Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [user-education]

Education aimed at helping users meet their security-related responsibilities.

89
votes
12answers
15k views

When is phishing education going too far? [closed]

I currently work on the IT security team at my workplace in a senior role. Recently, I assisted management in designing the phishing / social engineering training campaigns, by which IT security will ...
0
votes
2answers
113 views

Basic things that need to be explained to employees about a security policy and at what point in their employment

I have was asked this question: What are the basic things that need to be explained to every employee about a security policy? At what point in their employment? Why? (List at least 4 things). ...
5
votes
2answers
212 views

How to convince users that security is a good thing?

So I took over as senior IT manager at a small company a couple months ago. Up to now, there was no "IT department" as such, just another guy who "did computers". To this point: things are running off ...
1
vote
2answers
121 views

Allow user to export data, what about security?

We developers of course try to create the most secure (web) application out there that will not be hacked. While we already know it's impossible to know for certain that your application is secure, we ...
15
votes
3answers
387 views

Are browser wrappers in software bad for users?

These days I see a lot of browser wrappers in software. For example: when you purchase something in the Steam desktop application and use PayPal, you enter your PayPal security details in a browser ...
2
votes
2answers
196 views

Why bother with certain types of 2fa if they can be easily bypassed?

In the wild, there is a method of bypassing 2fa. The gist of it is that the attacker doesn't just phish the password, but they also phish the 2nd factor and use those for a real login on their own ...
81
votes
19answers
16k views

Good analogy needed: Sec issues due to different coders implementing the same features in different ways for the same app

I have to give a school presentation about vulnerabilities found in the Moodle platform. Of course, they only apply to a legacy version which has since been patched. The catch is that the ...
19
votes
1answer
4k views

Does being multi-lingual (in the 'natural language' sense) ever come in handy at all in information or network security?

I'm not professionally involved in security, so hopefully you can pardon me if I misuse any terminology or demonstrate my naivete in some other way. This question came to me as I was reading this ...
14
votes
6answers
641 views

How can I demonstrate SSL/TLS to 10 year olds?

I'm a software engineer with a particular skew on information security and DRM; I have a good understanding of the implementation (and some of the maths). My son's school are doing about information ...
2
votes
4answers
177 views

Is user-education considered a security measure?

Some people reason that an iOS device is safer from a security context than an Android device, because an iOS device does not simply allow users to install apps from any source other than the App ...
0
votes
1answer
76 views

Is it secure for a user to manually reset his password on every login when OTP isn't forced?

Is it secure for a user to manually reset his password every login (via email or 2 factor authentication) to a random token via email or 2 factor authentication, when OTP isn't forced ? I mean an ...
0
votes
1answer
67 views

Non-software individual password management solutions

I am interested in knowing if/what 'solutions' exist for password management in cases where people do not want to use a password manager (for whatever reasons they may offer...) Let's assume: The ...
7
votes
6answers
743 views

Users never remember their passwords or security answers. How can I get them to remember, but follow good security practices?

I work at a library where I teach computer literacy classes, especially for the elderly. Among other things, we have classes where people set up e-mail or other online accounts. For many of them, this ...
163
votes
26answers
20k views

Convince people not to share their password with trusted others

IT workers are usually trusted by their family members who readily share passwords (Facebook, email, twitter, you-name-it!) so they can get easy help to set what-ever-parameter they don't find or ...
2
votes
1answer
465 views

Is it legal to teach about hacking and tools? [closed]

I'am currentliy working on a e-learning content about wireless security. It is an app I want to launch on the AppStore and Google Play. It shows what the problems and dangers are and also what tools ...
-4
votes
1answer
194 views

Protecting a new computer nowadays? [closed]

With so many security threats - how does one protect their PC? Before it was easy(er?) - have a firewall and an updated anti-virus. But is that enough today? What type of software would you put on a ...
0
votes
2answers
708 views

As a user, is using MD5-encrypted passwords on websites a good practice? [duplicate]

