Education aimed at helping users meet their security-related responsibilities.

learn more… | top users | synonyms

1
vote
2answers
96 views

To trust, or not to trust? Adding exceptions to the Trusted Certificates List in (firefox) Light

I recently installed the Light (a more compact forking of Firefox). I started getting the "This Connection is Untrusted" error, which got me wondering: when should I add an exception to the list of ...
27
votes
10answers
6k views

How to explain to a customer that spamfilters don't catch everything

I used to work in a small office which provided basic desktop support for users. One day I had to answer a call from a very angry customer and he asked for my boss. He wanted to know how could one ...
7
votes
1answer
796 views

Why does every site makes me acknowledge cookie usage? [closed]

In the last year or so every other site on the net started showing different kinds of notification that they're using cookies and I should be aware of it. The sheer number of different sites doing ...
6
votes
2answers
181 views

Where can I “hide” easter eggs for students learning about Linux security?

I feel like this isn't the best place to ask this (since there's no single right answer), but I can't think of a better place. If you have a better recommendation, could you please recommend it and I ...
-2
votes
1answer
109 views

Interesting security demos for beginners [closed]

I am thinking about a creating short security demo to get people interested in the security topic. I've had a couple of ideas just want to see if anyone has anything else interesting. Edit: I was ...
30
votes
6answers
4k views

Can malware be dangerous even when quarantined?

I am reading a book on network security and when talking about user confusion it writes: "It is not uncommon for a user to be asked security questions such as Is it safe to quarantine this ...
3
votes
7answers
257 views

What are the benefits of encryption for everyday people?

In addition to the fact that encryption systems like PGP are notoriously difficult to use, and that encryption doesn't always jive with cloud-based services like webmail, the fact is that most people ...
0
votes
2answers
64 views

Is “user education” actually doable?

I was going to ask about how to educate users, but now that I think about it, I first want to know if it's actually possible to do effectively at all. Are there any amazing success (or horrible ...
2
votes
1answer
88 views

Anti-phishing educational resources for users?

I'm am looking into conducting a phishing campaign to gauge how susceptible my workplace is to phishing attacks. Part of this will involve guiding "duped" users to materials or resources that will ...
2
votes
2answers
111 views

Breach informing

I am a staff member of a large fanfic site, but not the head administrator with control over the site itself. Recently, we had a security breach and the databases were copied, which included the ...
0
votes
2answers
122 views

What college majors are suitable for a career in security? [closed]

I was recently asked by a friend of mine (outside the computer science field) if he can be successful in web-application pen-testing I took this as an excuse to ask a more comprehensive question. I ...
-1
votes
1answer
174 views

Security Awareness Training Ideas [closed]

Does anyone have any solid recommendations for deploying and maintaining security awareness training? I am not looking for a specific vendor but I am trying to gain insight about how the material is ...
19
votes
9answers
1k views

How to get top management support for security projects?

I am facing an issue regarding security projects, for example: last year we bought an antivirus licence for 500 (end point security), and made a policy in order to force everyone to install it, ...
2
votes
1answer
156 views

Logging in as administrator in windows 7, is there a downside?

I have a very straightforward question. Is there any downside to logging in as an administrator all the time in windows 7? I mean, it asks you whenever a program asks for permission to do something ...
10
votes
1answer
111 views

Why does Android mix phone state with phone identity?

The "Phone State" permission on Android is widely requested by many apps. The explanation often given by the developer is that the app needs it in order to determine when you're on the phone, to stop ...
0
votes
0answers
25 views

Deliberately-Vulnerable webapp for security education [duplicate]

A year or so ago I was playing around with an apache webapp I found that was designed for web exploitation practice. It was simple to use, I just downloaded the file, unzipped it, and placed it in the ...
2
votes
2answers
222 views

Building a web application security focused team

I work as an application architect at larger company that builds web applications using both .Net and Java technologies. These are sold to and accessed by other businesses (not consumers). We have ...
30
votes
7answers
2k views

How do I educate others about social engineering?

One of my friends used to boast about how long his passwords are. One day, I decided to play a prank and social-engineered it out of him. I was pretty surprised as to how effortless the entire ...
5
votes
3answers
636 views

What is a pen tester?

I asked two pen testers what exactly it is that they do. One of them has told me that all he ever does is try to find exploits in the software in order to gain access to internal servers and nothing ...
2
votes
3answers
900 views

Self-teach pentesting/CEH skills ethically

I am a Software Engineer currently and have done quite a bit of systems work as well. I love the idea of Penetration Testing and would love to work towards becoming a pentester/Certified Ethical ...
1
vote
2answers
81 views

Seeking security help as a non-technical manager [closed]

A friend in the business sector recently asked me for advice on "IT security in a large charity". Being a developer not specialized in security, I could see his difficulty in finding someone qualified ...
1
vote
2answers
159 views

What's a good tool or website to help learning about security? [closed]

I recall reading once online about a website that had a name that sounded Japanese (Matsz... something) with security problems for programmers to do and learn about different security issues. Does ...
8
votes
2answers
821 views

Gamification of IT security - any applications yet?

Gamification, which is the use of game design elements and game mechanics in a non-game context, is a heavily discussed topic. Looking at the behavioral impact on Gamification, it has potential in ...
2
votes
3answers
184 views

Website URL to point users to in order to “make a point” about security [closed]

It is 'common knowledge' that unpatched, older browsers and operating systems are dangerous, but when I tell people that they should not do their online banking in IE 6 on a pirated XP service pack 0, ...
6
votes
3answers
381 views

Out-of-the-box Network Intrusion Appliance for non-Power User

First, let me apologize if any of this question is naive or beneath the scope of this board. Bear in mind the context and that I'm asking as an attempt to exhaust all resources. Also, I understand if ...
4
votes
1answer
618 views

How does an end user differentiate between OV and DV certificates?

