Slashdot Mirror
Ask Slashdot: How Can We Create a Culture of Secure Behavior?
An anonymous reader writes "Despite the high news coverage that large breaches receive, and despite tales told by their friends about losing their laptops for a few days while a malware infection is cleared up, employees generally believe they are immune to security risks. They think those types of things happen to other, less careful people. Training users how to properly create and store strong passwords, and putting measures in place that tell individuals the password they've created is 'weak' can help change behavior. But how do we embed this training in our culture?"
Users are gonna do stupid things when it comes to security. Trying to fix that is a noble goal, but good luck.
The direction we need to keep going towards is idiot proofing. Assume the user will screw up and mitigate or eliminate the impact.
Perhaps we could take the lead from government departments already tasked with maintaining security, hold on, let me google this ... I'm finding 'Transportation Security Agency' and 'National Security Agency'. That should be a good start.
In my experience, a company with high employee morale has people who will tend to listen and follow security procedures, even when it might be time consuming. Even small things like stopping someone who slips past a door without badging in, or asking who someone is who is in a building without some ID.
With poor morale, there isn't much for the people to bother with security. I've seen companies try to save money by offshoring... then lose a lot more due to breaches than they would have spent by keeping existing talent in house.
While it may seem draconian, the best way I've found is to start from the ground up with recurring training. Make the training mandatory, but unobstructive, and ensure you get the people to sign they understand the rules. You'd be surprised just how much of a difference you will get from anyone if you have a piece of paper with their signature on it, there just isn't the same value in an emailed "ok, I got it".
There is a delicate balance between security and convenience, so you need to make sure that whatever you do to your end users doesn't bother them too much. Having purely random passwords is sure to get them to write it down and stick it under their keyboard. Having too loose of passwords is what will get you on the front page. However, if you can give them some leeway while maintaining some length and complexity in the passwords (i.e. pointers on using passphrases or self-made acronyms), you can go a long way. You might make a game out of your training too, give out some cheap prizes like lollipops or something, for various categories of passwords that the users create as part of the training. Who can make the best 24 character password? Who can make the funniest 12 character? etc... Engage them, give them something to remember, but hold them accountable for their (lack of) actions as well.
How can we create a culture where there is no incentive to hack or steal?
This is a great question, and one that plagues businesses of all sizes. Based on our experience writing security training and consulting companies on the best ways to plug the security holes in their organizations, it comes down to three things: 1) Spelling it out: A proactive approach to security awareness includes open lines of communication, telling employees exactly what sorts of things to look out for. One major mistake that corporations often make is assuming too much—mainly, assuming that their employees know how to identify malicious situations over the phone or through email. Instead, spell out the situations that may trip them up, either through policies or training. 2) Repeat, repeat, repeat: Even in companies that make a concerted effort to raise security awareness among workers, there is a tendency to backslide into comfortable complacency unless the danger is kept at the forefront of their minds. This doesn’t have to be onerous for management or irritating to employees, since there are so many effective ways to make security awareness a part of a worker’s daily experience. E-newsletters, security briefs, and clever, eye-catching security awareness campaigns are a few ideas. 3) Create a culture of teamwork: Often, corporate environments in large companies use impersonal policies to “teach,” hoping to generate desirable behaviors with a “Don’t think, just do” mentality. This approach makes employees feel like a tiny cog in a huge machine, a piece not worthy of more than minimal information. Smart employers give employees more credit. An attitude of inclusion should permeate every policy, every training campaign, and every common area. A real “good guys vs. bad guys” attitude makes everyone feel like part of a team that is working toward the common goal of security.
Sure, just was devs need, more users, who never requested a feature in the first place, coming in and demanding that a particular language be used in the implementation because the read an article about how its 'more secure'
Welcome to my nightmare, this rarely works out well
And for the inevitable, 'why didn't you make it secure in the first place' comment
fuck you, fuck you fuck you and your childish, 'I changed my mind, I don't want it fast, I don't want it cheep, I want you to read my mind and know the future and give me something that I can't break because I am a fucking idiot... and I need it tomorrow' attitude that makes everything somebody else's fault
People still drink and drive, smoke, do drugs, and have unsafe sex despite years and sometimes decades of having admonitions against all of those things embedded in our culture. Why? Because people still "think those types of things happen to other, less careful people." It is human nature, hubris, and magical thinking all rolled into one.
There is no "-1 offended" or "-1 you don't agree with me" mod options for a reason.
As long as there is incentive to skip security and get things done.
ie. let the nerds in IT worry about security - I'll worry about selling/making/doing and getting my bonus.
