Should an ISP keep corrupted machines off of a network?

Should an ISP keep corrupted machines off of a network?

What role should ISPs have in identifying or addressing corrupted machines on a network? Should they block and quarantine them?

    Requires Free Membership to View

    SearchSecurity.com members gain immediate and unlimited access to breaking industry news, virus alerts, new hacker threats, highly focused security newsletters, and more -- all at no cost. Join me on SearchSecurity.com today!

    Michael S. Mimoso, Editorial Director

    By submitting your registration information to SearchSecurity.com you agree to receive email communications from TechTarget and TechTarget partners. We encourage you to read our Privacy Policy which contains important disclosures about how we collect and use your registration and other information. If you reside outside of the United States, by submitting this registration information you consent to having your personal data transferred to and processed in the United States. Your use of SearchSecurity.com is governed by our Terms of Use. You may contact us at webmaster@TechTarget.com.

This is more of a good citizenship question than a technical question, so I suppose the answer is "it depends." I don't believe that Internet service providers (ISPs) have a legal responsibility to block and/or quarantine infected systems, but there are plenty of compelling reasons for them to take some action.

First, it's the neighborly thing to do. Blocking infected systems reduces the spread of malicious software on the Internet. Second, with fewer machines flooding the network with their wares, it conserves bandwidth, reducing costs for the ISP.

So why don't many ISPs do this? Quite simply, it can make customers angry. Many ISP customers expect unfettered access to the Internet, and they are not willing to tolerate "false positive" alerts that cause the temporary blocking of their systems while the matter is resolved.
There is a decent compromise that many ISPs adopt: notifying the owners of infected systems that they have security issue(s) on their network that require remediation. I would recommend this approach because it constitutes due diligence on the part of the ISP by informing the customer of the discovery without risking the client relationship due to an accidental disconnect.

More information:
  • IT pros still have an interest in network access control (NAC) technology. But as Neil Roiter explains, the cost and complexity of NAC means the road to adoption will not be quick.
  • Learn more about the basics of network access control.
  • This was first published in March 2008