From IETF-RUN@mailbag.cps.INTEL.COM Tue Oct 9 22:29:03 2001 Received: from mailbag.cps.intel.com (mailbag.cps.intel.com [192.102.199.72]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA17917 for ; Tue, 9 Oct 2001 22:29:03 -0400 (EDT) Received: from mailbag.intel.com (mailbag.cps.intel.com [192.102.199.72]) by mailbag.cps.intel.com (8.9.3/8.9.3/d: relay.m4,v 1.6 2000/11/24 22:10:56 iwep Exp iwep $) with ESMTP id TAA23336; Tue, 9 Oct 2001 19:07:49 -0700 (PDT) Received: from MAILBAG.INTEL.COM by MAILBAG.INTEL.COM (LISTSERV-TCP/IP release 1.8d) with spool id 14848 for IETF-RUN@MAILBAG.INTEL.COM; Tue, 9 Oct 2001 19:07:49 -0700 Received: from mail.2mbit.com (summit.magenet.net [216.152.230.50]) by mailbag.cps.intel.com (8.9.3/8.9.3/d: relay.m4,v 1.6 2000/11/24 22:10:56 iwep Exp iwep $) with ESMTP id SAA23235 for ; Tue, 9 Oct 2001 18:57:48 -0700 (PDT) Received: (from dinodrac@localhost) by mail.2mbit.com (8.11.6/8.11.6) id f9A1tjq02828 for ietf-run@mailbag.intel.com; Tue, 9 Oct 2001 21:55:45 -0400 Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5i Message-ID: <20011009215545.C32066@magenet.net> Date: Tue, 9 Oct 2001 21:55:45 -0400 Reply-To: IETF-RUN Sender: IETF-RUN From: Josh Rollyson Subject: end user security To: IETF-RUN@mailbag.cps.INTEL.COM I'd like to suggest that a document is needed on the responsibilities of end users to maintain secure systems. Every day I deal with abuse from compromised systems on broadband connections. The providers are usually too overwhelmed to take any action, and the users were usually never informed of the risks, or of their responsibility to insure their system isn't misused. Typically, when you do get a response from the user, you find out that it was a default installation, and that they had services running that they weren't using, that they had no idea they needed to keep updating things to stay secure, they had no firewall or packet filter, essentially an open door to abusers. Compromises of end user desktop computers can largely be stopped by basic education and basic security practices. Yet most users never learn this until its too late. While there is no magic bullet, users need to be informed, preferably before their systems are connected to the global internet, that there are certian things they must do to protect themselves and more importantly, the rest of the internet. -- Josh Rollyson System Administrator - SOSDG/2Mbit.com IRC Operator - efnet.vuurwerk.nl From IETF-RUN@mailbag.cps.INTEL.COM Tue Oct 9 23:13:53 2001 Received: from mailbag.cps.intel.com (mailbag.cps.intel.com [192.102.199.72]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA19430 for ; Tue, 9 Oct 2001 23:13:53 -0400 (EDT) Received: from mailbag.intel.com (mailbag.cps.intel.com [192.102.199.72]) by mailbag.cps.intel.com (8.9.3/8.9.3/d: relay.m4,v 1.6 2000/11/24 22:10:56 iwep Exp iwep $) with ESMTP id TAA23670; Tue, 9 Oct 2001 19:59:29 -0700 (PDT) Received: from MAILBAG.INTEL.COM by MAILBAG.INTEL.COM (LISTSERV-TCP/IP release 1.8d) with spool id 14911 for IETF-RUN@MAILBAG.INTEL.COM; Tue, 9 Oct 2001 19:59:29 -0700 Received: from newsguy.com (smtp.newsguy.com [209.155.56.71]) by mailbag.cps.intel.com (8.9.3/8.9.3/d: relay.m4,v 1.6 2000/11/24 22:10:56 iwep Exp iwep $) with ESMTP id TAA23666 for ; Tue, 9 Oct 2001 19:59:28 -0700 (PDT) Received: from home (dsl092-237-232.phl1.dsl.speakeasy.net [66.92.237.232]) by newsguy.com (8.9.1a/8.9.1) with SMTP id TAA35116 for ; Tue, 9 Oct 2001 19:57:22 -0700 (PDT) References: <20011009215545.C32066@magenet.net> X-Mailer: Forte