Slashdot Mirror
Schneier: Security Awareness Training 'a Waste of Time'
An anonymous reader writes "Security guru Bruce Schneier contends that money spent on user awareness training could be better spent and that the real failings lie in security design. 'The whole concept of security awareness training demonstrates how the computer industry has failed. We should be designing systems that won't let users choose lousy passwords and don't care what links a user clicks on,' Schneier writes in a blog post on Dark Reading. He says organizations should invest in security training for developers. He goes on, '... computer security is an abstract benefit that gets in the way of enjoying the Internet. Good practices might protect me from a theoretical attack at some time in the future, but they’re a bother right now, and I have more fun things to think about. This is the same trick Facebook uses to get people to give away their privacy. No one reads through new privacy policies; it's much easier to just click "OK" and start chatting with your friends. In short: Security is never salient.'"
It demonstrates that car industry has failed. We should be designing systems that don't need seatbelts and don't care if user decides to slam into a tree at 100km/h. Whole concept of secure driving is just an abstract benefit that gets in the way of enjoying driving.
Users can screw up because they are just as human as you. So live with it. Design around it. Make it safe regardless.
I've only been saying that since, mwah, 1999 or so.
Policies are OK, but rules that assume perfect compliance to work are really only there to cloak the failure of engineering in some fault tolerance in system architecture and user UI design. Glad someone finally caught on..
A common mistake that people make when trying to design something completely foolproof was to underestimate the ingenuity of complete fools.
Love many, trust a few, do harm to none.
He's comparing security with health and driving to 'prove his point'. Security is not the same as health or driving. So, any conclusion from making a comparison is a false one.
Second, you don't have to choose between completely ignoring security awareness training and spending lots and lots of money and time in it. There is a very good choice somewhere in between. I agree with him that the information systems have to be secure and shouldn't offer dangerous actions but no matter how secure you make your information system, it will all fail if the user has no clue about what he or she is doing. And giving empolyees a basis level of security awareness doesn't have to cost a lot of money but will still help you prevent a lot of trouble.
It doesn't have to be like this. All we need to do is make sure we keep talking.
I totally agree with Bruce here
We should be designing systems that won't let users choose lousy passwords
It reduces the search space I have to look at in order to brute force things, and that's a good thing...
Security Awareness training is a tick the box exercise most companies do to get auditors off their back.
Apparently, users are supposed to be "trained to recognise phishing emails and other Internet frauds". IT has enough trouble these days trying to recognise them, and somehow our ordinary users are supposed to recognise them too?
Users have to be "trained to pick good passwords". This should be system designed to prevent users from picking bad passwords in the first place.
Users should be advised to "pick strong passwords and change them regularly". Two contradictory statements, no-one can remember a new complex password that changes regularly unless they write it down. Oh, users should be told "not to write down passwords".
Awareness training is pushed because there are a number of so-called "security consultants" who have no real technical skills, yet have made a living pushing this snakeoil. They unfortunately are also good self-promoters and have the ear of regulators and auditors.
If you are relying on security awareness to protect your infrastructure, you're screwed. Most users don't care, and even those who do care cannot possibly be expected to remain aware of the myriad of threats that exist. Often, their attempts to remain secure achieve the opposite purpose ("I heard you tell me email was insecure, so I use dropbox now to transmit files to customers").
What galls me most is I have to spend part of my IT budget this year spending money on this stupid notion because it is expected by auditors. This means I have to cut back on the security projects that make a real difference.
Nice to hear it from someone with a big name. I'm an IT security specialist, giving talks every now and then, and I've basically been saying the same for years now. It is one of the topic where I face the most fierce opposition, usually from (big surprise) consultants and other people who offer security awareness trainings.
I've been doing this for so long that I can sum it up in one sentence by now: If security awareness trainings would work, don't you think we would be seing SOME effect after doing them for 20 years?
Of course, I am exaggerating a bit to make the point. I do think that training to make users familiar with specific security protocols is useful. I don't think general security awareness is. There is a plethora of reasons why it's a failure, from the context-specific nature of the human mind to the abstract level, but the main reason is that we have enough experience to show that it really is a waste of time and resources. Putting the same amount of money and effort into almost any other security program is going to give you a better ROI.
Assorted stuff I do sometimes: Lemuria.org
Its about things like the call-centre operator who gets a call saying Can I check my balance ... yea hear are the details... and while you are on can you tell me my wife's balance too. Its about the shop assistant in a phone shop who has someone asking for a replacement for a phone they just flushed down the toilet - they're desperate, miles from home and have no ID on them but expect an urgent call from their aunt in hospital so need a replacement on the same account. Its about the middle level IT manager who gets a call from a very annoyed board director who says his password doesn't work and you better reset it now or head will role. Its about not lending your access card to a visitor so they can go to the canteen and you are too busy to take a break.
