Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Our Approach to Employee Security Training

pagerduty.com

Post reply on HN
Print view View original

41–50 of 76 posts

Re: Our Approach to Employee Security Training

#41

Post by wpietri »

jrudolph wrote: post #10

Very interesting read, can't emphasise enough how important _practicing_ for security is as opposed to mere education. A couple of folks I went to Uni with launched a startup that helps companies conduct automated phishing awareness training and continuous employee sensibilisation by sending "white-hat" phishing emails: IT-Seal https://www.it-seal.de/en.html I can highly recommend giving it a try. The first few level…

I worked at one place that sent a fake phishing email in the employee's first month, and I loved it. I wish they had kept it going, though, doing random re-tests.

It reminds me of the luggage-scanner technology Threat Image Projection: https://www.rapiscansystems.com/en/products/rapiscan-threat-...

Basically I think there's an optimum frequency window for humans detecting and responding to problems. Once real occurrences drop below that frequency, we need to supplement with simulations. Fire drills are the obvious example, but I think we could use a lot more of it.

Re: Our Approach to Employee Security Training

#42

Post by jedberg »

jrudolph wrote: post #10

Very interesting read, can't emphasise enough how important _practicing_ for security is as opposed to mere education. A couple of folks I went to Uni with launched a startup that helps companies conduct automated phishing awareness training and continuous employee sensibilisation by sending "white-hat" phishing emails: IT-Seal https://www.it-seal.de/en.html I can highly recommend giving it a try. The first few level…

> by sending "white-hat" phishing emails

I hate those tests. I've been doing anti-phishing work since before the term was coined, and I fail every one of those tests. Why?

Because I load up a virtual env and click on every link in them to see how good of a phish it is.

I suspect this is a problem limited to a very small set of people, but none the less, it's annoying when our head of security comes over and says, "shouldn't you know better?"

Re: Our Approach to Employee Security Training

#43

Post by sverige »

ams6110 wrote: post #37
sverige wrote: post #32

Earlier quoted context omitted.

Fair enough, but many (probably most) of the people this training is aimed at have no idea what a reverse phone book is. I haven't seen a physical copy of one for a couple of decades. Do you have a source for the origin of the name, or is it just what comes to your mind when you think of it?

I don't have a source, but the analogy seems obvious to me. If you're more curious, I guess you could do your own research?

I have, actually. I can't find a reliable source for the origin of the name, even in the original papers written to describe them.

Re: Our Approach to Employee Security Training

#44

Post by spc476 »

Jsharm wrote: post #28
neotrope wrote: post #4

> 2. Don’t shy away from technical details. > The mere mention of the word “hashing” is probably enough to make non-technical employees’ eyes gloss over. So instead I just call it “Magic”. What..? Why state a principle and then tell us how you violate it a few sentences later.

You're right there's some contradiction, but overall I agree technical subjects are nearly always too dumbed down. People are smart! Give them a chance! Boring!=technical. And you can definitely explain hashing in an easy way.

I would substitute "scramble" with "magic". Something like: "The password is scrambled [1] so no one can see what it was originally. Second, this scrambling method ensures the result is the same length as every other password. Third, that very similar passwords, like 'aaaa' and 'aaab' [2] come out very different looking. And it's impossible [3] to descramble it to the original password."

[1] Using a mathematical concept known as "hashing"---see [link] for futher information.

[2] These are bad passwords; used for an example only.

[3] Not quite impossible, but very darned near impossible. See [link] for more information.

Re: Our Approach to Employee Security Training

#45

Post by IncRnd »

sverige wrote: post #30
flipp3r wrote: post #3

> Concepts such as rainbow tables can then be explained without having to refer to the actual name; we can just demonstrate that you can create a lookup and call it a “magic list”. Names are there for a reason. "magic list" instead of "rainbow table", seriously? You're teaching a concept and then giving it a slightly different name just to make it sound more edgy. People won't be able to find anything about "magic li…

OK, so "rainbow table" is what we all call them, but frankly I've always found that name to be baffling. Why are they called that? What is the origin of the name? What do they have to do with rainbows? Yes, googling "magic list" will not produce the same results as "rainbow table," but it's a good substitute when teaching non-technical people the concept. It might even help them avoid googling unsuccessfully for the…

A rainbow table is named "rainbow table" due to the lines created on a graph when drawing a continuous line through hash and reduction function chain. The graph can visually appear like a rainbow.

A hash function is a one way mapping, and so is a reduction (attempting to invert the hash function but usually failing).

