Tag Info

Hot answers tagged

83

A small trick I learned years ago - lay your email out like this: Short Version Small number of very short succinct points If X, then you need to do this Else, then you need to do that (or don't need to do anything) Long Version or Full Details ...and here you lay out whatever full version you want. 97% of your users will never ...


25

Consider the usual risk management statement: Don't spend 1000$ to protect 100$ Now, it might just be a situation that the execs are not aware that what they want will cost 1000$; more likely that they just don't realize that they're only protecting 100$ worth. If that is the case, you could consider trying to implement methodology that will ...


19

As @gowenfawr says many users will not read messages no matter what you do. So, in cases when you need to guarantee that the message was delivered to the brain and not only inbox, or acted upon, what you need is a feedback mechanism. This can be simple, using social approach - for example asking users an essentially fake question while providing ...


19

I see two sides on this: most government bodies I review/audit tend to believe that because they secure everything then they are the most secure and that is the way it should be! In actuality the organisations that go down the security nazi route usually end up more open than those who are pragmatic about it. For example, locking down your users too hard ...


15

Yes, I think it's possible to be too paranoid. Although, also, I just finished talking security with a bunch of performing artists - people with no money who really need to spend their time promoting their work and creating new work... not building the Fort Knox of security just so they can use Facebook. They need common sense, a basic understanding of ...


13

As I commented originally in the other question, Security cannot be the primary, or even a principle concern. Sometimes, during certain phases of the startup, you really need to focus on rapidly developing the features needed to drive the product, and patch security as necessary. Security can easily get in the way of operations, employee productivity, and ...


12

I'm sure there's many processes - the general term to search for is 'risk analysis' or 'risk assessment'. The process I'm most familiar with is what's advocated by NIST. Generally, the NIST process : what is your system - what counts as part of your system and not part of your system what are your threats? what groups or people, what are they after, ...


12

I consider myself to have high technical skills, and usually find myself skimming or simply ignoring these kind of messages myself. However, I was installing a Google product recently that had the following header: Please read this carefully - It's not just the usual yada yada. Because of the light hearted nature of this, I found myself to read the docs ...


12

Is there a strong challenge to be made against delaying security? No, I don't think so. Unless the industry is regulated by laws. That's why information security is sometimes similar to risk management. You minimize the risk the best you can (that usually means within budget), you don't totally eliminate it. So, delaying security is a form of accepting ...


11

Loss of revenue is the only threat you really need to talk about with business people. Frame the issue in terms of money and emphasize that money will be lost if security is not given a high priority. Explain that money can be lost in the following ways: Lawsuits due to disclosing sensitive user information. Bad publicity, which damages the brand, which, ...


11

Some points that come to my mind: Be concise and precise. Too long messages are usually dropped. Categorise message using the topic : maintenance, notice, important. And make the topic clear (but short). If possible, configure the email client to colourise email headers by default. With a consistent set of rules you can get more attention. Make important ...


11

One point is to only send out emails when it is important and critical that they be read - don't use them for normal newsletters or boring info - users will learn to ignore them very quickly. For general security awareness, use different mechanisms every time, and make it interesting, worth their while or if those fail: mandatory, along with annual signoff ...


10

If you're not familiar with it, FAIR (a quantitative risk framework) should give an organization the tools to do this. From the website: Factor Analysis of Information Risk (FAIR) provides a framework for understanding, analyzing, and measuring information risk. The outcomes are more cost-effective information risk management, greater credibility for ...


10

Both answers above are bang on the money, but I'd just like to add the following caveat. I run a regulatory services company and I got us certified to ISO 27001. The one thing I would communicate to anybody thinking of becoming certified is to remember that being certified to a standard is not like acquiring a magic talisman that wards off all evil (and ...


10

If you read Schneier, you'll be familiar with one of the basic premises of "smart" security that he also pushes a lot: Security is a Trade-off. It simply does not make sense to go full metal paranoid on your systems, since security can NEVER be 100% anyway (we used to be told the only way to be 100% is to unplug the computer... now we know that's ...


