Ask the Expert

Should an ISP keep corrupted machines off of a network?

What role should ISPs have in identifying or addressing corrupted machines on a network? Should they block and quarantine them?

    Requires Free Membership to View

    Login

This is more of a good citizenship question than a technical question, so I suppose the answer is "it depends." I don't believe that Internet service providers (ISPs) have a legal responsibility to block and/or quarantine infected systems, but there are plenty of compelling reasons for them to take some action.

First, it's the neighborly thing to do. Blocking infected systems reduces the spread of malicious software on the Internet. Second, with fewer machines flooding the network with their wares, it conserves bandwidth, reducing costs for the ISP.

So why don't many ISPs do this? Quite simply, it can make customers angry. Many ISP customers expect unfettered access to the Internet, and they are not willing to tolerate "false positive" alerts that cause the temporary blocking of their systems while the matter is resolved.
There is a decent compromise that many ISPs adopt: notifying the owners of infected systems that they have security issue(s) on their network that require remediation. I would recommend this approach because it constitutes due diligence on the part of the ISP by informing the customer of the discovery without risking the client relationship due to an accidental disconnect.

More information:
  • IT pros still have an interest in network access control (NAC) technology. But as Neil Roiter explains, the cost and complexity of NAC means the road to adoption will not be quick.
  • Learn more about the basics of network access control.

    • This was first published in March 2008

    Join the conversationComment

    Share
    Comments

      Results

      Contribute to the conversation

      All fields are required. Comments will appear at the bottom of the article.
      Back to top