I think one of the biggest issues is..

operating systems like windows give no indication to the ordinary user what internet connections they are making either legitimately themselves or

from software installed separately and giving users the opportunity to review and grant or deny access.

If ALL connections were transparent it would be much easier to see what was not appropriate.

Operating systems should say that a connection is being made and for what purpose and the user given the opportunity to grant or deny.

This is what i liked about Sophos' original interface sadly gone by the wayside.