The Stack Overflow podcast is back! Listen to an interview with our new CEO.
45

Of course no one wants to report, they are "turning in" their peers. Also, the time and complexity it takes to go through the reporting process you described is another negative reinforcement. You are only going to get low compliance if everything is a negative. And ... YOU CANNOT FORCE PEOPLE TO DO ANYTHING!! You are approaching the problem backwards. You ...


35

My 2cents here: While not technically illegal these companies have managed to develop malware and exploits, without anyone bugging them, because they sell them to governments, law enforcement agencies, secret services, organizations and, in case of some of the companies, to anyone else interested. Such companies include: VUpen Paladion More information ...


33

I can't comment on the actual job scene, but I do know a bit about the statistics of cybercrime. In terms of financial gain, the stats are quite interesting. In terms of profit, the top three are as follows: Pay-per-click advertising fraud - Wasn't so much of a profit-maker until recently, but blackhats seem to have focused on this method more intensely ...


31

When looking for actual physical risks, doxing and the results are most important. There are examples of the hivemind of Reddit and 4chan where peoples exact locations, addresses, names and anything else might useful for actual physical attacks (or swatting) available online to which I will not link for obvious reasons. The amount of information that can ...


16

Although there are exceptions, generally managers do things for one of two reasons: Doing it will make them look good Not doing it will make them look bad Now apply this to your management to see who the key stakeholders are: Stakeholder 1: Somebody's allocated money for anti-virus, which ought to make the manager who owns the AV look good. However, if ...


15

For example, I had experienced this in my practice: When penetration testing one company, I got access to the system via a password recovery form, because the mail server provided options for security questions like "name of your dog" and "your school". This information was displayed in profiles in social networks. Having many accounts makes it difficult ...


14

One option not mentioned here is espionage. Patriotism or corporate funding could be part of the reason you might end up in espionage. Corporate As a espionage contract worker you could charge a pretty high fee for doing any of a number of different black hat operations. Stealing, corporate information (design plans, blackmail, corrupting data, stealing ...


12

The "look at us on holiday" type of pictures are of interest because they can be viewed without arousing suspicion or notice, unlike keeping an eye on the house istelf. A single approach to a house that's expected to be empty could then lead to a break-in. If the same or a linked account includes pictures of valuables (whether as the subject -- "look at my ...


10

This is really about closing the gap between Information Security and Business objectives. For most security departments today, the battle selling Information Security to the board is the major challenge. Usually, board members don't care about "good security”, they care about "good enough security". InfoSec is rarely clearly defined in most organizations ...


10

Encouraging your employees to snitch on each other by sending documentation of minor misbehavior to a centralized email address is a terrible idea for work climate. Nobody does it because nobody wants their colleagues to hate them and nobody wants to build a work environment governed by a denunciation culture. The resistance to your process is not just ...


10

One risk that isn't mentioned, but is very real for a lot of people, is identity theft. Identity theft is the act of someone using your identity, usually to do criminal things. Lots of people tend to post a photo of their passport/identity card/drivers license/certificate with full name and/or anything else with a social security number at some point, ...


8

Good luck with that. Normally you make sure that all of these things have been done before you lay somebody off. If someone is a bit skilled it can get very hard, if not almost impossible to see if he hasn't compromised a system. If he was the only employee, there is no saying if he has any backdoors in place. So at this moment he still might have access. ...


7

Use DVWA or Mutillidae, get them to fix the code, then demonstrate pre/post fix behavior? Perhaps a little more complex than you were thinking, but it would also prove their coding ability. Or, if this is too much, get them to go through DVWA at lowest security settings, looking for certain data? (get usernames, login without creds, etc.) You could even ...


7

Like NlightNFotis's answer, there are a number of companies writing legal malware for governments, which are vendors at the ISS World Training. I documented them here: http://0xdabbad00.com/2011/12/10/legal-malware/


7

First thought that comes to mind is whether it is even legal to require all those documents. Passport makes sense (what happens if you don't have a current passport?), but demanding bank statements is a bit skeezy. Common, but skeezy (just because many companies insist on something, doesn't make it legal). That said, this is an issue to ask a local lawyer, ...