Agent 1.8/32.548 MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by mailbag.cps.intel.com id TAA23667 Message-ID: Date: Tue, 9 Oct 2001 22:58:24 -0400 Reply-To: tedgavin@newsguy.com Sender: IETF-RUN From: Ted Gavin Organization: Institute for the Very, Very Nervous Subject: Re: end user security To: IETF-RUN@mailbag.cps.INTEL.COM In-Reply-To: <20011009215545.C32066@magenet.net> Content-Transfer-Encoding: 8bit On Tue, 9 Oct 2001 21:55:45 -0400, Josh Rollyson wrote: >I'd like to suggest that a document is needed on the responsibilities >of end users to maintain secure systems. This brings up an interesting point, and one that should probably be raised at this time. At SpamCon last spring, a number of people expressed interest in pursuing this type of document, mostly from the perspective of an Abuse Desk professional. That is to say, who would create a document that could be used both by users and network abuse or support personnel in explaining why systems had to be secured, and how to address the need for a "best practices" type of approach for Abuse Desk staffs. I don't know that it should/would be this group, but I'd be curious to see what people's impressions are as to what scope the document should cover. Ted From IETF-RUN@mailbag.cps.INTEL.COM Wed Oct 10 00:07:52 2001 Received: from mailbag.cps.intel.com (mailbag.cps.intel.com [192.102.199.72]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA20162 for ; Wed, 10 Oct 2001 00:07:52 -0400 (EDT) Received: from mailbag.intel.com (mailbag.cps.intel.com [192.102.199.72]) by mailbag.cps.intel.com (8.9.3/8.9.3/d: relay.m4,v 1.6 2000/11/24 22:10:56 iwep Exp iwep $) with ESMTP id UAA24038; Tue, 9 Oct 2001 20:52:48 -0700 (PDT) Received: from MAILBAG.INTEL.COM by MAILBAG.INTEL.COM (LISTSERV-TCP/IP release 1.8d) with spool id 14948 for IETF-RUN@MAILBAG.INTEL.COM; Tue, 9 Oct 2001 20:52:48 -0700 Received: from mail.2mbit.com (summit.magenet.net [216.152.230.50]) by mailbag.cps.intel.com (8.9.3/8.9.3/d: relay.m4,v 1.6 2000/11/24 22:10:56 iwep Exp iwep $) with ESMTP id UAA24034 for ; Tue, 9 Oct 2001 20:52:46 -0700 (PDT) Received: (from dinodrac@localhost) by mail.2mbit.com (8.11.6/8.11.6) id f9A3ohN07489 for IETF-RUN@MAILBAG.INTEL.COM.; Tue, 9 Oct 2001 23:50:43 -0400 Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5i Message-ID: <20011009235043.F32066@magenet.net> Date: Tue, 9 Oct 2001 23:50:43 -0400 Reply-To: IETF-RUN Sender: IETF-RUN From: Josh Rollyson Subject: [dinodrac@magenet.net: Re: end user security] To: IETF-RUN@mailbag.cps.INTEL.COM > >I'd like to suggest that a document is needed on the responsibilities > >of end users to maintain secure systems. > > This brings up an interesting point, and one that should probably be > raised at this time. > > At SpamCon last spring, a number of people expressed interest in > pursuing this type of document, mostly from the perspective of an Abuse > Desk professional. That is to say, who would create a document that > could be used both by users and network abuse or support personnel in > explaining why systems had to be secured, and how to address the need > for a "best practices" type of approach for Abuse Desk staffs. > > I don't know that it should/would be this group, but I'd be curious to > see what people's impressions are as to what scope the document should > cover. I'm not sure which group would be appropriate for this, but considering that compromised systems are often used to stage much broader attacks against high profile targets, there is obviously imho, some degree of