Slashdot Mirror
Ask Slashdot: How Can We Create a Culture of Secure Behavior?
An anonymous reader writes "Despite the high news coverage that large breaches receive, and despite tales told by their friends about losing their laptops for a few days while a malware infection is cleared up, employees generally believe they are immune to security risks. They think those types of things happen to other, less careful people. Training users how to properly create and store strong passwords, and putting measures in place that tell individuals the password they've created is 'weak' can help change behavior. But how do we embed this training in our culture?"
Users are gonna do stupid things when it comes to security. Trying to fix that is a noble goal, but good luck.
The direction we need to keep going towards is idiot proofing. Assume the user will screw up and mitigate or eliminate the impact.
Perhaps we could take the lead from government departments already tasked with maintaining security, hold on, let me google this ... I'm finding 'Transportation Security Agency' and 'National Security Agency'. That should be a good start.
In my experience, a company with high employee morale has people who will tend to listen and follow security procedures, even when it might be time consuming. Even small things like stopping someone who slips past a door without badging in, or asking who someone is who is in a building without some ID.
With poor morale, there isn't much for the people to bother with security. I've seen companies try to save money by offshoring... then lose a lot more due to breaches than they would have spent by keeping existing talent in house.
Strong passwords are useless - well, they're useful only against a brute-force attack and that's not the big threat anymore. A 64-character password is worth nothing against a phishing attack, and is worse than nothing if you have to write it down.
Maybe the cure is to have the incoming mail server destroy all clickable links (or point them at an internal "you will need to navigate to that URL manually" warning page, and simply delete anything executable.
While it may seem draconian, the best way I've found is to start from the ground up with recurring training. Make the training mandatory, but unobstructive, and ensure you get the people to sign they understand the rules. You'd be surprised just how much of a difference you will get from anyone if you have a piece of paper with their signature on it, there just isn't the same value in an emailed "ok, I got it".
There is a delicate balance between security and convenience, so you need to make sure that whatever you do to your end users doesn't bother them too much. Having purely random passwords is sure to get them to write it down and stick it under their keyboard. Having too loose of passwords is what will get you on the front page. However, if you can give them some leeway while maintaining some length and complexity in the passwords (i.e. pointers on using passphrases or self-made acronyms), you can go a long way. You might make a game out of your training too, give out some cheap prizes like lollipops or something, for various categories of passwords that the users create as part of the training. Who can make the best 24 character password? Who can make the funniest 12 character? etc... Engage them, give them something to remember, but hold them accountable for their (lack of) actions as well.
How can we create a culture where there is no incentive to hack or steal?
This is a great question, and one that plagues businesses of all sizes. Based on our experience writing security training and consulting companies on the best ways to plug the security holes in their organizations, it comes down to three things: 1) Spelling it out: A proactive approach to security awareness includes open lines of communication, telling employees exactly what sorts of things to look out for. One major mistake that corporations often make is assuming too much—mainly, assuming that their employees know how to identify malicious situations over the phone or through email. Instead, spell out the situations that may trip them up, either through policies or training. 2) Repeat, repeat, repeat: Even in companies that make a concerted effort to raise security awareness among workers, there is a tendency to backslide into comfortable complacency unless the danger is kept at the forefront of their minds. This doesn’t have to be onerous for management or irritating to employees, since there are so many effective ways to make security awareness a part of a worker’s daily experience. E-newsletters, security briefs, and clever, eye-catching security awareness campaigns are a few ideas. 3) Create a culture of teamwork: Often, corporate environments in large companies use impersonal policies to “teach,” hoping to generate desirable behaviors with a “Don’t think, just do” mentality. This approach makes employees feel like a tiny cog in a huge machine, a piece not worthy of more than minimal information. Smart employers give employees more credit. An attitude of inclusion should permeate every policy, every training campaign, and every common area. A real “good guys vs. bad guys” attitude makes everyone feel like part of a team that is working toward the common goal of security.
good luck with that 40 yr old secretary that still hold old behavior at heart. Computers have good memories, people have crappy shitty memories. Thats why they tend to use words or something similar to what they know instead of gibberish random password generator for their security. I've seen people in high places which holds sensitive info that could easy kill a person if that info is leaked and they still used weak passwords... I've tried to tell them everything I can to use good behavior and it's a difficult challenge.
