Education aimed at helping users meet their security-related responsibilities.

learn more… | top users | synonyms

1
vote
2answers
45 views

Hardening charity volunteers' access to a web server [on hold]

I'm helping to administer a LAMP web server for a charity which runs CiviCRM on Joomla. This system is going to be accessed over the Internet by many volunteers from devices I have no control over.. ...
1
vote
2answers
114 views

Should users be allowed to reuse/recyle the same login credentials across a network for different systems?

Should users be allowed to reuse/recycle the same login credentials across a network for different systems? Should this be disallowed/discouraged, or are the security implications minimal? If it's ...
53
votes
8answers
3k views

Why does one need a high level of privacy/anonymity for legal activities?

This question is sort-of spun off of a previous one. How to counter the statement: "You don't need (strong) security if you're not doing anything illegal"? There are a lot of great ...
96
votes
11answers
8k views

How do you explain the necessity of “nuke it from orbit” to management and users?

When a machine has been infected with malware, most of us here immediately identify the appropriate action as "nuke it from orbit" - i.e. wipe the system and start over. Unfortunately, this is often ...
1
vote
2answers
72 views

If signature based AV software is becoming obsolete, what is the home user to do?

Assuming one is a worried home user who keeps certain sensitive files, works on personal projects, and generally wants to ensure the integrity of their single system (to keep it simple), what's a user ...
3
votes
3answers
109 views

Is it insecure to reveal if a password is being used for another account after a set period of time?

Password reuse can be considered a pandemic of security. The obvious way to fix this is to encourage people to use password managers, but (comparatively) few people actually do. My idea is to have ...
2
votes
2answers
260 views

Logging in as administrator in windows 7, is there a downside?

I have a very straightforward question. Is there any downside to logging in as an administrator all the time in windows 7? I mean, it asks you whenever a program asks for permission to do something ...
29
votes
7answers
4k views

Explain to non tech savvy person how to check that your connection to mybank.com is safe?

I was reading the security advice given by the Swedish Bankers' Association. They included these two pieces of advice (my translation), that I assume is to teach the user to check for SSL/TLS and ...
1
vote
4answers
152 views

Do technical advice sites sometimes link to malware, and if so, how should we properly research errors? [closed]

Suppose you get an error on your PC that shows up randomly, then you do a search on the internet for the error to find out how to fix it. Typically, you will get some sites that offer a solution, but ...
3
votes
2answers
40 views

Efficient way to demonstrate the value in Active Directory security improvements?

Working hard on Active Directory security in a corporate environment: getting rid of excess permissions, monitoring, patching, etc. Nothing comes free, and to keep the budget going, I need to somehow ...
85
votes
16answers
13k views

How to tell users that they shouldn't disclose their password over the phone to our help desk?

I work for a help desk, and we recently launched an online service where our members can log in. A problem we are having is that users who are calling us often ask us to confirm that the password ...
8
votes
4answers
118 views

Secure Memorable Passwords for Older Users

As with many people who work in IT I have found myself in the position of providing technical support for older relatives. Most of these relatives are not technically savvy and hate the idea of ...
6
votes
1answer
122 views

Is online security training effective?

I'm looking at an organization that requires that all employees undergo an annual one-hour online cybersecurity training (watch a video and take a quiz, apparently built using SANS's end-user security ...
7
votes
3answers
1k views

Out-of-the-box Network Intrusion Appliance for non-Power User

First, let me apologize if any of this question is naive or beneath the scope of this board. Bear in mind the context and that I'm asking as an attempt to exhaust all resources. Also, I understand if ...
18
votes
5answers
574 views

What are good ways to educate about IT security in a company?

I work in a company where security is a "fire once forget forever" concern. The administrator sets up a solution and seldom follow up and maintain it. As a result, we've got a security policy that's ...
5
votes
5answers
555 views

How can I explain self-signed certificates to users?

