ISPs and Egress Filtering

[morganlefay]

I had brought up this subject before in a previous post where I thought ISPs would\should start to aggressively filter traffic..as it must have some cost to have
this malicious traffic running around... I am sure thier help desks get swamped whenever a huge exploit hits the internet and starts to affect the customers machines.

I like the idea of leaper colonies

Anyway I found this interesting and thought I would post.

From

http://isc.sans.org//index.php?on=istsnews

ISPs and Egress Filtering

An increasing number of ISPs are beginning to brooch to concept of egress filtering of their end users (and not just port 25, and not just to stop spam). This has become a security vs usability problem, with the usability side probably going to lose. As a highly technical person, I do not want to hear that my ISP will not allow me to do what I want to do. I am in the minority.

On the other hand, most users don't have automatic updates, patch their machines, have anti-virus software, run Windows 95, or all of the above and the ISP has no control to do much about it. These machines will get compromised and happily spew all its malware goodness all over the Internet. There will come a day when ISPs will simply stop caring about the minority and reduce the high level of impact that compromised machines cause by filtering more and more traffic from their customers.

Many Universities have solved this problem by setting up "leper colony" VLANs and putting the problem users on them once infected. Then when they try to do something, they are redirected to a "clean up your machine" page. This may be something ISPs may more and more want to look at, in addition to setting minimum security standards for their users to get on the Internet.


Off to find a link to that other thread....

MLF

edited to fix spelling...first coffee

[dinowuff]

I read the same thing this morning. I believe that egress filtering is a waste of time.

The idea is to permit only packets from trusted hosts to leave your network? Certainly this can only be a voluntary thing, No way could this be enforced on a global scale.

Training is where I focus my energy when it comes to security.

As for the leaper colonies? Again too much time and energy. Just kick the offending PC off the network don't allow any more traffic from the offending nic.

Do this two or three times, and word gets around quick that there's a Bastard SysAdmin playing Bing Brother.

I know this is harsh, but should I / We as administrators spend all our free time coming up with new rules, mucking about with iptables / routers / insert favorite firewall because of stupid users?

Stupid users are a fact of life on the network. I believe if the user remains stupid because I don't properly train them - my fault. After training - I give each user three strikes per issue; No ACCESS FOR YOU!

/end rant

[nihil]

Yes, I also read the article.

I think that ISPs will probably get around to blocking some activity such as automatic port scanning, and maybe doing some virus scanning, if only for their own convenience. And they will doubtless increase their charges as well. I think that it would only be really effective if both ISP and e-mail providers were working together.

I cannot really see them introducing "leper colonies" as that would be too gargantuan a task asdinowuff says:

Just kick the offending PC off the network don't allow any more traffic from the offending nic.

However I do believe that can work at an institutional level which is obviously much smaller. For example I know of corporations that won't let an external or mobile device be connected to their networks unless it has the latest AV and has run a full scan since the update. Similarly, when an infected device is detected it is immediately disconnected from the network.

At the end of the day I think it will create two classes of user...........those paying for a premium service, and those left to fend for themselves.

just a thought