MAAWG, the large and influential cross-industry working group devoted to fighting spam, phishing, and all other forms of electronic "messaging abuse" announced last week an important new initiative in the battle against spam. In its "Best Practices for the Use of a Walled Garden," MAAWG is taking spam fighting to the streets, acknowledging the critical role that consumers themselves must play in eradicating email borne threats.
Some of the language may be a bit technically off-putting for marketers, so I'll summarize the new best practices in plain English for you: MAAWG is recommending that ISPs "enforce more proactive measures" to stop the spam from emanating from their own networks. As in, putting up "walls" around their own gardens, and not letting weeds grow into the neighbors' yards. As in, ISPs shouldn't just filter inbound mail, but put stronger controls in place to ensure their own networks don't become the sources of spam.
Security vendor and MAAWG member Cloudmark issued a release at this week's MAAWG's members-only meeting in DC stating that at least 100 - 150 million PCs out of the estimated 600 million currently connected to the Internet, are already "infected botnets," which are "large groups of computers that have been compromised by professional spammers and used, without the knowledge of the PC owner, to send high volumes of spam."
So what is MAAWG recommending ISPs do to defeat the botnet challenge? According to the document, "the primary goal of these practices is to help end-users become aware of and remove unwanted programs or malware residing on their personal computers and to stop the network from being used for abusive purposes."
ISPs should establish parameters for how their networks can be used to send email and what "privileges" individuals have when it comes to sending email (i.e., implementing systems that will shut down an email account if it all of a sudden starts sending 20,000 messages in an hour.) But when they do throw the wall up, MAAWG insists that ISPs also should tell their customers why the wall went up and what steps they can take to cure their computers of the botnet disease, including with links to free and/or fee-based anti-malware tools.
Consumer education is the core (and concluding) message of the new ISP best practices guide:
"End-User Education Should Be a Primary Focus. Since the end user is typically the weak link in the security chain the ISP should make reasonable efforts by way of documentation available on their Web site so that the end user can proactively educate themselves on how to mitigate risk of malware infection. As such, documentation in the form of FAQs, support videos, tutorials, and a searchable knowledge base should be made available to the end user."
