TWC: Medium: Reputation as Public Policy for Internet Security

互联网歹徒合作的利润在身份盗窃，拒绝服务等，同时，捍卫组织单独行动，并把互联网信息安全（infosec）作为一个成本，以尽量减少。 如果消费者知道哪个公司的安全性好或差，他们就可以在相互竞争的互联网公司中做出更明智的选择，而这种名声或耻辱会促使公司提高安全性以留住和吸引消费者。 其他安全问题可能不会导致出站垃圾邮件，这个项目并没有声称解决所有问题。 然而，正如打喷嚏表明疾病一样，垃圾邮件表明信息安全较差，可能被用于更坏的目的（盗窃，拒绝服务，勒索等），该项目在SpamRankings.net上对类似的组织进行排名，使用来自多个反垃圾邮件阻止列表的日常数据，将其从IP地址汇总到路由块（自治系统），并按地理位置和类型（托管，医疗，ISP等）对其所有者进行分类。 实地实验，包括不同的宣传策略的相对影响，试图确定是否发布信息的信息安全的症状（外发垃圾邮件）导致公司改善该symptom.Positive实验结果将作为垫脚石，及时和公开的事件披露，使更多的第三方同行排名的进一步改善信息安全的立法授权的政策建议。 因此，最低限度的执法可以促进互联网可用性、盈利能力和国家安全的显著改善。

Internet miscreants cooperate for profit in identity theft, denial of service, etc.  Meanwhile, defending organizations act separately and treat Internet information security (infosec) as a cost to be minimized. Customers could choose more wisely among competing Internet firms if they knew which had good or bad security, and such fame or shame would cause firms to improve security to retain and attract customers.To verify such a policy of peer influence, this project uses a readily available stand-in for organizational infosec: outbound spam (unsolicited bulk email).  Other security problems may not cause outbound spam, and this project makes no claims to solve all problems.  However, just as a sneeze indicates disease, spam indicates poor infosec that could be exploited for even worse purposes (theft, denial of service, blackmail, etc.), and no organization wants to be seen to have such problems.The project ranks similar organizations in SpamRankings.net, using daily data from multiple anti-spam blocklists, aggregating it from IP addresses into routing blocks (Autonomous Systems), and categorizing their owners by geography and type (hosting, medical, ISP, etc.).  Field experiments, including the relative effects of different publicity strategies, seek to determine whether publishing information on a symptom of infosec (outbound spam) causes firms to improve that symptom.Positive experimental results will serve as stepping stones to policy recommendations of legislative mandates of timely and publicly accessible incident disclosure to enable more third-party peer rankings for further infosec improvement.  Minimal enforcement could thus catalyze significant improvements in Internet usability, profitability, and national security.