Some highlights from the Management summary with my comments in [square brackets]:
Vulnerabilities * Although total vulnerability disclosures went down, the number of reported high severity vulnerabilities increased by 28 percent in comparison with 2006. * The busiest day of the week for vulnerability disclosures continued to be Tuesday, with 1,361 new vulnerabilities disclosed on this day of the week in 2007. * Of all the vulnerabilities disclosed in 2007, only 50 percent can be corrected through vendor patches. [suggests that ISPs need to be proactive about detecting and blocking compromised machines]
I think this conclusion assumes a number of facts not in evidence. If the vulnerability cannot be corrected through a vendor patch, then, one has to wonder what, exactly the vulnerability is. If it is social engineering, then, I don't believe that ISP proactivity can really address the issue. Much more detail on the nature of these vulnerabilities which cannot be corrected by vendor patches is needed before any useful conclusion about the correct solution can be drawn.
* Critical vulnerabilities for Mozilla Firefox were dramatically lower in 2007 compared to 2006. [If you still distribute any kind of software kits that do not install FireFox, you are doing your customers a disservice and making your detection and blocking task that much bigger. When you contact customers with compromised machines you might want to make it mandatory to install Firefox from your servers before re-enabling Internet access]
Huh? Why should everyone ship a browser with their software kit? Browsers are like religion. You're really not going to have a lot of success trying to force one down your customers' throats. It's great that Firefox security has improved, but, this statement alone does not really provide any details about the current relative level of vulnerability between Firefox and any other browser.
* The U. S. and Germany were the only two countries consistently among the top three hosting sources for each type of "unwanted" Internet content monitored throughout 2007. [Suggests that NANOG members need to raise the bar considerably to clean up their own backyard. What do you know about your own Internet peering partners?]
Considering that the US is also consistently among the top three sources of desirable content, I'm not sure that this ranking necessarily proves much of anything, but, I do agree that ISPs could do a better job of shutting down mal-sites.
Malcode * Trojans represent the largest category of malware in 2007 - 109,246 varieties account for 26 percent of all malware. * The most frequently occurring malware on the Internet was Trojan.Win32.Agent - 26,573 varieties in 2007 account for 24 percent of all Trojans. * The most common worm in 2007 was Net-Worm.Win32.Allaple with 21,254 varieties. It is a family of polymorphic worm that propagates by exploiting Windows(r) vulnerabilities instead of using e-mail. [This suggests that targetting these specific attack vectors could clean up a significant amount of the problem and correspondingly recduce your costs for detection and blocking of compromised machines.]
It also suggests that taking Windows off the net could do a lot to reduce the level of vulnerability, but, I'm not holding my breath until that happens either. Owen