Then the people who don't deeply care about using computers properly won't use them except for boring business stuff, and then we can replace Windows with z/OS or OpenVMS and all those PCs with terminals.
"I don't know, therefore Aliens" Wafflebox1
So until the software (or hardware) necessary to make systems more secure improves a great deal people won't use it. I can't say what the nemchmark is for user tolerance / acceptance, but if I had to guess I'd say is was about 1 second of "automatic" activity, zero intellectual input and one simple mechanical movement. Implement that and you've probably invented computer security.
politicians are like babies' nappies: they should both be changed regularly and for the same reasons
People can't be bothered to take moderate, reasonable precautions with their own LIFE-PRESERVING behaviors, you think that they're going to be motivated to change their behaviors because some tech has to fart around with their laptop for 3 days re-imaging it?
Seriously, people need to stop assuming that humans aren't just hairless primates with a knack for tools and language.
-Styopa
Sure, just was devs need, more users, who never requested a feature in the first place, coming in and demanding that a particular language be used in the implementation because the read an article about how its 'more secure'
Welcome to my nightmare, this rarely works out well
And for the inevitable, 'why didn't you make it secure in the first place' comment
fuck you, fuck you fuck you and your childish, 'I changed my mind, I don't want it fast, I don't want it cheep, I want you to read my mind and know the future and give me something that I can't break because I am a fucking idiot... and I need it tomorrow' attitude that makes everything somebody else's fault
People still drink and drive, smoke, do drugs, and have unsafe sex despite years and sometimes decades of having admonitions against all of those things embedded in our culture. Why? Because people still "think those types of things happen to other, less careful people." It is human nature, hubris, and magical thinking all rolled into one.
There is no "-1 offended" or "-1 you don't agree with me" mod options for a reason.
As long as there is incentive to skip security and get things done.
ie. let the nerds in IT worry about security - I'll worry about selling/making/doing and getting my bonus.
So technically I guess you could do something to foster this sort of secure behaviour but it won't happen because the powers that be don't give a shit.
So yeah, you can't.
Despite the high news coverage that large breaches receive, and despite tales told by their friends about losing their laptops for a few days while a malware infection is cleared up, employees generally believe they are immune to security risks. They think those types of things happen to other, less careful people.
Untrained users are not the cause of large breaches. Malware infections happen to even the most careful users. In other words, training users and trying to change your company's culture won't make a significant difference.
Encrypt the laptop before a user can touch it. Make sure a decent virus scanner is running (and keep your fingers crossed). Get well trained sysadmins who see their job as keeping your network and servers as secure as reasonably possible.
Same way as every other behavior: reward desired behavior and/or punish undesired behavior.
I am not a crackpot.
People are used to guarding against security threats, but are always defending against old ones. By the time you get everyone trained in defending the threat, the attackers have already moved on to a new one. The only way to defend yourself is have a small group of people who can anticipate or react to the ever changing threat and have them defend everyone else. Unless you are primarily interested in security, they will never focus on preventing new attack avenues.
Users are not the problem any more. Crap code is the problem.
C is the source of buffer overflows. Microsoft is the source of autorun problems, or "if it's executable, run it". PHP is the source of most SQL injection problems. Vendor-installed backdoors are the source of most router vulnerabilities. None of these are end-user problems.
Where the hell are my mod points??!! I'd mod you up to 9000 if I could.
Heartbleed would simply not have happened if OpenSSL was written in Ada or another type safe language.
Right you are. Heartbleed happened because everybody was _using_ OpenSSL. Fix that and the problem goes away.
In my 25 years working in IT, none of my passwords, weak or strong, have ever been hacked. Even my teenage sons, who have no idea about password strength, or site security, have never been hacked. And I doubt YOU can point to a single instance of someone hacking YOUR password.
Does password hacking happen? Yes, of course. Should we be careful? Yes. But there are much greater dangers, such as malware (which you no doubt HAVE had a personal brush with).
So if we need to put up with annoying security measures, let's at least focus on the more relevant dangers, rather than forcing us all write down our passwords and stick them to the bottom of our keyboards!
I used to use passwords like "love", "sex", "secret" and "god", but now that we have switched to passcodes I just use "12345".
I've recently learned a new definition of security, one that's a little bit different from what I'd thought about before.
