Our Approach to Employee Security Training • Hacker News Board

Re: Our Approach to Employee Security Training

#21

Post by mightybyte » Sat, May 05, 2018, 7:29 PM UTC

flipp3r wrote: post #3

> Concepts such as rainbow tables can then be explained without having to refer to the actual name; we can just demonstrate that you can create a lookup and call it a “magic list”. Names are there for a reason. "magic list" instead of "rainbow table", seriously? You're teaching a concept and then giving it a slightly different name just to make it sound more edgy. People won't be able to find anything about "magic li…

Completely agree. In particular I think the word "hash" is easy to explain. Just tell them it's kind of like the process of creating corn beef hash. Something goes into the process, and when it comes it it's unrecognizable and and you can reverse the process to get a cow back.

Re: Our Approach to Employee Security Training

#22

Post by [deleted] » Sat, May 05, 2018, 7:29 PM UTC

zachrose wrote: post #15

flipp3r wrote: post #3

> Concepts such as rainbow tables can then be explained without having to refer to the actual name; we can just demonstrate that you can create a lookup and call it a “magic list”. Names are there for a reason. "magic list" instead of "rainbow table", seriously? You're teaching a concept and then giving it a slightly different name just to make it sound more edgy. People won't be able to find anything about "magic li…

Devising a new, more familiar name for something like hashing is a good idea here because it communicates that “this is a complex thing handled by specialists, but it’s implications are important to us.”

[deleted]

Re: Our Approach to Employee Security Training

#23

Post by alangpierce » Sat, May 05, 2018, 7:35 PM UTC

flipp3r wrote: post #3

> Concepts such as rainbow tables can then be explained without having to refer to the actual name; we can just demonstrate that you can create a lookup and call it a “magic list”. Names are there for a reason. "magic list" instead of "rainbow table", seriously? You're teaching a concept and then giving it a slightly different name just to make it sound more edgy. People won't be able to find anything about "magic li…

To be clear, the "magic list" thing is focused on non-engineers, who likely will never need to read or write the term "rainbow table" as part of their job, they just need to be convinced that it's important to use a password manager. The presentation also mentions the technical terminology but switches to less intimidating terminology afterward.

The presentation for engineers uses "hash", "rainbow table", etc without ever using the less intimidating terminology: https://sudo.pagerduty.com/for_engineers/

Re: Our Approach to Employee Security Training

#24

Post by sillysaurus3 » Sat, May 05, 2018, 8:03 PM UTC

scrollaway wrote: post #14

flipp3r wrote: post #11

Earlier quoted context omitted.

> Also, if you continue to RTFA, I RTFpresentations even. Naming Hashing and then switching to Magic is just confusing for everyone involved. Again; it completely ruins effective communication. > for anyone else in a non-technical role, why does it really matter? They're getting security training on the topic of hashing. How does it not matter?? Employees will have to adjust their communication to toddler level anyti…

> They're getting security training on the topic of hashing. How does it not matter?? They're getting taught good password health. You don't need to know what hashing is to know good password health. I shouldn't get upset over comments but it's headdeskingly frustrating to read comments like yours from people who should know better and who, ultimately, contribute to worse personal security for everybody. Comments lik…

There's no reason to get personal. We're all on the same side here.

Re: Our Approach to Employee Security Training

#25

Post by c22 » Sat, May 05, 2018, 8:24 PM UTC

kenrose wrote: post #12

cup-of-tea wrote: post #6

If they can't understand hashing then there's no hope of teaching them security so why even bother?

No, if they can’t understand hashing, then you’ve failed as a teacher. What Rich has done amazingly well here is use the correct term, but then made the “magic” analogy that allows the concept to be more easily understood by people not within engineering. Think sales, marketing, HR, biz dev, etc. For those who are interested, they can look up more about hashing afterwards. But for everyone, the concept of how hashes…

I'm all for the power of analogy, but I agree with others here that "magic" is a pretty lame choice of words. Anything you don't understand can be described as magic, it's a meaningless analogy that doesn't have any more explanatory power than the word hash does to people who don't know it. The presentation was good, but I bet it would have had similar impact if the word hash had just been used throughout.

Re: Our Approach to Employee Security Training

#26

Post by SilasX » Sat, May 05, 2018, 8:28 PM UTC

flipp3r wrote: post #3

> Concepts such as rainbow tables can then be explained without having to refer to the actual name; we can just demonstrate that you can create a lookup and call it a “magic list”. Names are there for a reason. "magic list" instead of "rainbow table", seriously? You're teaching a concept and then giving it a slightly different name just to make it sound more edgy. People won't be able to find anything about "magic li…

When teaching about bitcoin, I say “scrambler function” instead of “hash function” because it better conveys the intuition of what they do — even though it’s longer and non-standard. (Most people I talk to don’t immediately associate “hash” with “make a hash of the whole thing” ie mess it up).

Although I also make sure to give the “decoder ring” and the end to list the actual standard terms for the concepts discussed.

Re: Our Approach to Employee Security Training

#27

Post by u801e » Sat, May 05, 2018, 9:14 PM UTC

Are there any initiatives out there that offer training/guidance in designing systems where even if someone's credentials are compromised, it doesn't really matter. When there are systems out there that still store passwords in an insecure manner and don't require a second form of authentication, then all the training in the world about password hygiene and recognizing phishing attempts won't fix the actual problem.

Re: Our Approach to Employee Security Training

#28

Post by Jsharm » Sat, May 05, 2018, 9:36 PM UTC

neotrope wrote: post #4

> 2. Don’t shy away from technical details. > The mere mention of the word “hashing” is probably enough to make non-technical employees’ eyes gloss over. So instead I just call it “Magic”. What..? Why state a principle and then tell us how you violate it a few sentences later.

You're right there's some contradiction, but overall I agree technical subjects are nearly always too dumbed down. People are smart! Give them a chance! Boring!=technical. And you can definitely explain hashing in an easy way.

Re: Our Approach to Employee Security Training

#29

Post by slavik81 » Sat, May 05, 2018, 10:20 PM UTC

neotrope wrote: post #4

> 2. Don’t shy away from technical details. > The mere mention of the word “hashing” is probably enough to make non-technical employees’ eyes gloss over. So instead I just call it “Magic”. What..? Why state a principle and then tell us how you violate it a few sentences later.

Using the standard name can aid understanding by allowing the audience to connect what you're saying to what they already know. However, if the audience's existing knowledge is tainted by fears, misconceptions and confusion, then the connection may hinder more than it helps. In that case, it might be better to make up a new name so the explanation can stand on its own.

I don't know if "magic" was the best choice, but you can still explain all the details of how it works even if you call it something else.

Re: Our Approach to Employee Security Training

#30

Post by sverige » Sat, May 05, 2018, 10:20 PM UTC

flipp3r wrote: post #3

> Concepts such as rainbow tables can then be explained without having to refer to the actual name; we can just demonstrate that you can create a lookup and call it a “magic list”. Names are there for a reason. "magic list" instead of "rainbow table", seriously? You're teaching a concept and then giving it a slightly different name just to make it sound more edgy. People won't be able to find anything about "magic li…

OK, so "rainbow table" is what we all call them, but frankly I've always found that name to be baffling. Why are they called that? What is the origin of the name? What do they have to do with rainbows?

Yes, googling "magic list" will not produce the same results as "rainbow table," but it's a good substitute when teaching non-technical people the concept. It might even help them avoid googling unsuccessfully for the origin of the actual name. (If you know the origin, I'd love to know, and so would the people at Wikipedia.)