Hot answers tagged

92

A small trick I learned years ago - lay your email out like this: Short Version Small number of very short succinct points If X, then you need to do this Else, then you need to do that (or don't need to do anything) Long Version or Full Details ...and here you lay out whatever full version you want. 97% of your users will never ...


77

My advice would be to remove the secrets from the drop-box and store them elsewhere. Your instructions have to be easily human readable by anyone, but they can include instructions on how to get access to the properly secured part of the data. That lets you separate the accessibility side of things from the security side. Once you can think about security ...


72

Get a USB device. Put all secrets on the USB, preferably in a KeePass file. In the documentation, tell the new person where the USB is and how to unlock it, but put the device in a secure physical location like the owner's office, the company safe, a secure deposit box, etc. Somewhere out of the reach of the public, and away from the prying eyes of other ...


40

You would never ignore a threat, and perhaps that is semantics over your wording. You either accept, mitigate, or outsource the risk for the given threat. In this case, that would be: accept that there will be a $X loss, mitigate fix DRM or find DRM alternate to protect the product, or outsource using insurance or place the risk on someone else in the ...


28

Create 'emergency use only' accounts For most systems, you will have some kind of privileged accounts that are used in their everyday administration, those may or may not be personalized depending on your organization policy. As for any credentials, you may lose access to them for various reasons - either by the person knowing them getting hit by a bus, or ...


25

Consider the usual risk management statement: Don't spend 1000$ to protect 100$ Now, it might just be a situation that the execs are not aware that what they want will cost 1000$; more likely that they just don't realize that they're only protecting 100$ worth. If that is the case, you could consider trying to implement methodology that will ...


23

I see two sides on this: most government bodies I review/audit tend to believe that because they secure everything then they are the most secure and that is the way it should be! In actuality the organisations that go down the security nazi route usually end up more open than those who are pragmatic about it. For example, locking down your users too hard ...


19

As @gowenfawr says many users will not read messages no matter what you do. So, in cases when you need to guarantee that the message was delivered to the brain and not only inbox, or acted upon, what you need is a feedback mechanism. This can be simple, using social approach - for example asking users an essentially fake question while providing ...


17

Yes, I think it's possible to be too paranoid. Although, also, I just finished talking security with a bunch of performing artists - people with no money who really need to spend their time promoting their work and creating new work... not building the Fort Knox of security just so they can use Facebook. They need common sense, a basic understanding of ...


14

As I commented originally in the other question, Security cannot be the primary, or even a principle concern. Sometimes, during certain phases of the startup, you really need to focus on rapidly developing the features needed to drive the product, and patch security as necessary. Security can easily get in the way of operations, employee productivity, and ...


14

TL;DR: NO (but we should define what "ignoring" means; from the text of the question I suspect we're actually of the same opinion). You do not "ignore" a threat. The ancient saw says that you do not fear a threat that you cannot avoid - stultum est timere quod vitare non potes, since fear will avail you nothing. But few threats are completely unavoidable ...


13

Is there a strong challenge to be made against delaying security? No, I don't think so. Unless the industry is regulated by laws. That's why information security is sometimes similar to risk management. You minimize the risk the best you can (that usually means within budget), you don't totally eliminate it. So, delaying security is a form of accepting ...


13

I consider myself to have high technical skills, and usually find myself skimming or simply ignoring these kind of messages myself. However, I was installing a Google product recently that had the following header: Please read this carefully - It's not just the usual yada yada. Because of the light hearted nature of this, I found myself to read the docs ...


12

I'm sure there's many processes - the general term to search for is 'risk analysis' or 'risk assessment'. The process I'm most familiar with is what's advocated by NIST. Generally, the NIST process : what is your system - what counts as part of your system and not part of your system what are your threats? what groups or people, what are they after, ...


11

Loss of revenue is the only threat you really need to talk about with business people. Frame the issue in terms of money and emphasize that money will be lost if security is not given a high priority. Explain that money can be lost in the following ways: Lawsuits due to disclosing sensitive user information. Bad publicity, which damages the brand, which, ...


