[[e-mail]: Re: end user security]

[Josh Rollyson <[e-mail]>]

> >I'd like to suggest that a document is needed on the responsibilities
> >of end users to maintain secure systems.
>
> This brings up an interesting point, and one that should probably be
> raised at this time.
>
> At SpamCon last spring, a number of people expressed interest in
> pursuing this type of document, mostly from the perspective of an Abuse
> Desk professional. That is to say, who would create a document that
> could be used both by users and network abuse or support personnel in
> explaining why systems had to be secured, and how to address the need
> for a "best practices" type of approach for Abuse Desk staffs.
>
> I don't know that it should/would be this group, but I'd be curious to
> see what people's impressions are as to what scope the document should
> cover.

I'm not sure which group would be appropriate for this, but considering
that compromised systems are often used to stage much broader attacks
against high profile targets, there is obviously imho, some degree of
responsibility on the part of the users to make sure this doesn't happen.
I didn't see a specific group this would fit perfectly in, as the issues
involved are both responsible use (by not allowing your systems to
be misused), and security (keeping the systems secure so that the chance of
unauthorized access and subsequent misuse is mimimal)

I'd like to see such a document cover at a minimum:

- Responsibility for systems under the control of end users.
- Basic security practices for end users
- General security threats against personal systems.
- Summary of typical attack methods in laymans terms.
  (buffer overflows, viruses and trojan horses, etc)
- Risks from social engineering.

Ideally this would be a document which a provider could hand out to users
when they sign up for service, so that users would hopefully have some
understanding of the issues involved with running a computer connected
to a network, particularly a public network.

While this doesn't need to be something that will make users afraid to
turn their systems on, it does need to be something that will convey
the severity of the risks involved, and the possible consequences of
inattention and inaction.