Re: Welcome, Administrivia

Steve Atkins wrote:
> Welcome all,
> 
> The volume of reports being received by abuse desks keeps increasing -
> tens of thousands a day at some ISPs. At the same time, many of these
> reports are unclear, hard to triage and respond to efficiently and,
> in many cases, don't provide enough information to allow an issue
> to be handled.

> Users of abuse reports include:
> 
>   o  Bandwidth provider abuse desks
>   o  Hosting and end-user ISP abuse desks, both large and small
>   o  ESP (email service provider) abuse desks
>   o  Security incident response teams
>   o  ISP and corporate spam filter operators
>   o  Legal staff at ISPs/ESPs justifying client terminations
>   o  Legal staff pursuing legal action against abusers
>   o  Law enforcement (civil, eg DAs, and criminal)
>   o  Tool developers for all the above

Looks like we have our work cut out for us hopefully, from that list we 
can narrow down a few requirements:

- Aggregation - Abuse reports should identify the source and nature of 
the abuse in a manner that allows a incident management/ticketing system 
to effectively and accurately aggregate multiple reports into a single 
incident.

- Accuracy - Any automated system to handle reports should be designed 
to promote accuracy. Any system designed for reporting by unskilled end 
users should have consistancy checks to discourage misdirected reports 
-AND- identify in those reports where errors are likely to exist.

- Ease of use - a reporting system should not impose undue burden on 
reporters or incident managers - if it does, it loses its effectiveness.

- Quality of information - All information needed to accurately process 
a complaint should be present, including:
   - nature of complaint
   - source of abuse in question
   - how the relationship between the source of abuse and the
     abusedesk was determined *IF* that isn't blatently obvious
     in the complaint.
   - Evidence of the alleged abuse, in sufficent detail as to
     correlate with other reports and logs (radius logs, etc)
   - Where prosecution or other legal action is a possiblity,
     digital signatures and other measures to help insure the
     integrity of the report.
   - References to related complaints (ticket numbers?)



As an end user making a complaint, I'd expect at least the following:

   - Standard method for filing report. Currently that would be
     abuse@ or postmaster@ accounts, but any method needs to
     be *universal* - having to figure out what method a given
     site expects is an undue burden.

   - Timely response. Ticket numbers should be given where
     practical. Some form of notification when an issue is
     actually resolved is very helpful. Such notification
     doesn't have to disclose WHAT action was taken, just
     whether the complaint was resolved, and if it wasn't
     resolved, why not. (ie, not enough evidence, misdirected)

Anyway, theres a start ;)

-Josh