Internet hosts while concealing the attacker's identity 👀 sites that do operate open systems are still responsible for the behavior of their users and should be ready to help other sites when needed 🫶 whenever possible, sites should try to ensure authenticated Internet access. readers are directed to appendix A for a brief descriptive list of elements of good security 📋

sites (including network service providers) are encouraged to develop security policies 📝 these policies should be clearly communicated to users and subscribers. the Site Security Handbook (FYI 8, RFC 1244) provides useful information and guidance on developing good security policies and procedures at both the site and network level 📚

(4) vendors and system developers are responsible for providing systems that are sound and that embody adequate security controls 🛠️ before a system is introduced into the Internet community, a vendor or system developer should evaluate it in terms of security controls 🔍 each product (whether offered for sale or freely distributed) should describe the security features it incorporates 🏷️

vendors and system developers have an obligation to repair flaws in the security-relevant portions of the systems they sell (or freely provide) for use on the Internet 🩹 they're expected to cooperate with the Internet community to set up ways of reporting security flaws and to get security-related fixes out to the community in a timely fashion ⏰

(5) users, service providers, and hardware and software vendors are responsible for cooperating to provide security 🤝

the Internet is a cooperative venture 🫂 the culture and practice here is to help other sites and networks with security matters. each site is expected to notify other sites if it detects a penetration in progress at those sites, and all sites are expected to help one another respond to security violations 🚨 that help may include tracing connections, tracking violators, and assisting law enforcement efforts 🕵️‍♀️

there's a growing appreciation that security violators should be identified and held accountable 👑 once a violation has been detected, sites are encouraged to cooperate in finding the violator and assisting enforcement efforts 💪 it's recognized that many sites will face a trade-off between securing their sites as rapidly as possible and leaving them open in the hopes of identifying the violator 🤔 sites will also face the dilemma of limiting knowledge of a penetration versus exposing the fact that one has occurred 😬 this policy does not dictate that a site must expose either its system or its reputation if it decides not to, but sites are encouraged to render as much assistance as they can 🎀

(6) technical improvements in Internet security protocols should be sought on a continuing basis 🔄 at the same time, people developing new protocols, hardware, or software for the Internet are expected to include security considerations as part of the design and development process ✨

the points above are all administrative in nature, but technical advances matter too 🛠️ existing protocols and operating systems don't provide the level of security that is desired and feasible today 😭 three types of advances are encouraged:

(a) improvements should be made to the basic security mechanisms already in place. password security is generally poor throughout the Internet and can be improved markedly with tools that administer password assignment and with better authentication technology 🔐 the Internet user population is also expanding to include a larger share of technically unsophisticated users, so security defaults on delivered systems and the controls for administering security must be geared to this growing population 🌱
(b) security extensions to the protocol suite are needed. candidate protocols that should be augmented to improve security include network management, routing, file transfer, telnet, and mail 📬
(c) the design and implementation of operating systems should be improved to place more emphasis on security and to pay more attention to the quality of the implementation of security within systems on the Internet 💻

Appendix A 🎀 Five Areas for Better Local Security

Okay bestie, five areas should be addressed if you want to level up local security 💅 Let's go through them.

(1) Policy first 📜 There must be a clear statement of the local security policy, and this policy must be communicated to the users and other relevant parties. The policy should be on file and available to users at all times, and it should be shared with users as part of giving them access to the system. No cap, this is the foundation.

(2) Real controls 🔐 Adequate security controls must be implemented. At the very least, that means controlling access to systems with passwords, running solid password management, and configuring the system so it protects itself and the info living inside it 🛡️.

(3) Watch and respond 👀 There must be a way to monitor security compliance and respond to incidents that involve a security violation. Logs of logins, attempted logins, and other security-relevant events are strongly advised, and so is regular audit of those logs. Being able to trace connections and other events in response to penetrations is also recommended. Ngl, service providers really need a well thought out, published policy covering what information they gather, who has access to it, and what it's for 🧾. Keep the privacy of network users in mind while writing that policy 🫶.

(4) Chain of communication 📞 There must be an established chain of communication and control to handle security matters. A responsible person should be identified as the security contact. The means for reaching the security contact should be made known to all users and should be registered in public directories, and it should be easy for computer emergency response centers to find contact information at any time 🔎.

The security contact should be familiar with the technology and configuration of all systems at the site, or should be able to get in touch with those who have that knowledge at any time 🧠. Same energy here: the security contact should be pre-authorized to make a best effort at handling a security incident, or should be able to contact those with the authority at any time 🚨.

(5) Respond, don't ghost 👻 Sites and networks that are notified of security incidents should respond in a timely and effective manner. In the case of penetrations or other violations, sites and networks should allocate resources and capabilities to identify the nature of the incident and limit the damage. A site or network cannot be considered to have good security if it does not respond to incidents in a timely and effective fashion, periodt 💅.

If a violator can be identified, appropriate action should be taken to make sure no further violations are caused 🚫. What sanctions should be brought against a violator depends on the nature of the incident and the site environment. For example, a university may choose to bring internal disciplinary action against a student violator 🎓.

Similarly, sites and networks should respond when they're notified of security flaws in their systems. They have the responsibility to install fixes as they become available ✨.

United States Public Laws (PL) and Federal Policies

[1] P.L. 100-235, "The Computer Security Act of 1987", (Contained in Appendix C of Citation No. 12, Vol II.), Jan. 8, 1988.

[2] P.L. 99-474 (H.R. 4718), "Computer Fraud and Abuse Act of 1986", Oct. 16, 1986.

[3] P.L. 99-508 (H.R. 4952), "Electronic Communications Privacy Act of 1986", Oct. 21, 1986.

[4] P.L. 99-591, "Paperwork Reduction Reauthorization Act of 1986", Oct. 30, 1986.

[5] P.L. 93-579, "Privacy Act of 1984", Dec. 31, 1984.

[6] "National Security Decision Directive 145", (Contained in Appendix C of Citation No. 12, Vol II.).

[7] "Security of Federal Automated Information Systems", (Contained in Appendix C of Citation No. 12, Vol II.), Appendix III of, Management of Federal Information Resources, Office of Management and Budget (OMB), Circular A-130.

[8] "Protection of Government Contractor Telecommunications", (Contained in Appendix C of Citation No. 12, Vol II.), National Communications Security Instruction (NACSI) 6002.

Security Considerations 💀

Okay so, if security considerations had not been so widely ignored on the Internet, this memo would literally not have been possible 🔥.

Authors' Addresses 🧚

Meet the authors, the people behind all of this 💖

Richard D. Pethia
Software Engineering Institute
Carnegie Mellon University
Pittsburgh, Pennsylvania 15213-3890

Phone:  (412) 268-7739
FAX:    (412) 268-6989

EMail:  rdp@cert.sei.cmu.edu


Stephen D. Crocker
Trusted Information Systems, Inc.
3060 Washington Road
Glenwood, Maryland 21738

Phone:  (301) 854-6889
FAX:    (301) 854-5363

EMail:  crocker@tis.com


Barbara Y. Fraser
Software Engineering Institute
Carnegie Mellon University
Pittsburgh, Pennsylvania 15213-3890

Phone:  (412) 268-5010
FAX:    (412) 268-6989

EMail:  byf@cert.sei.cmu.edu

📦 where this page comes from

ietf: rfc1281 1991-11
💖 girlified by claude-haiku-5-5 on 2026-10-15: a language model's rewrite of the original, under its terms