Tag Info

Hot answers tagged

84

A small trick I learned years ago - lay your email out like this: Short Version Small number of very short succinct points If X, then you need to do this Else, then you need to do that (or don't need to do anything) Long Version or Full Details ...and here you lay out whatever full version you want. 97% of your users will never ...


19

As @gowenfawr says many users will not read messages no matter what you do. So, in cases when you need to guarantee that the message was delivered to the brain and not only inbox, or acted upon, what you need is a feedback mechanism. This can be simple, using social approach - for example asking users an essentially fake question while providing ...


12

I consider myself to have high technical skills, and usually find myself skimming or simply ignoring these kind of messages myself. However, I was installing a Google product recently that had the following header: Please read this carefully - It's not just the usual yada yada. Because of the light hearted nature of this, I found myself to read the docs ...


12

Well there's a couple of potential attack vectors which could be relevant. First up ports. Surprsingly some ATMs do indeed have USB ports and have been attacked via them (more info here as an example and also this CCC presentation on infecting ATMs with malware). However you'd hope that ATMs have decent physical security to help mitigate that class of ...


11

One point is to only send out emails when it is important and critical that they be read - don't use them for normal newsletters or boring info - users will learn to ignore them very quickly. For general security awareness, use different mechanisms every time, and make it interesting, worth their while or if those fail: mandatory, along with annual signoff ...


11

Some points that come to my mind: Be concise and precise. Too long messages are usually dropped. Categorise message using the topic : maintenance, notice, important. And make the topic clear (but short). If possible, configure the email client to colourise email headers by default. With a consistent set of rules you can get more attention. Make important ...


11

Yes, this is accurate. If your version of the Android OS has known privilege escalation vulnerabilities, there is nothing stopping a rogue application from exploiting a privilege escalation vulnerability and thus escaping the sandbox (i.e., gaining unrestricted access to your phone). This absence of security upgrades is a shortcoming of the Android ...


10

The official site is www.chiark.greenend.org.uk/~sgtatham/putty, you can find the download in the download section. If you want to play it safe, you can verify the signature of the download. In my opinion compiling it from source is as safe as downloading the binary and checking the signature (make sure to also verify the key itself with at least one ...


9

Personally I don't think that the support end of Windows XP, is such a great deal for embedded systems like ATMs. I gave a quite detailed answer to this here. It definitely matters for the consumer market, though. In regards to your question on how these things might get exploited, refer to this blog entry for a few examples from the past. I think you are ...


8

The obvious answer (if we accept your premise) is: routinely port-scan your own machines to see if they are running any unexpected services. I'm not too sure about the premise that the best way to defend against this risk is to try to detect use of IIS Express. I wonder if you have considered an alternative approach, which is not specific to any particular ...


7

I think you can't look at just one mail message. Having watched our IT and ITSEC groups evolve over the years, I've noticed that the common perception of them has to do with the overall body of emails they put out, nothing gets fixed with just a few great emails. Here's some overall thoughts: don't use just one communication medium - I know you want to ...


6

Observations: Some users may understand that your message is important but still "leave it for later", or think that it's a good reference but put it aside for a time that "something bad happens" (it happens a lot with our awareness messages). I also had to face the insistence of middle level managers that all messages addressed internally to the ...


6

Lol. The first thing is to realize that users will generally ignore all your emails. Stop imagining that this problem can be solved. Certainly, there are things you can do in order to make your emails read by MORE users. No, HTML messages are not better. Studies have shown that users pay more attention to text messages and HTML pages. The shorter the ...


5

The easy answer is yes, it is possible. In fact, we have several servers that for various reasons are only patched in this manner. This does produce a bit of an annoyance on the admins, however once you get into the swing of things it is not so difficult to do on a small scale. Your situation sounds wonderfully easy, though. I would recommend installing ...


4

As I understand it (I am not a lawyer and I am not a compliance officer so take what I say with a grain of salt), there are interpretations of SOX compliance that require that a company have mechanisms in place to ensure that all machines are up-to-date with patches. So it wouldn't surprise me in the least if they are audited.


4

some valid points... I personally go the custom rom route, you mention having to trust the developer, this is true.... Just like every other open source, community driven project. And for that matter Google, Apple, Microsoft, etc. I find it much easy to trust an open project vs closed source anything. These are choices we have to make with all tech ...


3

One of the problems with unsupported software is that you simply don't know. Not only there is nobody to fix security bugs, but there's usually nobody to even collect and disseminate vulnerability reports. The problem becomes much worse with closed-source software. I think it would be difficult to find issues, let alone create and distribute unofficial ...


3

If you visit http://support.microsoft.com/lifecycle/search/default.aspx?sort=pn&alpha=.net+framework you'll see Microsoft's support lifecycle for the .NET framework. As you can see, many of the older versions are no longer supported, so Microsoft do not promise they will issue security patches for them, and you should no longer use them.


3

One trick I've used with some success for things that require user actions is to send it out a meeting request. Trick works for a few reasons: People tend to respond to meeting requests. Lets you create reminders before events requiring user actions. Actually puts things like scheduled downtime in people's calendars. I wouldn't do it for everything as ...


3

The claim can be substantiated by checking the successful exploit rates against (e.g.) Secunia databases, or by checking the latest, say, 100 security advisories from Microsoft TechNet (the management loves Microsoft sources :-) ) or e.g. US-CERT. Every time there's an exploit for something that was known at the time the exploit took place, that's a ...


3

It's a risk. XP has had enough holes over the years that it's hard to imagine there aren't some un-found holes in what remains. I'd recommend getting off XP if possible. If not, at least keep your ear to the ground. If a researcher finds more vulnerabilities that Microsoft is now unwilling to fix, you can bet they're going to hit the tech news media. ...


2

The thing is that users who don't know much about computers don't care very much about email they don't understand. And also, second point, people just get used to similar email coming often and start not reading them. Can you do something against that...probably not so much. I would recommend making some category in your email as a title. I would ...


2

From a range of organisations I used to look after from an IT audit perspective, the term 'audit' here usually meant 'check the list of updates installed against the list published' not go into any depth as to what each one contained. ie if it was a 'critical' from the vendor, audit would get concerned if it hadn't been implemented in timely fashion - or ...


2

NuGet does not currently support code signing for package or nuspec files, so the author of the package cannot truly be identified. This issue was raised as a feature request in 2010, but it didn’t get much attention and hasn’t been implemented. See http://nuget.codeplex.com/workitem/79. Currently an already existing package NuGet can only be upgraded by ...


2

Depending on the hierarchy of your organization, I have found a few things to be quite effective. I email the manager or supervisors of the rest of the users, when they forward it along with a short "read this if you still need your job" type one liner (usually not that crude but you get the point) I'd say close to 70% of the users try to read the important ...


2

Many excellent answers here, only thing worth adding is, for the RARE case that you really require users' attention and/or response, many email clients (e.g. Outlook) allow the sender to designate a reminder date/time, at which time the client would actually popup a reminder messagebox. Please do use this sparingly, though, as it is quite intrusive - though ...


2

If you really have something to say (not the “expect disruption” type of email), you can put the recipient name in subject. Yes, this is what spammers usually do. Subject like Richard, please take a look immediately takes attention and you gives you about 10 seconds to express the problem in short (i.e. explain the policies changed, the software is updated, ...


2

Often this is done because the fix used might have an impact on functionality. Remember they acted quickly so it might be that some functions are broken. If they would push it in their updates, it might result in a lot of users being unhappy because their webapplication is broken or doesn't work properly. So that's why they leave the choice at the moment. ...



Only top voted, non community-wiki answers of a minimum length are eligible