Think of it this way:

Draw a line from plaintext P on the left to hash output H on the right. Then a line from H back to P2 (plaintext 2 on the left), which is the output of the reduction function over H. Draw a line from P2 to H2 (output of the hash function over P2). Do this for a little bit of the chain, and you will visually have a rainbow.

You can also get banding, when drawing them linearly instead of left to right, when taking closed chains into consideration.

If someone sees such a graph of a rainbow table, that explains the concept directly. Caching in a table is just the implementation.

Re: Our Approach to Employee Security Training

#46

Post by tCfD »

sverige wrote: post #32
ams6110 wrote: post #31

Earlier quoted context omitted.

A real rainbow represents all colors: the full spectrum. A rainbow table has all possible passwords within its spectrum (8 characters, alphanumeric, or however it's defined). A non-technical term I might use is to call a rainbow table a "reverse phone book for passwords"

Fair enough, but many (probably most) of the people this training is aimed at have no idea what a reverse phone book is. I haven't seen a physical copy of one for a couple of decades. Do you have a source for the origin of the name, or is it just what comes to your mind when you think of it?

Iirc they acquired that nickname because early rainbow tables, which were in plain text or another simple uncompressed format, looked very much like ASCII rainbow patterns in a text editor due to the iterative nature of the key, salt, and hash stepping.

Re: Our Approach to Employee Security Training

#47

Post by zhte415 »

Jsharm wrote: post #28
neotrope wrote: post #4

> 2. Don’t shy away from technical details. > The mere mention of the word “hashing” is probably enough to make non-technical employees’ eyes gloss over. So instead I just call it “Magic”. What..? Why state a principle and then tell us how you violate it a few sentences later.

You're right there's some contradiction, but overall I agree technical subjects are nearly always too dumbed down. People are smart! Give them a chance! Boring!=technical. And you can definitely explain hashing in an easy way.

> Boring!=technical.

Yes. One of the best trainings I've been on was in my first job.

40+ minutes on... how to adjust your chair, by the health and safety manager. From how to position the arms, to spinning the chair over and adjusting the springyness of the tilt, to levelling the height against a screen. Almost 2 decades later, I remember the take-aways clearly.

Re: Our Approach to Employee Security Training

#48

Post by zw123456 »

jrudolph wrote: post #10

Very interesting read, can't emphasise enough how important _practicing_ for security is as opposed to mere education. A couple of folks I went to Uni with launched a startup that helps companies conduct automated phishing awareness training and continuous employee sensibilisation by sending "white-hat" phishing emails: IT-Seal https://www.it-seal.de/en.html I can highly recommend giving it a try. The first few level…

The company I am currently working for is doing those and they are making it fun for the employees keeping score and doing prizes, people are actually having fun with it. Kind of a cool approach I think, and it seems to be working too.

Re: Our Approach to Employee Security Training

#49

Post by ericpauley »

jedberg wrote: post #42
jrudolph wrote: post #10

Very interesting read, can't emphasise enough how important _practicing_ for security is as opposed to mere education. A couple of folks I went to Uni with launched a startup that helps companies conduct automated phishing awareness training and continuous employee sensibilisation by sending "white-hat" phishing emails: IT-Seal https://www.it-seal.de/en.html I can highly recommend giving it a try. The first few level…

> by sending "white-hat" phishing emails I hate those tests. I've been doing anti-phishing work since before the term was coined, and I fail every one of those tests. Why? Because I load up a virtual env and click on every link in them to see how good of a phish it is. I suspect this is a problem limited to a very small set of people, but none the less, it's annoying when our head of security comes over and says, "sh…

In my experience (at a large institution) these phishing tests haven't flagged a user until personal info was actually entered, or some other vulnerable action was taken. Seems like there would be so many false positives otherwise.

Re: Our Approach to Employee Security Training

#50

Post by fjsolwmv »

jedberg wrote: post #42
jrudolph wrote: post #10

Very interesting read, can't emphasise enough how important _practicing_ for security is as opposed to mere education. A couple of folks I went to Uni with launched a startup that helps companies conduct automated phishing awareness training and continuous employee sensibilisation by sending "white-hat" phishing emails: IT-Seal https://www.it-seal.de/en.html I can highly recommend giving it a try. The first few level…

> by sending "white-hat" phishing emails I hate those tests. I've been doing anti-phishing work since before the term was coined, and I fail every one of those tests. Why? Because I load up a virtual env and click on every link in them to see how good of a phish it is. I suspect this is a problem limited to a very small set of people, but none the less, it's annoying when our head of security comes over and says, "sh…

How many times in your life has that happened?

Why don't you enjoy the opportunity to show off your cleverness to head of security?

Post reply on HN