responsibility on the part of the users to make sure this doesn't happen. I didn't see a specific group this would fit perfectly in, as the issues involved are both responsible use (by not allowing your systems to be misused), and security (keeping the systems secure so that the chance of unauthorized access and subsequent misuse is mimimal) I'd like to see such a document cover at a minimum: - Responsibility for systems under the control of end users. - Basic security practices for end users - General security threats against personal systems. - Summary of typical attack methods in laymans terms. (buffer overflows, viruses and trojan horses, etc) - Risks from social engineering. Ideally this would be a document which a provider could hand out to users when they sign up for service, so that users would hopefully have some understanding of the issues involved with running a computer connected to a network, particularly a public network. While this doesn't need to be something that will make users afraid to turn their systems on, it does need to be something that will convey the severity of the risks involved, and the possible consequences of inattention and inaction. From IETF-RUN@mailbag.cps.INTEL.COM Wed Oct 10 01:50:06 2001 Received: from mailbag.cps.intel.com (mailbag.cps.intel.com [192.102.199.72]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA23028 for ; Wed, 10 Oct 2001 01:50:06 -0400 (EDT) Received: from mailbag.intel.com (mailbag.cps.intel.com [192.102.199.72]) by mailbag.cps.intel.com (8.9.3/8.9.3/d: relay.m4,v 1.6 2000/11/24 22:10:56 iwep Exp iwep $) with ESMTP id WAA24682; Tue, 9 Oct 2001 22:36:10 -0700 (PDT) Received: from MAILBAG.INTEL.COM by MAILBAG.INTEL.COM (LISTSERV-TCP/IP release 1.8d) with spool id 15019 for IETF-RUN@MAILBAG.INTEL.COM; Tue, 9 Oct 2001 22:36:09 -0700 Received: from smtp6.mindspring.com (smtp6.mindspring.com [207.69.200.110]) by mailbag.cps.intel.com (8.9.3/8.9.3/d: relay.m4,v 1.6 2000/11/24 22:10:56 iwep Exp iwep $) with ESMTP id WAA24678 for ; Tue, 9 Oct 2001 22:36:08 -0700 (PDT) Received: from darlene (user-2ivfn4r.dialup.mindspring.com [165.247.220.155]) by smtp6.mindspring.com (8.9.3/8.8.5) with SMTP id BAA19692 for ; Wed, 10 Oct 2001 01:34:03 -0400 (EDT) MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4522.1200 Importance: Normal Message-ID: Date: Tue, 9 Oct 2001 22:39:07 -0700 Reply-To: IETF-RUN Sender: IETF-RUN From: Bryan Follins Subject: Re: end user security To: IETF-RUN@mailbag.cps.INTEL.COM In-Reply-To: <20011009215545.C32066@magenet.net> Content-Transfer-Encoding: 7bit Check out the documents on my website at www.readingwhitepapers.com They may help. Bryan -----Original Message----- From: IETF-RUN [mailto:IETF-RUN@MAILBAG.INTEL.COM]On Behalf Of Josh Rollyson Sent: Tuesday, October 09, 2001 6:56 PM To: IETF-RUN@MAILBAG.INTEL.COM Subject: end user security I'd like to suggest that a document is needed on the responsibilities of end users to maintain secure systems. Every day I deal with abuse from compromised systems on broadband connections. The providers are usually too overwhelmed to take any action, and the users were usually never informed of the risks, or of their responsibility to insure their system isn't misused. Typically, when you do get a response from the user, you find out that it was a default installation, and that they had services running that they weren't using, that they had no idea they needed to keep updating things to stay secure, they had no firewall or packet filter, essentially an open door to