Every breach we've been called in to clean up after, in Pakistan or anywhere else, traces back to a small, repeating list of gaps. None of them are exotic. None require a zero-day or a sophisticated attacker. They're the basic items that got skipped while the network was being built fast, and that nobody circled back to once it was running.

This list isn't theoretical. It's the same ten things we find, in roughly this order of frequency, when we do a security posture assessment for a Pakistani ISP or WISP for the first time. If you're a PTA licensee, several of these map directly to controls under CTDISR-2025, which we've noted where relevant, but the list holds regardless of whether you're being audited this year.

1. Management Interfaces on Public IPs

This is the single most common finding, by a wide margin. Router and switch management interfaces, winbox, SSH, HTTP, sitting reachable from the public internet because it was convenient during setup and nobody locked it down afterward. Every internet-facing management port is a standing invitation to brute force and credential stuffing, and on MikroTik gear specifically, an unpatched management interface has been the entry point for entire botnet campaigns.

Fix: management access should only be reachable from a dedicated management VLAN or over VPN, never directly from the public internet. If a device absolutely must have a public management IP, restrict it with firewall rules to known source IPs only.

2. No Segmentation Between Subscriber and Management Networks

If a compromised subscriber device, or a compromised access-layer device, can reach your core routing and management infrastructure, you don't have a network, you have one flat blast radius. Segmentation between subscriber traffic, management traffic, and any internal corporate systems is foundational, not optional, and it's explicitly what CTDISR-2025's network segmentation requirements under Section 9 are getting at.

Fix: VLAN separation at minimum, with firewall policy enforced between segments, not just VLAN tags assumed to be sufficient on their own.

3. Default or Shared Admin Credentials

Still common, especially across access-layer MikroTik deployments where the same admin password gets reused across dozens or hundreds of devices because rotating credentials individually is tedious. One leaked credential, one departing employee who kept access, and the blast radius is your entire access network.

Fix: unique credentials per device class at minimum, centralized via RADIUS or a credential vault where possible, with a documented process for rotating access when staff leave.

4. No MFA on Privileged Access

Password-only access to anything privileged, core routers, the NMS, billing systems, is a single point of failure against credential theft, and it's a hard requirement under CTDISR-2025 Section 2, not a nice-to-have. If your privileged accounts don't have MFA today, this is the fastest fix on this list relative to its risk reduction.

Fix: MFA on every privileged account, prioritized by blast radius if you can't roll it out everywhere simultaneously, core network access first.

5. No Documented Incident Response Plan

When something goes wrong, and eventually something will, the difference between an organized response and a chaotic one is whether anyone wrote down what to do before the incident happened. Under CTDISR-2025, this isn't just good practice, PTA requires a documented incident response plan and mandates 24-hour incident reporting to PTA itself, with coordination through nTCERT.

Fix: a written IR plan covering detection, containment, eradication, recovery, and the specific reporting timeline and contacts your regulatory obligations require. This needs to exist before an incident, not get improvised during one.

6. No DDoS Mitigation in Place

Volumetric attacks against ISP infrastructure in Pakistan aren't hypothetical, they're a routine operational reality, and CTDISR-2025 specifically mandates AI-driven DDoS mitigation capability under Section 11. An ISP without traffic scrubbing capability or a documented upstream coordination plan for volumetric attacks is one large attack away from a multi-hour outage affecting every subscriber simultaneously.

Fix: scrubbing capability, whether self-hosted or via an upstream provider, plus a documented escalation path to your transit providers for attacks beyond your own mitigation capacity.

7. RADIUS and AAA Logs Nobody Reviews

Most ISPs running FreeRADIUS or equivalent are generating authentication logs that nobody ever looks at unless there's already a problem. Unreviewed logs mean credential abuse, account sharing, and unauthorized access attempts go undetected for months. This data is usually already being collected, the gap is review, not collection.

Fix: centralize AAA logs somewhere reviewable, and define what anomalies actually warrant investigation, repeated failed logins, geographically impossible login patterns, access outside normal hours.

8. No Patch Management Cadence

Routers, NMS platforms, and management tooling that haven't been patched in months, sometimes years, because patching feels risky and nobody owns the schedule. The irony is that unpatched infrastructure carries far more risk than a planned, tested patching cycle ever does.

Fix: a documented patch cadence, prioritized by CVSS severity for anything internet-facing, with a defined maintenance window so patching actually happens on schedule rather than getting indefinitely deferred.

9. No Vulnerability Scanning or Pen Testing Cadence

You can't fix what you haven't found. Regular vulnerability assessment and periodic penetration testing, both explicitly required under CTDISR-2025 Section 19, are how you find your own gaps before someone else does. ISPs that skip this entirely are relying on luck, not assessment, to catch what's exposed.

Fix: a defined scanning cadence at minimum, with periodic third-party penetration testing for anything internet-facing or handling subscriber data.

10. No CTDISR-2025 Compliance Owner

The last item on this list is the one that causes most of the other nine. CTDISR-2025 mandates a designated CISO and an Information Security Steering Committee chaired by the CEO, specifically so cybersecurity has an accountable owner rather than being everyone's part-time, low-priority responsibility. Without that ownership, security work competes with every other operational priority and consistently loses.

Fix: appoint a CISO, even fractionally if a full-time hire isn't justified yet, and establish the ISSC reporting cadence PTA requires.

Where to Start

If you recognized your network on five or more of these, that's not unusual, it's close to the norm for ISPs we assess for the first time. Start with MFA and management interface exposure, both are fast to fix and disproportionately reduce risk relative to the effort. Then work down the list in order of blast radius, not order of difficulty.

If you want a structured gap assessment rather than working through this list manually, ISP Audit scores your network against all 104 CTDISR-2025 controls, not just the ten here. For hands-on remediation, our Cybersecurity for ISPs engagements close these gaps directly, and if you're heading into a PTA audit cycle, CTDISR Audit Readiness and CISO-as-a-Service cover the governance side this list points back to.