ISPs and Egress Filtering
I had brought up this subject before in a previous post where I thought ISPs would\should start to aggressively filter traffic..as it must have some cost to have
this malicious traffic running around... I am sure thier help desks get swamped whenever a huge exploit hits the internet and starts to affect the customers machines.
I like the idea of leaper colonies :D
Anyway I found this interesting and thought I would post.
From
http://isc.sans.org//index.php?on=istsnews
ISPs and Egress Filtering
An increasing number of ISPs are beginning to brooch to concept of egress filtering of their end users (and not just port 25, and not just to stop spam). This has become a security vs usability problem, with the usability side probably going to lose. As a highly technical person, I do not want to hear that my ISP will not allow me to do what I want to do. I am in the minority.
On the other hand, most users don't have automatic updates, patch their machines, have anti-virus software, run Windows 95, or all of the above and the ISP has no control to do much about it. These machines will get compromised and happily spew all its malware goodness all over the Internet. There will come a day when ISPs will simply stop caring about the minority and reduce the high level of impact that compromised machines cause by filtering more and more traffic from their customers.
Many Universities have solved this problem by setting up "leper colony" VLANs and putting the problem users on them once infected. Then when they try to do something, they are redirected to a "clean up your machine" page. This may be something ISPs may more and more want to look at, in addition to setting minimum security standards for their users to get on the Internet.
Off to find a link to that other thread....
MLF
edited to fix spelling...first coffee :cool:
