[AusNOG] The shape of DDoS to come

[Ross Wheeler]

On Fri, 28 Oct 2016, Jake Anderson wrote:

> there needs to be a mechanism to get broken devices off the internet, 
> and ISP's are the only group with the power to do that

It's partly the power, partly the incentive/need/will but mostly the ISP 
is the only one who can (currently) identify the user.

> Govt could create a dept who received reports, worked with ISP's to ID 
> compromised hosts while maintaining every-bodies privacy and generally 
> being a smoothly run operation. That won't happen though

It exists now, and has done for years. AISI is doing a decent chunk of 
this work already. It does need to be a little faster, with the ability to 
provide near-real-time reports rather than 24-48 hours after the event 
(and sometimes even longer delays), and it probably needs some tweeking to 
pick up some of the additional threat vectors - but there is already a 
working framework that's pretty close.

RossW