If an IT manager implements a policy of scanning e-mails and e-mail attachments for worms/virus/trojans or other malicious code, the end user never receives the offending e-mail. While Microsoft is certainly culpable for allowing this type of attack, IT managers and ISPs need to take responsibility for offending code passing through their servers.

Why don't they, you ask? I would suggest it is for two reasons:

1. ignorance. You have a good deal of IT professionals who have no concept of network security or the necessary skills to implement proper security standards.

2. economics. Your IT staff is competent, but they don't receive the necessary funding to adequately protect their systems.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/27/1643#1643