A secure system is a system that continues to work as expected, even in the face of unexpected events.
Users like a system that works the way they expect. They don't like crashes, endless popups, and systems slowed to a halt by malware.
So teach them the benefits they can expect. You can have a fast, trouble-free computer by doing x, y, and z. Clicking on "virus alerts" makes your computer slow and prone to crashing. Opening unexpected PDF files causes a huge hassle of needing to change your passwords and all that mess.
For a company of decent size, having some sort of mandatory training may be in the realm of possibility, but good luck with all of the small business (20 employees) out there. My company provides IT services to these types of businesses, mostly medical practices. There is no way to do anything other than individual, one-on-one training, and then only after something has already gone wrong. The owners don't want to pay for our time, and the staff are simply too damn busy to deal with it. This could just be a medical office thing, but I doubt it. It seems like simply being a "business" is itself a hindrance to instilling safe habits. At least with my home user clients, I have the time to educate them in a way that resonates. Back when I was in school, "computer class" was typing, a little BASIC, and that's about it. I wonder if there is anything in the current curriculum regarding safe surfing and proper security practices?
A number of years ago I worked for a large (Global) company that wanted to make their new ticketing system secure. So they implemented a new password standard for the system that required a 35 character password, it reset every 30 days, and required 5 non-alpha numeric characters. The result? Within a week everyone in my department had their passwords written on a post-it note stuck to their monitor. The biggest problem with network security is usually the network security department.
Use common sense 2 factor authentication that's not too difficult for your users to comply with and they WILL comply. Make it overly complex and hard for the average non-tech person to understand and your own people will undermine all of your security efforts. Publicly fire any employe that violates your simple rules and it will quickly become apparent that adhering to those easy to follow rules is worth the effort.
The problem with that analogy is that we still have car accidents, many of which are serious.
And in the corporate world there is the problem of status. People higher on the hierarchy do not like being told that they cannot do something by people lower on the hierarchy.
And if something goes wrong then it is YOUR fault because "security" was YOUR responsibility.
The problem there is that software has all the problems of a magical system. If you do A, B and C and then expect D to happen ... maybe it will, maybe it won't. Had you previously done X, Y or Z without rebooting?
There was a CAD program that had a problem with memory fragmentation. Even if you closed the previous files, eventually you ran out of contiguous memory and then your computer would complain about "issues" when you tried to open a file larger than your available contiguous memory. So first thing in the morning everything was fine. But around lunchtime things got weird. And the weirdness wasn't evenly distributed. On Monday, Alice would have a problem but Bob would work fine. On Tuesday Bob would have a problem but Alice would be fine. Etc. .....
And that was a problem that I could diagnose. There are hundreds more where all I can say is "perform the rite of reboot" and only open the app you have trouble with right now and let me know if it's still having trouble my god what are all those apps that are loading on start-up.
Unless people have some training or background, thy will proceed blindly along until something actually Makes them pay attention.
Start with such basics in high-school, or even earlier than that. Explain (and mark their understanding) of things like strong vs weak passwords, and simple security procedures. E-mail safety tips. Good file management practices. Even basics like how to take care of a keyboard and/or pointing device would go fairly well in such a course.
Oh. Almost forgot: MAKE IT MANDATORY! Nobody gets to use the school computers/labs (even Office Staff) if they don't show proficiency. No personal systems should be allowed access to the school network without a valid certificate either, lest they infect the whole thing from their own carrier box. Ban those who violate the practices and cause problems. Make them responsible for what they caused, and Sit Through the repair procedures with a technician as an additional education in what happens, and what has to be done to Fix things, or no forgiveness, and therefore, no regained access! Give them a sense of what they are avoiding, and even what to do to fix a problem on their own system, should they get afflicted at home.
Start 'em young, and train them in the ways of the system. The results will be worth the effort.
Seriously: If people don't show they are responsible enough to use the school (or company) systems, they have no business accessing them, and probably shouldn't be working there in any capacity.
Or more succinctly: incentives matter. What incentive does an employee have to keep data secret? Will he be demoted in rank and lose pay if he does something stupid?
What incentives do companies have to maintain a secure infrastructure? Will their insurance policy hold them liable if they do not?
