[anti-abuse-wg] Re: Additional Layers for Economic Incentives to improve Internet Security

In message <1293396598.484327.23897 at bolo.quarterman.com>, 
"John S. Quarterman" <jsq at quarterman.com> wrote:

>The purpose of the proposed ranking system is that the organizations
>that own the ASNs should be concerned that people might decide to
>blacklist them,

Unfortunately, I rather doubt that any sort of ranking will have that effect,
which is a pity, because in an ideal world, these kinds of ranking _should_
have the effect of generating concern among those ASNs that receive bad
rankings.

But the reality is that instances of entire ASNs being blacklisted by
anybody and/or for anything are few and far between.  Thus we have the
current situation where certain ASes make a healthy business out of
thumbing their noses at the rest of the Internet community as they
continue to host rampant criminality, etc.

>or, for example if the organization is a bank,
>that people might not want to do business with a bank that has
>sufficiently bad Internet security that it is emitting spam.
>If an organization has that many vulnerabilities, some of them
>may also be exploitable for DDoS attacks or for password sniffing
>of customers or for other nefarious ends.
>
>Conversely, organizations that have good security should emit
>very little spam, and they could brag about their good rankings
>and thus retain and gain customers.

I only wish that the world operated in so simple a fashion.

Unfortunately, because network operators the world over have been con-
sistantly reluctant to do what is necessary to forcefully shun the
criminal, and the merely irresponsible, from their midst, instead of
a bad reputation causing loss of connectivity, it often seems to
have the perverse effect of generating even more business for various
well-known criminal-friendly ASNs.


Regards,
rfg