7

Few years ago there was a strong opposition to Gawker Stalker app for posting current locations of celebrities. The main argument for the app was: By posting someone's location out on a public forum, you allowed stalkers/psycopaths to reach there with guns and be ready when they come out of the building. This is an incredibly scary physical threat. ...


6

I'd say you're pushing Theory X and Theory Y too far away from their original position. The original posit of the theories relates to a relationship between people and authority. The people are in a system in which the manager has a significant degree of control over employment conditions and outcomes. The social engineering concepts and strategies run ...


6

I would imagine most of the money would be in organized crime rings, operating botnets to distribute malware. From there they can attack individual bank customers to steal money or setup mule accounts. They could also rent out their botnets to others do to distributing computing. Probably a lot of spyware is still out there, maybe you inject your affiliate ...


6

who knew most of the top credentials I am not exactly certain of your meaning, but this scares me. It sounds like the individual had extensive access and control over many critical systems. The sysadmin may even have had exclusive control. A few years ago the city of San Francisco lost control of it's network because a single sysadmin refused to give his ...


6

For the benefit of everyone else who will be reading this, this is definitely the wrong time to be thinking about this. Now, you've put yourself into a literally impossible position; you simply cannot tell with certainty that your system is not compromised. Furthermore, the more difficult your sysadmin was or how difficult a time you may have given him, ...


6

I'd like to respectfully offer a different perspective from the perfectly valid answer and comments already here. I'm reading between the lines a lot, but I believe the original question is trying to achieve quite a good (and difficult) thing - prioritize security awareness at departmental level, with objective measurements of awareness. The effect being ...


6

What generally is done is to hire a security expert who creates a custom webserver hardening standard and baseline, adjusted to your company's needs. The standard defines which security controls should be in place, technology independant. Then the baseline can be technology specific, e.g. IIS or Apache,... The baseline can be implemented by your system ...


6

The basic rules that the big companies follow aren't very much different from the rules/recommendations by popular infosec standards (e.g. ISO27k): Segregation of duties - separation on services provisioning, development process, or any other part of IT services, so different people are responsible for the various components/stages of service delivery, ...


5

In general I'd suggest avoiding use of the word, because it's meaning in general English is completely opposite to the meaning of the original jargon word, which means that sooner or later you're going to confuse or irritate someone. See the New Hackers Dictionary, for example, specifically sense 8. (Warning: that's the kind of document you'll get sucked ...


5

The theory is that you get support by using metrics: you have to put figures, preferably expressed in dollars (or euros or yens) behind security. Managers manage: they take decisions, based on observed situations and goals to reach. These goals are often expressed (at least in part) in financial terms. Therefore, managers will decide to support/fund/enforce ...


4

After reading ALL that + commentary... You're screwed. Start from scratch. Harden systems, new keys/passwords, VLAN's, VPN... Basically, the whole nine yards. Come @ it from the perspective of a VERY disgruntled ex-admin. Then, defend against those conceivable vectors. He worked remotely, restrict all other remote access except for your VPN(with ...


4

A core element of a security professional's job is to protect the integrity and confidentiality of systems. You can write your description up in many ways. I suggest the following: You know security and you dedicate yourself to that. Because this is a smaller company, you may sometimes do hands-on ops work as a backup, but your primary focus should be ...


4

I just had a flashback to the A+ and NT MCSE days.. back to the topic at hand. Information security tends to fall on two sides: either you do the technical side (aka analyst or engineer ) or the policy side (aka auditor or manager). In a 300 person company I would suspect that you are going to need to do both the technical and policy side. Do a search for ...


4

The SANS Institute offers a brochure on the topic for $5.00: The 20 Coolest Jobs in Information Security. That web page lists the titles along with a few sample descriptions.


4

I had the unfortunate experience of almost the same issue. I lost several nights of sleep over this, I hope this helps you. Short Answer: Start from the outside in. If your applications/internal operations would allow changing IP addresses (if you know they will attack) could be a game changer. In my case I could not do this since the applications ran from ...


Only top voted, non community-wiki answers of a minimum length are eligible