Second, Internet service providers, which are in the best position to manage the security of individual users’ machines, need to get more involved – again with a system that understands the costs of poor security and charges those costs back to the people responsible. (Just as we require drivers to have insurance, maybe we should require users either to buy security services from their ISP or to post some kind of bond/insurance.)