ISPs urged to bear security burden

Providers 'missing a sales opportunity', claim experts

Iain Thomson at InfoSec in London, vnunet.com 26 Apr 2005

ISPs should be taking care of internet security and offering "clean" internet connections, according to security experts speaking at this year's InfoSecurity Europe event.

Bruce Schneier, chief technical officer at Counterpane, maintained that ISPs should be the gatekeepers for security and be able to offer safe internet access, even if it comes at a price.

"I expect clean water from my water supplier," he told vnunet.com. "Why can't I get the same level of service from my ISP? They could solve a lot of common security problems but don't seem to want to."

Schneier claimed that the hardware and software industry had numerous fixes for common security problems which ISPs could use to alleviate problems like spam and email viruses. But he suggested that inertia and lack of responsibility are holding ISPs back.

Others have pointed out that ISPs are missing a significant business opportunity in not offering such services. Although specific applications, such as banking, have successfully charged customers for better security, no ISPs have tried such schemes.

John Turley, managing director of managed security provider Checkbridge, believes that legal fears may be holding ISPs back. If ISPs offer a guarantee of secure access, they may be in trouble if customers have problems.

"I've got a guarantee on my kettle, but that doesn't mean the company guarantees that it won't break," he said. "It just shows what to do to if something goes wrong. ISPs would be fine with that sort of guarantee."

Turley predicted the development of a split market if ISPs do offer such services. Some would choose to handle the security internally, while others would outsource.

See also: