Education aimed at helping users meet their security-related responsibilities.

learn more… | top users | synonyms

36
votes
8answers
3k views

Should I bother teaching buffer overflows any more?

The students are skeptical that turning off non-executable stacks, turning off canaries and turning off ASLR represents a realistic environment. If PaX, DEP, W^X, etc., are effective at stopping ...
8
votes
6answers
545 views

Doing a demo about open wireless networks exploiting with Firesheep

A collegue and I have been asked to do a demo where we show off stealing Facebook sessions with Firesheep. I've never used Firesheep before myself, but I reckon it should be a simple task. I know the ...
10
votes
4answers
760 views

How to define security requirements to ensure that developers… do not provide security by obscurity?

I tried to explain that security by obscurity should not be used but let's say I was challenged! I received the answer to list the known security by obscurity that I know, as a kind of bad practice ...
8
votes
3answers
205 views

What is the state of Security in Comp Sci Programs

In a previous question (How can I keep my programmer collegue informed about security issues ?) there was a statement: "...and I realise that security topics are often barely known from both the ...
13
votes
5answers
485 views

How can I keep my programmer collegues informed about security issues?

I am currently finishing a college degree in programming and I find that security topics are often barely understood by both students and teachers. It leads me to think that there are a lot of ...
17
votes
6answers
538 views

What policies maximize employee buy-in to security?

Security awareness training is a bane to most employees. A favorite anecdote I have is a group of employees figuring out how to quickly complete their online security awareness training from ...
17
votes
5answers
460 views

What are good ways to educate about IT security in a company?

I work in a company where security is a "fire once forget forever" concern. The administrator sets up a solution and seldom follow up and maintain it. As a result, we've got a security policy that's ...
9
votes
3answers
673 views

What are a few good analogies to describe the benefits of a strong security program?

Given communication is king, what are some of the favorite analogies you like to use to describe the benefits of security to organizations needing security but new to security?
15
votes
6answers
1k views

What are a few good lists of threats to use to kick-off conversations with others about what worries them?

To effectively communicate with business owners or executives on security, specifically with how people may harm their business, it often helps to discuss what types of people worry them. What are ...