Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Our Approach to Employee Security Training

pagerduty.com

Post reply on HN
Print view View original

51–60 of 76 posts

Re: Our Approach to Employee Security Training

#51

Post by fjsolwmv »

u801e wrote: post #27

Are there any initiatives out there that offer training/guidance in designing systems where even if someone's credentials are compromised, it doesn't really matter. When there are systems out there that still store passwords in an insecure manner and don't require a second form of authentication, then all the training in the world about password hygiene and recognizing phishing attempts won't fix the actual problem.

In the research this is called "capabilities", limiting your account, not giving everyone root. Also, there is fraud detection, stuff like automatic alerts when the same credential is used in two places at once, or with unusual access patterns.

Obviously it's impossible for compromising credentials to have no consequences -- if case, why do you have credentials?

Re: Our Approach to Employee Security Training

#52

Post by fjsolwmv »

merrington wrote: post #8
flipp3r wrote: post #3

> Concepts such as rainbow tables can then be explained without having to refer to the actual name; we can just demonstrate that you can create a lookup and call it a “magic list”. Names are there for a reason. "magic list" instead of "rainbow table", seriously? You're teaching a concept and then giving it a slightly different name just to make it sound more edgy. People won't be able to find anything about "magic li…

How many non-engineers would you expect to take the interest/time to investigate rainbow tables after this? Also, if you follow the link to the actual presentation ( https://sudo.pagerduty.com/for_everyone/#hashing for the lazy) then you'll see the author DOES indeed call it hashing, before switching to "magic" so as to make it easier for individuals without a technical background to not have to constantly think abou…

It doesn't make it easier though. Hashing makes a hash of the password -- chops it and scrambles it so you can see what it came from. Calling everything "magic" just conflates everything with e everything else, confusing everyone.

Re: Our Approach to Employee Security Training

#53

Post by fjsolwmv »

sverige wrote: post #32
ams6110 wrote: post #31

Earlier quoted context omitted.

A real rainbow represents all colors: the full spectrum. A rainbow table has all possible passwords within its spectrum (8 characters, alphanumeric, or however it's defined). A non-technical term I might use is to call a rainbow table a "reverse phone book for passwords"

Fair enough, but many (probably most) of the people this training is aimed at have no idea what a reverse phone book is. I haven't seen a physical copy of one for a couple of decades. Do you have a source for the origin of the name, or is it just what comes to your mind when you think of it?

The people in the training haven't used "magic" recently either, seeing as magic doesn't exist.

Re: Our Approach to Employee Security Training

#54

Post by fjsolwmv »

ams6110 wrote: post #37
sverige wrote: post #32

Earlier quoted context omitted.

Fair enough, but many (probably most) of the people this training is aimed at have no idea what a reverse phone book is. I haven't seen a physical copy of one for a couple of decades. Do you have a source for the origin of the name, or is it just what comes to your mind when you think of it?

I don't have a source, but the analogy seems obvious to me. If you're more curious, I guess you could do your own research?

There's no need to comment if you aren't sharing any information or ideas.

Re: Our Approach to Employee Security Training

#55

Post by fencepost »

neotrope wrote: post #4

> 2. Don’t shy away from technical details. > The mere mention of the word “hashing” is probably enough to make non-technical employees’ eyes gloss over. So instead I just call it “Magic”. What..? Why state a principle and then tell us how you violate it a few sentences later.

Hashing should be fairly easy to explain - start with a picture of some whole vegetables and maybe a meat (though perhaps not an actual pig....), show them all chopped up, and show a "breakfast skillet" at the end. While discussing, make sure you point out that computers are machines that are really good at doing repetitive tasks like chopping numbers up the same way every time and recombining them.

Heck, that can even make it easy to slip discussion of "salting" in there.

Re: Our Approach to Employee Security Training

#56

Post by jedberg »

ericpauley wrote: post #49
jedberg wrote: post #42

Earlier quoted context omitted.

> by sending "white-hat" phishing emails I hate those tests. I've been doing anti-phishing work since before the term was coined, and I fail every one of those tests. Why? Because I load up a virtual env and click on every link in them to see how good of a phish it is. I suspect this is a problem limited to a very small set of people, but none the less, it's annoying when our head of security comes over and says, "sh…

In my experience (at a large institution) these phishing tests haven't flagged a user until personal info was actually entered, or some other vulnerable action was taken. Seems like there would be so many false positives otherwise.