abusers. Compromises of end user desktop computers can largely be stopped by basic education and basic security practices. Yet most users never learn this until its too late. While there is no magic bullet, users need to be informed, preferably before their systems are connected to the global internet, that there are certian things they must do to protect themselves and more importantly, the rest of the internet. -- Josh Rollyson System Administrator - SOSDG/2Mbit.com IRC Operator - efnet.vuurwerk.nl From IETF-RUN@mailbag.cps.INTEL.COM Wed Oct 10 12:28:56 2001 Received: from mailbag.cps.intel.com (mailbag.cps.intel.com [192.102.199.72]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA13679 for ; Wed, 10 Oct 2001 12:28:52 -0400 (EDT) Received: from mailbag.intel.com (mailbag.cps.intel.com [192.102.199.72]) by mailbag.cps.intel.com (8.9.3/8.9.3/d: relay.m4,v 1.6 2000/11/24 22:10:56 iwep Exp iwep $) with ESMTP id JAA28660; Wed, 10 Oct 2001 09:14:35 -0700 (PDT) Received: from MAILBAG.INTEL.COM by MAILBAG.INTEL.COM (LISTSERV-TCP/IP release 1.8d) with spool id 14841 for IETF-RUN@MAILBAG.INTEL.COM; Wed, 10 Oct 2001 09:14:35 -0700 Received: from motgate.mot.com (motgate.mot.com [129.188.136.100]) by mailbag.cps.intel.com (8.9.3/8.9.3/d: relay.m4,v 1.6 2000/11/24 22:10:56 iwep Exp iwep $) with ESMTP id JAA28656 for ; Wed, 10 Oct 2001 09:14:34 -0700 (PDT) Received: [from pobox4.mot.com (pobox4.mot.com [10.64.251.243]) by motgate.mot.com (motgate 2.1) with ESMTP id JAA04540 for ; Wed, 10 Oct 2001 09:12:30 -0700 (MST)] Received: [from az33exb01.corp.mot.com (az33exb01.corp.mot.com [199.2.84.12]) by pobox4.mot.com (MOT-pobox4 2.0) with ESMTP id JAA01841 for ; Wed, 10 Oct 2001 09:12:30 -0700 (MST)] Received: by az33exb01.corp.mot.com with Internet Mail Service (5.5.2654.52) id <42YN70JQ>; Wed, 10 Oct 2001 09:12:30 -0700 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2654.52) Content-Type: text/plain; charset="iso-8859-1" Message-ID: <1D74B9231259D511B1AA0002B32C2896410623@az10exm06.sat.mot.com> Date: Wed, 10 Oct 2001 09:12:20 -0700 Reply-To: IETF-RUN Sender: IETF-RUN From: Austin Bill-P23393 Subject: Re: end user security To: IETF-RUN@mailbag.cps.INTEL.COM In almost all cases, it is not the computer systems that are the problem. It is almost always "operator error." The people who will always open that attachment that says "Readme.exe" or "Picture.exe" or "remove.exe" or "resume.doc.pif" are the ones who cause the problems. There will always be a new exploit, a new worm or virus, a new fraud, urban legend, scam or chain letter. Systems will never be secure against the brand new, just discovered exploit. If we write this document, it will probably be a compilation of ancient history that many people have been trying to get people to read for years. Why do we think they will read it now? Some source material I have gathered over the years is available here: http://www.stockhelp.net/virus.html and the group below is the largest mailing list in the Viruses Category on Yahoo Groups. http://groups.yahoo.com/group/virushoaxbusters/ Bill Austin, CDMA Systems Division Motorola Global Telecom Solutions Sector http://www.motorola.com/aspira/CDMA.htm -----Original Message----- From: Bryan Follins [mailto:asalh@MINDSPRING.COM] Sent: Tuesday, October 09, 2001 10:39 PM To: IETF-RUN@mailbag.cps.INTEL.COM Subject: Re: end user security Check out the documents on my website at www.readingwhitepapers.com They may help. Bryan -----Original Message----- From: IETF-RUN [mailto:IETF-RUN@MAILBAG.INTEL.COM]On