Security training is very important, but it needn't concentrate on systems.
is that many companies are too lazy to even get the most fundamental things right. Why on earth would you not distribute your own CA fro your internal web services? Do you really want to train yout employees that clicking on the "accept certificate" button is an everyday thing to do? Why dont you manage to get the security settings in a way that "content from an unknown source" is not "content from you own file server"? how the hell shoud the office assistant know that this is dangerous and theoretically unusual if in everyday work the instruciton says to accepti it several times per day? why yould you enable macros in office documents for no reason and not sign the document?
All security training, hints like "be careful when opening attachements from unknown sources" are anihilated if you train your employees everyday to do the exact opposite thing, namely constructing worflows and selecting toolsets which are requiring exactly that.
My 2 cents on this
a) If there is a "do not use/do x" in your security education, then something is wrong. The right way is "use/do y"
b) Construct your standard processes in a way that your users/employees can work secure *AND* efficient.
c) If there are new tools and your users demand these, keep an open ear! Note to the management: reserve some bugdet for it. If users find dropbox an efficient service, the right way is not to forbid it but to ask yourself why you cant provide any decent file sharing on your own servers.
He is correct. User training is largely a waste of time, and both in development, and deployment, the systems are not designed or setup for security. So yes, users clicking a link is not safe, and it should be. Users opening an application and reading data should be safe, but isn't.
These problems have to be engineered out. They cannot be socially controlled out, the audience has neither the inclination, knowledge or interest in resolving this. And even after training, once its established how you've trained your monkeys, a new method will be established that undoes the training.
The whole industry is still in its infancy. Its building bridges that are made from cardboard, and without any form of certification or regime. This will only be resolved when it becomes apparent that software providers cannot ship things like 'our software cannot be held accountable for anything, have a nice day'. Nobody in the world making bridges gets away with 'if this bridge falls down, we are not accountable'.
The Adobe and Java scenario is exactly like this. Both are wholly unaccountable, and yet frankly directly responsible for perhaps billions upon billions of dollars of data loss, theft, security breaches, and so on.
There is no_fundamental_reason why people should even bother to make their software secure - so they only ally a baseline effort to the task. Until this is addressed, the rinse, shampoo, rinse, shampoo will repeat. And its actually why the security landscape is degrading. Things like Metasploit may have seemed to help. But fundamentally the white hat hacking and info security folks have ultimatly not helped. Its only highlighting how bad things are, putting guns in hands that should not have them, and making things globally worse. The vendors have not changed by very much.
We`re all equal
And what do I see just to the right of the lead-in about how Bruce Schneier says security awareness training is a waste of time? An ad for Kevin Mitnick's Security Awareness Training.
Time's fun when you're having flies. - Kermit the Frog
This point of view smacks of "if we just worked a bit harder/longer we'll be able to build a perfectly secure system".
It aint gonna happen. Not for a system as sprawling as the internet, not for a system with as complex requirements as an operating system.
The more you know about security, the easier it seems to do what is required to improve security - but you have to have very tight control of platforms to be able to follow through on implementing that security. And tight control prevents innovation. Often, security reduces the usefulness of a product.
Convincing everyone in the IT world that they need to spend $ on educating developers and implementing security features is an insurmountable task - and even if you manage it, you still won't be done, because the security issues we understand now and have fixes for are only a subset of all security issues. New types of holes will be found continuously.
Of course, end user training might still be a waste of money - I can't deny that.
Also in computer security, there's a lot of false-flag type attacks going on: in the modern day, something tends not to look obviously unsafe, but winds up being so (browsing the web "safely" shouldn't even be a problem, when you get down to it the browser should be keeping things thoroughly "on the web only").
1) Tell people about social hacking/engineering.
2) Tell people about common tricks like infected flash drives being dropped in parkways, calling and requesting a password, etc. etc.
3) Warn them that sometime during the year, YOU WILL TRY TO HACK THEM.
4) Tell them if they fall for the hack, they will not get a bonus that year. (It helps if you actually give out yearly bonuses - even $100 will be fine)
5) Actually test them two months later.
6) If they fail the test, send them an email and require that they take your 10 minute class again.
I have found that if you do this, then people learn. The threat of losing even $100 bonus a year is more than enough to get people to stop being stupid.
Note, this will not stop people from downloading things from the internet and/or playing games. But it will stop them from picking up random flashdrives and using them - as well as stop them from giving out passwords over the phone.
excitingthingstodo.blogspot.com