How do you persuade people to keep their systems up to date?

[jrbarnett]

In many IT jobs I've done for people who use (rather than manage/maintain) computers, I have great difficulty in persuading them that it is necessary to keep antivirus/antispyware software, operating system and major applications critical security patches and service packs up to date.
Explaining that some of the operating system code has unintentional security holes which may be exploited by the viruses/spyware/malware in which these patches help close and the antivirus/antispyware updates are necessary for detecting the newest viruses/spyware is beyond their comprehension.

So far the best way I've found is showing someone an antivirus/antispyware scanner report, produced on their own PC showing lots of problems in front of them, but shock treatment isn't always the best.

How do you persude such people, especially those who spend hours on the internet, that it is necessary to do this, and that it is in their benefit long term to do so with respect to system security and stability, and it would be cheaper to do this than pay me (or somebody else) to fix them afterwards?

John

 

[carrr]

heck, let them keep paying you!

Seriously though, for some, no amount of persuasion seems to work. It's simply a technical hurdle that they can't/don't want to leap.
For others, I've found it most effective to "sensationalize" viruses and malwares and explain it to the user in terms of them being hapless, easy pickin's. Many take umbrage when I explain that their surfing habits can essentially be tracked, warehoused, reasearched and compiled. This really works on the privacy-minded. Another tack is to explain their pc as a testing/stomping ground for producers or malware. Their lack of protection and subsequent slow down/loss of resources/unpleasant and unmanageable wed surfing sessions are a success for the producers of the crap that's out there. Finally, I tout utilization and maintenance of proactive/protective/detection measures as something that makes them more of a "techie." This gets eaten up.

Tired of waiting for an answer? Try asking better questions. See: faq222-2244

 

[jrbarnett]

A couple of weeks ago I did it on an XP system with no a-v, no antispyware, firewall off on a broadband connection and no windowsupdates since initial setup.
With 155 viruses, 3 dodgy BHO's and a HJT log that was over a page long (before I started working on it), it worried me that they didn't understand the reasons why this was necessary.

John

 

[carrr]

That should convince even the most resistant user, but...like I say, there are some who, well...some who represent job security for us.

Tired of waiting for an answer? Try asking better questions. See: faq222-2244

 

[GlenJohnson]

Give them a copy of my faq
faq1248-5606
What are the 10 commandments of good computing?

Glen A. Johnson
Johnson Computer Consulting
Tek-Tips in Chicago IL

 

[jrbarnett]

Good idea Glen (PS in question 5, should it say "Outlook Express" rather than "Outlook Exchange"?)

Now all I need to do is persuade them to read it and take note of its contents.

John

 

[GlenJohnson]

Done, thanks.


Glen A. Johnson
Johnson Computer Consulting
Tek-Tips in Chicago IL

 

[orypecos]

One thing that is important is to do everything you can to make sure any updates that you send out don't have problems with them. While working at Avaya, I got into the habit of not doing updates when they were first sent out. This was due to problems with many of them. So I waited for most everyone else to do the update and see if they had problems with it. If they didn't have problems, then I went ahead and did them. My confidence with the IT department of course lowered every time we had problems with an update. So I am not knocking all IT departments, just the incompetent ones that make the users want to avoid updates because the update was not tested thoroughly.
One program that was sent out to all of the users was Goback by Roxio.(I believe that was the name, it was a couple of years ago.) We had a lot of problems with it, but couldn't get any support from the IT department. When coming in in the morning you would see computer after computer with the 'blue screen of death'. The only thing that would bring it out of the lockup was a hard reboot. I went to Roxios' website but didn't find anything mentioning known problems. I pursued trying to fix the problem but it is too long to remember about the particulars. I finally got the IT department to stop forcing me to load it after deleting it.
The moral of the story is 'if you don't have the confidence of your users then you can expect them to keep their computer up to date'.

 

[jrbarnett]

Trouble is, these aren't users of a commercial company, it is either jobs I've done as a favour for friends/family or small jobs for friends of friends (or similar) who have the "my computer has a problem, can you help?" type questions.
At least in the office we have the SUS server and group policies to force through Windows updates...

John

 

[GlenJohnson]

Don't forget the update MS sent out for Terminal Services a few years back. Don't remember the details because I didn't download it, but it caused more problems than it was worth. Always wait on installing updates. If a "Freind of a freind" doesn't keep up with updates and needs help because of pc problems caused by it, well, just keep track of your hours and ask them which would have been cheaper. I had one client called me back about once every two weeks because they kept getting infected or got spyware loaded because they kept going to the wrong places and opening the wrong emails. Just kept a running tab on them.

Glen A. Johnson
Johnson Computer Consulting
Tek-Tips in Chicago IL

 

[jrbarnett]

Well, I'm fully aware of problems with certain Windows updates.
Last night I updated the A-V and spywareblaster software on his PC, and left a printed copy of your document together with a CD clearly labelled "Windows XP Service pack 2" on top of his keyboard.
I started Norton scanning and went out to get something to eat and when I had finished, it had found 2 items of adware (nothing too serious).

I left them on the screen for him to see. I'm away for a few days now, lets see what happens...

John

 

[Auger282]

If you are dealing with a non business environment I would set everything up for auto... auto windows updates .. auto spyware and antivirus scanning...

there is no other way its going to get done..

 

[johncurtis]

I have found the best way to persuade people that AV/firewalls/updates etc are necessary is to scare them. Most home users now use their PC for purchasing and/or for managing their bank account. Tell them that not being protected or up-to-date lets hackers steal their bank details and they soon get the message. I might not be telling them the whole truth, but in the end it's better for them (they have a secure system) and for me (I don't get those phone call we're all familiar with: "John, I've got a problem...")

John

It said Windows 2000 or better, so I bought a Mac

 

[jrbarnett]

Well, I returned back last night, and not a thing has been updated on the PC. Exactly as I left it with regards to antivirus, anti ad-ware/spyware software, service packs/critical updates etc.

Why am I not surprised.

John

 

[GlenJohnson]

Congratulations, your fee just went up.


Glen A. Johnson
Johnson Computer Consulting
If you're from Northern Il, Southern Wi, feel free to join Tek-Tips in Chicago IL

 

[jrbarnett]

Well, to bring this thread to a close, I plucked up the courage and finally got SP2 installed last Thursday evening, together with 18 of 20 currently available critical updates. I'll do the other 2 during the week.

John

 

[orypecos]

If your just installing SP2 at this time, I would say that the system is impossibly compromised and needs to have the hard drive formated and everything reloaded before connecting to the internet and/or network.