New answers tagged

0

No list is complete without a mention of the twitter-only @SwiftOnSecurity which is something of an infotainment meta-blog, featuring links to current infosec topics (and some, uh "miscellaneous stuff") on a daily basis. The operator also runs a companion how-to site, http://decentsecurity.com/


0

Matt Green's blog http://blog.cryptographyengineering.com/ regularly has pretty thorough posts on current cryptographic attacks and protocols. It also has some pretty good discussion of the politics and policy around crypto currently.


0

Some of my favorite: The Inside Out Security blog Troy Hunt's blog IT Security Guru harmj0y's blog


1

Assuming you mean web-application penetration testing (you have not clarified), you can start by taking a look at OWASP (Open Web Application Security Project). They have many useful guidelines such as the OWASP ASVS and OWASP CVSS. These will guide you through basic testing methodologies and threat assessment techniques. From there, you can use this ...


0

Take this in the spirit it is meant… You have pretty much answered you own question. Your uncertainty regarding what to learn suggests you need a solid and fundamental understanding of computer science in general. Once you have that, knowing what you need to add to your knowledge base for an Information Security career will be obvious. The more fundamentals ...


5

It's so unreal for them that the only way to have it stick is by showing them by real life example. Ask them: Who knows what phishing is? Ask them: So what kind of information leaked would be Problematic? They say: If document ThisIsImportant.doc with accounting info about customer C would be leaked. Ask them: Who has access to ThisIsImportant.doc? They ...


0

As l1thal pointed out, your question is quite broad. So I will try to advice you based in my personal experience. First of all, you need network knowledge: you need to understand how a network works in detail. For example, how to setup routers, network-related services (dhcp, dns, gateways, proxys, firewalls, file-sharing, etc), protocols and ports. You ...


2

Generally speaking, the more security measures you can abstract away from the user - the better! For example: File storage should, if available, be done on a centralized server. Assuming you have resources with sufficient competence to set this up correctly, it is easier to maintain company-wide backups done by trained people than teaching each employee ...


1

I think kjartan's answer is spot on, but in more general terms of security awareness training there are just a few main components What are you protecting? Information, data, and knowledge - the drivers of every aspect of your business. Why does it need to be protected? CIA + non-repudiation. I think it's important to explain why it's important that users ...


2

Show them a Password Manager like LastPass or KeePass. Most everyone I know has a TON of user ids and passwords. To help remember them they do things like use all the same passwords, write them down on sticky notes, or store them in unencrypted text documents. Instead show them how to use a password manager. I showed a few of my non-IT friends how to use ...


15

None of the existing answers mention this and its too long for a comment even if its not a thorough answer. One thing you will absolutely need to avoid engendering in your audience is nihilism (i.e. I will get hacked no matter what I do). Its quite easy to scare people s@#$less (and temptingly entertaining depending on circumstances). But big part of ...


41

I actually did a presentation similar to this a little over a year ago, and spent quite a bit of time deciding how to structure it. My target audience did include developers and other people quite knowledgeable in IT, but also managers and other non-programmers, so I tried to keep it fairly general, and not to technically complicated. As someone else pointed ...


3

On the one hand you say you want to run workshops while on the other, you dive into some some quite hard-core topics with people who have limited knowledge of security. While I applaud your efforts, if it were me I would be looking to raise awareness and get people thinking about security rather than just presenting death-by-powerpoint / something which ...



Top 50 recent answers are included