-1

I have a question regarding approach to online security and protection against viruses, malware and phishing by one of the biggest European ISP. Below you will find my understanding of the topic. Is ISP's approach safe? Would you use it? Do you know similar solutions/implementations? Is it worth to sacrifice privacy for this kind of safety?

The cyber shield logic:

  • Security team known as CERT in Orange ISP in Poland and Moldavia released service called "Cyber Shield".
  • Cyber Shield is a traffic monitoring middleware set between your router and the grid - ISP sees your requests and prevents you from visiting dangerous websites, but also can detect various trojans or ransomware going both directions (from and to your PC).
  • If you happen to click a phishing link, visit an infected website or distribute malware you will either be blocked by ISP's warning similar to the one generated by Chrome, when you visit "insecure content" or the internet access will be completely blocked.
  • ISP claims to be able to recognise susceptibility of devices present in your local network to external threats and can block the connection if safety requirements are not met.
  • If danger is identified, ISP provides customer with detailed instruction regarding problem solving, e.g. scanning for viruses, setting up wi-fi password, disabling remote access to your router's configuration panel.

closed as primarily opinion-based by forest, Teun Vink, Matthew, Tom K., Josef Nov 27 '18 at 11:40

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

1

There are too few things known on how this is supposed to work and what the exact claims are, but some security is possible and some not:

  • Since about 80% of the web traffic is HTTPS know and HTTPS is also used for phishing or malware sites they will not be able to filter by the exact URL in most cases. It is possible though to filter by hostname, either by filtering the query at the DNS level (return a different IP address for the name, similar to what OpenDNS and others do) or through deep packet inspection of HTTP requests (when in plain) or TLS handshake (with HTTPS). DNS based filtering is more likely since it is both less invasive and requires less resources at the ISP.
  • It is possible to detect typical malware communication. This is possible even if it is encrypted because it has typical traffic patterns, TLS handshake patterns etc.
  • In case the ISP is used as a mail provider too it can fully analyze any incoming mails and filter for spam, malware, phishing. Similar it can analyze outgoing mails from the user and thus detect potential misuse of the users systems as spambot or similar.
  • Given that the ISP is the first hop on the path to the internet it can also block both suspicious outgoing connections from the user and also incoming connections from the internet.

In summary: a lot of detection can be done by the ISP, but it cannot provide complete security. But no solution can provide such complete detection. Specifically local desktop antivirus products have no visibility of the complete network and can thus not detect if the router or DVR or whatever IoT device is infected and part of a botnet.

Not the answer you're looking for? Browse other questions tagged or ask your own question.