Re: The home user problem returns

[jseymour () linxnet com (Jim Seymour)]

"Marcus J. Ranum" <mjr () ranum com> wrote:
> Mason Schmitt wrote:
[snip]
> > User education
> > ----------------
> > User education still needs to happen
>
> Pointless. If educating users was going to work, it would have worked
> by now. If Anna Kournikova worm and phishing hadn't gotten people
> to take this seriously years ago, they aren't going to next year, either.
[snip]
>

It may be pointless in home user space, but, IME, it's most definitely
*not* pointless in the workplace.  I regard end-user education as one
of my best defenses.  And it has worked for me.

Some things that've no doubt helped: Relatively small company--only 150
or so desktops.  Good support from management: Official dispensation to
*immediately* remove from the network misbehaving machines.  I once
disconnected an entire R&D department.  Another time I suspended a
manager's account (for password sharing).  I'm allowed Draconian email
filtering at the mail gateways.  Most of that same filtering is done on
internal mail servers.  But still: End-user education is an important
component.  I have somebody either come to me or email me about how "I
received this, and it looked suspicious, so I didn't open it.  Do you
want to see it?" on a fairly regular basis.

Result: We haven't had a single virus/worm/Trojan get loose on the
network, with *one* exception, in the six years I've been working for
my current employer.  That one exception was a "day 0" kind of a thing,
infected .zip file, sent from the outside to somebody that was
expecting an email, with an attachment, from that person.  (It didn't
get far.  As luck would have it: Soon after he opened that attachment,
I had logged-in remotely because of the advisories, detected the spoor,
and shut down all the mail and POP servers until I got in the next
morning.)

Jim
_______________________________________________
firewall-wizards mailing list
firewall-wizards () honor icsalabs com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards