Questions tagged [user-education]
Education aimed at helping users meet their security-related responsibilities.
93
questions
2
votes
1
answer
303
views
Android exploit demos to scare my parents?
I recently discovered that my parents' android phones have not received security updates for years because the phones are out of support. When I talked to them I realized that the benefit of up-to-...
- 153
0
votes
1
answer
152
views
What are the most tolerable options for a more general public type not to be victimized by malware? [closed]
I've talked with a new friend who is fairly bright and who can do some interesting things programming Office applications, but whose technical abilities omit infosec. And he got bitten by nasty ...
- 1,200
1
vote
0
answers
136
views
Educational activities for entering the cyber-security profession? [closed]
This is a question concerning ways that people can get their feet wet with ethical hacking:
https://www.reddit.com/r/hacking/comments/1d9onz/how_do_i_start_getting_into_pentesting/
It's an extremely ...
- 11
32
votes
5
answers
7k
views
How do I know if a Google Chrome extension is leaking data?
Many Google Chrome extensions require permissions to read the contents of webpages the user visits. How can the user verify whether and to what extent a certain Chrome extension leaks data?
- 1,680
2
votes
2
answers
165
views
How should failures by a single user on a simulated phishing email be measured?
I work in the IT Security function of my company as a team lead. We periodically send out phishing emails to all users on company network as a form of continuous education of users on how to spot ...
- 1,756
103
votes
19
answers
16k
views
How to explain to traditional people why they should upgrade their old Windows XP device?
This is an issue I'm recurringly facing: older people from my family (or people who my family members know) can be surprisingly reluctant to apply most basic security measures when they're using their ...
- 6,167
87
votes
12
answers
16k
views
When is phishing education going too far? [closed]
I currently work on the IT security team at my workplace in a senior role. Recently, I assisted management in designing the phishing / social engineering training campaigns, by which IT security will ...
- 1,756
1
vote
2
answers
592
views
Basic things that need to be explained to employees about a security policy and at what point in their employment
I was asked this question:
What are the basic things that need to be explained to every employee
about a security policy? At what point in their employment? Why? (List
at least 4 things).
...
- 11
6
votes
2
answers
516
views
How to convince users that security is a good thing?
So I took over as senior IT manager at a small company a couple months ago. Up to now, there was no "IT department" as such, just another guy who "did computers". To this point: things are running off ...
- 211
1
vote
2
answers
419
views
Allow user to export data, what about security?
We developers of course try to create the most secure (web) application out there that will not be hacked. While we already know it's impossible to know for certain that your application is secure, we ...
- 117
16
votes
3
answers
1k
views
Are browser wrappers in software bad for users?
These days I see a lot of browser wrappers in software. For example:
when you purchase something in the Steam desktop application and use PayPal, you enter your PayPal security details in a browser ...
- 163
3
votes
2
answers
396
views
Why bother with certain types of 2fa if they can be easily bypassed?
In the wild, there is a method of bypassing 2fa. The gist of it is that the attacker doesn't just phish the password, but they also phish the 2nd factor and use those for a real login on their own ...
- 1,152
81
votes
19
answers
16k
views
Good analogy needed: Sec issues due to different coders implementing the same features in different ways for the same app
I have to give a school presentation about vulnerabilities found in the Moodle platform. Of course, they only apply to a legacy version which has since been patched.
The catch is that the ...
- 833
18
votes
1
answer
5k
views
Does being multi-lingual (in the 'natural language' sense) ever come in handy at all in information or network security?
I'm not professionally involved in security, so hopefully you can pardon me if I misuse any terminology or demonstrate my naivete in some other way. This question came to me as I was reading this ...
- 283
13
votes
6
answers
1k
views
How can I demonstrate SSL/TLS to 10 year olds?
I'm a software engineer with a particular skew on information security and DRM; I have a good understanding of the implementation (and some of the maths).
My son's school are doing about information ...
- 423
2
votes
4
answers
1k
views
Is user-education considered a security measure?
Some people reason that an iOS device is safer from a security context than an Android device, because an iOS device does not simply allow users to install apps from any source other than the App ...
- 123
0
votes
1
answer
162
views
Is it secure for a user to manually reset his password on every login when OTP isn't forced?
