Microsoft has a change of heart about keeping the Internet safe

ISPS should those who maintain hacked PC anywhere? Security chief executive of Microsoft used to think so, but now had a change of heart.

Speaking at the RSA Conference Tuesday, Microsoft Corporate Vice President for Trustworthy Computing Scott Charney said that she thought it was a good idea to be service providers that those on the hook to keep infected PCS from the rest of the Internet.

"Last year at RSA, I said, ' you know we need to think about ISP, because the IOC for the public sector, and we need to think about their consumer scan machines and making sure they are clean and possibly quarantined them from the Internet, '" he said. "But over the last year as I thought much more about this I realized that there are many flaws with that model."

Consumers can see security scans as invasive and an invasion of privacy and with more and more people use the Internet as their telephone, quarantining a PC could amount to cutting off someone's 911 service, he said. "We see the scenery, right: a heart attack, I ran to my computer, it says, you must install four patches and reboot before you can access the Internet. That is not the experience that we strive for ".

Then there is the biggest problem of all. ISP would have to bear the costs. "Puts a lot of burden on ISPs, because they are the ones that are gating access to the Internet," said Charney.

ISPs have experimented with different ways to reduce the infected computers. Comcast, for example, has a service called constant guard that warn customers when they have a security problem.

But cut infected customer service is a costly proposition. "It takes only a phone call from a consumer to make you lose your profit margin for the year" on users, said Craig Labovitz, chief scientist with firm Arbor Networks, in a telephone interview network monitoring.

Labovitz said that technology companies are coming up with new ways to rid the world of infected machines for about two decades now, without success. "Even if we force end users to maintain their patch update there are still a huge number of zero days," he said, referring to defects in software patches that can be used to take a fully patched PCS. "It's an arms race that keeps going. There is certainly any single bullet. "

Still, Charney thinks that there are ways to improve things.

He thinks the company Internet could take a page from organizations like the World Health Organization and find new ways to keep infected PCs away from the rest of the network--to "enforce goodness," he said.

Perhaps the solution is for consumers to share trusted certificates on the health of their personal computers--including data if running anti-virus or is fully patched--Charney suggested. He called this "collective defence". An example? A bank may ask customers to sign up for a program that would scan the PC for signs of infection during online sessions. If there is a problem, the Bank could limit then what the customer might make--topping out at $ 2000 transactions, for example.

That may end up to be a more viable model for the Internet, said Charney. "The user remains in control. The user can say I don't want to pass a health certificate, "said" there can be consequences to that decision, but you can do it. "

Robert McMillan covers the security of your computer and General technology breaking news for the IDG News Service. Follow Robert on Twitter at @ bobmcmillan. E-mail address is robert_mcmillan@idg.com, Robert