This year has been a time of many changes. Now many more people connect to the Internet through their home routers to telecommute, shop or for leisure. It is then where the security of Internet operators acquires greater relevance. The question is whether ISP security is good enough to be the only security that our companies and teleworkers need. Today in this article we are going to talk about security when connecting from our homes to the Internet, and why the security measures of ISPs are not enough for telecommuters.
In case you do not know ISP , it comes from the English Internet Service Provider , or what is the same, Internet service provider. Basically it is a company that provides Internet connection services to its clients, such as the popular Movistar, Vodafone, Orange, Masmóvil and many others that we currently have in Spain.
We connect more Internet from our homes
The Covid-19 pandemic has changed the way we work and also live. Right now many people are working remotely from their homes, either due to the Coronavirus or because they used to work from there. Without a doubt, these workers depend on their Internet operator to do their jobs. Thanks to the Internet service they receive, they can keep in touch with their customers, suppliers and colleagues during their working hours. In addition, they use the network of networks for their personal issues such as shopping and private relationships with family and friends.
Is the safety of the operators sufficient?
One thing to keep in mind is that Internet operators or ISPs are not known for their security protections. However, many of them claim that they are increasing their defenses against the attacks carried out by cybercriminals, either by having a specific cybersecurity division, or directly outsourcing hardware and support from leading companies in the cybersecurity world. One of the questions is whether small and medium-sized companies can trust that with these measures they will have sufficient protection, that is, is the protection that ISPs have enough so that attacks do not affect us?
According to Vince Crisler , CEO of Dark Cubed and a former White House chief information security officer, the answer is no. The reason he argues is that security for small businesses and residential users is primarily about minimalist capabilities driven by marketing purposes rather than security.
Reasons why ISP security protections aren’t enough
Now let’s look at the reasons why ISP security capabilities tend to be minimal or incomplete. In that sense, Crisler comments that this is because the ISP is mainly focused on providing reliable and stable bandwidth for its customers. He also comments that they value these two things above all else. Therefore, if they needed to make a decision between security and uptime, their decision would focus on uptime.
Another issue to keep in mind is that the home hardware offered by ISPs is often outdated and not well protected, as it has many security vulnerabilities or uses old versions of their internal software. It should be noted that many customers rent or use network hardware from their ISP. In this sense, these devices, such as routers, often lack basic security controls. The problem is that these computers rarely receive firmware updates, and sometimes they even leave services such as Telnet or directly web administration open and exposed.
However, ISPs defend themselves by saying that security problems do not depend solely on them. Although it is also true, due to the high expectations that their customers have, but that does not mean that they should improve.
How you can improve ISP security
Shrihari Pandit , President and CEO of Stealth Communications, thinks the best way to fix this is by making changes to the OSI communication layers.
At Layer 1 / Physical Layer , one problem is that the traffic is not encrypted between the ISP and the customer in most cases. This is particularly serious with providers that provide services over wireless or fiber PON technologies. These technologies transmit traffic to all subscribers and allow attackers to physically access the network. The GPON standard that is widely used in Spain by FTTH ISPs, makes use of AES encryption as indicated by the standard.
On the other hand, Layer 2 / Data Link Layer (Ethernet) , which represents a communication path between the ISP and the customer, generally also does not have encrypted traffic and is prone to spying. One way to improve security in this area is by implementing technologies like MACsec.
At Layer 3 / Transport Layer (Internet Protocol) users and organizations can implement IPsec to provide end-to-end encryption between two endpoints on the Internet. Thus, it is possible to make it difficult for cybercriminals to access so that they can decode the Internet provider’s traffic. That is, make use of VPN protocols to add an additional layer of security.
Vince Crisler says ISP customers want to use their Internet connections for any purpose, without their provider monitoring them. However, to provide security, ISPs should go beyond our privacy. The ISP security issue is complex, and now for the moment free VPNs are becoming one of the best alternatives we have to maintain privacy.