<html><head><style id="axi-htmleditor-style" type="text/css">p { margin: 0px; }</style></head><body dir="" style="font-size: 10pt; font-family: "Source Sans Pro", sans-serif; background-image: none; background-repeat: repeat; background-attachment: fixed;"><div><div><div style="font-family: 'Source Sans Pro', sans-serif; font-size: 10pt;"><div style="list-style-type: none;">There are many things to consider (some semi random topics to consider).</div><div style="list-style-type: none;"><ol id="ext-gen3762" start="1" style="list-style-type: decimal;"><li>what do you consider abuse? <ol style="list-style-type: lower-alpha;"><li>only technical abuse (portscanes, spam, brute force attacks etc)</li><li>or also 'content abuses' (doxxing, hate speech, csam etc)</li><li>what about harmful content, will that be considered abuse</li><li>what about unwanted content?</li><li>how does this all relate to freedom of expression?</li><li>what rights do your customers have</li><li>to what extent are you willing to act as the sheriff ?</li></ol></li><li>there should be a dedicated working address for receiving abuse notices/complaints. (we have that covered for the most part)<ol style="list-style-type: lower-alpha;"><li>do you issue a ticket number as a reference?</li><li>how can a complainer escalate?</li></ol></li><li>making a abuse complaint should be made as easy as possible</li><ol style="list-style-type: lower-alpha;"><li>however, (for streamlinening puposes) a webform, or registration in a support system should be acceptable (some complainers are really stupid)</li><li>if a complaint does not include the minimal information to assess the validity, a request for more information could be sent, while the original complaint is closed</li><li>every company is different, has different policies, procedures and customers, educating frequent complainers is needed to ensure to most efficient way of dealing with abuse.</li></ol><li>you have to make a decision about the information you forward to your client so they are able to resolve the issue<ol style="list-style-type: lower-alpha;"><li>full message, always? only to reseller? also to enduser?</li><li>does a complainer have a reasonable expectation of privacy?<ol style="list-style-type: lower-roman;"><li>is this different for the automated copyright abuse sending mills?</li><li>what if the 'proof' of an abuse, would reviel the means? (ie spamtrap address)<ol style="list-style-type: decimal;"><li>how much proof do you need to forward this as an issue to your client?</li></ol></li></ol></li></ol></li><li>you should have a process to contact the customer<ol style="list-style-type: lower-alpha;"><li>directly by the abuse desk,</li><li>via sales (so they know their client generates 'issues')</li></ol></li><li>you should have a process to restrict or limit usage of resources<ol style="list-style-type: lower-alpha;"><li>directly by the abuse desk,</li><li>via networking</li></ol></li></ol></div><blockquote style="border-left: 1px solid rgb(204, 204, 204); margin-left: 10px; padding-left: 10px;"><div style="null; null;"><br><ul style="list-style-type: disc;"><li><br></li><li>Abuse handling is not the same as support handling. Abuse
reporters don't want help, they expect that it is in your own
interest as a network operator to curb abuse originating from
your network, and their reports are intended to help you reach
that goal. This results in some Don'ts (I'm seeing all of these
in reponse to abuse reports):</li>
<ul style="list-style-type: circle;">
<li>don't reject their messages because they are not your
customers, <br>
</li>
<li>don't require them to register with some support system, <br>
</li>
<li>don't send meaningless auto-replies, <br>
</li>
<li>don't try to teach them (unless they are really doing
something wrong).</li>
</ul>
<li>Although there may be conflicts with protecting your user's
privacy, reporters really appreciate to know whether their
reports have a meaningful effect as they sometimes spend
considerable amounts of time. Positive feedback ("we've
terminated that customer", or "we've worked with the customer to
fix their exploitable software/account") is a huge encouragement
to continue reporting abuse. If there is no detectable reaction
(either in form of an answer or an observable stop of abuse)
then an abuse reporter might determine that blocking your
network is a more effective use of their time.</li>
<li>Many types of abuse originating from your network are signs of
substandard security and warnings of possibly more damaging
future exploits. Work proactively with your customers when you
find systemic problems. For example, on one of the services that
I look after, we had one or two mail account password
compromises which led to spam bursts. We established a strict
password policy, checking the password database for easily
breakable passwords, and contacting all users with weak
passwords so they changed them to secure passwords. Similarly,
we proactively check customer's websites for exploitable
plugins. What kinds of proactive abuse prevention works in your
case might be vastly different, but not doing anything is gross
negligence.</li>
<li>Abuse desk workers need authority to contact customers and to
restrict their use of your resources. One basic prerequisite for
contacting customers is that you know them. If your operation
does not establish appropriate KYC rules you're bound to be an
attractive provider for abusers. Of course, the amount of info
you need for an e-mail account and for renting out a server are
different, and you may be limited by privacy laws, but if you
simply refuse to take responsibility while not disclosing
information on who *is* actually responsible you're in for
blocking.</li>
</ul>
Cheers,<br>
Hans-Martin<br>
</div></blockquote><style type="text/css" style="display:none;">P {margin-top:0;margin-bottom:0;}</style></div></div></div><style id="axi-htmleditor-style" type="text/css">p { margin: 0px; }</style></body></html>