March 2013 Final Report U.S. Anti-Bot Code of Conduct (ABC) For
Total Page:16
File Type:pdf, Size:1020Kb
March 2013 Final Report U.S. Anti-Bot Code of Conduct (ABC) for Internet Services Providers (ISPs) Barrier and Metric Considerations WORKING GROUP 7 - Botnet Remediation The Communications Security, Reliability and Interoperability Council Working Group 7 Final Report March, 2013 Table of Contents 1 Results in Brief ......................................................................................................................... 3 1.1 Executive Summary ........................................................................................................ 3 2 Introduction .............................................................................................................................. 4 2.1 CSRIC III Structure ........................................................................................................ 5 2.2 CSRIC III WG7 Structure ............................................................................................... 5 2.3 Working Group 7 Team Members .................................................................................. 5 2.4 Working Group 7 Deliverables: ...................................................................................... 7 3 Objectives, Scope, Methodology, and Recommendations ....................................................... 7 3.1 Barriers to ISP Participation ........................................................................................... 7 3.1.1 Objective ................................................................................................................... 8 3.1.2 Scope ......................................................................................................................... 8 3.1.3 Methodology ............................................................................................................. 8 3.1.4 Barriers to Code Implementation: Considerations ................................................... 9 3.1.4.1 Technology Barriers ............................................................................................ 10 3.1.4.2 Consumer/Market Barriers .................................................................................. 10 3.1.4.3 Operational Barriers ............................................................................................ 10 3.1.4.4 Financial Barriers ................................................................................................ 11 3.1.4.5 Legal/Policy Barriers........................................................................................... 11 3.2 Metrics .......................................................................................................................... 12 3.2.1 Objective ................................................................................................................. 13 3.2.2 Scope ....................................................................................................................... 13 3.2.3 Methodology ........................................................................................................... 13 4 Conclusions & Recommendations ......................................................................................... 13 5 Acknowledgements ................................................................................................................ 16 Appendix 1 – Working Group 7 Mission Statement .................................................................... 17 Appendix 2 – U.S. Anti-Bot Code of Conduct (ABCs) for Internet Service Providers (ISPs) Addressing Bot Activity in Broadband Networks ........................................................................ 18 Appendix 3 – Barrier Guide .......................................................................................................... 35 Appendix 4 – Metrics Guide ......................................................................................................... 62 Appendix 5 – Metrics Glossary .................................................................................................... 92 Appendix 6 - Related Industry Security and Metrics Activity ..................................................... 96 Page 2 of 99 The Communications Security, Reliability and Interoperability Council Working Group 7 Final Report March, 2013 1 Results in Brief 1.1 Executive Summary The CSRIC III initially tasked Working Group 7, Botnet Remediation, with proposing a set of voluntary practices that would constitute the framework for a voluntary program for ISPs to follow to mitigate the botnet threat. In response, the U.S. Anti-Bot Code of Conduct for ISPs was delivered in March 2012 which addresses the threat of bots and botnets in residential broadband networks through voluntary participation. As emphasized in the Code, “the growth of bot infected end-user devices represents a meaningful threat to the vitality and resiliency of the Internet and to the online economy.” Network security and customer access to the services provided by networks is of critical importance. Code participation offers a voluntary and collaborative approach that enhances participants’ ability to communicate with the public and their customers. It is important to restate from the Code that constituents of the entire Internet ecosystem have important roles to play in addressing the botnet threat, and that ISPs depend on support from the other parts in the ecosystem. To maximize the effectiveness of anti-botnet efforts, it is essential to recognize the shared responsibilities that exist across the broad internet ecosystem. Such efforts, would involve active participation from such stakeholders as anti-virus and security vendors, applications and operating systems developers, device manufacturers, domain registrars and registries, end users, cloud-service providers, IT departments, search engines, web-owners, hosting services, and others. The FCC should support efforts to locate future botnet related activities in multi-stakeholder venues. This report addresses aspects of the future work identified in the March 2012 U.S. Anti-Bot Code of Conduct for ISPs Final Report. First, it identifies potential barriers to participation in the Code, and provides guidance to evaluate or overcome specific barriers associated with each of the Code’s recommendations. Second, it addresses the current state and challenges associated with the development of standardized metrics for use in implementation of the Code. A guide is provided for both barriers to participation in the Code as well as for the ongoing development of metrics. Recommendations for each report section, barriers to participation and metrics, are included in the Conclusion and Recommendations Section. Recommendations are made to treat the Code, Barriers Guide, and Metrics Guide as living documents which will require updates based on collaboration by Code participants with support from the Internet ecosystem community to address bots. WG7 further recommends the creation of a FCC sponsored botnet workshop involving members of the Internet ecosystem on addressing these recommendations. Page 3 of 99 The Communications Security, Reliability and Interoperability Council Working Group 7 Final Report March, 2013 2 Introduction CSRIC III established Working Group 7 (WG7) to address botnet remediation in broadband residential networks. In addition to creating the Code, WG7 was chartered to identify potential obstacles to ISP implementation of the U.S. Anti-Bot Code of Conduct for ISPs and steps the FCC could take that may help overcome these obstacles. WG7 was also requested to identify performance metrics to evaluate the effectiveness of the U.S. Anti-Bot Code of Conduct for ISPs at curbing the spread of bot infections. Work to address these items and additional steps ISPs can take are documented in this report. A specific guide is provided for each of the sections: A Barriers Guide addressing barriers to Code participation as well as a Metrics Guide for the ongoing development of metrics. The guides will provide useful tools for ISP participation in the Code and provide templates for contribution of future work. ISPs of all sizes should find tangible and practical steps to help in their efforts to combat bots. The report concludes with recommendations related to participation in anti-botnet initiatives and efforts to overcome barriers to Code participation. Page 4 of 99 The Communications Security, Reliability and Interoperability Council Working Group 7 Final Report March, 2013 2.1 CSRIC III Structure Communications Security , Reliability, and Interoperability Council ( CSRIC) III CSRIC Steering Committee Co - Chairs Co - Chairs Co - Chairs Co - Chairs Chair Co - Chairs Chair Chair Co - Chairs Co - Chairs Co - Chairs Working Group Working Group Working Group Working Group Working Group Working Group Working Group Working Group Working Group Working Group Working Group 2 1 3 4 5 6 7 8 9 10 11 Working Group 5: Working Group 1: Working Group 2: Working Group 3: Working Group 4: Working Group 6: Working Group 7: Working Group 9: DNSSEC Working Group 8: Next Generation Next Generation E911 Location Network Security Secure BGP Botnet Legacy Broadcast Working Group 10: Working Group 11: Implementation E911 Best 911 Alerting Accuracy Best Practices Deployment Remediation Alerting Issues 911 Prioritization Cybersecurity Practices for ISPs Practices Controls 2.2 CSRIC III WG7 Structure WG7 is chaired by Michael O’Reirdan, Co-Chairman of the Messaging Anti-Abuse Working Group (M3AAWG1),