Here's an idea for an analogy that I think is fairly accurate while generally understandable:
A bank requires two forms of ID to get a loan: a driver's license and a birth certificate. Bank employees Alice and Bob are lazy in different ways: Alice always stamps "driver's license verified" without checking, while Bob always stamps "birth certificate ...
The nice and educational way
This is a bit similar to your third bullet point.
Nobody else should know your password, not even people you trust. That is the only way you can be sure only you have access to your account. Let's say you give me your Facebook password and a week later rumors start spreading about what you did in Las Vegas last year.
This post is about communication with people that have absolutely no technical knowledge or interest; especially people afraid of technology.
Don't explain, don't complain
It is incredible hard to change other people, especially if they are IT laymen and you are the expert.
This is the same issue as in general communications. Avoid all sentences that ...
In my experience management doesn't like to listen to clever analogies. Depending on the person they care about the bottom line in dollars or hours of productivity. I would explain:
The actual bottom line is that a compromise of our data will cost the
company approximately X dollars + Y hours to recover. This is Z%
likely to happen given the malware ...
I think there is an underlying problem that you will need to address. Why do the users care that they are failing?
Phishing simulations should, first and foremost, be an education tool not a testing tool.
If there are negative consequences to failing, then yes, your users are going to complain if the tests are more difficult than you have prepared them ...
Ensure there is a method for users to reset their own passwords, and make a policy whereby the helpdesk will initiate a password reset if a password is revealed to them.
Users will tend to phone up when they can't log in, and therefore triggering the same password reset process as they can themselves results in them slowly learning that it doesn't help to ...
Funny enough, I actually don't accept your premise. As an IT professional you can read other people's emails and other communication, delete their directories etc. It is part of the professional code of conduct not to abuse your position. People trust your integrity, the same way they trust their bank's employees not to steal their money, although they could....
You don't need to lock your front door unless you're a thief.
It's the same idea in all relevant respects.
Each person needs to take reasonable measures to protect himself and his property from those who would harm him or his property, in accordance with his best judgment of the risks.
You buy a lock and lock your front door if you live in a city, in ...
One real world example - when you are naked in your shower, not doing anything wrong, would you like it if everyone came by and took pictures? Or televised your shower for the world? Probably not.
Another example - if I send a love letter, or write a will dividing up my savings, should that be published on the front page of the national papers? Again - no.
We have been getting push back from end users that they have no way of distinguishing a legitimate email that they would receive day to day from truly malicious phishing emails.
This is an indication that tests that could be rooted out as fakes by trained security professionals are being used to evaluate people who aren't. You may have the skills to pick ...
Your answer is pretty OK, but you could explain the ongoing "game" between spammers and spamfilters a bit more. This makes it understandable why some spam always will find its way to the customer.
Spam filters try to catch all mail that is spam.
Spammers try to create mails that are trusted not to be spam - both by spam filters and by humans.
I would avoid the biological or non-business analogies (unless this is a hospital). Your job is to assess risk, cost, and provide options. Your management's job is to make the decision based on your analysis and advice.
Generally, an approach in a tabular format is best. "approach", "likelihood of correcting the problem", "cost" are the minimum needed. ...
Quarantine is nothing but a place to store the infected/suspicious files. When you quarantine a file it is deleted from the actual place and moved to the quarantine location (to the path that your anti-virus program has for them).
This is something like keeping a zombie inside a jail. Obviously it is not a threat as long as you don't open the cage.
Why security indicators fail vs. phishing
There is no action that can be taken that is economically viable. Put another way, it's too effortful to defend against phishing attacks. See 'So long and no thanks for the externalities' for an example on the US economy and information workers.
You are correct that checking for URL correctness is error-prone, and ...
Just change the password after you're done helping them, and send them a password reset link. They will soon learn that it's easier to keep their passwords safe than to restore them.
Alternatively (e.g. for a primary e-mail account), simply change their password to a strong one and communicate it to them. Explain that changing passwords and using computer ...
The situation is: people working independently without coordination, to design functionality meant to be useful locally, but when combined, created a disaster.
The first historical references that come to mind:
the chaos of the UK rail system where each train line owner ran their own tracks, track sizes, trains, and timetables (and sometimes, their own ...
Here's a perfect example: the loss of the Mars Climate Orbiter.
A NASA review board found that the problem was in the software controlling the orbiter's thrusters. The software calculated the force the thrusters needed to exert in pounds of force. A separate piece of software took ...
There are a great many tweets, blog posts, articles, papers and books on this topic. Here are summaries of three of them in order of accessibility. First some quips in response to the classic question (from Schneier, see below for why these aren't the right answer though).
"If I'm not doing anything wrong, then you have no cause to watch me."
"Because the ...
There's one possible point to make that I haven't seen in other answers, but have seen in the real world.
Users say they "have no way of distinguishing a legitimate email that they would receive day to day from truly malicious phishing emails". What this may tell you, is that legitimate emails about password renewals, service changes and such, do not obey ...
You can drink all the red wine anti-virus you want to try and prevent getting cancer, but once you get that first tumor, more drinking isn't going to help. You need to cut it out and make sure that you get all of it, because if you don't it will come back again.
Once you get infected with a virus, the obvious symptoms are an annoyance, but it is what you ...
Allow any passwords. Just highlight consequences.
Your scheme is weird and alien to users and I believe many people would rather stop using your service than comply. Instead of letting them choose their own password, you're forcing them to remember one you chose for them. This is unacceptable to most people. You think that you're giving them a choice by "...
My first thought is to ask, “Do you have anything valuable that you don’t want someone else to have?”
If the answer is Yes then follow up with “Are you doing anything to protect it?”
From there you can suggest ways to protect what is valuable (do threat modeling, attack modeling, etc.).
Code is written in English-based languages, and coders from any country generally know enough English not to need their native language even in comments.
The most accurate way of identifying a writer's country of origin in such a scenario is based on counting the frequency of various types of mistakes they make in English. This calls for scientific ...
This brings to mind the Hyatt Regency walkway collapse in 1981. TL;DR the architect stipulated one design, a manufacturer on contract substituted their own design, mechanical failure (and fatality) ensues. It is a common case study for engineering students.
EDIT to provide ...
While I previously stated that this might be a good option, the world has changed, and the use of EV is no longer a particularly reliable indicator, even given the drawbacks mentioned below. There are articles such as this one from Troy Hunt which explain the full issue, but, in short, browsers are no longer treating EV certificates as ...
I think what op is describing best corresponds to Swiss Cheese security:
The Swiss cheese model of accident causation illustrates that,
although many layers of defense lie between hazards and accidents,
there are flaws in each layer that, if aligned, can allow the accident
As the Miranda Rights say: "anything you say can and will be used against you in a court of law". Right after the police finish giving you the Miranda rights, they then say "but if you are innocent, why don't you talk to us?". This leads to many people getting convicted of crimes because it is indeed used against them in a court of law. This is a great video ...
Turn the question around
We would need a society where everyone was trustworthy.
All ISP's that handle my traffic.
All Web sites.
All users on the Internet, for every country.
All governments (how many wars right now).
All staff of every company.
All aliens (they are out there).
If we don't encrypt communication and lock systems then it ...