Why not just revoke protection from the users that don't adhere to good practices? If the store all of the credit card information on their computer, and don't bother with a firewall, antivirus, etc. and their card gets stolen, they don't get protection from the banks or agencies? This would mean including yet another "clause" on pretty much all documents, but if it was pointed out and included a reference manual on protecting your information....(don't store your account numbers on the computer in the first place) then they would have no recourse if they were compromised. The financial institution would not be liable and, if caught, the criminal who took the information would still be sent to jail. And the foolish user who didn't listen would have to learn their hard lesson, probably only once. Just a thought.

~She

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/231/25688#25688