Maybe they’ve gotten better since I started ignoring them. But back in the day they flagged you the moment you clicked.

Re: Our Approach to Employee Security Training

#57

Post by CaptainZapp »

wpietri wrote: post #41
jrudolph wrote: post #10

Very interesting read, can't emphasise enough how important _practicing_ for security is as opposed to mere education. A couple of folks I went to Uni with launched a startup that helps companies conduct automated phishing awareness training and continuous employee sensibilisation by sending "white-hat" phishing emails: IT-Seal https://www.it-seal.de/en.html I can highly recommend giving it a try. The first few level…

I worked at one place that sent a fake phishing email in the employee's first month, and I loved it. I wish they had kept it going, though, doing random re-tests. It reminds me of the luggage-scanner technology Threat Image Projection: https://www.rapiscansystems.com/en/products/rapiscan-threat-... Basically I think there's an optimum frequency window for humans detecting and responding to problems. Once real occurre…

"It reminds me of the luggage-scanner technology Threat Image Projection"

Yeah, thanks to those I once was asked what that huge hypodermic needle is doing in my hand luggage. I didn't really have a clue and it disappeared, when they scanned it for the second time.

It was an European airport with reasonable security scanners so overall it was a quite funny experience.

Re: Our Approach to Employee Security Training

#58

Post by wpietri »

CaptainZapp wrote: post #57
wpietri wrote: post #41

Earlier quoted context omitted.

I worked at one place that sent a fake phishing email in the employee's first month, and I loved it. I wish they had kept it going, though, doing random re-tests. It reminds me of the luggage-scanner technology Threat Image Projection: https://www.rapiscansystems.com/en/products/rapiscan-threat-... Basically I think there's an optimum frequency window for humans detecting and responding to problems. Once real occurre…

"It reminds me of the luggage-scanner technology Threat Image Projection" Yeah, thanks to those I once was asked what that huge hypodermic needle is doing in my hand luggage. I didn't really have a clue and it disappeared, when they scanned it for the second time. It was an European airport with reasonable security scanners so overall it was a quite funny experience.

Hah! As I understand it, machines with TIP have a button they're supposed to press as soon as they see a threat. Then any fake threats go away. Weird that they didn't do that in your case.

Re: Our Approach to Employee Security Training

#59

Post by CaptainZapp »

wpietri wrote: post #58
CaptainZapp wrote: post #57

Earlier quoted context omitted.

"It reminds me of the luggage-scanner technology Threat Image Projection" Yeah, thanks to those I once was asked what that huge hypodermic needle is doing in my hand luggage. I didn't really have a clue and it disappeared, when they scanned it for the second time. It was an European airport with reasonable security scanners so overall it was a quite funny experience.

Hah! As I understand it, machines with TIP have a button they're supposed to press as soon as they see a threat. Then any fake threats go away. Weird that they didn't do that in your case.

Maybe there was such a button and they rescan it anyway?

After all they have to ensure that there's no other dodgy stuff in there, which may have been obscured by the imposed image.

Re: Our Approach to Employee Security Training

#60

Post by noobhacker »

skissane wrote: post #34
slavik81 wrote: post #29

Earlier quoted context omitted.

Using the standard name can aid understanding by allowing the audience to connect what you're saying to what they already know. However, if the audience's existing knowledge is tainted by fears, misconceptions and confusion, then the connection may hinder more than it helps. In that case, it might be better to make up a new name so the explanation can stand on its own. I don't know if "magic" was the best choice, but…

One thing I dislike about medical doctors, is many of them try to "dumb things down" when talking to me. I'd much prefer they tell me the correct technical medical terminology. Some of it I already know what it means, and if I don't I can always ask them to explain further, or go look it up and read more about it. (My mother and brother are doctors, and I don't get the feeling they are dumbing things down if I ask th…

As a TA of statistics for non-statistics major, I find it hard to choose the appropriate level of complexity because every audience has a different expectation. I'd encourage you to communicate with your doctors that you'd like the full details and terminology. Otherwise they simply can't know what you want.
Post reply on HN