Introducing Defense-in-Depth to a Small ISP

With the recent spate of worms and vulnerabilities, and the increasing public awareness of same, a rural Internet Service Provider (ISP) requested some assistance in assessing the security of their production server and network environment. The ISP has limited in-house technical resources, and utilizes consultants on an as-needed basis. After a few service interruptions due to security-related issues (worms, web site defacement, Denial-of-Service attacks), I was asked to provide some specific recommendations on how to increase security and availability, without significantly increasing complexity or adversely affecting service usability. Utilizing a 'defense-in-depth' approach to security I assessed their environment made recommendations and then re-assessed the environment to measure the impact of the changes. The layered nature of a 'defense-in-depth' strategy as outlined in the SANS Security Essentials track seemed to make the most sense in this situation. Several areas were addressed which significantly increased security yet did not take away from the usability of the services being offered.