I'm just in the middle of polishing up a puppet module to deploy a bunch of new certs on my infrastructure. My incentive is that my reputation looks pretty bad if I advise clients to be secure but my own infrastructure is not up to snuff. That's really an incentive to avoid lost opportunities, I suppose.
Google is talking about scoring up pages that are secure. Another very wise incentive.
Let's keep this ball rolling: what other incentives can we offer or explain?
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
It's not known exactly how to instill a culture of paranoia, but one idea is to subject employees to traumatic experiences involving police and/or gangsters.
First off, stop worrying about passwords. Most malware doesn't get into systems by way of an attacker cracking passwords. It comes in in ways that bypass passwords entirely, either by getting a user to run it or by getting the user to give the attacker their password.
Second, look at your management culture. Do you expect your employees to routinely click on links in e-mail? Look for things like HR or IT sending e-mails that instruct people to follow links they've provided, or "secure" or "encrypted" e-mail systems that store the messages on Web servers and expect your employees to use a link to get at the contents of the "secure" or "encrypted" message. If you find such things, realize that you're training your employees to be insecure, because you're training them to expect to do as a normal part of their job exactly what the malware will need them to do to infect their systems. Start by removing such things from your management culture. If you need encrypted e-mail, do it within your own e-mail system so that users never need to follow links to read encrypted or secured e-mail. Outlook and Exchange offer this directly. If you need to give employees links to internal web applications or documents, create a Web page or site with a directory of links and train your employees to use a bookmark in their browser to access that site and navigate to the appropriate section where you'll put all the new links they need.
Third, look at your IT policies. Not the ones you wrote, the ones you expect employees to follow. If your policy manuals say "No user-installed software." but your actual policies require users to get and install software from outside, you have a problem. It can be as innocuous as sending zipped archives while not having a program to handle them pre-installed on user computers. It can be as pervasive as not having your IT able to support the myriad of tools your developers need, most of which will by definition not be the kind of thing most desktops would need. But every time you have a situation where what you expect of your employees requires software you didn't pre-install on their systems and where it'd negatively impact an employee's job performance and more importantly their performance evaluations if they refused to install that needed software themselves, you're creating security problems. Sit down and decide how you're going to address this, then address it. It can be as simple as a page of "approved" links to sites you know are safe and where employees can get all that useful software that gets used every day.
Fourth, evaluate your software update policies and IT budget and staffing. If your IT department doesn't have the staff or the budget to monitor the vendors of all the software in use in your organization, test changes and push updates out to your desktops and servers, you need to re-evaluate your IT budget and staffing levels. You need to get most updates installed within 30 days of their release, and you need to be able to get major critical security updates analyzed, tested and deployed within 24 hours. Your IT staff can't do that if security updates are a side item they're expected to handle in between doing everything else. If management wants security to be a priority, they need to back up their words with the resources and budget departments need to make it a priority.
Yes, a lot of that comes back to management. Attitudes towards security come from the top. More importantly, they come from what those at the top do and expect rather than from what they say.
This requires security to be a priority over whatever that user is doing. In most cases, it's not. The job of IT is to keep the system running and support the people doing the things that the company actually cares about (buying widgets, making widgets, selling widgets, whatever). When IT folk get ideas of grandeur and images of violators of their well defined policy being given the boot, it never ends well.
Much as it sucks, I think the onus is on us to build software and systems that the user can't screw up. People clicking links and attachments.. filter out all links and attachments save for whitelisted senders. Careless with their password? Time for a 2 factor system where the hacker on the other end of the phone doesn't have easy access to one of the factors. Spearfishing becoming a problem? Implement something that makes it really obvious an email is from an outside source (and don't make it a big paragraph, just a simple large font "THIS EMAIL WAS SENT FROM SOMEONE OUTSIDE OF THIS COMPANY" at the top.
I used the same approach my requiring my users tattoo their passwords on their foreheads. Eventually my user base dropped to almost zero...but for those who stayed I did see an interesting trend. Passwords like %uS*32Ldi# started prevailing because passwords like wafflebunny make for an embarrassing tattoo.
Well, you have to start somewhere, right?
Windows 2000 - from the guys who brought us edlin
The first question is not actually how you can create such a culture, but whether it's actually a good thing in the first place. You seriously need to evaluate this. One of the primary means of being secure is not trusting others. But trusting others is an incredibly useful tool to get things done, and it may be worth taking the security hit. Stand on a crowded railway platform, and you're trusting so many people, each of whom could push you off and kill you so easily, without even thinking about it. Without trust, society itself would be impossible.
