
Originally Posted by
Symphony
Which is why I said in my first post "reasonable security based on what's being protected."
This isn't new information, and it doesn't require an IT background or an IT department behind it. It's fundamental, basic security 101. Every security system, whether it's for a computer or the physical means by which you lock up gold bullion, is forever balancing utility with function.
Yes, the only 100% foolproof security on a computer system is a system that never connects to anything, ever...no Internet, no disks, no uploads or installs of any kind....it only runs whatever you program directly on it. That's as secure as you can possibly get, but that's not a horribly useful computer...in that extreme case, you'd have literally secured a system completely out of any usefulness.
You determine what level of security (and restriction) is appropriate based on the value of what you have to lose, the risk that you're actually going to lose it, and the utility you need from the system it's on.
If you have something truly unique and valuable...say, the formula for a pandemic cure for cancer, or plans for a Perpetually Self-Powered Wonderflonium Dispenser, yes, you'd want to keep that on a system that interacted with the outside world as little as possible.
For a less extreme example, say you're a credit card issuer. You maintain a known repository of account information (everybody knows you're a card issuer) of extremely high value. In other words, you're a really juicy target, with a really high payload. Those systems have rather extreme security need, and are often isolated as much as possible.
For the staggering majority of home users, though, disconnecting a broadband connection every time you're not physically sitting at your computer is overkill and counterproductive....your normal home user wouldn't notice a security intrusion even if they were sitting there. Standard security measures (home security software, strong passwords, etc) are perfectly reasonable and effective, especially so since the staggering majority of home users don't have enough of a "payload" available on their systems to make the kind of effort required to defeat those measures worthwhile. Cybercriminals aren't magicians, and contrary to the media image, standard, reasonable home security measures are not easy to defeat so long as they're correctly configured and updated...they take time and effort, and a criminal is going to spend that kind of time and effort going after the big payday, not your bank account.
I hate to say it, but your IT department is making unreasonable, unnecessary recommendations to you as a home user. Disconnecting your system unless you're sitting there doesn't make you appreciably less vulnerable...the few bits of data that represent the credit card information you might have on your home system only take a second to transmit somewhere, and a virus that's grabbed it will simply transmit it out once you DO connect...and you sitting there observing won't stop it from happening.
Circling this all back around to the topic, the original contention (that a large Steam update could potentially take hours, hours where you're sitting helpless at your computer, unable to live your life) really doesn't hold a lot of water, and isn't a realistic concern for the overwhelming majority of users.