You don’t need to be a mathematician to see that this patchwork coverage puts everyone at risk. With bits and bytes traveling from one ISP’s network to another, who’s to say that a security threat stopped by one ISP filter won’t escape another network that

doesn’t filter or does it inadequately? Gregg Mastoras, senior security analyst for North America with the network security solutions provider Sophos, says that once a threat gets past one ISP, it essentially has gotten past them all. Mastoras adds that since information on the Internet knows no borders, everyone is at risk. If the security that ISPs currently offer is really as good as they say it is, this

wouldn’t be a problem. Yet one just needs to look at the news today to know that corporations are getting hit hard by all manners of malfeasant code. The problem, says Mastoras, is that nothing exists to standardize security across the ISP industry, making everyone in the industry susceptible to the lowest common denominator.

How to Protect Yourself in the OK Corral

ISPs may not be able to get away with this free-market approach for long, if only because pressure from government, industry and consumer groups is growing. This May, the FTC said it would soon ask ISPs to make sure that their customers’ computers haven’t been hijacked by spammers with plans to create botnets. Though ISPs are not required to comply, the FTC suggested that service providers should identify computers on their networks that are sending out large amounts of e-mail and quarantine them if they are found to be zombies. One final recommendation from the FTC: Internet providers should route all customer e-mail through their own servers (as opposed to allowing individual users to route e-mails through their own servers).

ISP executives are optimistic that the industry can regulate itself. Dave Jevans, chairman of the Anti-Phishing Working Group, says a number of ISPs have already banded together to discuss security best practices. If the industry can’t improve security on its own, there’s always the possibility of regulating it through state or federal legislation, but that’s something that most in the ISP industry firmly oppose. Howard Schmidt, president and CEO of R&H Security Consulting and a former official with the Department of Homeland Security, agrees that legislation is not the answer, saying that most ISPs would simply pass the cost of compliance along to users in the form of increased monthly and annual fees.