I don't trust certificate authorities, so I'm using a self-signed certificate on my server. The server provides both a website as well as other services. Most modern SSL-capable software, upon ...
2
votes
0answers
51 views

Can anyone predict the scope of security in the year 2030? [closed]

I'm just curious to know the scope of the future security in terms of compliance and cyber security. And also the way of technology growth in terms of speed, authentication and authorization and OS. ...
64
votes
8answers
7k views

Is forcing users to use a strong password effective?

I am designing a service that would, among other things, store sensitive information. To ensure no unauthorized access of this information, it would be encrypted with a key derived from their password ...
6
votes
8answers
471 views

What are the benefits of encryption for everyday people?

In addition to the fact that encryption systems like PGP are notoriously difficult to use, and that encryption doesn't always jive with cloud-based services like webmail, the fact is that most people ...
-1
votes
1answer
134 views

Interesting security demos for beginners [closed]

I am thinking about a creating short security demo to get people interested in the security topic. I've had a couple of ideas just want to see if anyone has anything else interesting. Edit: I was ...
27
votes
10answers
6k views

How to explain to a customer that spamfilters don't catch everything

I used to work in a small office which provided basic desktop support for users. One day I had to answer a call from a very angry customer and he asked for my boss. He wanted to know how could one ...
1
vote
2answers
2k views

To trust, or not to trust? Adding exceptions to the Trusted Certificates List in (firefox) Light

I recently installed the Light (a more compact forking of Firefox). I started getting the "This Connection is Untrusted" error, which got me wondering: when should I add an exception to the list of ...
6
votes
1answer
3k views

Why does every site makes me acknowledge cookie usage? [closed]

In the last year or so every other site on the net started showing different kinds of notification that they're using cookies and I should be aware of it. The sheer number of different sites doing ...
2
votes
1answer
470 views

Anti-phishing educational resources for users?

I'm am looking into conducting a phishing campaign to gauge how susceptible my workplace is to phishing attacks. Part of this will involve guiding "duped" users to materials or resources that will ...
6
votes
2answers
357 views

Where can I “hide” easter eggs for students learning about Linux security?

I feel like this isn't the best place to ask this (since there's no single right answer), but I can't think of a better place. If you have a better recommendation, could you please recommend it and I ...
11
votes
3answers
3k views

What Twitter #hashtags apply to IT Security

I'm trying to search twitter for evidence of near-realtime alerts or updates regarding security issues. What hashtags are common or popular in the IT Security world?
31
votes
6answers
7k views

Can malware be dangerous even when quarantined?

I am reading a book on network security and when talking about user confusion it writes: "It is not uncommon for a user to be asked security questions such as Is it safe to quarantine this ...
0
votes
2answers
91 views

Is “user education” actually doable?

I was going to ask about how to educate users, but now that I think about it, I first want to know if it's actually possible to do effectively at all. Are there any amazing success (or horrible ...
2
votes
2answers
150 views

Breach informing

I am a staff member of a large fanfic site, but not the head administrator with control over the site itself. Recently, we had a security breach and the databases were copied, which included the ...
0
votes
2answers
212 views

What college majors are suitable for a career in security? [closed]

I was recently asked by a friend of mine (outside the computer science field) if he can be successful in web-application pen-testing I took this as an excuse to ask a more comprehensive question. I ...
-1
votes
1answer
422 views

Security Awareness Training Ideas [closed]

Does anyone have any solid recommendations for deploying and maintaining security awareness training? I am not looking for a specific vendor but I am trying to gain insight about how the material is ...
20
votes
9answers
2k views

How to get top management support for security projects?

I am facing an issue regarding security projects, for example: last year we bought an antivirus licence for 500 (end point security), and made a policy in order to force everyone to install it, ...
11
votes
1answer
155 views

Why does Android mix phone state with phone identity?