Behalf Of Josh Rollyson Sent: Tuesday, October 09, 2001 6:56 PM To: IETF-RUN@MAILBAG.INTEL.COM Subject: end user security I'd like to suggest that a document is needed on the responsibilities of end users to maintain secure systems. Every day I deal with abuse from compromised systems on broadband connections. The providers are usually too overwhelmed to take any action, and the users were usually never informed of the risks, or of their responsibility to insure their system isn't misused. From IETF-RUN@mailbag.cps.INTEL.COM Wed Oct 10 14:16:22 2001 Received: from mailbag.cps.intel.com (mailbag.cps.intel.com [192.102.199.72]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA17474 for ; Wed, 10 Oct 2001 14:16:22 -0400 (EDT) Received: from mailbag.intel.com (mailbag.cps.intel.com [192.102.199.72]) by mailbag.cps.intel.com (8.9.3/8.9.3/d: relay.m4,v 1.6 2000/11/24 22:10:56 iwep Exp iwep $) with ESMTP id KAA29221; Wed, 10 Oct 2001 10:51:55 -0700 (PDT) Received: from MAILBAG.INTEL.COM by MAILBAG.INTEL.COM (LISTSERV-TCP/IP release 1.8d) with spool id 14889 for IETF-RUN@MAILBAG.INTEL.COM; Wed, 10 Oct 2001 10:51:55 -0700 Received: from mail.2mbit.com (summit.magenet.net [216.152.230.50]) by mailbag.cps.intel.com (8.9.3/8.9.3/d: relay.m4,v 1.6 2000/11/24 22:10:56 iwep Exp iwep $) with ESMTP id KAA29217 for ; Wed, 10 Oct 2001 10:51:54 -0700 (PDT) Received: (from dinodrac@localhost) by mail.2mbit.com (8.11.6/8.11.6) id f9AHnf211206 for IETF-RUN@mailbag.cps.INTEL.COM; Wed, 10 Oct 2001 13:49:41 -0400 References: <1D74B9231259D511B1AA0002B32C2896410623@az10exm06.sat.mot.com> Mime-Version: 1.0 Content-Type: application/pgp; x-action=sign; format=text Content-Disposition: inline; filename="msg.pgp" User-Agent: Mutt/1.2.5i Message-ID: <20011010134941.I13795@summit.magenet.net> Date: Wed, 10 Oct 2001 13:49:41 -0400 Reply-To: IETF-RUN Sender: IETF-RUN From: Josh Rollyson Subject: Re: end user security To: IETF-RUN@mailbag.cps.INTEL.COM In-Reply-To: <1D74B9231259D511B1AA0002B32C2896410623@az10exm06.sat.mot.com>; from Bill.Austin@MOTOROLA.COM on Wed, Oct 10, 2001 at 09:12:20AM -0700 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Wed, Oct 10, 2001 at 09:12:20AM -0700, Austin Bill-P23393 wrote: > > In almost all cases, it is not the computer systems that are the problem. It is almost always "operator error." > > The people who will always open that attachment that says "Readme.exe" or "Picture.exe" or "remove.exe" or "resume.doc.pif" are the ones who cause the problems. There will always be a new exploit, a new worm or virus, a new fraud, urban legend, scam or chain letter. Systems will never be secure against the brand new, just discovered exploit. If we write this document, it will probably be a compilation of ancient history that many people have been trying to get people to read for years. Why do we think they will read it now? > > Some source material I have gathered over the years is available here: > > http://www.stockhelp.net/virus.html and the group below is the largest mailing list in the Viruses Category on Yahoo Groups. > > http://groups.yahoo.com/group/virushoaxbusters/ While most compromises occur through operator error, most providers don't take the time to make even the slightest mention of security to new users. If security is mentioned anywhere, it is on some obscure technical support site, which the "average" user never reads. While the exploits change, basic common-sense security practices rarely do. Things like check with the operating system vendor for security updates