So technically I guess you could do something to foster this sort of secure behaviour but it won't happen because the powers that be don't give a shit.
So yeah, you can't.
Users are not the problem any more. Crap code is the problem.
C is the source of buffer overflows. Microsoft is the source of autorun problems, or "if it's executable, run it". PHP is the source of most SQL injection problems. Vendor-installed backdoors are the source of most router vulnerabilities. None of these are end-user problems.
Sometimes good security isn't a pain. Had client certificates been used more often, or just having a website ask the user to PGP/gpg sign a blob of text for logging in, passwords would be less critical.
With a client cert, almost all authentication troubles go away. However, client certs are troublesome for users to manage (have to remember the key's password as well as copy the private key to every device in advance), so it comes at a cost, although if people got as used to it as they are used to the like button, it wouldn't be that much of a speedbump.
In my 25 years working in IT, none of my passwords, weak or strong, have ever been hacked. Even my teenage sons, who have no idea about password strength, or site security, have never been hacked. And I doubt YOU can point to a single instance of someone hacking YOUR password.
Does password hacking happen? Yes, of course. Should we be careful? Yes. But there are much greater dangers, such as malware (which you no doubt HAVE had a personal brush with).
So if we need to put up with annoying security measures, let's at least focus on the more relevant dangers, rather than forcing us all write down our passwords and stick them to the bottom of our keyboards!
If I had to give five general things a company could do, it would be similar to the following the parent stated:
1: First and foremost... separate and isolate. Finance should be isolated from everything else, with a Citrix or TS server so people working there can browse the web with the browsing well separated from critical assets. If a breach does occur, it will be limited in scope.
2: Laptop encryption is trivial. BitLocker [1] and the AD infrastructure to recovery is a must-have. Depending on level of paranoia, AD policy can be set to auto-encrypt USB drives, so a dropped thumbdrive doesn't mean a massive data breach. In fact, it would be wise to have BitLocker on all desktops as well, so repurposing of the machines is easy -- just a simple format or clean command in diskpart.exe.
3: Backups. Often overlooked, but a humble tape drive can mean the difference between a quick restore versus paying some guy out of Russia a lot of BitCoins. Disk arrays != backup because one command (blkdiscard for example) can render all backed up data gone in seconds.
4: A clear chain of command. This way, someone can't hack a VoIP connection, browbeat some lackey to get some critical access or knowledge about internal networking.
5: Active pen-testing from a guy running a script on boxes to actual blackhats using everything at their disposal including sending people on site in coveralls and fake badges to get in.
[1]: Yes, TrueCrypt is a good utility, but this is the enterprise where recoverability is as important as security.
A number of years ago I worked for a large (Global) company that wanted to make their new ticketing system secure. So they implemented a new password standard for the system that required a 35 character password, it reset every 30 days, and required 5 non-alpha numeric characters. The result? Within a week everyone in my department had their passwords written on a post-it note stuck to their monitor. The biggest problem with network security is usually the network security department.
Use common sense 2 factor authentication that's not too difficult for your users to comply with and they WILL comply. Make it overly complex and hard for the average non-tech person to understand and your own people will undermine all of your security efforts. Publicly fire any employe that violates your simple rules and it will quickly become apparent that adhering to those easy to follow rules is worth the effort.
And in the corporate world there is the problem of status. People higher on the hierarchy do not like being told that they cannot do something by people lower on the hierarchy.
And if something goes wrong then it is YOUR fault because "security" was YOUR responsibility.
The problem there is that software has all the problems of a magical system. If you do A, B and C and then expect D to happen ... maybe it will, maybe it won't. Had you previously done X, Y or Z without rebooting?
There was a CAD program that had a problem with memory fragmentation. Even if you closed the previous files, eventually you ran out of contiguous memory and then your computer would complain about "issues" when you tried to open a file larger than your available contiguous memory. So first thing in the morning everything was fine. But around lunchtime things got weird. And the weirdness wasn't evenly distributed. On Monday, Alice would have a problem but Bob would work fine. On Tuesday Bob would have a problem but Alice would be fine. Etc. .....
And that was a problem that I could diagnose. There are hundreds more where all I can say is "perform the rite of reboot" and only open the app you have trouble with right now and let me know if it's still having trouble my god what are all those apps that are loading on start-up.
Or more succinctly: incentives matter. What incentive does an employee have to keep data secret? Will he be demoted in rank and lose pay if he does something stupid?
What incentives do companies have to maintain a secure infrastructure? Will their insurance policy hold them liable if they do not?
I'm just in the middle of polishing up a puppet module to deploy a bunch of new certs on my infrastructure. My incentive is that my reputation looks pretty bad if I advise clients to be secure but my own infrastructure is not up to snuff. That's really an incentive to avoid lost opportunities, I suppose.
