Network Computingwww.networkcomputing.com

Ranum says Network Flight Recorder lets you decompose break-ins and actually determine the sequence of events that led up to them. No one yet has taken this approach of maintaining accurate records as evidence of security breaches, he says. Several big ISPs--including UUNET Technologies--are currently testing Network Flight Recorder. Ranum plans to sell commercial rights to the software.

A More Unified Front
It's tough to be an Internet service provider (ISP) these days. First, you have to actually make money in a commodity market, and then you have to try to make the inherently unreliable Internet reliable.

On top o f all that, ISPs have had a shaky record when it comes to security. Critics say security has taken a back-sea t to the more pressing day-to-day demands of running the network and marketing newer services. But ISPs aren't sitting back and deflecting criticism anymore. Recently, they set up the IOPS.ORG group, a consortium of major ISPs that addresses operational issues of the Internet, like interconnection and router problems (see Business Trends, July 15, page 30). IOPS.ORG even is working on a standard trouble-ticket architecture ISPs might use to help track network troubles, as well as looking at ways to improve security alerts on the Internet.

Now there's the ISP Security Consortium (ISPSec), a group of major U.S. and international ISPs that is looking at ways to improve their response to security attacks on their networks and prevent them from occurring. ISPSec, under the auspices of the National Computer Security Association (NCSA), has its own Web site (www.ncsa.com) with valuable information like who to call when a Ping o' Death or SYN Flood attack hits, for instance, as well as a listserv for informal dis cussions on security topics.

ISPs have worked informally when security attacks occur among their networks, in much the same way they deal with a faulty router jamming traffic across their networks. The rule of thumb that applies when a hacker started jiggling your network locks has been to pick up the phone and call your interconnected ISP, who also was at risk or who might have been hit unknowingly.

ISPs increasingly are taking a more proactive approach to the flood of denial-of-service attacks like SYN Flood and those obnoxious spamming incidents that affect everyone's network. Fred Avolio, vice president of technology at firewall vendor Trusted Information Systems, says he expects ISPs to start tracking spamming more actively by monitoring these attacks more closely and shutting them down. The bottom line: No ISP is an island anymore.