Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Our Approach to Employee Security Training

pagerduty.com

Post reply on HN
Print view View original

31–40 of 76 posts

Re: Our Approach to Employee Security Training

#31

Post by ams6110 »

sverige wrote: post #30
flipp3r wrote: post #3

> Concepts such as rainbow tables can then be explained without having to refer to the actual name; we can just demonstrate that you can create a lookup and call it a “magic list”. Names are there for a reason. "magic list" instead of "rainbow table", seriously? You're teaching a concept and then giving it a slightly different name just to make it sound more edgy. People won't be able to find anything about "magic li…

OK, so "rainbow table" is what we all call them, but frankly I've always found that name to be baffling. Why are they called that? What is the origin of the name? What do they have to do with rainbows? Yes, googling "magic list" will not produce the same results as "rainbow table," but it's a good substitute when teaching non-technical people the concept. It might even help them avoid googling unsuccessfully for the…

A real rainbow represents all colors: the full spectrum. A rainbow table has all possible passwords within its spectrum (8 characters, alphanumeric, or however it's defined).

A non-technical term I might use is to call a rainbow table a "reverse phone book for passwords"

Re: Our Approach to Employee Security Training

#32

Post by sverige »

ams6110 wrote: post #31
sverige wrote: post #30

Earlier quoted context omitted.

OK, so "rainbow table" is what we all call them, but frankly I've always found that name to be baffling. Why are they called that? What is the origin of the name? What do they have to do with rainbows? Yes, googling "magic list" will not produce the same results as "rainbow table," but it's a good substitute when teaching non-technical people the concept. It might even help them avoid googling unsuccessfully for the…

A real rainbow represents all colors: the full spectrum. A rainbow table has all possible passwords within its spectrum (8 characters, alphanumeric, or however it's defined). A non-technical term I might use is to call a rainbow table a "reverse phone book for passwords"

Fair enough, but many (probably most) of the people this training is aimed at have no idea what a reverse phone book is. I haven't seen a physical copy of one for a couple of decades.

Do you have a source for the origin of the name, or is it just what comes to your mind when you think of it?

Re: Our Approach to Employee Security Training

#33

Post by gukov »

jrudolph wrote: post #10

Very interesting read, can't emphasise enough how important _practicing_ for security is as opposed to mere education. A couple of folks I went to Uni with launched a startup that helps companies conduct automated phishing awareness training and continuous employee sensibilisation by sending "white-hat" phishing emails: IT-Seal https://www.it-seal.de/en.html I can highly recommend giving it a try. The first few level…

Kevin Mitnick's KnowBe4 does it too.

Re: Our Approach to Employee Security Training

#34

Post by skissane »

slavik81 wrote: post #29
neotrope wrote: post #4

> 2. Don’t shy away from technical details. > The mere mention of the word “hashing” is probably enough to make non-technical employees’ eyes gloss over. So instead I just call it “Magic”. What..? Why state a principle and then tell us how you violate it a few sentences later.

Using the standard name can aid understanding by allowing the audience to connect what you're saying to what they already know. However, if the audience's existing knowledge is tainted by fears, misconceptions and confusion, then the connection may hinder more than it helps. In that case, it might be better to make up a new name so the explanation can stand on its own. I don't know if "magic" was the best choice, but…

One thing I dislike about medical doctors, is many of them try to "dumb things down" when talking to me. I'd much prefer they tell me the correct technical medical terminology. Some of it I already know what it means, and if I don't I can always ask them to explain further, or go look it up and read more about it.

(My mother and brother are doctors, and I don't get the feeling they are dumbing things down if I ask them for medical advice.)

A professional who talks about technical details, even if I don't completely understand those details, gives me the impression that they know what they are talking about, and that makes me feel confident in their abilities.

Re: Our Approach to Employee Security Training

#35

Post by dbasedweeb »

skissane wrote: post #34
slavik81 wrote: post #29

Earlier quoted context omitted.

