RE: The home user problem returns

["Tina Bird" <tbird () precision-guesswork com>]

> It seems that there are two primary ways in which people 
> change.  Either
> they make a conscious choice to change prior to a problem 
> getting out of
> hand (requires knowledge that there is an impending problem and
> knowledge of how to avoid the problem) or they endure more 
> and more pain
> until they are forced to look at the problem and finally make 
> a choice.

i disagree. i don't know *anyone* who willingly makes a fundamental,
significant change in their behavior without pain as a motivator. for every
example of your first category that you can present, i can *probably*
demonstrate that the "apparent" change is really an example of the person
behaving consistently with some deeper part of their personality, which
isn't changing.

i think it's human nature to resist change altogether unless some sort of
pain - personal, physical, financial - motivates them. it's why carrot and
stick works so well as a way to influence behavior. 

so for me, the question is, how do we influence the *consequences* of badly
configured or managed machines - wherever they are, on corporate networks or
the internet - in order to create the change we want? how do we create a
beneficial sort of pain?

when i'm dealing with my relatives, i just change the configuration of their
computer when i'm visiting. that's not exactly a motivator, but hey, their
machines are fully patched :-)

it's why i'm so interested in NAC and NAP and other sorts of enterprise
technologies that let me use network connectivity as the bribe to get
machines configured the way i want them. i'm creating pain for the end user
by not letting them get to the web without doing what i want - the height of
security admin arrogance, i'm sure, but i try to be reasonable in my
expectations.

cheers - tbird

_______________________________________________
firewall-wizards mailing list
firewall-wizards () honor icsalabs com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards