45

Of course no one wants to report, they are "turning in" their peers. Also, the time and complexity it takes to go through the reporting process you described is another negative reinforcement. You are only going to get low compliance if everything is a negative. And ... YOU CANNOT FORCE PEOPLE TO DO ANYTHING!! You are approaching the problem backwards. You ...


35

My 2cents here: While not technically illegal these companies have managed to develop malware and exploits, without anyone bugging them, because they sell them to governments, law enforcement agencies, secret services, organizations and, in case of some of the companies, to anyone else interested. Such companies include: VUpen Paladion More information ...


34

I can't comment on the actual job scene, but I do know a bit about the statistics of cybercrime. In terms of financial gain, the stats are quite interesting. In terms of profit, the top three are as follows: Pay-per-click advertising fraud - Wasn't so much of a profit-maker until recently, but blackhats seem to have focused on this method more intensely ...


31

When looking for actual physical risks, doxing and the results are most important. There are examples of the hivemind of Reddit and 4chan where peoples exact locations, addresses, names and anything else might useful for actual physical attacks (or swatting) available online to which I will not link for obvious reasons. The amount of information that can ...


16

Although there are exceptions, generally managers do things for one of two reasons: Doing it will make them look good Not doing it will make them look bad Now apply this to your management to see who the key stakeholders are: Stakeholder 1: Somebody's allocated money for anti-virus, which ought to make the manager who owns the AV look good. However, if ...


15

For example, I had experienced this in my practice: When penetration testing one company, I got access to the system via a password recovery form, because the mail server provided options for security questions like "name of your dog" and "your school". This information was displayed in profiles in social networks. Having many accounts makes it difficult ...


14

One option not mentioned here is espionage. Patriotism or corporate funding could be part of the reason you might end up in espionage. Corporate As a espionage contract worker you could charge a pretty high fee for doing any of a number of different black hat operations. Stealing, corporate information (design plans, blackmail, corrupting data, stealing ...


12

The "look at us on holiday" type of pictures are of interest because they can be viewed without arousing suspicion or notice, unlike keeping an eye on the house istelf. A single approach to a house that's expected to be empty could then lead to a break-in. If the same or a linked account includes pictures of valuables (whether as the subject -- "look at my ...


10

This is really about closing the gap between Information Security and Business objectives. For most security departments today, the battle selling Information Security to the board is the major challenge. Usually, board members don't care about "good securityā€¯, they care about "good enough security". InfoSec is rarely clearly defined in most organizations ...


10

Encouraging your employees to snitch on each other by sending documentation of minor misbehavior to a centralized email address is a terrible idea for work climate. Nobody does it because nobody wants their colleagues to hate them and nobody wants to build a work environment governed by a denunciation culture. The resistance to your process is not just ...


10

One risk that isn't mentioned, but is very real for a lot of people, is identity theft. Identity theft is the act of someone using your identity, usually to do criminal things. Lots of people tend to post a photo of their passport/identity card/drivers license/certificate with full name and/or anything else with a social security number at some point, ...


7

Like NlightNFotis's answer, there are a number of companies writing legal malware for governments, which are vendors at the ISS World Training. I documented them here: http://0xdabbad00.com/2011/12/10/legal-malware/


7

The basic rules that the big companies follow aren't very much different from the rules/recommendations by popular infosec standards (e.g. ISO27k): Segregation of duties - separation on services provisioning, development process, or any other part of IT services, so different people are responsible for the various components/stages of service delivery, ...


7

First thought that comes to mind is whether it is even legal to require all those documents. Passport makes sense (what happens if you don't have a current passport?), but demanding bank statements is a bit skeezy. Common, but skeezy (just because many companies insist on something, doesn't make it legal). That said, this is an issue to ask a local lawyer, ...


7

Few years ago there was a strong opposition to Gawker Stalker app for posting current locations of celebrities. The main argument for the app was: By posting someone's location out on a public forum, you allowed stalkers/psycopaths to reach there with guns and be ready when they come out of the building. This is an incredibly scary physical threat. ...


