end user security

[Josh Rollyson <[e-mail]>]

I'd like to suggest that a document is needed on the responsibilities
of end users to maintain secure systems.

Every day I deal with abuse from compromised systems on broadband
connections. The providers are usually too overwhelmed to take any action,
and the users were usually never informed of the risks, or of their
responsibility to insure their system isn't misused.

Typically, when you do get a response from the user, you find out that
it was a default <insert consumer operating system of choice here>
installation, and that they had services running that they weren't using,
that they had no idea they needed to keep updating things to stay secure,
they had no firewall or packet filter, essentially an open door to abusers.

Compromises of end user desktop computers can largely be stopped by basic
education and basic security practices. Yet most users never learn this
until its too late. While there is no magic bullet, users need to be
informed, preferably before their systems are connected to the global
internet, that there are certian things they must do to protect themselves
and more importantly, the rest of the internet.


--
Josh Rollyson
System Administrator - SOSDG/2Mbit.com
IRC Operator - efnet.vuurwerk.nl