Is it secure for a user to manually reset his password every login (via email or 2 factor authentication) to a random token via email or 2 factor authentication, when OTP isn't forced ?
I mean an ...
- 1,244
0
votes
1
answer
157
views
Non-software individual password management solutions
I am interested in knowing if/what 'solutions' exist for password management in cases where people do not want to use a password manager (for whatever reasons they may offer...)
Let's assume:
The ...
- 3
8
votes
6
answers
1k
views
Users never remember their passwords or security answers. How can I get them to remember, but follow good security practices?
I work at a library where I teach computer literacy classes, especially for the elderly. Among other things, we have classes where people set up e-mail or other online accounts. For many of them, this ...
- 211
171
votes
26
answers
24k
views
Convince people not to share their password with trusted others
IT workers are usually trusted by their family members who readily share passwords (Facebook, email, twitter, you-name-it!) so they can get easy help to set what-ever-parameter they don't find or ...
- 1,518
2
votes
1
answer
1k
views
Is it legal to teach about hacking and tools? [closed]
I'am currentliy working on a e-learning content about wireless security.
It is an app I want to launch on the AppStore and Google Play.
It shows what the problems and dangers are and also what tools ...
- 21
-4
votes
1
answer
321
views
Protecting a new computer nowadays? [closed]
With so many security threats - how does one protect their PC?
Before it was easy(er?) - have a firewall and an updated anti-virus. But is that enough today?
What type of software would you put on a ...
- 111
0
votes
2
answers
1k
views
As a user, is using MD5-encrypted passwords on websites a good practice? [duplicate]
Disclaimer: This is from a user standpoint. We'll thus assume the target website (say, Paypal or Netflix) already uses a strong hashing algorithm with salts (bcrypt of pbkdf2, for example) and accepts ...
- 233
3
votes
2
answers
8k
views
Does the use of an on-screen keyboard give a false sense of security or protect against all types of keyloggers? [duplicate]
Does the use of an on-screen keyboard (OSK) give a false sense of security? For example when people use the OSK in an attempt to prevent key-loggers from logging information like passwords, typed on ...
- 6,745
1
vote
2
answers
158
views
Hardening charity volunteers' access to a web server [closed]
I'm helping to administer a LAMP web server for a charity which runs CiviCRM on Joomla. This system is going to be accessed over the Internet by many volunteers from devices I have no control over.. ...
- 111
1
vote
2
answers
769
views
Should users be allowed to reuse/recyle the same login credentials across a network for different systems?
Should users be allowed to reuse/recycle the same login credentials across a network for different systems? Should this be disallowed/discouraged, or are the security implications minimal? If it's ...
- 635
1
vote
2
answers
289
views
If signature based AV software is becoming obsolete, what is the home user to do?
Assuming one is a worried home user who keeps certain sensitive files, works on personal projects, and generally wants to ensure the integrity of their single system (to keep it simple), what's a user ...
- 21
3
votes
3
answers
401
views
Is it insecure to reveal if a password is being used for another account after a set period of time?
Password reuse can be considered a pandemic of security. The obvious way to fix this is to encourage people to use password managers, but (comparatively) few people actually do.
My idea is to have ...
- 261
1
vote
4
answers
239
views
Do technical advice sites sometimes link to malware, and if so, how should we properly research errors? [closed]
Suppose you get an error on your PC that shows up randomly, then you do a search on the internet for the error to find out how to fix it. Typically, you will get some sites that offer a solution, but ...
- 3,185
3
votes
2
answers
115
views
Efficient way to demonstrate the value in Active Directory security improvements?
Working hard on Active Directory security in a corporate environment: getting rid of excess permissions, monitoring, patching, etc. Nothing comes free, and to keep the budget going, I need to somehow ...
32
votes
7
answers
5k
views
Explain to non tech savvy person how to check that your connection to mybank.com is safe?
I was reading the security advice given by the Swedish Bankers' Association. They included these two pieces of advice (my translation), that I assume is to teach the user to check for SSL/TLS and ...
- 65.7k
86
votes
16
answers
17k
views
How to tell users that they shouldn't disclose their password over the phone to our help desk?
I work for a help desk, and we recently launched an online service where our members can log in.
A problem we are having is that users who are calling us often ask us to confirm that the password ...