Disclaimer: This is from a user standpoint. We'll thus assume the target website (say, Paypal or Netflix) already uses a strong hashing algorithm with salts (bcrypt of pbkdf2, for example) and accepts ...
1
vote
2answers
5k views

Does the use of an on-screen keyboard give a false sense of security or protect against all types of keyloggers? [duplicate]

Does the use of an on-screen keyboard (OSK) give a false sense of security? For example when people use the OSK in an attempt to prevent key-loggers from logging information like passwords, typed on ...
1
vote
2answers
93 views

Hardening charity volunteers' access to a web server [closed]

I'm helping to administer a LAMP web server for a charity which runs CiviCRM on Joomla. This system is going to be accessed over the Internet by many volunteers from devices I have no control over.. ...
1
vote
2answers
332 views

Should users be allowed to reuse/recyle the same login credentials across a network for different systems?

Should users be allowed to reuse/recycle the same login credentials across a network for different systems? Should this be disallowed/discouraged, or are the security implications minimal? If it's ...
1
vote
2answers
192 views

If signature based AV software is becoming obsolete, what is the home user to do?

Assuming one is a worried home user who keeps certain sensitive files, works on personal projects, and generally wants to ensure the integrity of their single system (to keep it simple), what's a user ...
3
votes
3answers
307 views

Is it insecure to reveal if a password is being used for another account after a set period of time?

Password reuse can be considered a pandemic of security. The obvious way to fix this is to encourage people to use password managers, but (comparatively) few people actually do. My idea is to have ...
1
vote
4answers
166 views

Do technical advice sites sometimes link to malware, and if so, how should we properly research errors? [closed]

Suppose you get an error on your PC that shows up randomly, then you do a search on the internet for the error to find out how to fix it. Typically, you will get some sites that offer a solution, but ...
4
votes
2answers
56 views

Efficient way to demonstrate the value in Active Directory security improvements?

Working hard on Active Directory security in a corporate environment: getting rid of excess permissions, monitoring, patching, etc. Nothing comes free, and to keep the budget going, I need to somehow ...
32
votes
7answers
5k views

Explain to non tech savvy person how to check that your connection to mybank.com is safe?

I was reading the security advice given by the Swedish Bankers' Association. They included these two pieces of advice (my translation), that I assume is to teach the user to check for SSL/TLS and ...
89
votes
16answers
14k views

How to tell users that they shouldn't disclose their password over the phone to our help desk?

I work for a help desk, and we recently launched an online service where our members can log in. A problem we are having is that users who are calling us often ask us to confirm that the password ...
8
votes
4answers
1k views

Secure Memorable Passwords for Older Users

As with many people who work in IT I have found myself in the position of providing technical support for older relatives. Most of these relatives are not technically savvy and hate the idea of ...
6
votes
1answer
206 views

Is online security training effective?

I'm looking at an organization that requires that all employees undergo an annual one-hour online cybersecurity training (watch a video and take a quiz, apparently built using SANS's end-user security ...
6
votes
4answers
1k views

How can I explain self-signed certificates to users?

I don't trust certificate authorities, so I'm using a self-signed certificate on my server. The server provides both a website as well as other services. Most modern SSL-capable software, upon ...
2
votes
0answers
107 views

Can anyone predict the scope of security in the year 2030? [closed]

I'm just curious to know the scope of the future security in terms of compliance and cyber security. And also the way of technology growth in terms of speed, authentication and authorization and OS. ...
74
votes
8answers
8k views

Is forcing users to use a strong password effective?