So for example, if everyone believed they were immune to the security risk of terrorism, this would very obviously be such a good thing for society. There have been security economic analyses done of various security measures recommended by security guys, thinking their users to be fools who just wouldn't listen, which established that the users who ignored them were actually completely right, that the cost of implementing these measures was hundreds of times greater than the benefit of preventing the attacks they were effective against.
A security professional who thinks doing things securely must always be a priority just because that's his field, instead of taking the time to gain a more holistic understanding of the situation, deserves to be ignored.
APK tells
Nothing but lies
'Cept when he tries
To spamvertise
BURMA SHAVE
cat
"Time for a 2 factor system where the hacker on the other end of the phone doesn't have easy access to one of the factors. "
this is where dial-backs come in handy .
the way it works is :
1 you get a call from "Joe Smith in the Texas Office"
2 you tell "Joe" im going to dial you back give me Line 3 when i call
3 you use your phone list to dial him back and
4 Joe gives you Line 3 (this is from a key string list) AND You as instructed give him line "5"
5 You then continue with business
Or Video Phones with the system doing Face Recog on both persons
Any person using FTFY or editing my postings agrees to a US$50.00 charge
Suppose I have a private office with a lockable door, do not anticipate being targeted for physical espionage, and personally know everyone who has keys (except the janitorial staff). How is writing 'horse correct battery staple' on a sticky and putting it under the keyboard worse than forcing password to empty? This is exactly as effective as memorizing "348Chj#(hf.4%!g'; DROP TABLE Students; 'fh2^*Hcvbmmz" at preventing anyone who does not have access to my office from accessing my computer.
I worked in the CS division of a US National Lab last summer - yes, people there have left their laptops alone in a conference room while they go pee, and come back to find someone attacking their machine. We were under advisement to always, always, always lock screen if you're away. If we are worried about casual espionage attempts, I'll keep the sticky note in my wallet.
If you wish to evince a scenario where either my home will be burglarized and/or myself physically attacked so they can steal my credentials, or my computer will be physically attacked and compromised, then we're past the point where storing the password only in my neural engams is sufficient so the argument is now moot.
1. It's annoying.
2. Most people don't think like that.
People are not built for that kind of caution.
My blog: http://www.seebs.net/log/ --- My iPhone/iPad app: http://www.seebs.net/seebsfrac/
I'll probably be modded down for this but the most effective way is to pwn the users to show them that they are merely bitches that any moderately skilled geek can defraud completely. Since they only learn from being fucked over, being fucked over is the only way they learn - otherwise you are just considered to be paranoid.
Repeat this for every user you meet and add the strange looks you get from them when you do things a secure way.
My ism, it's full of beliefs.
If your users can do their job, then obviously IT Security is not doing theirs and stricter security policies are required!
I have never heard anyone say
I had a download that was just flying when a kid on a bicycle came out of nowhere and I had to crash my computer to avoid hitting him.
Firefox crashed, my wrist was broken in two places and I got a concussion, I was lucky compared to the guy with internet explorer.
Requiring users to change their password often and requiring long and "strong" passwords that are difficult to memorize is not the answer to better security. This results in people having to write down their password someplace convenient for them (and any nefarious people around). This is well demonstrated by the movie "Ferris Bueller's Day Off" where the main character find the schools' passwords taped inside a desk and alters his and his friends grades. It also trains users, and the help desk, that they will have to reset their password often. This has the effect of making the actual passwords irrelevant to security. All a nefarious person has to do to gain access to the system is convince the help desk that they are an employee that needs to change their password.
Our company, for example, uses Linux and measures uptime in years. Machines are rebooted for CPU and kernel upgrades and that's about it. Hard drive upgrades don't require a reboot, and they sure as heck don't crash. One machine had a bad memory module that caused a crash. We don't have users or software that crashes.
That definition absolutely includes what this thread is about. TFA talked mostly about malicious email attachments. When you do that, things stop working right. The discussion has talked about poor passwords. When your poorly chosen password is cracked, things stop working right. Using a good passphrase helps keep things working they way you expect them to work.
