Many of us have agreed that, for competitive reasons, it's not possible for ISPs to lock infected users out of a network. I'd like to suggest a crazy idea for your reaction: A law governing ISPs that sets rules for these situations. It sets rules for how they can and should contact users about suspected infections and *requires* that they isolate such users until that user remediates their systems(s), and sets rules for how that is determined.
The point of this would be to protect ISPs from the competitive impact of taking those users off the network: If they can't just take their business elsewhere, to a less-responsible ISP, then they will have more of an incentive to fix their problems. One could argue that such rules would be devastating to small ISPs (time to call Brett Glass; is he on this list?) On the one hand perhaps we could say (not sure if this is legal) that it only applies to large ISPs, perhaps those who provide their own physical infrastructure to the user (fiber, cable, etc.).On the other hand, such a distinction would create an incentive for smaller ISPs to have lax security in order to scoop up infected refugees from the large ones. (Think virual leper colonies.) Perhaps there's a better way to deal with this, or perhaps the answer is just that smaller ISPs will suffer. It's possible, in fact, that the ISPs who took customer service the most seriously would do well under such a policy. The ones who don't help users would suffer the worst. I'm thinking out loud here; I don't necessarily believe in this as a matter of policy. Certainly it would be highly disruptive to users and some thought would have to go into how it was implemented. Many users, for instance those still running Win98, really can't be secured anymore and may be effectively banished. And I don't like the idea of telling people what they can and can't run, but that's where the policy might actually head. On the other hand, if you want to clean up the consumer ISP networks in the US, this would seem to be a way to get a lot of it done. Not perfect of course, but it gives users a real incentive to keep their systems clean. Local consultants and security software companies should make out like bandits. Larry Seltzer Contributing Editor, PC Magazine larry_selt...@ziffdavis.com http://blogs.pcmag.com/securitywatch/ _______________________________________________ Fun and Misc security discussion for OT posts. https://linuxbox.org/cgi-bin/mailman/listinfo/funsec Note: funsec is a public and open mailing list.