We often wonder how Network Providers (ISPs and hosting providers) can best triage abuse reports and focus on appropriate reports to keep their networks as safe as possible. 

This question arises since we have helped many organizations deal with network and copyright abuse problems. As a result, when considering new triage approaches, we often ask ourselves what SOC and Abuse Management teams are doing if they cannot efficiently address the following issues in their blocking and tackling. 

This is not a criticism but rather a curiosity about alternative approaches to ensuring safe harbor and managing trust and safety at network operators.

From our lens, we believe primary SOC and Abuse Desk abuse reporting triage at a Network Provider must include the following best practices:

• The Network Provider must be able to quickly filter abuse reports by type of abuse.
• The Network Provider must be able to quickly identify the subscriber machine and account associated with every reported incident.
• The Network Provider must be able to group all incidents for a similar subscriber in cases and handle the case, not every incident.

See also

The Processes Behind Improved Network Security and Effective Abuse Handling.

SOC and Abuse Desk Best Practices

Let’s drill into these SOC and Abuse Desk triage best practices to understand why they are critical cyber security paradigms for Network Providers.

1. Tagging and filtering reports by the type of abuse ensures proper prioritization of effort

You have 14,000 messages about spam. Should you handle them before addressing a reported instance of a phishing attack or child exploitation?

While sometimes it makes more sense to clear out the most significant volume of reports first, that’s how serious reports slip through the cracks.

Automatic report tagging and filtering by abuse type provides a faster, simpler, and clearer view of where to prioritize your response, especially when trying to open every report.

2. Identifying the subscriber machine and/or account associated with every incident you receive lets you address the problem

Imagine a customer installing a WordPress plugin and receiving an automated abuse alert from you 15 minutes later that their machine has been compromised. With rapid reaction times, your customer is likelier to connect the two events and solve the problem quickly.

Conversely, suppose a message is sent to your customer manually by an agent 1-3 days later. In that case, the customer is less likely to make the connection between the plugin installation and the abuse alert.

Sending automated email alerts to customers quickly in the vulnerability, compromise, and abuse lifecycle prevents volumetric abuse before it becomes significant.

While there will always be some tasks that have to be handled manually, it is beneficial to minimize the number of manual tasks as much as possible.

See also

How to Avoid Your Service Provider Becoming a Haven of Network Abuse.

3. Tying all subscriber incidents together under a single case ID allows you to craft the best customer response

When you receive a copyright report, you must know if it is the 3rd or 6th report or strike. Protecting your Safe Harbor requires Network Providers to take ever-escalating actions restricting subscriber services. You must act in addition to passing along reports to meet the DMCA Safe Harbor provisions.

Another example of the importance of tying subscriber incidents together is spam reports. Repeated spam reports and tickets; not addressing the problem, which might be an open form, as a single ongoing issue means too much labor becomes tied up in the problem, whereas, if you could aggregate them together, you might look at a histogram of activity to tell you if the problem had gone away or was continuing.

Critically important is the understanding that not all Safe Harbor provisions are as precisely spelled out as the DMCA regulations. 

There have been multiple cases in various jurisdictions around the globe where Network Providers have lost their Safe Harbor in a court case if there have been repeated reports of abuse from a specific machine or account and do nothing. 

Acting on cases, and taking uniform, reasonable, escalated steps to keep your network and the internet safe ensures you are not harboring; abuse, fraud, and criminal activity.

4. Triaging faster with greater precision always leads to better results

Understanding the type(s) of threats being reported, the subscriber with the problem, and the history of the threat and user notifications will equip you to automate processes further, crafting better subscriber notifications throughout the lifecycle of a compromised user or bad actor.

Need help?

If you are an ISP or Hosting Provider who is spending any resources managing your abuse role address and

• Can not automatically tag and filter reports and their incidents by the type of abuse.
• Can not automatically identify the subscriber machine and account associated with every incident.
• Can not tie all subscriber incidents together under a single case ID.

You are ready to start on the path of a better, more streamlined SOC and Abuse Desk with simplified triaging and want to better protect your company’s safe harbor. Contact us at [email protected] to learn more and try AbuseHQ.