once in a while, don't take candy from strangers, turn off unused services, etc. The fact that there are still large numbers of systems still vunerable to exploits released years ago, shows that there are still sufficient numbers of end users and even system administators that aren't doing their jobs. Its possible that these negligant users might even face civil penalties for the damage caused by their unsecured systems, although I'm no legal expert, and have no idea if this has been tested in the courts yet. I'd certianly love to hear if anybody has had any success doing this. - -- Josh Rollyson -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE7xIo1xz6PNhQ7Zr8RAvcLAJ4xvWBI7LLE0EZ5RzrE5MfgR3I1GgCfUmBV vpDRb57p1xdNa58P/iOMyo8= =Oics -----END PGP SIGNATURE----- From IETF-RUN@mailbag.cps.INTEL.COM Wed Oct 10 14:54:22 2001 Received: from mailbag.cps.intel.com (mailbag.cps.intel.com [192.102.199.72]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA18392 for ; Wed, 10 Oct 2001 14:54:22 -0400 (EDT) Received: from mailbag.intel.com (mailbag.cps.intel.com [192.102.199.72]) by mailbag.cps.intel.com (8.9.3/8.9.3/d: relay.m4,v 1.6 2000/11/24 22:10:56 iwep Exp iwep $) with ESMTP id LAA29693; Wed, 10 Oct 2001 11:39:48 -0700 (PDT) Received: from MAILBAG.INTEL.COM by MAILBAG.INTEL.COM (LISTSERV-TCP/IP release 1.8d) with spool id 14967 for IETF-RUN@MAILBAG.INTEL.COM; Wed, 10 Oct 2001 11:39:48 -0700 Received: from crotus.sc.intel.com (scfdns02.sc.intel.com [143.183.152.26]) by mailbag.cps.INTEL.COM (8.9.3/8.9.3/d: relay.m4,v 1.6 2000/11/24 22:10:56 iwep Exp iwep $) with ESMTP id LAA29689 for ; Wed, 10 Oct 2001 11:39:47 -0700 (PDT) Received: from Ludwig.sc.intel.com (ludwig.sc.intel.com [143.183.53.32]) by crotus.sc.intel.com (8.9.1a+p1/8.9.1/d: relay.m4,v 1.44 2001/10/01 19:10:43 root Exp $) with SMTP id SAA20304 for ; Wed, 10 Oct 2001 18:37:44 GMT Received: by Ludwig.sc.intel.com (4.1/SMI-4.1) id AA28205; Wed, 10 Oct 01 11:37:23 PDT Message-ID: <10110101837.AA28205@Ludwig.sc.intel.com> Date: Wed, 10 Oct 2001 11:37:23 PDT Reply-To: IETF-RUN Sender: IETF-RUN From: Sally Hambridge Subject: Re: end user security To: IETF-RUN@mailbag.cps.INTEL.COM Gents - before we start writing, check out RFC 2504 - Users' Security Handbook. If this doc is incomplete or misses some vital points then RUN might take that on, but I think the majority of what's being proposed already exists. Sally Hambridge sallyh@ludwig.sc.intel.com From IETF-RUN@mailbag.cps.INTEL.COM Wed Oct 10 15:41:41 2001 Received: from mailbag.cps.intel.com (mailbag.cps.intel.com [192.102.199.72]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA19414 for ; Wed, 10 Oct 2001 15:41:40 -0400 (EDT) Received: from mailbag.intel.com (mailbag.cps.intel.com [192.102.199.72]) by mailbag.cps.intel.com (8.9.3/8.9.3/d: relay.m4,v 1.6 2000/11/24 22:10:56 iwep Exp iwep $) with ESMTP id MAA29985; Wed, 10 Oct 2001 12:27:50 -0700 (PDT) Received: from MAILBAG.INTEL.COM by MAILBAG.INTEL.COM (LISTSERV-TCP/IP release 1.8d) with spool id 14994 for IETF-RUN@MAILBAG.INTEL.COM; Wed, 10 Oct 2001 12:27:49 -0700 Received: from mail.2mbit.com (summit.magenet.net [216.152.230.50]) by mailbag.cps.INTEL.COM (8.9.3/8.9.3/d: relay.m4,v 1.6 2000/11/24 22:10:56 iwep Exp iwep $) with ESMTP id MAA29981 for ; Wed, 10 Oct 2001 12:27:48 -0700 (PDT) Received: (from dinodrac@localhost) by mail.2mbit.com (8.11.6/8.11.6) id f9AJPj616069 for IETF-RUN@mailbag.cps.INTEL.COM; Wed, 10 Oct 2001 15:25:45 -0400 References: <10110101837.AA28205@Ludwig.sc.intel.com> Mime-Version: 1.0 