Protecting ISP Networks and the Internet at Inform[ED] IoT Security
1 like200 views
The document discusses the challenges ISPs face in securing their networks and the internet, highlighting vulnerabilities that have been exposed, especially in IoT devices. It emphasizes the need for ISPs to implement robust security measures and collaborate with various stakeholders to improve data protection and respond to threats. Key lessons from the Mirai attack illustrate the significant impact of poor security practices and the necessity of proactive strategies to manage and mitigate cyber threats.
![PROTECTING ISP
NETWORKS AND THE
INTERNET
CABLELABS INFORM[ED] CONFERENCE
NEWYORK, APRIL 12, 2017](https://image.slidesharecdn.com/06-protectingispnetworksandtheinternetv4-170509161243/85/Protecting-ISP-Networks-and-the-Internet-at-Inform-ED-IoT-Security-1-320.jpg)
Protecting ISP Networks and the Internet at Inform[ED] IoT Security
- 1. PROTECTING ISP NETWORKS AND THE INTERNET CABLELABS INFORM[ED] CONFERENCE NEWYORK, APRIL 12, 2017
- 2. GROWTH OFTHE INTERNET 0% 10% 20% 30% 40% 50% 60% 0 500 1000 1500 2000 2500 3000 3500 4000 Dec-95 Jun-96 Dec-96 Jun-97 Dec-97 Jun-98 Dec-98 Jun-99 Dec-99 Jun-00 Dec-00 Jun-01 Dec-01 Jun-02 Dec-02 Jun-03 Dec-03 Jun-04 Dec-04 Jun-05 Dec-05 Jun-06 Dec-06 Jun-07 Dec-07 Jun-08 Dec-08 Jun-09 Dec-09 Jun-10 Dec-10 Jun-11 Dec-11 Jun-12 Dec-12 Jun-13 Dec-13 Jun-14 Dec-14 Jun-15 Dec-15 Jun-16 Dec-16 INTERNET GROWTH MILLIONS OF USERS % WORLD POPULATION
- 3. COUNT OF UNIQUE SOURCES SCANNING ON POPULAR IOT PORTS 4YEARS (AS OF APRIL 3, 2017) TCP 23 - Telnet TCP 7547 – Eir D1000 RouterVulnerability UDP 53413 – Netis Router Backdoor TCP 5358 - WSDAPI TCP 23231 – Mirai port scanning
- 4. THE LESSONS OF MIRAI • In Europe at least three ISPs were seriously impacted • DeutscheTelekom reportedly being the most significantly affected (900k+ users knocked offline through Mirai variant affecting CPE) • It only takes a few vulnerabilities to bring down a network • Poor security practices by a few vendors (e.g. default credentials) put everyone at risk. • Customers cannot be expected to overcome vendor mistakes. Products and networks should be secure by default even if the customer does nothing. • A new approach is required to break out of “Security Ground Hog Day”
- 6. WHO ISTHE INTERNET? • Most consumers and businesses connect to the Internet through their ISP. • Customers rely on a variety of ecosystems players to protect their data and Internet connectivity: anti-virus companies, ISPs, operating system vendors, application vendors, search engine vendors, social media vendors, and hardware manufactures to name a few. • If something goes wrong, customers are likely to call their ISP, but we cannot expect the builders of highways to provide safe cars and good drivers. • With the Internet ofThings, the scale of security issues from IoT devices is going to increase rapidly.
- 7. HOW DO ISP’S STAY AHEAD OF ATTACKS? • Quick and accurate detection • Data analytics • Machine learning • Honey pots • Quick response • Traffic management • Quarantine • Proactive countermeasures • DDoS Attacks • Flow based monitoring / Select DPI • Data Scrubbing • Flowspec / Blackhole filtering • DNS Protections • Botnets • Collaboration with law enforcement • Customer notifications • Collaboration with other ecosystem players
- 8. TODAY’S PANEL • Clarke Stevens – Principal Architect, Shaw Communications • Rich Compton – Principal Engineer, Charter Communications • AndreVan derWalt – InterimVP and CISO, Liberty Global • Brian Rexroad –VP, Security Platforms,AT&T • Mike Glenn –VP Security Services, CableLabs