FCC Chairman Julius Genachowski yesterday asked Internet service providers to voluntarily adopt certain measures aimed at enhancing cybersecurity. Specific cyber threats include botnets, IP route hijacking and domain name fraud.
Genachowski made his remarks at the Bipartisan Policy Center in Washington D.C. “Tackling the challenges to Internet security is so important, because the opportunities of the Internet are so great,” he said.
Genachowski said his recommendations were based on input from the Communications Security, Reliability and Interoperability Council (CSRIC), an advisory group that includes FCC officials as well as representatives from communications companies such as Verizon and Comcast, Internet-centric businesses such as Amazon and PayPal and industry associations.
Botnets
As Genachowski explained, botnets are created when a computer or server is infected by an end user unsuspectingly opening an email or downloading a file, thereby installing a piece of malicious software on the device that enables “bad actors” to control the computer remotely. The bad actors then direct the computer, along with many others, to send millions of simultaneous requires to a target website, crashing the site.
“Botnets have been central to a very large percentage of the website crashes you’ve heard of, and that you haven’t,” said Genachowski.
To address this, Genachowski called on ISPs to increase customer awareness so end users can look for signs that their computers are being used as bots. In addition, he encouraged them to detect infections in customers’ computers, notify the customers and offer remediation support.
Genachowski praised Comcast and CenturyLink for taking the lead in developing and promoting such solutions.
IP route hijacking
IP route hijacking occurs when bad actors re-program routers in carrier networks to misdirect Internet traffic meant for one destination through another, where it can be subject to eavesdropping.
The fix, he said, is for ISPs to implement secure routing standards that have been developed to prevent such occurrences.
“The benefits of ISPs taking these steps to eliminate accidentally misrouted traffic would be enormous,” said Genachowski, advising ISPs to minimize implementation costs by putting the new standards in place during routine hardware and software upgrades.
Domain name fraud
Domain name fraud occurs when a bad actor changes identifying information about a website on the domain name servers that ISPs use to route traffic to that website. Here, too, the fix relies on an update to equipment in the ISP’s network—in this case installing new security extensions known as DNSSEC to the software that runs on the domain name servers, Genachowski said.
Without naming the provider, Genachowski said one major U.S. ISP already has completed implementation of DNSSEC, which was developed by the Internet Engineering Task Force.
“If they adopt DNSSEC, ISPs can provide a real and tangible benefit to the consumers and businesses that rely on them,” said Genachowski.
In addressing cybersecurity threats, stakeholders should focus on three key components, Genachowski said. These include preserving Internet freedom and openness, preserving privacy, and using a multi-stakeholder model for problem solving.
