"If a user isn't educated enough to know how to open up a port he needs to run a particular program that needs a hole punched in the firewall, then that user shouldn't have unfettered access to the Net anyway."

I think this is entirely the wrong approach to personal computer security. It is unproductive to insist that those that just want to do their jobs, communicate with colleagues, or play games online have to become computer experts in order to do so.

The onus should be on the software and security industry - those that are responsible for designing the products - to make software which is not only safe to use by default, but easy to secure.

The tasks of hardening the average computer is difficult for the majority of computer users. Instructions such as, "turn off unnecessary services" are entirely inadequate for those which have no idea what each service does and if they will be using it. (With obscure service names like, "WMDM PMSP Service", can you blame them?)


Noam Eppel
www.noameppel.com
Web Security Consultant

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/262/28032#28032