Grassroots security - securing where it really counts

We've all heard the the term "grassroots" in politics, but what exactly does that mean?  It means getting in touch with and involving the people.  So, grassroots security would be an effort in the security industry of getting the common people involved in security. 

But to many security professionals, this is a foreign concept.  So many security professionals focus their efforts towards talking to other security professionals and helping corporations figure out how to secure their networks.  They don't want to deal with common home users because it often feels beneath them and because they mistakenly feel like the corporate world is where security should be focused (and to be honest, they know that is generally where the money is to be made).  But if we are going to make us all more secure, we have to think about security from the aspect of where most of the security issues are and what enables the bad guys to do the bad things they do.

What am I talking about?  Well, let's look at two of the top security problems we face today: spam and phishing.  These two issues are almost exclusively propogated via botnets that are comprised of thousands and thousands of compromised machines on the Internet.  But do you know types of computers mostly make up botnets?  Purchased servers on foreign soil?  Used to be, but not anymore.  Corporate computers and servers?  Nope.  Educational institutions?  No way.  Home computers attached to broadband Internet links?  You got it. 

These types of computers are notoriously insecure.  We know all the common problems: 

• No firewall
• Anti-malware software not installed
• Anti-malware software turned off because it caused so many problems
• Kids surfing to all kinds of crazy websites with embedded malicious code
• Ignoring warnings from Windows about installing software when they go to websites
• Etc., etc., etc.

All this consequently leads to home PC's making up the biggest population of zombies.  And it also essentially means that users are uneducated (not stupid) about security.  They don't know what causes these problems, and they don't know how to fix them.  And ignorance of an issue such as this joined with the higher power of computers and cheap high speeds of Internet connections is very dangerous to the security of the Internet.

Our job is to help them become educated.  Our task is to swallow our pride and work with the grassroots of society.  They are the unwitting allies of spammers, phishers, and other bad guys.  They are the unknowing underpinning of this evil empire.  These problems would not exist on the current scale if the regular Joe or Jane user knew how to fix their security problems.  And if they knew they were contributing to the security of the Internet as a whole versus just protecting their own butts, then they might be even more motivated.

I am starting to write more about this on my personal blog, but basically, education, not avoidance, is the key.  We have to hit the problem where the problem starts.  If you are a security professional, don't be too proud.   Take some time to invest in the user.  That will make a real difference in security as a whole.