As bender would put it "kill all humans"
because if any of us remain the likelihood of us being careless and stupid is guaranteed
A culture of intense security awareness is a scared culture. Knowing that your colleagues are not going to leave a gap in to your file servers is important from the perspective of keeping your data safe from potential outside threats, but a state of persistent distrust is going to ultimately hamper the work of your organization through dehumanizing its members and tying them up in procedure.
A few simple policies and a few general guidelines should be the extent of an active security presence in the wider culture of an organization, with the exception of people specifically there to deal with security issues or sensitive items.
Myu:
The first step would be to reduce the number of separate passwords that have to be used. That means minimizing/eliminating the use of outside vendors that interact with your users via the web. If there's some vital human resource service that is needed (testing, training, employee reviews, whatever), bring it in house rather than contracting it out to an outside vendor. Because every single outside vendor you use means another set of credentials to be maintained.
The second step would be to eliminate password expiration. This may mean eliminating people in your organizatoin who think that password expiration is necessary. Depending on that person's position within the company, that might be as simple as telling them to knock it off, or might involve a complicated scheme to convince another company to recruit them away. When all else fails, compromising photographs are always effective.
But as the situation stands, I have to maintain half a dozen passwords, many of which I only use once or twice a year. So they are written on a post it note in my desk drawer. Sure, that pisses off the data security people. But before they steal that they'll nip the $200 backup drive sitting on my desk.
Easy Online Role Playing Campaign Management
Financial loss is not the same as physical harm. Money is psychological.
How many times has one's smartphone been infected by malware? How many people do you know whose smartphone was infected by malware? What about tablets? The problem has already been solved by shifting to a different type of computer than a PC.
I work at a large IT company and there is so much fragmentation and inconsistent security policies that seem to come from knee-jerk decisions by middle managers that have been chewed up because of specific security exposures.
This ends up being difficult for an end user as you end up jumping through extra loops for a service that less important that the one you normally use.
Security personnel, don't listen to reason, they just perform their goosestep and salute to the leader.
If I find a loophole to make my life easier I will use it.
Companies need to realize security needs to be thought out and need to be integrated properly, not a strap on what I see used by large companies.
The first problem is security through stupidity that you see all over the place. This is where you are required to change your password every x months, or days. It has been found that the maximum number of password changes per year, without storing it, is 2. That is maximum. It is still recommended to have people change their password, but currently the recommendation is if you do, to set it to once a year. I think Microsoft on their server products has this set to 3 months by default.
Low maximum password length. While it is expected there will be some length limitation. I have found places that limit you to 8, or 16 characters. Space is pretty cheap these days, can't you afford to store 50 characters, or more as the maximum? Also there are some places that require you to have really high minimum number of characters. 12 as a minimum is too high, 6, or 8 I see as more reasonable. I am constantly boggled by the places that require exactly x characters.
My other personal favorite is only allowing alpha, or numeric characters. Honestly, why limit which characters can be used?
On the other hand, requiring at least 1 character from 4 different groupings is also a bit excessive. Having to require from 2-3 groupings may be okay.
Basically many of the problem I see come from putting limitations on password that make it harder for people to remember their passwords, while making it easier for people to guess the passwords.
Also if you have a forgot password feature with a limit of number of tries. Make sure you warn the person before they are locked out, so they can use the forgot password feature. There should be a limit on the number of tries of a password, as not having this allows people to brute force the password, which is one of the more common ways getting passwords.
Microsoft, Apple, Google, Amazon what's the difference? All steal money from devs and control with walled gardens.
The problem is that you run into situations like one I ran into during the last security evaluation:
One of those is a legitimate message from an executive and failure to follow it's instructions will result in possible termination. The other is a fake from IT Security. I have described all significant differences in the messages. Now, tell me which one is which?
The above, in a nutshell, is the problem with most attempts to enforce security policy: the people making policy in the company ignore the security policies when deciding how to do things.
Sure, just what devs need, more users, who never requested a feature in the first place, coming in and demanding that a particular language be used in the implementation because the read an article about how its 'more secure'
Heh. That reminds me of a meeting some 15 years ago. Java was gaining a strong foothold as an enterprise app development language at the time (especially in IBM Global Services, which is who I worked for), and at the same time we were living through a seemingly neverending series of Java sandbox security defects. Running code automatically downloaded from random websites in your browser is a devilishly hard thing to make safe, but that's completely irrelevant to enterprise software.