10

I agree with the executive. If you look at the number of startups that have failed due to a security breach, vs the number of startups that have failed due to losing the race to be first, I think it's clear that the latter vastly outweigh the former. Startups are all about taking risks to get to the big win. There are so many ways that a startup can fail. ...


9

No matter what size the business, in my experience the only three ways to get a provider to move on this are: Financial: Tell them you'll take your business elsewhere - I understand this isn't possible here. Regulatory: If they are dealing with personal information they must provide appropriate protection in most jurisdictions (eg DPA in the UK - so the ...


9

I recently came across this article written by Ross Anderson. Apart from pointing out to your colleagues how quickly bad passwords can be broken, it is worth noting that their research showed some benefits in just reminding people some good rules for passwords and having a basic induction into password choice. ...


9

Parasites will not only ruin your potential revenue streams for products/services, but they will also ruin your early-on brand/reputation, and destroy your ability to market your products/services. They will break your SEO, AdWords, and similar Internet marketing concepts -- which are necessary to build your online presence. Adversaries automate parasitic ...


9

If you want an analogy, read this. As for the list of vulnerabilities: Emails can be sniffed in transit, since they are not encrypted (some sites will opportunistically employ encryption for transit, but this is not reliably activated). Emails will be stored on physical disks in the servers which are involved in the operation: the sender's email server, ...


8

Sometimes things must fail and this sounds like one of those times. As I read your situation you are in charge of securing a troubled project with both subordinates and superiors chasing down a rabbit hole of perfection. So this is in many ways a ‘lanes in the road’ issue. Senior management has chosen to be fascinated by unrealistic plans by your staff ...


8

Switches are not meant for security. A switch differs from a hub in that it observes packets to deduce where each host is, so that a packet aimed at a given host will be written only on the physical cable leading to that host. This is a performance optimization in that it allows more traffic to happen concurrently on a given network. The side-effect of ...


7

Threat Modeling is really a skill, based on experience, after learning what works and what doesn't. I don't think a choice of framework will make things much easier for you, you will still have the same issues and difficulties that you have now. On the contrary, I would recommend STRIDE-per-element as the better place to start, and later add in ...


7

According to McAfee Labs Threat Predictions for 2011: Exploiting Social Media: URL-shortening services Social media sites such as Twitter and Facebook have created the movement toward an “instant” form of communication, a shift that will completely alter the threat landscape in 2011. Of the social media sites that will be most riddled with cybercriminal ...


7

I think you can't look at just one mail message. Having watched our IT and ITSEC groups evolve over the years, I've noticed that the common perception of them has to do with the overall body of emails they put out, nothing gets fixed with just a few great emails. Here's some overall thoughts: don't use just one communication medium - I know you want to ...


6

I suggest reading Krag Brotby's Information Security Management Metrics book for coverage of most of the relevant risk analysis frameworks that are usually tailored to a specific kind of risk (e.g. financial analysis for information security management programs or risk management programs could use ROSI, ALE/SLE, VAR, cost-effectiveness, etc). I also ...


6

You'll want to look at the Data Protection Act (or its equivalent in your jurisdiction) as it lays out guidelines for the protection of sensitive personal data, which includes medical data. The wording in it, and in similar documents, is quite woolly - using phrases like "appropriate protection" - which isn't helpful, but basically it aims to push ...


6

A business upside here is that if I am the security expert hired in, someone senior will have agreed my budget, and that already gives me some traction. That aside, every security decision should really be based on a business risk decision and with the best will in the world IT should have little to do with that decision, aside from being able to detail the ...


6

Lol. The first thing is to realize that users will generally ignore all your emails. Stop imagining that this problem can be solved. Certainly, there are things you can do in order to make your emails read by MORE users. No, HTML messages are not better. Studies have shown that users pay more attention to text messages and HTML pages. The shorter the ...


6

Observations: Some users may understand that your message is important but still "leave it for later", or think that it's a good reference but put it aside for a time that "something bad happens" (it happens a lot with our awareness messages). I also had to face the insistence of middle level managers that all messages addressed internally to the ...



Only top voted, non community-wiki answers of a minimum length are eligible