Insecure IoT devices have enabled the largest DDoS service attacks on the internet to date and are threatening the basic functionality of the Internet. A panel of experts will discuss how ISPs are working to mitigate these attacks and protect their networks and the Internet from the growing number of insecure devices. Rich Compton Principal Engineer, Charter Communications Michael Glenn Vice President Security Services, CableLabs Brian Rexroad VP, Security Platforms, AT&T Clarke Stevens, Moderator Principal Architect, Shaw Communications André van der Walt Interim VP & CISO, Liberty Global https://www.cablelabs.com/informed/

1. PROTECTING ISP
NETWORKS AND THE
INTERNET
CABLELABS INFORM[ED] CONFERENCE
NEWYORK, APRIL 12, 2017

2. GROWTH OFTHE INTERNET
0%
10%
20%
30%
40%
50%
60%
0
500
1000
1500
2000
2500
3000
3500
4000
Dec-95
Jun-96
Dec-96
Jun-97
Dec-97
Jun-98
Dec-98
Jun-99
Dec-99
Jun-00
Dec-00
Jun-01
Dec-01
Jun-02
Dec-02
Jun-03
Dec-03
Jun-04
Dec-04
Jun-05
Dec-05
Jun-06
Dec-06
Jun-07
Dec-07
Jun-08
Dec-08
Jun-09
Dec-09
Jun-10
Dec-10
Jun-11
Dec-11
Jun-12
Dec-12
Jun-13
Dec-13
Jun-14
Dec-14
Jun-15
Dec-15
Jun-16
Dec-16
INTERNET GROWTH
MILLIONS OF USERS % WORLD POPULATION

3. COUNT OF UNIQUE SOURCES SCANNING ON POPULAR IOT PORTS
4YEARS (AS OF APRIL 3, 2017)
TCP 23 - Telnet
TCP 7547 – Eir D1000 RouterVulnerability
UDP 53413 – Netis Router Backdoor
TCP 5358 - WSDAPI
TCP 23231 – Mirai port scanning

4. THE LESSONS OF MIRAI
• In Europe at least three ISPs were seriously impacted
• DeutscheTelekom reportedly being the most significantly affected (900k+ users knocked
offline through Mirai variant affecting CPE)
• It only takes a few vulnerabilities to bring down a network
• Poor security practices by a few vendors (e.g. default credentials) put everyone at risk.
• Customers cannot be expected to overcome vendor mistakes. Products and networks
should be secure by default even if the customer does nothing.
• A new approach is required to break out of “Security Ground Hog Day”

5. THREATVECTORSTHROUGH COMMON
PRODUCTS
Source: BBC

6. WHO ISTHE INTERNET?
• Most consumers and businesses connect to the Internet through their ISP.
• Customers rely on a variety of ecosystems players to protect their data and Internet
connectivity: anti-virus companies, ISPs, operating system vendors, application vendors,
search engine vendors, social media vendors, and hardware manufactures to name a few.
• If something goes wrong, customers are likely to call their ISP, but we cannot expect the
builders of highways to provide safe cars and good drivers.
• With the Internet ofThings, the scale of security issues from IoT devices is going to
increase rapidly.

7. HOW DO ISP’S STAY AHEAD OF ATTACKS?
• Quick and accurate detection
• Data analytics
• Machine learning
• Honey pots
• Quick response
• Traffic management
• Quarantine
• Proactive countermeasures
• DDoS Attacks
• Flow based monitoring / Select DPI
• Data Scrubbing
• Flowspec / Blackhole filtering
• DNS Protections
• Botnets
• Collaboration with law enforcement
• Customer notifications
• Collaboration with other ecosystem
players

8. TODAY’S PANEL
• Clarke Stevens – Principal Architect, Shaw Communications
• Rich Compton – Principal Engineer, Charter Communications
• AndreVan derWalt – InterimVP and CISO, Liberty Global
• Brian Rexroad –VP, Security Platforms,AT&T
• Mike Glenn –VP Security Services, CableLabs