These are still working papers, but they are well worth reading. They detail the Security Expectations for Internet Service Provider Consumers and for Internet Service Providers, and update the existing Site Security Handbook for the benefit of ISPs. But fundamentally, site security is not about finding someone to blame, or throwing a band-aid on a gash. Site security is about taking responsibility for what happens, and making sure that adequate safeguards are in place to prevent problems. First, it seems silly to need to say this, but it is a fundamental point.
Network managers have to manage their networks.
They need to know what is going on because security is first and foremost at the local host. Some of the attacks spoofed source addresses - they made it look as though the messages were coming from a place that they were not in fact coming from. All of the attacks worked by overloading links with traffic from a number of sources, as many as 100,000. Clearly, had they done a better job, their machines would not have been sources for the attack, and the attacks may not even have occurred. Yes, you are protected from certain classes of problems initiated by people outside the firewall, but most attacks are from within.