331–340 of 357 posts
Earlier quoted context omitted.
You can wave any object at the sensor. Maybe an unauthorized tag will yield a different beep or make the light flash a different color. Maybe the person in front of you will be in a position to see the light on the reader, maybe they'll notice, and maybe they'll consider it odd. Getting that far, and then actually deciding to challenge you or report it, is a vanishingly small chance. There is no point in badging an u…
Agree. The whole idea of 'challenging tailgating' falls apart because someone walking in after you is not performing a strange act. You would have to actively close the door _on_ people, including your colleagues, which goes against social norms to such an extreme extent that it's just not happening.
Earlier quoted context omitted.
Agree. The whole idea of 'challenging tailgating' falls apart because someone walking in after you is not performing a strange act. You would have to actively close the door _on_ people, including your colleagues, which goes against social norms to such an extreme extent that it's just not happening.
If, as a company, you actually care about tailgating, there is no "challenge" aspect. There's a barrier that lets one person through at a time at most, and you remove any and all social aspects to it.
Earlier quoted context omitted.
The German U-Bahn has a brilliant solution to this. No turnstiles or gates, you're just expected to have a ticket. The penalty for getting caught without a ticket is considered sufficiently high to make "Schwarzfahren" statistically more expensive.
While I agree that the solution is brilliant (and obvious), I'd like to note that freeriding (Schwarzfahren) is not statistically more expensive in monetary terms (the fine is not that large, controls are not that frequent and tickets are not that cheap). The social stigma, unpredictability and inconvenience of having to pay the fine is a big part of it (not having a ticket is just stressful). Another part is that yo…
Obviously "not having too many unauthorized riders" is a very different objective from "only allowing authorized access and refusing all else".
Earlier quoted context omitted.
I don't think background noise of broad, low-effort phishing emails can be directly compared to a more focused attack. If you work somewhere with interesting data the odds of a good phishing attack leading to an exploit could be much higher because you're being specifically targeted and they're not going to send the message until they have a current exploit ready (probably hoping to get it in before your IT departmen…
If someone had a working browser exploit, wouldn't they just deliver it to their targets via an ad network? AFAIK most enterprises don't mandate ad blocking or noscript.
I've heard more people at enterprises using ad blockers for security so I wouldn't rule that out but in general this is hitting that the broad vs. targeted distinction I mentioned: each time you use an exploit you're risking discovery, which will lead to it being patched & AV signatures going out. Using an ad network increases the number of people who are not your target getting the payload, not to mention any scanning the network does, and since ad networks require payment there's another trail pointing back to you which might not otherwise be the case if you are hosting things on compromised servers.
Earlier quoted context omitted.
It would still trigger the fail. Typically the link contains an identifier and the landing page is hosted on a public facing web server.
I wonder what happens when a bot crawls one of the phishing sites and triggers all the unique links...
Earlier quoted context omitted.
The German U-Bahn has a brilliant solution to this. No turnstiles or gates, you're just expected to have a ticket. The penalty for getting caught without a ticket is considered sufficiently high to make "Schwarzfahren" statistically more expensive.
While I agree that the solution is brilliant (and obvious), I'd like to note that freeriding (Schwarzfahren) is not statistically more expensive in monetary terms (the fine is not that large, controls are not that frequent and tickets are not that cheap). The social stigma, unpredictability and inconvenience of having to pay the fine is a big part of it (not having a ticket is just stressful). Another part is that yo…
Earlier quoted context omitted.
On the other hand, all the security team needs to do is point to the number of billion-dollar breaches that have happened due to phishing. If phishing tests are a game, then so are DR tests, so are code reviews, so is the QA department. If phishing tests are a game, then so are your yearly performance reviews, or showing up to work on time, or meeting your deadlines. Not destroying the company through your own neglig…
So, do the security guys get fired when they misconfigure a firewall or give the wrong settings for a database?
Earlier quoted context omitted.
>At the very least you're giving away everything your browser (even Lynx) puts in the headers of a request. Which you're giving away any time you browse any external web site. >Lynx supports cookies too so it would be possible to track a user between sessions. You're downloading cookies for most external web sites. If the worst you do is the same as going to espn.com, then reprimand people for going to any external w…
The point is that you're giving data to a known phishing site by visiting the link in a phishing email. It's true that ESPN might also be a phishing site but it's less likely.
Phish tests need to be fair to people who actually understand something about security. "Opening an email" is not actually an issue (spearphishers that sit on drive-by 0-days in current browsers or email programs are not a threat model that most orgs can possibly defend against). Opening attachements is hard to measure and again needs context: What kind of software and sandbox was the attachement opened with? Attacke…