6

I'd say you're pushing Theory X and Theory Y too far away from their original position. The original posit of the theories relates to a relationship between people and authority. The people are in a system in which the manager has a significant degree of control over employment conditions and outcomes. The social engineering concepts and strategies run ...


6

I would imagine most of the money would be in organized crime rings, operating botnets to distribute malware. From there they can attack individual bank customers to steal money or setup mule accounts. They could also rent out their botnets to others do to distributing computing. Probably a lot of spyware is still out there, maybe you inject your affiliate ...


6

I'd like to respectfully offer a different perspective from the perfectly valid answer and comments already here. I'm reading between the lines a lot, but I believe the original question is trying to achieve quite a good (and difficult) thing - prioritize security awareness at departmental level, with objective measurements of awareness. The effect being ...


6

What generally is done is to hire a security expert who creates a custom webserver hardening standard and baseline, adjusted to your company's needs. The standard defines which security controls should be in place, technology independant. Then the baseline can be technology specific, e.g. IIS or Apache,... The baseline can be implemented by your system ...


5

The theory is that you get support by using metrics: you have to put figures, preferably expressed in dollars (or euros or yens) behind security. Managers manage: they take decisions, based on observed situations and goals to reach. These goals are often expressed (at least in part) in financial terms. Therefore, managers will decide to support/fund/enforce ...


4

(Full disclosure: I build and run software pen-testing and security teams as a sub-function of building security software, and developing software securely. My company is not listed in any of the services recommendations below.) Should you build a security team or pen-testing team? While a few responders here have alluded to internal penetration testing, ...


4

In addition to what Eric has said, there is another money generating field out there - coding custom malware. An example is of this guy - Tataye - author of the famous Beast Trojan. He is now selling his work for monnies at http://www.spytector.com/. Another example is this guy - http://www.nuclearwintercrew.com/Buy-Princeali/ Sky is only the limit if you ...


4

Partially anecdotally - it does look like barring a handful of exceptions, the only big winners in this business are the organised crime gangs, who are in a position to use skilled exploit writers, hackers, social engineers etc to create money makers. While some of these exploit coders get paid reasonably well (for example the blackhat exploit market pays 5 ...


4

Since this question was originally asked, the industry has been working to come up with an answer. NIST's National Initiative for Cybersecurity Education (NICE) Cybersecurity Workforce Framework outlines a definitive list, and it describes 52 work roles in information security. Authorizing Official/Designating Representative Security Control Assessor ...


4

Email is unsafe -- deal with it. Email can be made safe for an adequately defined value of "safe", through the use of signatures (S/MIME or OpenPGP). This is not as easy as it seems (I mean, it does not look easy, but in reality it is worse). The cornerstone of the system is that unsigned emails should be rejected automatically; human users should never see ...


4

Information security is all about risk management, it's not about being positive or negative, but about being factual. In risk management we take the likelihood, assess the exposure of attack (vulnerability) and then there is an actor with a certain motivation or any circumstance or event with the potential to adversely impact an asset. Now if we take your ...


4

In the UK, law is a strong factor. The Human Rights Act 1998 states: Everyone has the right to respect for his private and family life, his home and his correspondence. So if any users that are caught up in the penetration test have an "expectation of privacy", then you are required by law to inform them prior to any testing. Note that just because ...


4

I find it interesting to speak to the one who ever thought this was a good way to achieve results. The stimulus is extremely negative. You ask people to snitch on their co-workers. They must do this in full view of other co-workers (taking photographs). You clearly distrust the offender to 'own up' and the snitch to report honestly, as you require hard ...


4

As this answer says, some personal information can be answers to security questions, possible allowing someone to access your email. I want to clarify the physical risks associated with that, since the connection was not made clear in that answer. Losing your email can further compromise your personal information (and online assets, bank accounts, etc.), ...


3

Email is an insecure communication channel. The "to" and "from" headers can be set to anything. Anything can be written into the body of an email message. This includes changing the quote text. The first issue of manipulating "to" and "from" headers can be prevented in a closed environment such as company internal mail. The company mail server can verify ...


Only top voted, non community-wiki answers of a minimum length are eligible