This is a very good link that explains the different types of SSL certificates and level of trust provided by them. An Extended Validation (EV) certificate it is easily identified by the green color ...
2
votes
1answer
332 views

What is the cost of SSL encryption?

So, I've been looking over various websites that don't handle confidential information per se, but do accept user authentication tokens (i.e. you can create accounts with them and associate an ...
2
votes
3answers
379 views

Account lockout with human interaction required to unlock

I just got locked out yet again from my university's system for typing the wrong password twice, then mistyping the correct one by accident. Now I have to call the helpdesk or go there myself to reset ...
1
vote
3answers
116 views

How to protect against an attack where a person claims to be in a position of authority?

In an office if a person approaches an employee and claims to be a new IT staff and to give them access to their computer, what can prevent this kind of attack? I've worked a couple tech support jobs ...
3
votes
8answers
467 views

Generate user a password instead of asking for one?

I'm trying to weigh the benefits of not allowing users to create their own passwords, but must pick out of a generated selection. Are there any examples of sites that use this approach? Workflow ...
31
votes
6answers
3k views

Teaching a loved one about secure coding practices

This might be far too narrow, but it is a unique problem to ITSec professionals. A loved one is just starting out in a new programming career and I get the joy of watching her learn the most basic ...
2
votes
4answers
527 views

Detecting and filtering data over AC power lines?

Given that it's possible for the average consumer to send covert signals over normal AC lines how can an IT department identify and filter out this communication? I'm not sure how difficult this is ...
3
votes
5answers
197 views

What is a good way to demonstrate the insecurity of common bad practices?

A friend of mine teaches a "Basic IT Security" class at a .edu and asked what demonstrations he can do, live, to show why certain practices are bad. Currently, we have cobbled together a Firesheep ...
67
votes
10answers
6k views

How do you explain the necessity of “nuke it from orbit” to management and users?

When a machine has been infected with malware, most of us here immediately identify the appropriate action as "nuke it from orbit" - i.e. wipe the system and start over. Unfortunately, this is often ...
9
votes
2answers
3k views

How to prepare for a career in Pen-Testing

I am currently a sophmore in Penn State's SRA:ICS program (Cyber Security) and IST:Dev program. My goal is that when I graduate I can become a Pen-Tester. I'm looking for advice on how to learn how to ...
1
vote
2answers
171 views

How to educate users about the dangers of social engineering?

What would be the best way to teach and test employees on the topic of social engineering? What topics would you include?
7
votes
5answers
502 views

How can we get into the user's mindset?

As security folk, we tend to over- or under-estimate the capabilities and educatedness of our users, especially in terms of resistance to social engineering attacks. Stereotypically, this is due to ...
3
votes
2answers
726 views

Ideas to build security awareness

It has been claimed that "the weakest factor in security is the humans". Unfortunately this is a weak link we cannot cut away so we have to deal with it. I need ideas to help build inherently ...
0
votes
3answers
446 views

What is social engineering, how does it relate to security and how can it affect my business? [duplicate]

Possible Duplicate: Is social-engineering an actual threat What is social engineering? Can you give me some examples? Can social engineering have a big impact on business?
2
votes
2answers
817 views

Looking for a presentation about information security for corporate employees

I'd appreciate if you could recommend me a presentation the describes the dangers and possible solutions and guidelines, when using the Internet. Specifically, in corporate settings. I would need to ...
10
votes
3answers
566 views

How can I promote good password practices in an organization that doesn't currently care about that?

I work with an organization that uses some very poor practices such as using default user accounts, default passwords (or passwords the same as user accounts), sharing password information between ...
16
votes
2answers
2k views

If you have to write an information security guide for non technical users, what would you cover?

Inspired by a question I saw on Twitter: As the title says, what items would you include? And to what depth? Are there obvious topics everyone should be thinking of, or is it important to advise on ...
10
votes
3answers
1k views

What Twitter #hashtags apply to IT Security

I'm trying to search twitter for evidence of near-realtime alerts or updates regarding security issues. What hashtags are common or popular in the IT Security world?
9
votes
7answers
562 views

What are the best reasons you've heard for not implementing security?

We can devise the best technical solution to a security problem, but that solution needs to be applied by people, by a business, to an organization, and/or in spite of objections. The barriers ...
2
votes
1answer
188 views

CIS vs CS for Information Systems Security?

I would like to know which degree out of these two would better prepare me for Information Systems Security. I want to eventually work with the CIA as a Information Systems security specialist however ...
35
votes
7answers
2k views

Why does one need a high level of privacy/anonymity for legal activities?

This question is sort-of spun off of a previous one. How to counter the statement: "You don't need (strong) security if you're not doing anything illegal"? There are a lot of great ...
53
votes
15answers
3k views

Why do law-abiding citizens need strong security?

The layman's counter-argument I run in to for any complaint about inadequate security seems to always take the form: You don't need security if you aren't doing something illegal. This kind of ...
34
votes
8answers
3k views

Should I bother teaching buffer overflows any more?

The students are skeptical that turning off non-executable stacks, turning off canaries and turning off ASLR represents a realistic environment. If PaX, DEP, W^X, etc., are effective at stopping ...
8
votes
6answers
513 views

Doing a demo about open wireless networks exploiting with Firesheep

A collegue and I have been asked to do a demo where we show off stealing Facebook sessions with Firesheep. I've never used Firesheep before myself, but I reckon it should be a simple task. I know the ...
10
votes
4answers
664 views

How to define security requirements to ensure that developers… do not provide security by obscurity?

I tried to explain that security by obscurity should not be used but let's say I was challenged! I received the answer to list the known security by obscurity that I know, as a kind of bad practice ...