Content-Type: application/pgp; x-action=sign; format=text Content-Disposition: inline; filename="msg.pgp" User-Agent: Mutt/1.2.5i Message-ID: <20011010152545.M13795@summit.magenet.net> Date: Wed, 10 Oct 2001 15:25:45 -0400 Reply-To: IETF-RUN Sender: IETF-RUN From: Josh Rollyson Subject: Re: end user security To: IETF-RUN@mailbag.cps.INTEL.COM In-Reply-To: <10110101837.AA28205@Ludwig.sc.intel.com>; from sallyh@LUDWIG.SC.INTEL.COM on Wed, Oct 10, 2001 at 11:37:23AM -0700 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Wed, Oct 10, 2001 at 11:37:23AM -0700, Sally Hambridge wrote: > Gents - before we start writing, check out > RFC 2504 - Users' Security Handbook. If this > doc is incomplete or misses some vital points > then RUN might take that on, but I think the > majority of what's being proposed already exists. > > Sally Hambridge > sallyh@ludwig.sc.intel.com I see a few additions which could be made to that document. First, unsecured systems are now of much greater value to "script kiddies" as sophisticated distributed denial of service tools for almost every platform with a IP stack are widely available to allow any compromised machine to be used as part of coordinated attacks. Which means the old excuse "Well my system is of no value because it doesn't have sensitive information stored on it" is even less valid now. Second, there are a lot more home users with 24/7 connectivity to the Internet, meaning a lot more unattended systems are exposed. Third, the document focuses primarily on user security in a business environment, and mentions home security almost as an afterthought. It also mentions the need for security fixes but doesn't go into detail on where to find them. Granted the existing document is a good start (and I admittedly overlooked it before), but it could better address home security. - -- Josh Rollyson -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE7xKC4xz6PNhQ7Zr8RAsbpAJsHbXWe7JJCJUM/jPRjTMwx0KC8LACfToIu YrxsF+TXUt5aibXXlKtSOpU= =itRr -----END PGP SIGNATURE----- From IETF-RUN@mailbag.cps.INTEL.COM Wed Oct 10 16:05:28 2001 Received: from mailbag.cps.intel.com (mailbag.cps.intel.com [192.102.199.72]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA19801 for ; Wed, 10 Oct 2001 16:05:27 -0400 (EDT) Received: from mailbag.intel.com (mailbag.cps.intel.com [192.102.199.72]) by mailbag.cps.intel.com (8.9.3/8.9.3/d: relay.m4,v 1.6 2000/11/24 22:10:56 iwep Exp iwep $) with ESMTP id MAA00242; Wed, 10 Oct 2001 12:49:44 -0700 (PDT) Received: from MAILBAG.INTEL.COM by MAILBAG.INTEL.COM (LISTSERV-TCP/IP release 1.8d) with spool id 15008 for IETF-RUN@MAILBAG.INTEL.COM; Wed, 10 Oct 2001 12:49:44 -0700 Received: from crncd ([208.50.38.130]) by mailbag.cps.intel.com (8.9.3/8.9.3/d: relay.m4,v 1.6 2000/11/24 22:10:56 iwep Exp iwep $) with ESMTP id MAA00238 for ; Wed, 10 Oct 2001 12:49:43 -0700 (PDT) Received: from megacrunch ([10.100.1.69]) by crncd with Microsoft SMTPSVC(5.0.2195.2966); Wed, 10 Oct 2001 15:49:26 -0400 MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook, Build 10.0.2627 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Importance: Normal X-OriginalArrivalTime: 10 Oct 2001 19:49:26.0441 (UTC) FILETIME=[AAD1F190:01C151C4] Message-ID: <000801c151c4$318627c0$4501640a@acttnow.com> Date: Wed, 10 Oct 2001 15:46:02 -0400 Reply-To: IETF-RUN Sender: IETF-RUN From: Bill Frizzell Subject: Re: end user security To: IETF-RUN@mailbag.cps.INTEL.COM In-Reply-To: <10110101837.AA28205@Ludwig.sc.intel.com> Content-Transfer-Encoding: 7bit I am a little concerned