Education aimed at helping users meet their security-related responsibilities.
48
votes
10answers
4k views
How do you explain the necessity of “nuke it from orbit” to management and users?
When a machine has been infected with malware, most of us here immediately identify the appropriate action as "nuke it from orbit" - i.e. wipe the system and start over. Unfortunately, this is often ...
10
votes
6answers
643 views
What are a few good lists of threats to use to kick-off conversations with others about what worries them?
To effectively communicate with business owners or executives on security, specifically with how people may harm their business, it often helps to discuss what types of people worry them. What are ...
11
votes
2answers
603 views
If you have to write an information security guide for non technical users, what would you cover?
Inspired by a question I saw on Twitter:
As the title says, what items would you include? And to what depth?
Are there obvious topics everyone should be thinking of, or is it important to advise on ...
42
votes
15answers
2k views
Why do law-abiding citizens need strong security?
The layman's counter-argument I run in to for any complaint about inadequate security seems to always take the form:
You don't need security if you aren't doing something illegal.
This kind of ...
11
votes
5answers
363 views
How can I keep my programmer collegues informed about security issues?
I am currently finishing a college degree in programming and I find that security topics are often barely understood by both students and teachers. It leads me to think that there are a lot of ...
10
votes
4answers
484 views
How to define security requirements to ensure that developers… do not provide security by obscurity?
I tried to explain that security by obscurity should not be used but let's say I was challenged!
I received the answer to list the known security by obscurity that I know, as a kind of bad practice ...
17
votes
6answers
380 views
What policies maximize employee buy-in to security?
Security awareness training is a bane to most employees.
A favorite anecdote I have is a group of employees figuring out how to quickly complete their online security awareness training from ...
31
votes
8answers
2k views
Should I bother teaching buffer overflows any more?
The students are skeptical that turning off non-executable stacks, turning off canaries and turning off ASLR represents a realistic environment. If PaX, DEP, W^X, etc., are effective at stopping ...
14
votes
5answers
349 views
What are good ways to educate about IT security in a company?
I work in a company where security is a "fire once forget forever" concern. The administrator sets up a solution and seldom follow up and maintain it. As a result, we've got a security policy that's ...
11
votes
3answers
683 views
Why does one need a high level of privacy/anonymity for legal activities?
This question is sort-of spun off of a previous one.
How to counter the statement: "You don't need (strong) security if you're not doing anything illegal"?
There are a lot of great ...
3
votes
7answers
233 views
Generate user a password instead of asking for one?
I'm trying to weigh the benefits of not allowing users to create their own passwords, but must pick out of a generated selection. Are there any examples of sites that have do use this approach?
...
3
votes
1answer
80 views
How does an end user differentiate between OV and DV certificates?
This is a very good link that explains the different types of SSL certificates and level of trust provided by them. An Extended Validation (EV) certificate it is easily identified by the green color ...
2
votes
4answers
216 views
Detecting and filtering data over AC power lines?
Given that it's possible for the average consumer to send covert signals over normal AC lines how can an IT department identify and filter out this communication?
I'm not sure how difficult this is ...
