Education aimed at helping users meet their security-related responsibilities.

learn more… | top users | synonyms

64
votes
10answers
5k views

How do you explain the necessity of “nuke it from orbit” to management and users?

When a machine has been infected with malware, most of us here immediately identify the appropriate action as "nuke it from orbit" - i.e. wipe the system and start over. Unfortunately, this is often ...
3
votes
1answer
264 views

How does an end user differentiate between OV and DV certificates?

This is a very good link that explains the different types of SSL certificates and level of trust provided by them. An Extended Validation (EV) certificate it is easily identified by the green color ...
51
votes
15answers
2k views

Why do law-abiding citizens need strong security?

The layman's counter-argument I run in to for any complaint about inadequate security seems to always take the form: You don't need security if you aren't doing something illegal. This kind of ...
32
votes
7answers
2k views

Why does one need a high level of privacy/anonymity for legal activities?

This question is sort-of spun off of a previous one. How to counter the statement: "You don't need (strong) security if you're not doing anything illegal"? There are a lot of great ...
14
votes
6answers
854 views

What are a few good lists of threats to use to kick-off conversations with others about what worries them?

To effectively communicate with business owners or executives on security, specifically with how people may harm their business, it often helps to discuss what types of people worry them. What are ...
15
votes
2answers
1k views

If you have to write an information security guide for non technical users, what would you cover?

Inspired by a question I saw on Twitter: As the title says, what items would you include? And to what depth? Are there obvious topics everyone should be thinking of, or is it important to advise on ...
13
votes
5answers
403 views

How can I keep my programmer collegues informed about security issues?

I am currently finishing a college degree in programming and I find that security topics are often barely understood by both students and teachers. It leads me to think that there are a lot of ...
10
votes
4answers
590 views

How to define security requirements to ensure that developers… do not provide security by obscurity?

I tried to explain that security by obscurity should not be used but let's say I was challenged! I received the answer to list the known security by obscurity that I know, as a kind of bad practice ...
17
votes
6answers
458 views

What policies maximize employee buy-in to security?

Security awareness training is a bane to most employees. A favorite anecdote I have is a group of employees figuring out how to quickly complete their online security awareness training from ...
8
votes
2answers
2k views

How to prepare for a career in Pen-Testing

I am currently a sophmore in Penn State's SRA:ICS program (Cyber Security) and IST:Dev program. My goal is that when I graduate I can become a Pen-Tester. I'm looking for advice on how to learn how to ...
34
votes
8answers
3k views

Should I bother teaching buffer overflows any more?

The students are skeptical that turning off non-executable stacks, turning off canaries and turning off ASLR represents a realistic environment. If PaX, DEP, W^X, etc., are effective at stopping ...
28
votes
7answers
1k views

How do I educate others about social engineering?

One of my friends used to boast about how long his passwords are. One day, I decided to play a prank and social-engineered it out of him. I was pretty surprised as to how effortless the entire ...
17
votes
5answers
391 views

What are good ways to educate about IT security in a company?

I work in a company where security is a "fire once forget forever" concern. The administrator sets up a solution and seldom follow up and maintain it. As a result, we've got a security policy that's ...
3
votes
8answers
391 views

Generate user a password instead of asking for one?

I'm trying to weigh the benefits of not allowing users to create their own passwords, but must pick out of a generated selection. Are there any examples of sites that use this approach? Workflow ...
0
votes
3answers
363 views

What is social engineering, how does it relate to security and how can it affect my business? [duplicate]

Possible Duplicate: Is social-engineering an actual threat What is social engineering? Can you give me some examples? Can social engineering have a big impact on business?
3
votes
2answers
536 views

Ideas to build security awareness

It has been claimed that "the weakest factor in security is the humans". Unfortunately this is a weak link we cannot cut away so we have to deal with it. I need ideas to help build inherently ...
2
votes
4answers
385 views

Detecting and filtering data over AC power lines?

Given that it's possible for the average consumer to send covert signals over normal AC lines how can an IT department identify and filter out this communication? I'm not sure how difficult this is ...