funsec mailing list archives
Re: Public Policy and Consumer ISP Hygiene (was Comcast pop-ups)
From: Dan White <dwhite () olp net>
Date: Sun, 11 Oct 2009 23:31:08 -0500
On 11/10/09 22:29 -0400, Larry Seltzer wrote:
Many of us have agreed that, for competitive reasons, it's not possible for ISPs to lock infected users out of a network. I'd like to suggest a crazy idea for your reaction: A law governing ISPs that sets rules for these situations. It sets rules for how they can and should contact users about suspected infections and *requires* that they isolate such users until that user remediates their systems(s), and sets rules for how that is determined.
And what would trigger this law? SPAM? a port-scan? A high bandwidth attack on another network?
On the other hand, if you want to clean up the consumer ISP networks in the US, this would seem to be a way to get a lot of it done. Not perfect of course, but it gives users a real incentive to keep their systems clean. Local consultants and security software companies should make out like bandits.
You don't mention SPAM, perhaps intentionally... But that's almost single handedly the only issue that is brought to our ISP's attention when a residential customer's network is compromised. The other, unusual, case is when an attacker might set up a bank phishing website on a customer's home computer/server. We get lots of auto-generated emails about someone on our network running a port-scan or protocol scan on a remote network but these tend to be very isolated (contrary to what you might think), and I usually just file those email notifications away for future reference. I would contend that, for the most part, infected PCs are not an ISP problem, but the customer's problem. Rather than lobbying law makers, I'd rather see our time spent on: 1) Educating users on proper use of anti-virus and anti-malware tools - and being ADHD about installing OS updates. 2) Replacing SMTP with something sane and secure. SMTP has got to be IETF's biggest failure. 3) Doing what we can to develop and increase our participation in a public key infrastructure and IPSEC. -- Dan White _______________________________________________ Fun and Misc security discussion for OT posts. https://linuxbox.org/cgi-bin/mailman/listinfo/funsec Note: funsec is a public and open mailing list.
Current thread:
- dumb. Comcast pop-ups RandallM (Oct 10)
- Re: dumb. Comcast pop-ups Jon Kibler (Oct 10)
- Re: dumb. Comcast pop-ups Alex Lanstein (Oct 10)
- Re: dumb. Comcast pop-ups Rich Kulawiec (Oct 11)
- Public Policy and Consumer ISP Hygiene (was Comcast pop-ups) Larry Seltzer (Oct 11)
- Re: Public Policy and Consumer ISP Hygiene (was Comcast pop-ups) Dan White (Oct 13)
- Re: Public Policy and Consumer ISP Hygiene (was Comcast pop-ups) Larry Seltzer (Oct 12)
- Re: Public Policy and Consumer ISP Hygiene (was Comcast pop-ups) Dan White (Oct 13)
- Re: Public Policy and Consumer ISP Hygiene (was Comcast pop-ups) Valdis . Kletnieks (Oct 13)
- Re: Public Policy and Consumer ISP Hygiene (was Comcast pop-ups) Dan White (Oct 13)
- Re: Public Policy and Consumer ISP Hygiene (was Comcast pop-ups) Rich Kulawiec (Oct 13)
- Re: Public Policy and Consumer ISP Hygiene (was Comcast pop-ups) Dan White (Oct 13)
- Re: Public Policy and Consumer ISP Hygiene (was Comcast pop-ups) Rich Kulawiec (Oct 16)
- Re: Public Policy and Consumer ISP Hygiene (was Comcast pop-ups) Dan White (Oct 16)
- Re: Public Policy and Consumer ISP Hygiene (was Comcast pop-ups) Valdis . Kletnieks (Oct 16)
- Re: Public Policy and Consumer ISP Hygiene (was Comcast pop-ups) Dan White (Oct 16)
- Re: dumb. Comcast pop-ups Alex Lanstein (Oct 10)
- Re: dumb. Comcast pop-ups Jon Kibler (Oct 10)