The "Phone State" permission on Android is widely requested by many apps. The explanation often given by the developer is that the app needs it in order to determine when you're on the phone, to stop ...
10
votes
3answers
663 views

How can I promote good password practices in an organization that doesn't currently care about that?

I work with an organization that uses some very poor practices such as using default user accounts, default passwords (or passwords the same as user accounts), sharing password information between ...
3
votes
2answers
276 views

Building a web application security focused team

I work as an application architect at larger company that builds web applications using both .Net and Java technologies. These are sold to and accessed by other businesses (not consumers). We have ...
4
votes
8answers
854 views

Generate user a password instead of asking for one?

I'm trying to weigh the benefits of not allowing users to create their own passwords, but must pick out of a generated selection. Are there any examples of sites that use this approach? Workflow ...
33
votes
7answers
2k views

How do I educate others about social engineering?

One of my friends used to boast about how long his passwords are. One day, I decided to play a prank and social-engineered it out of him. I was pretty surprised as to how effortless the entire ...
7
votes
3answers
4k views

What is a pen tester?

I asked two pen testers what exactly it is that they do. One of them has told me that all he ever does is try to find exploits in the software in order to gain access to internal servers and nothing ...
6
votes
3answers
2k views

Self-teach pentesting/CEH skills ethically

I am a Software Engineer currently and have done quite a bit of systems work as well. I love the idea of Penetration Testing and would love to work towards becoming a pentester/Certified Ethical ...
34
votes
6answers
3k views

Teaching a loved one about secure coding practices

This might be far too narrow, but it is a unique problem to ITSec professionals. A loved one is just starting out in a new programming career and I get the joy of watching her learn the most basic ...
1
vote
2answers
92 views

Seeking security help as a non-technical manager [closed]

A friend in the business sector recently asked me for advice on "IT security in a large charity". Being a developer not specialized in security, I could see his difficulty in finding someone qualified ...
1
vote
2answers
181 views

What's a good tool or website to help learning about security? [closed]

I recall reading once online about a website that had a name that sounded Japanese (Matsz... something) with security problems for programmers to do and learn about different security issues. Does ...
8
votes
2answers
1k views

Gamification of IT security - any applications yet?

Gamification, which is the use of game design elements and game mechanics in a non-game context, is a heavily discussed topic. Looking at the behavioral impact on Gamification, it has potential in ...
1
vote
3answers
124 views

How to protect against an attack where a person claims to be in a position of authority?

In an office if a person approaches an employee and claims to be a new IT staff and to give them access to their computer, what can prevent this kind of attack? I've worked a couple tech support jobs ...
2
votes
3answers
197 views

Website URL to point users to in order to “make a point” about security [closed]

It is 'common knowledge' that unpatched, older browsers and operating systems are dangerous, but when I tell people that they should not do their online banking in IE 6 on a pirated XP service pack 0, ...
11
votes
1answer
2k views

How does an end user differentiate between OV and DV certificates?

This is a very good link that explains the different types of SSL certificates and level of trust provided by them. An Extended Validation (EV) certificate it is easily identified by the green color ...
11
votes
2answers
8k views

How to prepare for a career in Pen-Testing

I am currently a sophmore in Penn State's SRA:ICS program (Cyber Security) and IST:Dev program. My goal is that when I graduate I can become a Pen-Tester. I'm looking for advice on how to learn how to ...
2
votes
1answer
704 views

What is the cost of SSL encryption?

So, I've been looking over various websites that don't handle confidential information per se, but do accept user authentication tokens (i.e. you can create accounts with them and associate an e-mail/...
2
votes
3answers
491 views

Account lockout with human interaction required to unlock

I just got locked out yet again from my university's system for typing the wrong password twice, then mistyping the correct one by accident. Now I have to call the helpdesk or go there myself to reset ...
3
votes
4answers
992 views

Detecting and filtering data over AC power lines?

Given that it's possible for the average consumer to send covert signals over normal AC lines how can an IT department identify and filter out this communication? I'm not sure how difficult this is ...