There are many things to consider (some semi random topics to consider). * what do you consider abuse? * only technical abuse (portscanes, spam, brute force attacks etc) * or also 'content abuses' (doxxing, hate speech, csam etc) * what about harmful content, will that be considered abuse * what about unwanted content? * how does this all relate to freedom of expression? * what rights do your customers have * to what extent are you willing to act as the sheriff ? * there should be a dedicated working address for receiving abuse notices/complaints. (we have that covered for the most part) * do you issue a ticket number as a reference? * how can a complainer escalate? * making a abuse complaint should be made as easy as possible * however, (for streamlinening puposes) a webform, or registration in a support system should be acceptable (some complainers are really stupid) * if a complaint does not include the minimal information to assess the validity, a request for more information could be sent, while the original complaint is closed * every company is different, has different policies, procedures and customers, educating frequent complainers is needed to ensure to most efficient way of dealing with abuse. * you have to make a decision about the information you forward to your client so they are able to resolve the issue * full message, always? only to reseller? also to enduser? * does a complainer have a reasonable expectation of privacy? * is this different for the automated copyright abuse sending mills? * what if the 'proof' of an abuse, would reviel the means? (ie spamtrap address) * how much proof do you need to forward this as an issue to your client? * you should have a process to contact the customer * directly by the abuse desk, * via sales (so they know their client generates 'issues') * you should have a process to restrict or limit usage of resources * directly by the abuse desk, * via networking
*
* Abuse handling is not the same as support handling. Abuse reporters don't want help, they expect that it is in your own interest as a network operator to curb abuse originating from your network, and their reports are intended to help you reach that goal. This results in some Don'ts (I'm seeing all of these in reponse to abuse reports): * don't reject their messages because they are not your customers,
* don't require them to register with some support system,
* don't send meaningless auto-replies,
* don't try to teach them (unless they are really doing something wrong). * Although there may be conflicts with protecting your user's privacy, reporters really appreciate to know whether their reports have a meaningful effect as they sometimes spend considerable amounts of time. Positive feedback ("we've terminated that customer", or "we've worked with the customer to fix their exploitable software/account") is a huge encouragement to continue reporting abuse. If there is no detectable reaction (either in form of an answer or an observable stop of abuse) then an abuse reporter might determine that blocking your network is a more effective use of their time. * Many types of abuse originating from your network are signs of substandard security and warnings of possibly more damaging future exploits. Work proactively with your customers when you find systemic problems. For example, on one of the services that I look after, we had one or two mail account password compromises which led to spam bursts. We established a strict password policy, checking the password database for easily breakable passwords, and contacting all users with weak passwords so they changed them to secure passwords. Similarly, we proactively check customer's websites for exploitable plugins. What kinds of proactive abuse prevention works in your case might be vastly different, but not doing anything is gross negligence. * Abuse desk workers need authority to contact customers and to restrict their use of your resources. One basic prerequisite for contacting customers is that you know them. If your operation does not establish appropriate KYC rules you're bound to be an attractive provider for abusers. Of course, the amount of info you need for an e-mail account and for renting out a server are different, and you may be limited by privacy laws, but if you simply refuse to take responsibility while not disclosing information on who *is* actually responsible you're in for blocking. Cheers,
Hans-Martin