I am designing a service that would, among other things, store sensitive information. To ensure no unauthorized access of this information, it would be encrypted with a key derived from their password ...
2
votes
2answers
5k views

To trust, or not to trust? Adding exceptions to the Trusted Certificates List in (firefox) Light

I recently installed the Light (a more compact forking of Firefox). I started getting the "This Connection is Untrusted" error, which got me wondering: when should I add an exception to the list of ...
29
votes
10answers
7k views

How to explain to a customer that spamfilters don't catch everything

I used to work in a small office which provided basic desktop support for users. One day I had to answer a call from a very angry customer and he asked for my boss. He wanted to know how could one ...
12
votes
1answer
8k views

Why does every site makes me acknowledge cookie usage? [closed]

In the last year or so every other site on the net started showing different kinds of notification that they're using cookies and I should be aware of it. The sheer number of different sites doing ...
6
votes
2answers
520 views

Where can I “hide” easter eggs for students learning about Linux security?

I feel like this isn't the best place to ask this (since there's no single right answer), but I can't think of a better place. If you have a better recommendation, could you please recommend it and I ...
-1
votes
1answer
149 views

Interesting security demos for beginners [closed]

I am thinking about a creating short security demo to get people interested in the security topic. I've had a couple of ideas just want to see if anyone has anything else interesting. Edit: I was ...
37
votes
6answers
10k views

Can malware be dangerous even when quarantined?

I am reading a book on network security and when talking about user confusion it writes: "It is not uncommon for a user to be asked security questions such as Is it safe to quarantine this ...
6
votes
7answers
693 views

What are the benefits of encryption for everyday people?

In addition to the fact that encryption systems like PGP are notoriously difficult to use, and that encryption doesn't always jive with cloud-based services like webmail, the fact is that most people ...
0
votes
2answers
114 views

Is “user education” actually doable?

I was going to ask about how to educate users, but now that I think about it, I first want to know if it's actually possible to do effectively at all. Are there any amazing success (or horrible ...
3
votes
1answer
849 views

Anti-phishing educational resources for users?

I'm am looking into conducting a phishing campaign to gauge how susceptible my workplace is to phishing attacks. Part of this will involve guiding "duped" users to materials or resources that will ...
3
votes
2answers
233 views

Breach informing

I am a staff member of a large fanfic site, but not the head administrator with control over the site itself. Recently, we had a security breach and the databases were copied, which included the ...
0
votes
2answers
364 views

What college majors are suitable for a career in security? [closed]

I was recently asked by a friend of mine (outside the computer science field) if he can be successful in web-application pen-testing I took this as an excuse to ask a more comprehensive question. I ...
0
votes
1answer
704 views

Security Awareness Training Ideas [closed]

Does anyone have any solid recommendations for deploying and maintaining security awareness training? I am not looking for a specific vendor but I am trying to gain insight about how the material is ...
20
votes
9answers
2k views

How to get top management support for security projects?

I am facing an issue regarding security projects, for example: last year we bought an antivirus licence for 500 (end point security), and made a policy in order to force everyone to install it, ...
2
votes
2answers
309 views

Logging in as administrator in windows 7, is there a downside?

I have a very straightforward question. Is there any downside to logging in as an administrator all the time in windows 7? I mean, it asks you whenever a program asks for permission to do something ...
12
votes
1answer
194 views

Why does Android mix phone state with phone identity?

The "Phone State" permission on Android is widely requested by many apps. The explanation often given by the developer is that the app needs it in order to determine when you're on the phone, to stop ...
3
votes
2answers
330 views

Building a web application security focused team

I work as an application architect at larger company that builds web applications using both .Net and Java technologies. These are sold to and accessed by other businesses (not consumers). We have ...
34
votes
7answers
3k views

How do I educate others about social engineering?

One of my friends used to boast about how long his passwords are. One day, I decided to play a prank and social-engineered it out of him. I was pretty surprised as to how effortless the entire ...
10
votes
3answers
11k views

What is a pen tester?

I asked two pen testers what exactly it is that they do. One of them has told me that all he ever does is try to find exploits in the software in order to gain access to internal servers and nothing ...
7
votes
3answers
4k views

Self-teach pentesting/CEH skills ethically

I am a Software Engineer currently and have done quite a bit of systems work as well. I love the idea of Penetration Testing and would love to work towards becoming a pentester/Certified Ethical ...