Slashdot Mirror
What Non-Experts Can Learn From Experts About Real Online Security
An anonymous reader writes: Google researchers have asked 231 security experts and 294 web-users who aren't security experts about their security best practices, and the list of top ones for each group differs considerably. Experts recognize the benefits of updates, while non-experts are concerned about the potential risks of software updates. Non-experts are less likely to use password managers: some find them difficult to use, some don't realize how helpful they can be, and others are simply reluctant to (as they see it) "write" passwords down. Another interesting thing to point out is that non-experts love and use antivirus software.
I've been out of the field for 10 years, but what I've learned since then is that "experts" don't care if the clients can actually use the system. AV? Take it or leave it, but for software updates, well, the cost of breaking corporate software with an update (they just took out our scheduling program for 4 days) is very measurable and affects everyone in the company, while the cost of a security incident is not nearly as measurable and doesn't affect everyone.
If you want to win these fights, you have to present defensible numbers in units that the PHB's understand: Dollars or Euro. The cost of breaking the scheduling program is easy about 6 hours of salary for the entire fucking company due to lost productivity. The cost of cleaning up a security incident needs to be measured and presented. How much lost productivity did this cost, how much tech time did it cost, what's the cost of the stolen data, etc... IT, and security in particular, will always be a cost unless you show, in dollars, that it's worth keeping.
That's missing the point. Identifying 1 or 2 differences in approach between experts and non-experts shows 1 or 2 things you can tell the non-experts to do to greatly improve security overall.
In this case, the take away action would seem to be to make sure you keep all the software updated.
These comments are my personal opinions and do not necessarily reflect the opinions of the other voices in my head.
.
For example --- software updates:
- do the experts use "custom" installs to avoid the installation of unwanted browser toolbars and adware, and that is why they are more likely to install updates?
- do the non-experts use the "default" installs, which pull in toolbars and crap adware, leading the non-experts to avoid updates?
I think the article is a good one, but there should be some more depth to it.
Any system that depends on users doing the right thing has ALREADY failed.
1) If it's difficult or complicated, users won't do it.
2) If your security organization's working strategy is, "break stuff, walk away and tell the user it's their problem," your strategies will be subverted from within so users can get actual productive work done, for which *they* get *their* bonuses.
In short, users need productivity to get their extra money. Security people need a lower number of intrusions to get theirs. These two goals are always at odds, mostly because current security strategies burden nontechnical, uninterested users.
The solution, which security people hate to hear, is to get better at installing and maintaining multiple levels of firewall, application sandboxing and/or streaming applications for all office applications, improving intrusion detection and dynamic virus removal in real time. NOT training users not to download suspicious executables or engage in fantastic feats of memory regarding passwords.
Please do not read this sig. Thank you.
Although the password keeper point struck me as interesting, I take issue with the "experts" stance on updates.
People don't shun (non-OS) updates because they "might" install malware - They shun them because they do install unwanted tag-alongs (if not outright malware). Flash tries to install its partner-of-the-week every time you update it. Chrome just added push notifications. Java... Let's not even go there. And let's not overlook the fact that most users can't tell a legit update prompt from a drive-by installer.
Security experts have a bias here because they:
1) can usually tell the legit updates from the bogus ones (and know enough to get the bloat-free version of the update); and
2) can themselves remove or repair the occasional spyware that slips through, without needing to pay BestBuy $150 for five minutes' work on a machine only worth $300 in the first place.
A) Anyone using the term 'best practice' has already lost half their audience. Being the 'best' is a hard claim to make.
B) Real world usability trumps ivory tower douchebaggery. Stop making people have eleventy digit passwords with special characters that they rotate weekly. You aren't helping.
C) The world is mostly people who just want to get shit done - as an IT guy, your stuff is an appliance. People don't care about nuance.
The solution, which security people hate to hear, is to get better at installing and maintaining multiple levels of firewall
Firewalls are not a solution. They're a small piece of a solution, but that's all. Firewalls segment networks, which is good because it reduces the scope of the attacks that have to be considered, but any good security design should assume that attackers will be able to get onto any network that has users.
application sandboxing and/or streaming applications for all office applications
Even better, move all applications to the web, so everything runs on central servers which are much easier to manage and secure than a fleet of personal computers. Give users Chromebooks or another thin client configuration and don't let them install software.
improving intrusion detection
IDS is good, but primarily for reducing the duration of an intrusion and trying to estimate the scope of the damage. IDS almost never reacts quickly enough to stop an intrusion.
dynamic virus removal in real time
Preventing the installation of viruses is far better than removing them.
NOT training users not to download suspicious executables
If the users can't install and run what they download, then it doesn't matter what they download.
or engage in fantastic feats of memory regarding passwords.
Totally. Most enterprise password policies are ridiculous. High-entropy passwords are neither necessary nor sufficient for securing systems. Multi-factor auth is more secure, and makes it possible to set reasonable password policies. Say, eight characters, alphanumeric, maybe require one non-alphanumeric symbol. Annual rotation is good, unless there is some reason to believe the password may have been compromised. Users can deal with that.
Three-factor authentication is great, and not actually all that difficult. One factor is the password. Another is some sort of one-time password generator or, even better, a USB dongle that requires user activation (OTPs can be phished -- a user you can social engineer into giving you their password will also give you an OTP, in fact it's even easier to phish an OTP than a normal password). The third is a client-side digital certificate installed on the machine after verification that it complies with corporate security policies. Use Puppet or similar to not only keep the machine up to date, but identify if it gets out of date and if it does, revoke the certificate.
Another crucial key to successful security is single sign-on. I can remember one moderately good password easily. Require me to know several and I'll have to write them down or reuse the same one everywhere. If I reuse the password we have none of the security benefits of multiple passwords and all of the password management headaches. So users should have one, strongly-secured, account that crosses all company systems. This is another benefit of web apps over local applications: You can secure all of your web apps behind a single set of authentication credentials by deploying them behind a reverse proxy server. That server handles authentication and provides a signed, time-limited user ID token to the systems it fronts.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
You want to trust your financial log-ins to Facebook, Google or Microsoft? Hope you keep most of your money stuffed in your mattress, it would certainly be safer there.
Sure they do. They tell non-experts to install updates. When's the last time you heard about someone's grandmother testing a patch?
Your ad here. Ask me how!