Using the standard name can aid understanding by allowing the audience to connect what you're saying to what they already know. However, if the audience's existing knowledge is tainted by fears, misconceptions and confusion, then the connection may hinder more than it helps. In that case, it might be better to make up a new name so the explanation can stand on its own. I don't know if "magic" was the best choice, but…

One thing I dislike about medical doctors, is many of them try to "dumb things down" when talking to me. I'd much prefer they tell me the correct technical medical terminology. Some of it I already know what it means, and if I don't I can always ask them to explain further, or go look it up and read more about it. (My mother and brother are doctors, and I don't get the feeling they are dumbing things down if I ask th…

It also makes researching what they talked about much much easier. I can google “demyelination” while some metaphorical treatment of the topic involving insulated wires may be substantially less amenable to that.

Re: Our Approach to Employee Security Training

#36

Post by akavi »

c22 wrote: post #25
kenrose wrote: post #12

Earlier quoted context omitted.

No, if they can’t understand hashing, then you’ve failed as a teacher. What Rich has done amazingly well here is use the correct term, but then made the “magic” analogy that allows the concept to be more easily understood by people not within engineering. Think sales, marketing, HR, biz dev, etc. For those who are interested, they can look up more about hashing afterwards. But for everyone, the concept of how hashes…

I'm all for the power of analogy, but I agree with others here that "magic" is a pretty lame choice of words. Anything you don't understand can be described as magic, it's a meaningless analogy that doesn't have any more explanatory power than the word hash does to people who don't know it. The presentation was good, but I bet it would have had similar impact if the word hash had just been used throughout.

I think there's some value for swapping out one semantically opaque word that seems intimidating/"engineer-y" for another equally semantically opaque word that instead connotes "hey, I'm on your side in helping you understand this".

Ie, the value isn't in the word choice itself, but rather in signalling that you empathize with your audience's discomfort.

Re: Our Approach to Employee Security Training

#37

Post by ams6110 »

sverige wrote: post #32
ams6110 wrote: post #31

Earlier quoted context omitted.

A real rainbow represents all colors: the full spectrum. A rainbow table has all possible passwords within its spectrum (8 characters, alphanumeric, or however it's defined). A non-technical term I might use is to call a rainbow table a "reverse phone book for passwords"

Fair enough, but many (probably most) of the people this training is aimed at have no idea what a reverse phone book is. I haven't seen a physical copy of one for a couple of decades. Do you have a source for the origin of the name, or is it just what comes to your mind when you think of it?

I don't have a source, but the analogy seems obvious to me. If you're more curious, I guess you could do your own research?

Re: Our Approach to Employee Security Training

#38

Post by [deleted] »

alangpierce wrote: post #18
neotrope wrote: post #4

> 2. Don’t shy away from technical details. > The mere mention of the word “hashing” is probably enough to make non-technical employees’ eyes gloss over. So instead I just call it “Magic”. What..? Why state a principle and then tell us how you violate it a few sentences later.

I think the point is that technical terminology and technical details are different things, and the latter is much more important. The alternative is to say "hashing is a technical topic, and technical terms intimidate and confuse people, so we won't mention hashing". Instead, the article says that you should try to make hashing approachable and non-intimidating, since understanding the ideas around hashing will help…

[deleted]

Re: Our Approach to Employee Security Training

#39

Post by zephharben »

u801e wrote: post #27

Are there any initiatives out there that offer training/guidance in designing systems where even if someone's credentials are compromised, it doesn't really matter. When there are systems out there that still store passwords in an insecure manner and don't require a second form of authentication, then all the training in the world about password hygiene and recognizing phishing attempts won't fix the actual problem.

"security in depth". This is the kind of problem that can't be solved via specific technology choices, or technical standards.

Instead, it's a matter of understanding that most attacks involve several pivot points; and that these pivots are possible because we treat internal networks as if they are "safe spaces" where we can let our guard down.

Re: Our Approach to Employee Security Training

#40

Post by techman9 »

flipp3r wrote: post #3

> Concepts such as rainbow tables can then be explained without having to refer to the actual name; we can just demonstrate that you can create a lookup and call it a “magic list”. Names are there for a reason. "magic list" instead of "rainbow table", seriously? You're teaching a concept and then giving it a slightly different name just to make it sound more edgy. People won't be able to find anything about "magic li…

> That said, I didn’t want to mislead people. So we chose to be clear to them that there is a technical term; it’s just not going to be important for the rest of the content.
Post reply on HN