Google is talking about scoring up pages that are secure. Another very wise incentive.
Let's keep this ball rolling: what other incentives can we offer or explain?
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
First off, stop worrying about passwords. Most malware doesn't get into systems by way of an attacker cracking passwords. It comes in in ways that bypass passwords entirely, either by getting a user to run it or by getting the user to give the attacker their password.
Second, look at your management culture. Do you expect your employees to routinely click on links in e-mail? Look for things like HR or IT sending e-mails that instruct people to follow links they've provided, or "secure" or "encrypted" e-mail systems that store the messages on Web servers and expect your employees to use a link to get at the contents of the "secure" or "encrypted" message. If you find such things, realize that you're training your employees to be insecure, because you're training them to expect to do as a normal part of their job exactly what the malware will need them to do to infect their systems. Start by removing such things from your management culture. If you need encrypted e-mail, do it within your own e-mail system so that users never need to follow links to read encrypted or secured e-mail. Outlook and Exchange offer this directly. If you need to give employees links to internal web applications or documents, create a Web page or site with a directory of links and train your employees to use a bookmark in their browser to access that site and navigate to the appropriate section where you'll put all the new links they need.
Third, look at your IT policies. Not the ones you wrote, the ones you expect employees to follow. If your policy manuals say "No user-installed software." but your actual policies require users to get and install software from outside, you have a problem. It can be as innocuous as sending zipped archives while not having a program to handle them pre-installed on user computers. It can be as pervasive as not having your IT able to support the myriad of tools your developers need, most of which will by definition not be the kind of thing most desktops would need. But every time you have a situation where what you expect of your employees requires software you didn't pre-install on their systems and where it'd negatively impact an employee's job performance and more importantly their performance evaluations if they refused to install that needed software themselves, you're creating security problems. Sit down and decide how you're going to address this, then address it. It can be as simple as a page of "approved" links to sites you know are safe and where employees can get all that useful software that gets used every day.
Fourth, evaluate your software update policies and IT budget and staffing. If your IT department doesn't have the staff or the budget to monitor the vendors of all the software in use in your organization, test changes and push updates out to your desktops and servers, you need to re-evaluate your IT budget and staffing levels. You need to get most updates installed within 30 days of their release, and you need to be able to get major critical security updates analyzed, tested and deployed within 24 hours. Your IT staff can't do that if security updates are a side item they're expected to handle in between doing everything else. If management wants security to be a priority, they need to back up their words with the resources and budget departments need to make it a priority.
Yes, a lot of that comes back to management. Attitudes towards security come from the top. More importantly, they come from what those at the top do and expect rather than from what they say.
This requires security to be a priority over whatever that user is doing. In most cases, it's not. The job of IT is to keep the system running and support the people doing the things that the company actually cares about (buying widgets, making widgets, selling widgets, whatever). When IT folk get ideas of grandeur and images of violators of their well defined policy being given the boot, it never ends well.
Much as it sucks, I think the onus is on us to build software and systems that the user can't screw up. People clicking links and attachments.. filter out all links and attachments save for whitelisted senders. Careless with their password? Time for a 2 factor system where the hacker on the other end of the phone doesn't have easy access to one of the factors. Spearfishing becoming a problem? Implement something that makes it really obvious an email is from an outside source (and don't make it a big paragraph, just a simple large font "THIS EMAIL WAS SENT FROM SOMEONE OUTSIDE OF THIS COMPANY" at the top.
I work in Tape, and I can tell you that I've run into sysadmins and CTOs who have overlooked #3 (particularly with their belief in cheap disk arrays) to their sorrow. Tape is boring old tech, but it's damn near bulletproof in saving the bacon every damn time something goes wrong and a restore needs to occur. Ethernet with NAS boxes my ass, you need a tape library in there somewhere to completely insure that your company doesn't go down permanently after the inevitable rogue wave of human stupidity hits your network.
Here's to hot beer, cold women, and Glaswegian kisses for all.
Requiring users to change their password often and requiring long and "strong" passwords that are difficult to memorize is not the answer to better security. This results in people having to write down their password someplace convenient for them (and any nefarious people around). This is well demonstrated by the movie "Ferris Bueller's Day Off" where the main character find the schools' passwords taped inside a desk and alters his and his friends grades. It also trains users, and the help desk, that they will have to reset their password often. This has the effect of making the actual passwords irrelevant to security. All a nefarious person has to do to gain access to the system is convince the help desk that they are an employee that needs to change their password.
Financial loss is not the same as physical harm. Money is psychological.