about the responsibility being levied toward the end users here. As a group, I don't believe they are ultimately responsible for securing their personal internet connections. If they were, that would imply that they had the requisite skill sets to manage their systems, and/or the motiviation to learn these skills. This is clearly not a viable assumption to make. For the internet to achieve its maximum inertia, it must be governed by some basic tenets: ease of use, "hands-free" maintenance, and reliable connections and security. Some how, some way, providers must account for the security of their connections, much as a domain's server must account for the security of it's network hosts. The real question here becomes "How do we ensure provider guidelines/standardization/education of security measures for their user networks?". Just my two cents worth. Bill Frizzell, B.S./M.S. Net+, i-Net+, CIW Professional, Master CIW Designer, CIW Certified Instructor, MCP, MCSE, MCSD, MCDBA, MCT, CTT+ CIO/VP Education & Technology ACTT-Charlotte, LLC Voice: (704) 329-1777 Fax: (704) 329-1755 Cell: (704) 577-1512 Email: bfrizzell@actt-now.com -----Original Message----- From: IETF-RUN [mailto:IETF-RUN@mailbag.cps.INTEL.COM] On Behalf Of Sally Hambridge Sent: Wednesday, October 10, 2001 2:37 PM To: IETF-RUN@mailbag.cps.INTEL.COM Subject: Re: end user security Gents - before we start writing, check out RFC 2504 - Users' Security Handbook. If this doc is incomplete or misses some vital points then RUN might take that on, but I think the majority of what's being proposed already exists. Sally Hambridge sallyh@ludwig.sc.intel.com From IETF-RUN@mailbag.cps.INTEL.COM Wed Oct 10 21:50:35 2001 Received: from mailbag.cps.intel.com (mailbag.cps.intel.com [192.102.199.72]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA25367 for ; Wed, 10 Oct 2001 21:50:34 -0400 (EDT) Received: from mailbag.intel.com (mailbag.cps.intel.com [192.102.199.72]) by mailbag.cps.intel.com (8.9.3/8.9.3/d: relay.m4,v 1.6 2000/11/24 22:10:56 iwep Exp iwep $) with ESMTP id SAA01662; Wed, 10 Oct 2001 18:33:27 -0700 (PDT) Received: from MAILBAG.INTEL.COM by MAILBAG.INTEL.COM (LISTSERV-TCP/IP release 1.8d) with spool id 15054 for IETF-RUN@MAILBAG.INTEL.COM; Wed, 10 Oct 2001 18:33:26 -0700 Received: from motgate4.mot.com (motgate4.mot.com [144.189.100.102]) by mailbag.cps.intel.com (8.9.3/8.9.3/d: relay.m4,v 1.6 2000/11/24 22:10:56 iwep Exp iwep $) with ESMTP id SAA01658 for ; Wed, 10 Oct 2001 18:33:25 -0700 (PDT) Received: [from pobox.mot.com (pobox.mot.com [129.188.137.100]) by motgate4.mot.com (motgate4 2.1) with ESMTP id SAA11043 for ; Wed, 10 Oct 2001 18:31:22 -0700 (MST)] Received: [from az33exi01.corp.mot.com (az33exi01.corp.mot.com [199.2.84.10]) by pobox.mot.com (MOT-pobox 2.0) with ESMTP id SAA01824 for ; Wed, 10 Oct 2001 18:31:21 -0700 (MST)] Received: by az33exi01.corp.mot.com with Internet Mail Service (5.5.2654.52) id <42YPCPR7>; Wed, 10 Oct 2001 18:31:20 -0700 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2654.52) Content-Type: text/plain; charset="iso-8859-1" Message-ID: <1D74B9231259D511B1AA0002B32C289641062E@az10exm06.sat.mot.com> Date: Wed, 10 Oct 2001 18:31:20 -0700 Reply-To: IETF-RUN Sender: IETF-RUN From: Austin Bill-P23393 Subject: Re: end user security To: IETF-RUN@mailbag.cps.INTEL.COM > -----Original Message----- > From: Josh Rollyson [mailto:dinodrac@MAGENET.NET] > Sent: Wednesday, October 10, 2001 12:26 PM > To: IETF-RUN@mailbag.cps.INTEL.COM > Subject: Re: end user security > > << File: msg.pgp >>