Re: Public Policy and Consumer ISP Hygiene (was Comcast pop-ups)

[Dan White <dwhite () olp net>]

On 11/10/09 22:29 -0400, Larry Seltzer wrote:
> Many of us have agreed that, for competitive reasons, it's not possible
> for ISPs to lock infected users out of a network. I'd like to suggest a
> crazy idea for your reaction: A law governing ISPs that sets rules for
> these situations. It sets rules for how they can and should contact
> users about suspected infections and *requires* that they isolate such
> users until that user remediates their systems(s), and sets rules for
> how that is determined.

And what would trigger this law? SPAM? a port-scan? A high bandwidth
attack on another network?

> On the other hand, if you want to clean up the consumer ISP networks in
> the US, this would seem to be a way to get a lot of it done. Not perfect
> of course, but it gives users a real incentive to keep their systems
> clean. Local consultants and security software companies should make out
> like bandits.

You don't mention SPAM, perhaps intentionally... But that's almost single
handedly the only issue that is brought to our ISP's attention when a
residential customer's network is compromised. The other, unusual, case is
when an attacker might set up a bank phishing website on a customer's home
computer/server.

We get lots of auto-generated emails about someone on our network
running a port-scan or protocol scan on a remote network but these tend
to be very isolated (contrary to what you might think), and I usually
just file those email notifications away for future reference.

I would contend that, for the most part, infected PCs are not an ISP
problem, but the customer's problem. 

Rather than lobbying law makers, I'd rather see our time spent on:

1) Educating users on proper use of anti-virus and anti-malware tools - and
being ADHD about installing OS updates.

2) Replacing SMTP with something sane and secure. SMTP has got to be IETF's
biggest failure.

3) Doing what we can to develop and increase our participation in a public
key infrastructure and IPSEC.

-- 
Dan White
_______________________________________________
Fun and Misc security discussion for OT posts.
https://linuxbox.org/cgi-bin/mailman/listinfo/funsec
Note: funsec is a public and open mailing list.