Member Avatar for Thomas_42

Hi,
I am looking for advice about internet service providers. My questions here may seem silly but please do reply. I am an entrepreneur. I am about to start a new business. This business handles a lot of confidential documents and if any of these are leaked it could bring huge financial problems. So currently I am studying the ways my documents could be compromised and I have a few doubts.

Could there be a security breach through my ISP?
If yes, is there any way to prevent this?
How can prevent my data from being leaked?

I became paranoid about my data security after reading this article recently .Where ever I searched only news about American ISPs came up. I am using this business internet service provider in Canada. Do they have a history of leaking user data? Please advise on all this. Since I don't have any knowledge about Computer please explain in a non-geeky language.

  • 4 Contributors
  • 5 Replies
  • 526 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by happygeek

Dani AI

Generated

Short answer: an ISP can be a vector, but it is rarely the weakest link for business documents. ISPs can see metadata (which IPs and domains you contact, connection times and volumes) and any traffic you send without end-to-end encryption. For real protection of confidential files, assume the network (including the ISP) is untrusted and make the data unreadable before it leaves your devices. (eff.org)

The community replies are on the right lines: and pointed to transport encryption and middleboxes, and ’s note about antivirus TLS interception is important in practice. Research shows TLS/HTTPS interception by middleboxes or client software is common and often reduces security — some interceptors weaken ciphers, mishandle newer TLS versions, or introduce vulnerabilities. Check for unexpected root certificates on endpoints and insist any organizational TLS-inspection appliance produce security and configuration attestations. (ndss-symposium.org)

Practical, low‑tech steps to reduce risk (apply to a new small business):

  • Encrypt files before you upload or email them (client-side encryption or per-file encryption) so the ISP, a cloud admin, or a leaked backup can’t read them.
  • Use strong authentication and least-privilege access for all accounts (require MFA and limit who can download sensitive files).
  • Enforce encryption both in transit and at rest, and use customer-managed keys or HSMs where possible.
  • Keep endpoints secure: full-disk encryption, up-to-date OS/AV, controlled browser extensions, and tight device-management.
  • For extra privacy on general browsing or DNS lookups use encrypted DNS or a trusted VPN, but treat the VPN provider as a party you must trust.

These are standard controls recommended in data‑protection and security baselines. (cas.docs.cisecurity.org)

Next steps that match this thread’s concerns: get a written security statement from your ISP/vendor (ask about certificate handling, logging/retention, and past incidents), require contractual breach-notification terms, and adopt client-side encryption for the files you care about most. If confirmation about a provider’s history is needed, check regulator breach logs and request their incident disclosure records.

Recommended Answers

All 5 Replies

Member Avatar for pty

What does your ISP have to do with your data? Why would they ever see it? If they were compromised, how would that affect you?

Member Avatar for happygeek

What pty said, the Forbes article is about selling data about you and not your data as in documents etc. The reason the research you have done turns up US ISPs is courtesy of it being about US legislation changes...

Member Avatar for pty

Additionally, in theory your ISP could inspect your data as it passes through them on its way to you. However, sites that contain important personal data (such as your bank, email provider, online shops you buy things from, etc) should be secured via SSL. This will prevent anyone from inspecting data in transit.

Your browser will tell you if a site is secure, just look for a green padlock on the left side of the URL bar.

Screen_Shot_2017-11-10_at_15_57_10.png

It's a good idea not to send anything personal or important unless you can see one of these.

Edited by pty
Member Avatar for cereal

Hi!

I remember reading that there was a failure point on SSL as antiviruses were performing a MITM against browsers to verify the contents of connected pages. In practice they used to replace certificates in the client machine. Is this still an issue? See: http://ieeexplore.ieee.org/document/6956558/

Anyway, just a drop in the ocean.

commented: AV vendors installing their own root certificates was always a recipe for disaster. I don't use AV products so I'm not really up to date on this +9
Member Avatar for happygeek

I wrote a piece about such 'middleboxes' (either in hardware or software) on the network, and a draft IETF standard that proposes to bypass such things, just yesterday. It's at SC Magazine UK here:

Edited by happygeek
commented: great reading thanks! +15
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.