But the fact that the two contexts are completely different didn't prevent a clueless PM from boldly asserting (to the even more clueless customer!) that using Java is a bad idea because "it's insecure". I was the lead architect on the project and I had a hell of a time convincing the customer that the PM was wrong and that Java was, in fact, a good choice for the application. Especially since it would be impolitic to just come out and say the PM was full of shit, since he was ostensibly on my team.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
On the other hand, depriving somebody of the money they need is similar to depriving them of the health they need, and physical pain can be equated to emotional distress. I suspect a broken arm would be a lot less hassle then a bad case of so-called identity theft. (I know about the broken arm. I'm surmising about identity theft.)
The psychological is real. It's the foundation of how we perceive the world.
"When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
Ada would not have affected the "goto fail;" bug, since that was simple repetition of a line. If I understand Heartbleed correctly, it wouldn't have helped there.
Not to mention that any idiots who mangle C like that for the sake of a few additional cycles (really, calloc() instead of malloc() would have stopped that bug cold) are going to manage to screw up in any language.
"When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
The harm in the case of identity theft is virtual, and can be fixed much quicker than a broken arm, by voiding any unauthorized transactions, reimbursing the victim.
Exactly. The best way to "encourage" a culture of security is regular beatings until things improve.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
Most people don't have a private, lockable office.
Most people don't even have an office that has a door.
They have a cubicle, and one without a lockable file drawer... (as though typical office furniture locks weren't jokes to anybody with two paper clips and the MIT Lock Picking Guide)
Some people don't even have a cubicle. Look at an "Open Architecture Office"... they have one two floors down. I'm not sure if I would pick that or pick McDonalds as better or worse.
That's the problem. You need to keep the security token (be it a yellow stickie-note or an RSA key) on your person, all the time.
And it still doesn't stop a good phish, or the next Heartbleed.
- Dr. Crash
Everyone has worked somewhere and the rule said wear your security badge at all times. Nobody ever looked closely at them and jokers would routinely wear badges with Jar-Jar Binks photos. So long as a piece of plastic was dangling from your neck however then "security" had somehow been delivered. Everyone (including the person who wrote the rule) knew it was bullshit but if the rule were abandoned then the ISO-compliance security box could not be ticked and the auditors would get mad. The same essentially goes for frequent password cycling containing at least one character from the Klingon alphabet and so on.
The first problem with promoting a genuine culture of [anything] is deciding what you really want to achieve.
"Don't belong. Never join. Think for yourself. Peace." V.Stone, Microsoft Corporation
Smartphones don't automatically create a security culture. Ask the parents of kids who bought $5000 worth of in-game purchases with real money.
Except that he was right (by accident)?
By using Java you were also importing a massive API surface onto production machines.
No different than any other language. And massive libraries are better than creating massive amounts of new code to solve the same problems any day, in terms of both effort and security.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
Passwords need only be as secure as the effective aggregate retry policy of whatever is accepting credential inputs.
Half the problem are all these 'hashes' stored in the clear on disk where administrators incorrectly assume users are responsible to select big enough password to make up for lack of effective protections. This of course is a complete failure having never worked continuing to grow more laughably amusing over time as computing power per unit cost increases.
Next we have security standards actively mandating complexity AND password change policy with no regard for the collateral damage: post-it notes, password wallets with access passwords that never change, complacency regarding frequent administrative change requests.
Next we have the breathtaking idiocy of completely untrusted email systems where sender identities are trivially spoofed by anyone .. a height of insanity eclipsed only by those same email systems allowing for convenient file attachments and one click execution of untrusted code in the users security context.
What do you expect? Do you really think ANY amount of vigilance in such an environment is worth anything? The basic security problems enumerated in TFA are much more representative of underlying infrastructure failing to provide any useful contextual information to the user... aint the users fault. While it absolutely is productive to teach awareness of technical and social engineering threats most of it stems from catastrophic failures of systems and their administrators.
Clearly we can't convince folks to stop at stop signs. We can't convince folks to "just say no" to drugs. We can't prevent un-safe sex. Why would we think for a minute that on-line security would be important to anyone else. Perhaps penury is an excellent teacher as are automobile wrecks, brain damage, and gonorrhea.