11

Threat Modeling is really a skill, based on experience, after learning what works and what doesn't. I don't think a choice of framework will make things much easier for you, you will still have the same issues and difficulties that you have now. On the contrary, I would recommend STRIDE-per-element as the better place to start, and later add in ...


11

Some points that come to my mind: Be concise and precise. Too long messages are usually dropped. Categorise message using the topic : maintenance, notice, important. And make the topic clear (but short). If possible, configure the email client to colourise email headers by default. With a consistent set of rules you can get more attention. Make important ...


11

One point is to only send out emails when it is important and critical that they be read - don't use them for normal newsletters or boring info - users will learn to ignore them very quickly. For general security awareness, use different mechanisms every time, and make it interesting, worth their while or if those fail: mandatory, along with annual signoff ...


10

Both answers above are bang on the money, but I'd just like to add the following caveat. I run a regulatory services company and I got us certified to ISO 27001. The one thing I would communicate to anybody thinking of becoming certified is to remember that being certified to a standard is not like acquiring a magic talisman that wards off all evil (and ...


10

If you read Schneier, you'll be familiar with one of the basic premises of "smart" security that he also pushes a lot: Security is a Trade-off. It simply does not make sense to go full metal paranoid on your systems, since security can NEVER be 100% anyway (we used to be told the only way to be 100% is to unplug the computer... now we know that's ...


10

If you're not familiar with it, FAIR (a quantitative risk framework) should give an organization the tools to do this. From the website: Factor Analysis of Information Risk (FAIR) provides a framework for understanding, analyzing, and measuring information risk. The outcomes are more cost-effective information risk management, greater credibility for ...


10

I agree with the executive. If you look at the number of startups that have failed due to a security breach, vs the number of startups that have failed due to losing the race to be first, I think it's clear that the latter vastly outweigh the former. Startups are all about taking risks to get to the big win. There are so many ways that a startup can fail. ...


10

If you want an analogy, read this. As for the list of vulnerabilities: Emails can be sniffed in transit, since they are not encrypted (some sites will opportunistically employ encryption for transit, but this is not reliably activated). Emails will be stored on physical disks in the servers which are involved in the operation: the sender's email server, ...


10

Maybe a better solution to your situation is to design the system such that even if you are hit by a bus, and your credentials are lost forever, nothing bad happens. Perhaps it's best to think of the problem as two problems, authentication and authorization. Authentication establishes that you are who you claim to be. Some system can know that a request it ...


10

There are four basic strategies to control risks: Avoidance: Applying safeguards that eliminate or reduce the remaining uncontrolled risks for the vulnerability Transference: Shifting the risk to other areas or to outside entities Mitigation: Reducing the impact if the vulnerability is exploited Acceptance: Understanding the consequences and accepting the ...


9

No matter what size the business, in my experience the only three ways to get a provider to move on this are: Financial: Tell them you'll take your business elsewhere - I understand this isn't possible here. Regulatory: If they are dealing with personal information they must provide appropriate protection in most jurisdictions (eg DPA in the UK - so the ...


9

Parasites will not only ruin your potential revenue streams for products/services, but they will also ruin your early-on brand/reputation, and destroy your ability to market your products/services. They will break your SEO, AdWords, and similar Internet marketing concepts -- which are necessary to build your online presence. Adversaries automate parasitic ...


9

I recently came across this article written by Ross Anderson. Apart from pointing out to your colleagues how quickly bad passwords can be broken, it is worth noting that their research showed some benefits in just reminding people some good rules for passwords and having a basic induction into password choice. http://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-...


8

Sometimes things must fail and this sounds like one of those times. As I read your situation you are in charge of securing a troubled project with both subordinates and superiors chasing down a rabbit hole of perfection. So this is in many ways a ‘lanes in the road’ issue. Senior management has chosen to be fascinated by unrealistic plans by your staff ...


8

Switches are not meant for security. A switch differs from a hub in that it observes packets to deduce where each host is, so that a packet aimed at a given host will be written only on the physical cable leading to that host. This is a performance optimization in that it allows more traffic to happen concurrently on a given network. The side-effect of ...



Only top voted, non community-wiki answers of a minimum length are eligible