Tough Time for Security Engineers

When Arbor Networks completed its fourth annual Worldwide Infrastructure Security Report, the security software company identified not only the latest threats to ISP networks but also the fact that this is a tough time to be in ISP network security.

The current economic picture has constrained ISP resources, including those for security, just as services are growing more complex and network threats more sophisticated, said Craig Labovitz, chief scientist for Arbor Networks and co-author of the report. A year ago, there was almost a sense of optimism among security engineers, as if they thought they were getting a handle on network attacks, but that has faded, Labovitz said.

“There definitely is concern over very sophisticated services and the resources of the engineering staffs tasked to protect them,” he said. “ISPs are racing to get services out there, and in the early phases of rolling out many of these large services, until these things mature, until the budgets for security are in place, there is always a danger.”

This year, one key area for attacks was DNS cache poisoning. In mid-2008, security researcher Dan Kaminsky “found a subtle implementation detail that allowed for cache poisoning to take a little less effort,” Labovitz said. “Kaminsky tried to contact the major domain name server vendors to get them to implement patches ahead of any public release of the information.”

ISPs weren't notified, however, and the information went public before they could deploy patches, producing an increase in DNS cache poisoning.

“The information was shared selectively, and they didn't like not being among those selected,” Labovitz said. “No one likes to be the last to know.”