- 1,105
16
votes
4
answers
4k
views
Secure Memorable Passwords for Older Users
As with many people who work in IT I have found myself in the position of providing technical support for older relatives. Most of these relatives are not technically savvy and hate the idea of ...
- 436
6
votes
1
answer
292
views
Is online security training effective?
I'm looking at an organization that requires that all employees undergo an annual one-hour online cybersecurity training (watch a video and take a quiz, apparently built using SANS's end-user security ...
- 100k
6
votes
4
answers
2k
views
How can I explain self-signed certificates to users?
I don't trust certificate authorities, so I'm using a self-signed certificate on my server. The server provides both a website as well as other services.
Most modern SSL-capable software, upon ...
- 1,104
1
vote
0
answers
162
views
Can anyone predict the scope of security in the year 2030? [closed]
I'm just curious to know the scope of the future security in terms of compliance and cyber security. And also the way of technology growth in terms of speed, authentication and authorization and OS.
...
- 1,130
74
votes
8
answers
9k
views
Is forcing users to use a strong password effective?
I am designing a service that would, among other things, store sensitive information. To ensure no unauthorized access of this information, it would be encrypted with a key derived from their password ...
- 813
2
votes
2
answers
6k
views
To trust, or not to trust? Adding exceptions to the Trusted Certificates List in (firefox) Light
I recently installed the Light (a more compact forking of Firefox).
I started getting the "This Connection is Untrusted" error, which got me wondering: when should I add an exception to the list of ...
- 121
28
votes
10
answers
8k
views
How to explain to a customer that spamfilters don't catch everything
I used to work in a small office which provided basic desktop support for users.
One day I had to answer a call from a very angry customer and he asked for my boss. He wanted to know how could one ...
- 8,803
12
votes
1
answer
9k
views
Why does every site makes me acknowledge cookie usage? [closed]
In the last year or so every other site on the net started showing different kinds of notification that they're using cookies and I should be aware of it. The sheer number of different sites doing ...
7
votes
2
answers
1k
views
Where can I “hide” easter eggs for students learning about Linux security?
I feel like this isn't the best place to ask this (since there's no single right answer), but I can't think of a better place. If you have a better recommendation, could you please recommend it and I ...
- 1,464
-1
votes
1
answer
209
views
Interesting security demos for beginners [closed]
I am thinking about a creating short security demo to get people interested in the security topic. I've had a couple of ideas just want to see if anyone has anything else interesting.
Edit:
I was ...
- 719
40
votes
6
answers
13k
views
Can malware be dangerous even when quarantined?
I am reading a book on network security and when talking about user confusion it writes:
"It is not uncommon for a user to be asked security questions such as
Is it safe to quarantine this ...
- 503
6
votes
7
answers
865
views
What are the benefits of encryption for everyday people?
In addition to the fact that encryption systems like PGP are notoriously difficult to use, and that encryption doesn't always jive with cloud-based services like webmail, the fact is that most people ...
- 1,369
0
votes
2
answers
194
views
Is "user education" actually doable?
I was going to ask about how to educate users, but now that I think about it, I first want to know if it's actually possible to do effectively at all.
Are there any amazing success (or horrible ...
- 317
3
votes
1
answer
1k
views
Anti-phishing educational resources for users?
I'm am looking into conducting a phishing campaign to gauge how susceptible my workplace is to phishing attacks. Part of this will involve guiding "duped" users to materials or resources that will ...
- 69
3
votes
2
answers
313
views
Breach informing
I am a staff member of a large fanfic site, but not the head administrator with control over the site itself.
Recently, we had a security breach and the databases were copied, which included the ...
- 31
0
votes
2
answers
456
views
What college majors are suitable for a career in security? [closed]
I was recently asked by a friend of mine (outside the computer science field) if he can be successful in web-application pen-testing
I took this as an excuse to ask a more comprehensive question.
I ...
- 1,896
0
votes
1
answer
793
views
Security Awareness Training Ideas [closed]
Does anyone have any solid recommendations for deploying and maintaining security awareness training? I am not looking for a specific vendor but I am trying to gain insight about how the material is ...
- 139
20
votes
9
answers
3k
views
How to get top management support for security projects?
I am facing an issue regarding security projects, for example: last year we bought an antivirus licence for 500 (end point security), and made a policy in order to force everyone to install it, ...
- 1,367