Subject: end user security

From: Josh Rollyson <[email-masked]>
Date: Tue, 9 Oct 2001 21:55:45 -0400

I'd like to suggest that a document is needed on the responsibilities
of end users to maintain secure systems.

Every day I deal with abuse from compromised systems on broadband
connections. The providers are usually too overwhelmed to take any action,
and the users were usually never informed of the risks, or of their
responsibility to insure their system isn't misused.

Typically, when you do get a response from the user, you find out that
it was a default <insert consumer operating system of choice here>
installation, and that they had services running that they weren't using,
that they had no idea they needed to keep updating things to stay secure,
they had no firewall or packet filter, essentially an open door to abusers.

Compromises of end user desktop computers can largely be stopped by basic
education and basic security practices. Yet most users never learn this
until its too late. While there is no magic bullet, users need to be
informed, preferably before their systems are connected to the global
internet, that there are certian things they must do to protect themselves
and more importantly, the rest of the internet.

--
Josh Rollyson
System Administrator - SOSDG/2Mbit.com
IRC Operator - efnet.vuurwerk.nl

---

From: Ted Gavin <[email-masked]>
Date: Tue, 9 Oct 2001 22:58:24 -0400

>of end users to maintain secure systems.

This brings up an interesting point, and one that should probably be
raised at this time.

At SpamCon last spring, a number of people expressed interest in
pursuing this type of document, mostly from the perspective of an Abuse
Desk professional. That is to say, who would create a document that
could be used both by users and network abuse or support personnel in
explaining why systems had to be secured, and how to address the need
for a "best practices" type of approach for Abuse Desk staffs.

I don't know that it should/would be this group, but I'd be curious to
see what people's impressions are as to what scope the document should
cover.

Ted

---

From: Bryan Follins <[email-masked]>
Date: Tue, 9 Oct 2001 22:39:07 -0700

Check out the documents on my website at www.readingwhitepapers.com
They may help.

Bryan