Hot answers tagged

92

A small trick I learned years ago - lay your email out like this: Short Version Small number of very short succinct points If X, then you need to do this Else, then you need to do that (or don't need to do anything) Long Version or Full Details ...and here you lay out whatever full version you want. 97% of your users will never ...


55

Excellent question. Yes, your understanding is correct, as well as your rationale behind it. Staggering roll outs for new features often makes good sense. Staggering roll outs for security patches rarely is a good idea. As you pointed out, this gives even more opportunity for the vulnerabilities to be exploited. Perhaps even more importantly, the ...


41

What are the strengths of each team member that I will work with regularly? (i.e. programming, linux, networking, regulations, etc.) Where is our documentation? You hopefully have a wiki, a knowledge base, or set of documents somewhere that explain your processes and policies. If you don't, be a hero and get started on one. What are the current projects the ...


19

As @gowenfawr says many users will not read messages no matter what you do. So, in cases when you need to guarantee that the message was delivered to the brain and not only inbox, or acted upon, what you need is a feedback mechanism. This can be simple, using social approach - for example asking users an essentially fake question while providing ...


15

Yes, this is accurate. If your version of the Android OS has known privilege escalation vulnerabilities, there is nothing stopping a rogue application from exploiting a privilege escalation vulnerability and thus escaping the sandbox (i.e., gaining unrestricted access to your phone). This absence of security upgrades is a shortcoming of the Android ...


15

The official site is www.chiark.greenend.org.uk/~sgtatham/putty, you can find the download in the download section. If you want to play it safe, you can verify the signature of the download. In my opinion compiling it from source is as safe as downloading the binary and checking the signature (make sure to also verify the key itself with at least one ...


13

I consider myself to have high technical skills, and usually find myself skimming or simply ignoring these kind of messages myself. However, I was installing a Google product recently that had the following header: Please read this carefully - It's not just the usual yada yada. Because of the light hearted nature of this, I found myself to read the docs ...


13

Well there's a couple of potential attack vectors which could be relevant. First up ports. Surprsingly some ATMs do indeed have USB ports and have been attacked via them (more info here as an example and also this CCC presentation on infecting ATMs with malware). However you'd hope that ATMs have decent physical security to help mitigate that class of ...


12

The crux of the problem is that with only a few notable exceptions, every phone ships with a fork of Android, not with the software written by Google. So Google can't push changes to Samsung's phones any more than FreeBSD can push changes to Apple's Macbooks. Android is Open Source, which is a bit unusual. This is the first time a major consumer operating ...


11

One point is to only send out emails when it is important and critical that they be read - don't use them for normal newsletters or boring info - users will learn to ignore them very quickly. For general security awareness, use different mechanisms every time, and make it interesting, worth their while or if those fail: mandatory, along with annual signoff ...


11

Some points that come to my mind: Be concise and precise. Too long messages are usually dropped. Categorise message using the topic : maintenance, notice, important. And make the topic clear (but short). If possible, configure the email client to colourise email headers by default. With a consistent set of rules you can get more attention. Make important ...


9

Personally I don't think that the support end of Windows XP, is such a great deal for embedded systems like ATMs. I gave a quite detailed answer to this here. It definitely matters for the consumer market, though. In regards to your question on how these things might get exploited, refer to this blog entry for a few examples from the past. I think you are ...


8

The obvious answer (if we accept your premise) is: routinely port-scan your own machines to see if they are running any unexpected services. I'm not too sure about the premise that the best way to defend against this risk is to try to detect use of IIS Express. I wonder if you have considered an alternative approach, which is not specific to any particular ...


7

I think you can't look at just one mail message. Having watched our IT and ITSEC groups evolve over the years, I've noticed that the common perception of them has to do with the overall body of emails they put out, nothing gets fixed with just a few great emails. Here's some overall thoughts: don't use just one communication medium - I know you want to ...


