Education aimed at helping users meet their security-related responsibilities.
48
votes
10answers
4k views
How do you explain the necessity of “nuke it from orbit” to management and users?
When a machine has been infected with malware, most of us here immediately identify the appropriate action as "nuke it from orbit" - i.e. wipe the system and start over. Unfortunately, this is often ...
42
votes
15answers
2k views
Why do law-abiding citizens need strong security?
The layman's counter-argument I run in to for any complaint about inadequate security seems to always take the form:
You don't need security if you aren't doing something illegal.
This kind of ...
31
votes
8answers
2k views
Should I bother teaching buffer overflows any more?
The students are skeptical that turning off non-executable stacks, turning off canaries and turning off ASLR represents a realistic environment. If PaX, DEP, W^X, etc., are effective at stopping ...
29
votes
6answers
2k views
Teaching a loved one about secure coding practices
This might be far too narrow, but it is a unique problem to ITSec professionals. A loved one is just starting out in a new programming career and I get the joy of watching her learn the most basic ...
17
votes
6answers
380 views
What policies maximize employee buy-in to security?
Security awareness training is a bane to most employees.
A favorite anecdote I have is a group of employees figuring out how to quickly complete their online security awareness training from ...
14
votes
5answers
349 views
What are good ways to educate about IT security in a company?
I work in a company where security is a "fire once forget forever" concern. The administrator sets up a solution and seldom follow up and maintain it. As a result, we've got a security policy that's ...
11
votes
5answers
363 views
How can I keep my programmer collegues informed about security issues?
I am currently finishing a college degree in programming and I find that security topics are often barely understood by both students and teachers. It leads me to think that there are a lot of ...
11
votes
3answers
683 views
Why does one need a high level of privacy/anonymity for legal activities?
This question is sort-of spun off of a previous one.
How to counter the statement: "You don't need (strong) security if you're not doing anything illegal"?
There are a lot of great ...
11
votes
2answers
604 views
If you have to write an information security guide for non technical users, what would you cover?
Inspired by a question I saw on Twitter:
As the title says, what items would you include? And to what depth?
Are there obvious topics everyone should be thinking of, or is it important to advise on ...
10
votes
6answers
643 views
What are a few good lists of threats to use to kick-off conversations with others about what worries them?
To effectively communicate with business owners or executives on security, specifically with how people may harm their business, it often helps to discuss what types of people worry them. What are ...
10
votes
4answers
484 views
How to define security requirements to ensure that developers… do not provide security by obscurity?
I tried to explain that security by obscurity should not be used but let's say I was challenged!
I received the answer to list the known security by obscurity that I know, as a kind of bad practice ...
8
votes
6answers
416 views
Doing a demo about open wireless networks exploiting with Firesheep
A collegue and I have been asked to do a demo where we show off stealing Facebook sessions with Firesheep. I've never used Firesheep before myself, but I reckon it should be a simple task.
I know the ...
8
votes
3answers
420 views
What are a few good analogies to describe the benefits of a strong security program?
Given communication is king, what are some of the favorite analogies you like to use to describe the benefits of security to organizations needing security but new to security?
7
votes
5answers
423 views
How can we get into the user's mindset?
As security folk, we tend to over- or under-estimate the capabilities and educatedness of our users, especially in terms of resistance to social engineering attacks.
Stereotypically, this is due to ...
7
votes
7answers
469 views
What are the best reasons you've heard for not implementing security?
We can devise the best technical solution to a security problem, but that solution needs to be applied by people, by a business, to an organization, and/or in spite of objections.
The barriers ...
7
votes
3answers
154 views
What is the state of Security in Comp Sci Programs
In a previous question (How can I keep my programmer collegue informed about security issues ?) there was a statement:
"...and I realise that security topics are often barely known from both the ...
6
votes
1answer
437 views
What Twitter #hashtags apply to IT Security
I'm trying to search twitter for evidence of near-realtime alerts or updates regarding security issues.
What hashtags are common or popular in the IT Security world?
6
votes
2answers
706 views
How to prepare for a career in Pen-Testing
I am currently a sophmore in Penn State's SRA:ICS program (Cyber Security) and IST:Dev program. My goal is that when I graduate I can become a Pen-Tester. I'm looking for advice on how to learn how to ...
3
votes
7answers
233 views
Generate user a password instead of asking for one?
I'm trying to weigh the benefits of not allowing users to create their own passwords, but must pick out of a generated selection. Are there any examples of sites that have do use this approach?
...
3
votes
5answers
151 views
What is a good way to demonstrate the insecurity of common bad practices?
A friend of mine teaches a "Basic IT Security" class at a .edu and asked what demonstrations he can do, live, to show why certain practices are bad.
Currently, we have cobbled together a Firesheep ...
3
votes
2answers
252 views
Ideas to build security awareness
It has been claimed that "the weakest factor in security is the humans". Unfortunately this is a weak link we cannot cut away so we have to deal with it.
I need ideas to help build inherently ...
3
votes
1answer
80 views
How does an end user differentiate between OV and DV certificates?
This is a very good link that explains the different types of SSL certificates and level of trust provided by them. An Extended Validation (EV) certificate it is easily identified by the green color ...
2
votes
4answers
216 views
Detecting and filtering data over AC power lines?
Given that it's possible for the average consumer to send covert signals over normal AC lines how can an IT department identify and filter out this communication?
I'm not sure how difficult this is ...
2
votes
3answers
188 views
Account lockout with human interaction required to unlock
I just got locked out yet again from my university's system for typing the wrong password twice, then mistyping the correct one by accident. Now I have to call the helpdesk or go there myself to reset ...
2
votes
1answer
130 views
What is the cost of SSL encryption?
So, I've been looking over various websites that don't handle confidential information per se, but do accept user authentication tokens (i.e. you can create accounts with them and associate an ...
2
votes
2answers
391 views
Looking for a presentation about information security for corporate employees
I'd appreciate if you could recommend me a presentation the describes the dangers and possible solutions and guidelines, when using the Internet. Specifically, in corporate settings. I would need to ...
2
votes
1answer
156 views
CIS vs CS for Information Systems Security?
I would like to know which degree out of these two would better prepare me for Information Systems Security. I want to eventually work with the CIA as a Information Systems security specialist however ...
1
vote
2answers
117 views
How to educate users about the dangers of social engineering?
What would be the best way to teach and test employees on the topic of social engineering?
What topics would you include?
0
votes
3answers
235 views
What is social engineering, how does it relate to security and how can it affect my business? [duplicate]
Possible Duplicate:
Is social-engineering an actual threat
What is social engineering? Can you give me some examples?
Can social engineering have a big impact on business?
-2
votes
1answer
72 views
Is SE a bigger threat than breaking-and-entering or other threats? [closed]
Thinking about this week's topic I thought of something I would love to hear more about:
What is so special about Social Engineering? Is SE a bigger threat than breaking-and-entering?
This is not ...
