Tag Info

Hot answers tagged

84

A small trick I learned years ago - lay your email out like this: Short Version Small number of very short succinct points If X, then you need to do this Else, then you need to do that (or don't need to do anything) Long Version or Full Details ...and here you lay out whatever full version you want. 97% of your users will never ...


40

Using obscure applications is, as my phrasing suggests, a form of security through obscurity. Such reasoning is false, and only leads to a false sense of security. Obscurity is not security. Don't select your security-critical software based on how popular it is or isn't; select it based on the amount of analysis that has gone into the software, how quick ...


39

Here are my thoughts on this: Somebody could hide something--a flashdrive with malicious content, for example--in an unlocked drawer. An employee could find that flashdrive and plug it in to his computer, putting the computer at risk of compromise. Also, it's easier to modify the locks of unlocked drawers than it is to modify the locks of locked drawers. ...


29

Clean desks policies are quite literal. They don't mean that the papers on your desk need to be organized...They mean that you're not allowed to have papers on your desk at all. So, no papers left unlocked on a desk mean no papers with sensitive information for others to trawl through after hours. Sensitive data doesn't only include password. ...


28

Trevor Paglen's book about USA Department of Defense secrecy Blank Spots on the Map has an illuminating incident. During the Manhattan Project, a Los Alamos physicist got in trouble for leaving an orange on his desk after lunch. The Manhattan Project security people had a policy against leaving spherical objects out in the open, probably because the atom ...


19

As @gowenfawr says many users will not read messages no matter what you do. So, in cases when you need to guarantee that the message was delivered to the brain and not only inbox, or acted upon, what you need is a feedback mechanism. This can be simple, using social approach - for example asking users an essentially fake question while providing ...


17

None of the reasons you've given are valid reasons for escrowing your password. There's only a couple valid reasons for escrowing any sort of "authenticator" information. A couple others have touched on these, but I'll try to clarify a bit. Encryption Keys: It makes absolute sense for the organization to have access to escrow copies of your encryption ...


14

An admin should never have "super user credentials" that cannot be removed by simply removing his user account or move the user account to a group that lacks the permission. An example: The admin logs in to a Linux system with his own account and uses sudo somecommand to do things that requires root permission. You don't allow this admin user to actually ...


13

@Polynomial makes very good points regarding "security through obscurity" and you definitely shouldn't secure yourself based on "obscurity" because it has proven not to work. However, I don't believe that the answer to your question is that simple - I think your question is more of a "risk reduction" question but could be wrong. Quite often in the security ...


13

IMHO it is doing the un-sexy things consistently that will provide you the best defences against even targeted attacks and "APT's". As I wrote when RSA provided details of their advanced attack good lessons learnt are: Email as a malware distribution mechanism is not dead. Dig out those user awareness presentations and add some training on spear phishing ...


13

I'm also a developer, and my passion for security often makes the dynamic a little unusual when dealing with other non-security-focused developers. There are three main areas of constraint when it comes to security policy: Usability: Making sure that the user can actually use the software, and that they don't get overly irritated or delayed by security ...


12

This is far-fetched, but non-obvious information leaks: 1. We must keep empty drawers locked If someone knows that there is a regular meeting discussing secret project X every Tuesday and Friday; and noticed that the drawers are always empty and unlocked on Tuesday and Friday, but locked otherwise, then it's pretty clear indication that the content of ...


12

This may be seen more as a template than a policy, but I think it's worth mentioning here. The U.S. National Institute of Standards and Technology has a number of Special Publications (SPs) regarding the security of information systems. These are collectively called the 800 series, as all of them have numeric designations beginning with 800. They are used ...


12

I consider myself to have high technical skills, and usually find myself skimming or simply ignoring these kind of messages myself. However, I was installing a Google product recently that had the following header: Please read this carefully - It's not just the usual yada yada. Because of the light hearted nature of this, I found myself to read the docs ...


12

It depends. If all reasonably functional alternatives are fundamentally prone to programming errors, like it is the case with browsers, it is probably a good idea to use a not-so-popular one. In particular, if your threat model does not include sophisticated adversaries that wait, observe and develop attacks specifically for your setup, using the ...


12

@ChrisAD From personal experience: Key prerequisite is an effective asset register. Otherwise you wont even know if it is one of your laptops / pc's that is missing or that turns up on the front page of the daily mail (well ok they may help in letting you know it was your device!). Secondly - Establish a clear requirement and ability for your staff to ...


11

There are all sorts of security risks - the ones I tend to highlight are: The big social networking sites are a wonderful target for attackers. Imagine a group of over a billion users, most of whom are not technically savvy, that all use the same web app (eg Facebook) and have personal data, links to others etc. So take it as read that these sites are ...


11

Some points that come to my mind: Be concise and precise. Too long messages are usually dropped. Categorise message using the topic : maintenance, notice, important. And make the topic clear (but short). If possible, configure the email client to colourise email headers by default. With a consistent set of rules you can get more attention. Make important ...


11

One point is to only send out emails when it is important and critical that they be read - don't use them for normal newsletters or boring info - users will learn to ignore them very quickly. For general security awareness, use different mechanisms every time, and make it interesting, worth their while or if those fail: mandatory, along with annual signoff ...


10

Paradoxically, the first responsibility of the security training is to show why the security training is important, interesting to you (the employee), and relevant (for your work). Any training (at least the first-time awareness trainings) must start with this, or at least lead up to it very quickly, otherwise its pointless. Though it seems from your WTF ...


10

You will likely not find too many people or groups who will vouch for OSS product's security because it could put them at risk of being legally liable. While reputation is a part of a measure, it is hard to quantify and people like hard numbers. Here are some factors you could consider. Has it been independently reviewed? Ok here's your numbers. Coverity ...


10

The first reason (give you your password back in case your forgot it) is quite weak: if you forgot your password, then it is not a good password, and it would make more sense to let you reset it by choosing a new password. The second reason is totally bogus: if they cannot "lock you out" without knowing your password, then they should fire their sysadmin ...


10

Serverfault has a great canonical answer on "what should we do now to clean up this mess", so I'll take a stab at "what should we do to prevent this happening ever again". Your organisation needs to establish an "employee leaving" process and stick to it. Your organisation will need to work out if they should treat all terminations the same, or differently ...


9

It does depend quite a lot on if the admin left on good terms and how complex your network is but some good steps to take are. I have worked with a number of organisations that take some of these steps but none of them take them all. A lot of them only revoke the user credentials and only take further steps if the admin left on bad terms or was going to a ...


9

The non-interference model is all about preventing covert channels through shared resources or inference attacks. An example can be the following: Suppose that two users of different security levels are working on the same system (remotely, using shells for example). The lower level user should not be know anything about the work done by the higher level ...


9

The kind of attack you are talking is popularly coined as "Juice Jacking". Are there any "known bad" or "known safe" smartphones with regard to USB security? In my knowledge, NO. How does a corporation protect from these risks? By making policies (actually spreading awareness) about the threat as many people yet aren't aware about it. And ...


9

Firstly I would answer the question "Is it within my remit to be worried by this". Presumably the sys-admins have a team lead or line manager, and it is their responsibility, not yours. You may be letting emotions cloud judgement a bit. A good place to start if you want to get involved regardless is to propose some level of change control. Putting all ...



Only top voted, non community-wiki answers of a minimum length are eligible