Tag Info

Hot answers tagged

91

A small trick I learned years ago - lay your email out like this: Short Version Small number of very short succinct points If X, then you need to do this Else, then you need to do that (or don't need to do anything) Long Version or Full Details ...and here you lay out whatever full version you want. 97% of your users will never ...


73

The ANSSI, French government service in charge of IT security, has published a document providing brief advice to people having to travel abroad. Relevant here are the advisories concerning preparation before travel: Review the applicable company policy, Review destination country applicable laws, Prefer to use devices dedicated to travel (computers, ...


41

Using obscure applications is, as my phrasing suggests, a form of security through obscurity. Such reasoning is false, and only leads to a false sense of security. Obscurity is not security. Don't select your security-critical software based on how popular it is or isn't; select it based on the amount of analysis that has gone into the software, how quick ...


40

Here are my thoughts on this: Somebody could hide something--a flashdrive with malicious content, for example--in an unlocked drawer. An employee could find that flashdrive and plug it in to his computer, putting the computer at risk of compromise. Also, it's easier to modify the locks of unlocked drawers than it is to modify the locks of locked drawers. ...


36

The question could also be asked: "how long should an employee have access to data before they are trained in how to use and protect that data?" For most organizations, the answer is "0 minutes". You wouldn't place an employee in front of machinery without training them, and you shouldn't place employees in front of a computer without training either. Each ...


30

Clean desks policies are rather literal in the sense they don't mean that the papers on your desk need to be organized...They mean that you're not allowed to have papers on your desk at all. So, no papers left unlocked on a desk mean no papers with sensitive information for others to trawl through after hours. Sensitive data doesn't only include ...


30

Trevor Paglen's book about USA Department of Defense secrecy, Blank Spots on the Map, has an illuminating incident. During the Manhattan Project, a Los Alamos physicist got in trouble for leaving an orange on his desk after lunch. The Manhattan Project security people had a policy against leaving spherical objects out in the open, probably because the atom ...


19

As @gowenfawr says many users will not read messages no matter what you do. So, in cases when you need to guarantee that the message was delivered to the brain and not only inbox, or acted upon, what you need is a feedback mechanism. This can be simple, using social approach - for example asking users an essentially fake question while providing ...


17

None of the reasons you've given are valid reasons for escrowing your password. There's only a couple valid reasons for escrowing any sort of "authenticator" information. A couple others have touched on these, but I'll try to clarify a bit. Encryption Keys: It makes absolute sense for the organization to have access to escrow copies of your encryption ...


17

IMHO it is doing the un-sexy things consistently that will provide you the best defences against even targeted attacks and "APT's". As I wrote when RSA provided details of their advanced attack good lessons learnt are: Email as a malware distribution mechanism is not dead. Dig out those user awareness presentations and add some training on spear phishing ...


17

A useful and practical guide to securing information devices when crossing borders is provided by the Canadian Bar Association here. I would not say the U.S. border is the only one of concern, others such as China might eventually become similarly aggressive (though I've seen little sign of that to date). The guide echos many of the points made in other ...


16

The best way to protect against that type of border search is actually not to have anything suspicious on the hardware you take through the custom. Using encryption technology will most likely raise suspicion in the first place. Refusing to provide the necessary codes can, in some places, leads to the hardware being confiscated or even to you being ...


16

Do it as part of new employee orientation and follow up with more training at regular intervals. Security policy is part of our new employee orientation. We also require a short online "securing the human" training to be completed once every other year. Introduction of this regular training has had noticable positive results.


15

An admin should never have "super user credentials" that cannot be removed by simply removing his user account or move the user account to a group that lacks the permission. An example: The admin logs in to a Linux system with his own account and uses sudo somecommand to do things that requires root permission. You don't allow this admin user to actually ...


14

I'm also a developer, and my passion for security often makes the dynamic a little unusual when dealing with other non-security-focused developers. There are three main areas of constraint when it comes to security policy: Usability: Making sure that the user can actually use the software, and that they don't get overly irritated or delayed by security ...


