[fw-wiz] ISP firewalling of residential customers - was - About Port Forwarding, Apache and Firewall Rules

From: Mason (hr824_at_sunwave.net)
Date: 09/01/04

  • Next message: Paul D. Robertson: "[fw-wiz] Re: ISP firewalling of residential customers - was - About Port Forwarding, Apache and Firewall Rules" 
    To: "Paul D. Robertson" <paul@compuwar.net>
Date: Wed, 1 Sep 2004 01:12:50 -0700

    On August 30, 2004 05:41 am, Paul D. Robertson wrote:
    > Given the number of already compromised home machines on broadband, I
    > *definitely* would rather that the generic population were put behind
    > firewalls, and kept there.
    >
    I work for a *small* cable ISP surrounded on all sides by a giant competitor.

    In discussions within my department, we find ourselves torn between a desire
    to be transparent to our customers, our knowledge of the what is "out
    there" (spam, worms, phishing, etc), and the feeling that we need to do more
    to protect our customers (absence of funds and man-power always figure
    heavily into this as well...).

    We are currently fighting on several fronts, but one in particular really
    bothers me. I'm forced to play the cat and mouse game of blocking individual
    ports in response to "new threats". I would love to implement a default deny
    policy on my residential networks (at least ingress if not egress as well).
    I think that ISPs are going to have to do something like this eventually
    simply due to the massive amount of crap that our networks get hit with at
    all times and the fact that user education concerning patching, firewalls and
    antivirus just isn't moving along all that well.

    Our quandary is that we are the little guy and we fear that implementing any
    such restrictive policy would kill us. Our customers are accustomed to
    largely unrestricted access to the net and our formidable competition is
    highly unlikely to take similar steps in protecting their network which would
    of course make them look pretty rosy by comparison.

    Anyone have any brilliant ideas...? It's really unfortunate that we feel our
    hands are tied; most of this mess could be dealt with if we were able to get
    a bit more involved in our customers' access to the net.

    > Contrary to popular opinion, full access to the Internet is neither a
    > god-given right, nor a necessity.
    >
    The big issue from a business standpoint is that popular opinion seems to
    rule... I wish that we could do what is right rather than what is popular -
    it would make this feel more like network adminstration than politics... 

    --
Mason Schmitt
_______________________________________________
firewall-wizards mailing list
firewall-wizards@honor.icsalabs.com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards
  • Next message: Paul D. Robertson: "[fw-wiz] Re: ISP firewalling of residential customers - was - About Port Forwarding, Apache and Firewall Rules"

    Relevant Pages

    • RE: Signatures taking down network
      ... Since the updates are "preauthorized", ... Subject: Re: Signatures taking down network ... I'm curious to know how these customers feel about their networks being ...
      (Focus-IDS)
    • RE: A question for the list...
      ... >ISP's warning them that x number of their customers have the latest worm. ... infected with worms. ... Just like wired networks, wireless LANs require network security policies ...
      (Incidents)
    • Re: Dish ordered to stop transmitting DNS
      ... There are still just as many Direct customers out in the boonies who got distant networks when there weren't local networks and were never converted over to the locals when they began to beam them. ... We had networks without waivers for over 4 years when they were required by the same ruling Dish is being clobbered with. ... Yet Direct thumbs their nose at the same regulations and invades the privacy of their customers in blatant disregard for the law. ...
      (rec.outdoors.rv-travel)
    • Re: [fw-wiz] ISPs with more secure networks???
      ... filtering anywhere other than the leaf node to the customer. ... provide managed firewalling for customers for a price. ... > networks x bandwidth and other international networks y bandwidth. ... > (i.e. firewall, routing, filtering or other). ...
      (Firewall-Wizards)
    • RE: [fw-wiz] ISPs with more secure networks???
      ... filtering anywhere other than the leaf node to the customer. ... provide managed firewalling for customers for a price. ... > networks x bandwidth and other international networks y bandwidth. ... the managed services arena, but with per-customer infrastructure for the ...
      (Firewall-Wizards)