Re: SP's & network security issues

["Travis Pugh" <tdp () discombobulated net>]

----- Original Message -----
From: "Martin hepworth" <martinh () solid-state-logic com>

> I think you need to differentiate between broadband cable/DSl customers
> at 'home' and those who run a business over it. There's alot of ranting
> on /. about the fact that AT&T Broadband is stopping port 80 into the
> cable modem and Verizon also not allowing port 25 in, ie stopping the
> end user running web and mail servers over their nice new broadband
> connection.
>
> Certain users want this so they can run these services locally without
> paying  fees for leased lines, colo's etc. Obviously the ISP's don't
> like it (or the telco's) as it means they loose their leased lines that
> are nice and profitable.
>
> Maybe the providers should offer to do this port blocking if the
> customer requests it, of at least have the options to remove the port
> blocking is I want to run all this stuff locally.
>
> Now Colo's are a different issue and IHMO the servers there should be
> well segmented, but it depends on the contract. Does the colo look after
> the O/S and applications or is the customer responsible. In the cases
> I've seen in the UK the colo usually does this as an added service.
>
> just my 2 pence worth

Hey Martin.  I think what i'm suggesting is a "security by default" stance,
even for small businesses or power users on the other end of these
connections.  It makes the system monstrously more complex, but I'd rather
see a situation where the access customer has to "opt in" to any given open
port across an upstream link, and has to take some responsibility to secure
it.  It is a large change from the current thinking -- a.k.a. "we just give
you the line, what you do with it is your business", but it is blindingly
obvious to me that the current line of thinking has failed miserably.

Granted, performance considerations on faster links and any given customer's
desire to manage their own security must be taken into account, but those
seem to be exceptions to the rule.  How many DS3 and above customers and
yahoo-style server farms are we really dealing with, and how many small
businesses with a competent security admin, as compared to T1/E1 and
broadband customers who take the line, plug it in, and hope for the best?

-travis

> --
> Martin Hepworth
> Senior Systems Administrator
> Solid State Logic Ltd
> +44 (0)1865 842300