7

The easy answer is yes, it is possible. In fact, we have several servers that for various reasons are only patched in this manner. This does produce a bit of an annoyance on the admins, however once you get into the swing of things it is not so difficult to do on a small scale. Your situation sounds wonderfully easy, though. I would recommend installing ...


7

You could use nmap to get a better view of the (network)services it is running: nmap -sS -v <your_server> -sV -p1-65535 and lsof to view the current inbound/outbound connections to the box. lsof -i If there are no processes listening on any port then the server is reasonably safe. If new services are installed(i.e. ssh server) it is recommended ...


6

Lol. The first thing is to realize that users will generally ignore all your emails. Stop imagining that this problem can be solved. Certainly, there are things you can do in order to make your emails read by MORE users. No, HTML messages are not better. Studies have shown that users pay more attention to text messages and HTML pages. The shorter the ...


6

Observations: Some users may understand that your message is important but still "leave it for later", or think that it's a good reference but put it aside for a time that "something bad happens" (it happens a lot with our awareness messages). I also had to face the insistence of middle level managers that all messages addressed internally to the ...


5

some valid points... I personally go the custom rom route, you mention having to trust the developer, this is true.... Just like every other open source, community driven project. And for that matter Google, Apple, Microsoft, etc. I find it much easy to trust an open project vs closed source anything. These are choices we have to make with all tech ...


5

There are definitely some regulations that require this to be checked. For example, PCI-DSS requires (requir-ed? Havent reviewed v2 yet..) all security patches to be installed within a certain amount of time. And yes, QSAs need to verify this too.


5

As I understand it (I am not a lawyer and I am not a compliance officer so take what I say with a grain of salt), there are interpretations of SOX compliance that require that a company have mechanisms in place to ensure that all machines are up-to-date with patches. So it wouldn't surprise me in the least if they are audited.


5

Your question is a good one as it is used by some marketing department to praise their own Linux distribution. Most often Linux distributions are not the patches authors: as their name states they are just distributing otherwise already existing content. A security vulnerability is discovered and notified privately to the software development team, The ...


4

"Average length of time that an announced vulnerability has widespread exploitation", T "Attractiveness of server as a target", A, on a qualitative scale of 1-5 (higher number representing more attractiveness). "Ease of exploitation", E, using the CVE score as a basis of common comparison (T/A) x E = N Considering that T is now considered to be measured ...


4

However, for security patches, wouldn't a staggered release make it much easier for blackhat hackers to utilize the now-public vulnerabilities against users whose devices have not yet received the OTA, even though a patch for their device model is already available? Easier than what?, is the important question. Yes it will be easier for the hacker ...


3

If you visit http://support.microsoft.com/lifecycle/search/default.aspx?sort=pn&alpha=.net+framework you'll see Microsoft's support lifecycle for the .NET framework. As you can see, many of the older versions are no longer supported, so Microsoft do not promise they will issue security patches for them, and you should no longer use them.


3

NuGet does not currently support code signing for package or nuspec files, so the author of the package cannot truly be identified. This issue was raised as a feature request in 2010, but it didn’t get much attention and hasn’t been implemented. See http://nuget.codeplex.com/workitem/79. Currently an already existing package NuGet can only be upgraded by ...


3

One of the problems with unsupported software is that you simply don't know. Not only there is nobody to fix security bugs, but there's usually nobody to even collect and disseminate vulnerability reports. The problem becomes much worse with closed-source software. I think it would be difficult to find issues, let alone create and distribute unofficial ...


3

Short and easy answer: The same way you audit and detect installation of any other software. You do do this, don't you?


3

One trick I've used with some success for things that require user actions is to send it out a meeting request. Trick works for a few reasons: People tend to respond to meeting requests. Lets you create reminders before events requiring user actions. Actually puts things like scheduled downtime in people's calendars. I wouldn't do it for everything as ...



Only top voted, non community-wiki answers of a minimum length are eligible