Re: I-D.ietf-v6ops-cpe-simple-security-09

[Mark Smith <[e-mail]>]

On Sun, 21 Mar 2010 13:19:50 +1300
Brian E Carpenter <[e-mail]> wrote:

> On 2010-03-21 08:32, Mark Townsley wrote:
> > 
> > On 3/20/10 1:32 AM, james woodyatt wrote:
> >> On Mar 19, 2010, at 16:50, Brian E Carpenter wrote:
> >>   
> >>> But I'm afraid that the simplicity of 'default deny' has long
> >>> ago won the hearts and minds of enterprise network managers.
> >>>      
> >> Sadly, enterprise network managers aren't the only people whose
> >> legitimate interests are at stake in the matter under discussion.
> >>    
> > This document is clearly scoped in the first sentence of the
> > Introduction to:
> > 
> > "gateway devices that enable delivery of Internet services in
> > residential and small office settings."
> > 
> > So, I'm not sure why we are even considering enterprise network managers
> > here.
> 
> Fair enough, but...
> > 
> > The networks themselves, the assets under protection, the types of
> > applications, are quite different
> > between and enterprise network and residential network.
> 
> Indeed. But ISPs that supply CPE to their customers are going to
> assume that their customers are running unpatched insecure operating
> systems at high risk of catching malware. So I think they are just as
> likely as enterprise IT departments to favour default deny approaches.
> 

I can't speak for all ISPs, however the ones I've worked at here in
Australia don't make that assumption universally. There will be a
percentage of customers who have that issue, however they'll be the
minority, and they'll have trouble pretty quickly because of it.

One other broader issue with making that assumption is boundaries of
responsibility / care. If ISPs universally assume that customers devices
are insecure, unmaintained and unpatched, and take active yet
limited measures to mitigate that, some customers might then believe
that the ISP is taking care of all their Internet security needs. If a
customer then suffers a security incident and has a financial loss
because if it, they might try to sue the ISP for the loss because they
believe the ISP is taking care of all their Internet security. 


Regards,
Mark.