Should We Blame Security Victims?

Ramblings

from the where-to-place-the-blame... dept

There is always something of a back and forth on who to blame whenever a big virus goes around. Is it the fault of a company like Microsoft for not creating their software in a way to better protect against such things? Is it the fault of anti-virus software vendors who are always a step behind the latest virus? Or, is it the fault of the end-user who is convinced to click a strange attachment despite thousands upon thousands of warnings not to? Walt Mossberg recently wrote a column calling for techies to stop blaming the victims. Instead, he blames Microsoft and calls on them to create a one-stop shop for protecting end-users from any and all security problems. Now, Tim Mullen has struck back and pointed out that people should stop being victims if they want to use computers and the internet. He points out, first of all, that Mossberg’s vision of the perfect security protection system is impossible. Furthermore, he explains that no one is expecting end users to become system administrators, but to just do a few basic things to secure their computers from the most obvious of malicious attacks by installing basic anti-virus and firewall software (though, these days, you also need anti-spam software, anti-spyware software and anti-phishing software to really be complete). Mullen’s point, however, is that we expect a basic level of competence to drive a car without hurting themselves, or to cook meat without giving themselves food poisoning. Thus, is it really that much to ask users to secure their own computers? The answer, of course, probably lies somewhere in the middle. Software companies and, increasingly, internet service providers, are going to be expected to do more to stop malicious attacks in their tracks – but end users should be expected to handle basic protection of their own machines. Besides, if we really must blame someone for all these malicious attacks, shouldn’t it be those who are actually creating them?