[anti-abuse-wg] Re: Additional Layers for Economic Incentives to improve Internet Security

Howdy,

My response is inline below.

> In message <4D133394.9040008 at ripe.net>, Mirjam Kuehne <mir at ripe.net> wrote:
> 
> >Dear colleagues,
> >
> >Following up from his earlier posts on RIPE Labs, John Quarterman is now 
> >looking at 'ASN Ranking Correlations Between Spam Blocklists':
> >
> >http://labs.ripe.net/Members/jsq/asn-ranking-correlations-between-spam-blocklist

> I skimmed this document, and I'm still not 100% sure that I have grasped
> the ultimate point.
> 
> It begins thus:
> 
>     "Comparing ASN rankings by spam volume from two different data sources...
>     indicates there is enough correlation to have confidence in the rankings.
> "
> 
> Yes.  And?

The point of this particular article is exactly what you quoted:
there is enough correlation to have confidence in the rankings.
Some people don't believe it is possible to build such a ranking
system, so we have demonstrated that it is possible.

> This is a little like saying that the track records of multiple meterologists
> do indeed indicate that yes, by and large they generally seem to get it right
> .

Thanks for the complimentary analogy.

> But then what is the functional value of that knowledge?  Is the point here
> that I can leave my umbrella at home when two or more of them say that it's
> not going to rain today?
> 
> Is the point of Mr. Quarterman's study that certain entire ASNs may be
> safely or reasonably blacklisted?

The purpose of the proposed ranking system is that the organizations
that own the ASNs should be concerned that people might decide to
blacklist them, or, for example if the organization is a bank,
that people might not want to do business with a bank that has
sufficiently bad Internet security that it is emitting spam.
If an organization has that many vulnerabilities, some of them
may also be exploitable for DDoS attacks or for password sniffing
of customers or for other nefarious ends.

Conversely, organizations that have good security should emit
very little spam, and they could brag about their good rankings
and thus retain and gain customers.

See the other articles in this series (there are links at the end
of the present article) for more about the proposed rankings
and related certifications, SLA self-insurance, and insurance policies.

> Regards,
> rfg

Thanks for your comment,
-jsq