13

I consider myself to have high technical skills, and usually find myself skimming or simply ignoring these kind of messages myself. However, I was installing a Google product recently that had the following header: Please read this carefully - It's not just the usual yada yada. Because of the light hearted nature of this, I found myself to read the docs ...


13

@Polynomial makes very good points regarding "security through obscurity" and you definitely shouldn't secure yourself based on "obscurity" because it has proven not to work. However, I don't believe that the answer to your question is that simple - I think your question is more of a "risk reduction" question but could be wrong. Quite often in the security ...


13

Full disk encryption is the most common one used. The cost would depend on the time which needs to be implemented by the IT department ontop of normal laptop staging. However in my experience FDE is a must for any organization taking its security serious. Aside from that there are also some really anti-forensic tools, I remember a talk at Brucon where one ...


12

This is far-fetched, but non-obvious information leaks: 1. We must keep empty drawers locked If someone knows that there is a regular meeting discussing secret project X every Tuesday and Friday; and noticed that the drawers are always empty and unlocked on Tuesday and Friday, but locked otherwise, then it's pretty clear indication that the content of ...


12

This may be seen more as a template than a policy, but I think it's worth mentioning here. The U.S. National Institute of Standards and Technology has a number of Special Publications (SPs) regarding the security of information systems. These are collectively called the 800 series, as all of them have numeric designations beginning with 800. They are used ...


12

It depends. If all reasonably functional alternatives are fundamentally prone to programming errors, like it is the case with browsers, it is probably a good idea to use a not-so-popular one. In particular, if your threat model does not include sophisticated adversaries that wait, observe and develop attacks specifically for your setup, using the ...


12

@ChrisAD From personal experience: Key prerequisite is an effective asset register. Otherwise you wont even know if it is one of your laptops / pc's that is missing or that turns up on the front page of the daily mail (well ok they may help in letting you know it was your device!). Secondly - Establish a clear requirement and ability for your staff to ...


12

I have two solutions. Both require Full Disk Encryption (FDE). First Solution Credit to Bruce Schneier. Just before leaving home, create a second key. Type it with your forehead, a cat or dog, just so it's random and not possible to remember. Send the second key to a trusted person, preferably someone with a privileged relationship, i.e. lawyer, ...


11

There are all sorts of security risks - the ones I tend to highlight are: The big social networking sites are a wonderful target for attackers. Imagine a group of over a billion users, most of whom are not technically savvy, that all use the same web app (eg Facebook) and have personal data, links to others etc. So take it as read that these sites are ...


11

Defending against targeted attacks compels the defenders to boost observation capabilities. Strengthening defensive gaps is great (e.g. accelerating patch deployment, whitelisting apps end-users can run, providing throw-away virtual machines, enhancing the security hardening of client-side apps), but since all prevention tools are expected to fail in time ...


11

Some points that come to my mind: Be concise and precise. Too long messages are usually dropped. Categorise message using the topic : maintenance, notice, important. And make the topic clear (but short). If possible, configure the email client to colourise email headers by default. With a consistent set of rules you can get more attention. Make important ...


11

One point is to only send out emails when it is important and critical that they be read - don't use them for normal newsletters or boring info - users will learn to ignore them very quickly. For general security awareness, use different mechanisms every time, and make it interesting, worth their while or if those fail: mandatory, along with annual signoff ...


11

What you are pointing is the difference between imposing security rules to people and involving people to get better security. Chances are that you will find this video quite interesting. After a walk through issues quite similar to the one you mention, the presenter (Jayson E. Street to name him) ends up by talking about positive enforcement. It makes the ...


10

Paradoxically, the first responsibility of the security training is to show why the security training is important, interesting to you (the employee), and relevant (for your work). Any training (at least the first-time awareness trainings) must start with this, or at least lead up to it very quickly, otherwise its pointless. Though it seems from your WTF ...



Only top voted, non community-wiki answers of a minimum length are eligible