Build ISP Security in Layers: Edge, Control and Subscriber
Organize firewall, DDoS, management and incident controls by trust boundary and evidence.
Organize firewall, DDoS, management and incident controls by trust boundary and evidence.
Protect distinct planes differently
An ISP carries subscriber traffic, exchanges routes, manages infrastructure and stores customer and financial data. One perimeter firewall cannot protect all of these. Security begins by separating forwarding, control, management and application planes, then assigning narrow access and monitoring to each.
Routing
Filter advertisements, validate sources and protect routing sessions.
Management
Use private paths, strong identity and source restrictions.
Subscriber
Apply anti-spoofing and isolation without breaking legitimate service.
Application
Protect billing, portals, APIs and staff sessions as sensitive systems.
Reduce attack surface first
Disable unused services, bind management to intended interfaces, patch through staged change and inventory every public endpoint. Use unique credentials and MFA where supported.
Apply source validation near the customer edge and document exceptions. Egress filtering limits spoofed traffic leaving your network and supports the wider internet.
Plan DDoS response before the event
Define detection thresholds, upstream contacts, RTBH or FlowSpec capability, evidence retention and customer communication. Local firewall rules cannot absorb traffic that already saturates the circuit.
Use flow, interface, route and service telemetry together. Rate changes and top talkers are signals; preserve baseline context before declaring an attack.
Operate firewall changes safely
Use explicit chains by plane, counters, comments, peer review, safe-mode or rollback and out-of-band access. Shadow and log a new match before dropping when practical.
Review rules for dead objects, broad sources and temporary exceptions with expired owners.
Evidence before rollout
| Signal | Required proof |
|---|---|
| Inventory | All public and management services have owners. |
| Source validation | Customer and infrastructure anti-spoofing is tested. |
| DDoS contract | Upstream escalation and mitigation methods are documented. |
| Change safety | Firewall rollback works without the primary session. |
| Detection | Baselines cover traffic, routes and critical services. |
Put the plan into operation
- Map. Separate trust zones and control planes.
- Reduce. Disable, patch and restrict exposed services.
- Filter. Deploy route and source validation in stages.
- Exercise. Run a DDoS and management-loss tabletop.
- Monitor. Alert on meaningful deviation and control failure.
- Review. Remove stale access and close incident lessons.
The decision standard
A secure ISP can explain which boundary stopped an event, which evidence detected it, how the network behaves under saturation and how operators recover from their own emergency changes.
Research basis: MANRS actions; NIST Cybersecurity Framework; BCP 38; MikroTik RouterOS security documentation. Validate implementation details against the releases, contracts, and local regulations governing your network.