First, it's the neighborly thing to do. Blocking infected systems reduces the spread of malicious software on the Internet. Second, with fewer machines flooding the network with their wares, it conserves bandwidth, reducing costs for the ISP.
So why don't many ISPs do this? Quite simply, it can make customers angry. Many ISP customers expect unfettered access to the Internet, and they are not willing to tolerate "false positive" alerts that cause the temporary blocking of their systems while the matter is resolved.
There is a decent compromise that many ISPs adopt: notifying the owners of infected systems that they have security issue(s) on their network that require remediation. I would recommend this approach because it constitutes due diligence on the part of the ISP by informing the customer of the discovery without risking the client relationship due to an accidental disconnect.
Dig Deeper on Enterprise network security
Related Q&A from Mike Chapple
It's not possible to eradicate the risk of DoS attacks, but there are steps infosec pros can take to reduce their impact. Mike Chapple shares ...continue reading
The HHS OCR ruled that healthcare ransomware attacks are HIPAA violations, so these covered entities need to react according to the HHS's guidance. ...continue reading
HIPAA regulations incorporate NIST guidelines and standards, so do healthcare organizations need to be compliant with both? Expert Mike Chapple ...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.