The way I do things, is to treat the cable modem as already compromised and connect it to a router 100% under my control (running Linux) that will perform addit

The way I do things, is to treat the cable modem as already compromised and connect it to a router 100% under my control (running Linux) that will perform additional firewalling and/or act as a wireless AP. I will never let a border device have any sort of direct access into my internal network. There is no point in spending lots of time & effort trying to secure half-baked half-open devices that are not under my full control. I will do what I can [or what I'm allowed to do by the usually severely restricted configuration modem panel] but I know the game, there, is already lost. Moreover, the ISP can remotely administer the cable modem and flash anything to it. A second perimeter that is based on infrastructure I fully configure/control/administer is where I still have a chance.