Slashdot Mirror
IT and Security Professionals Think Normal People Are Just the Worst (zdnet.com)
Two new studies reaffirm every computer dunce's worst fears: IT professionals blame the employees they're bound to help for their computer problems -- at least when it comes to security. From a report: One, courtesy of SaaS operations management platform BetterCloud, offers grim reading. 91 percent of the 500 IT and security professionals surveyed admitted they feel vulnerable to insider threats. Which only makes one wonder about the supreme (over-)confidence of the other 9 percent.
[...] Yet now I've been confronted with another survey. This one was performed by the Ponemon Institute at the behest of security-for-your-security company nCipher. Its sampling was depressingly large. 5,856 IT and security professionals from around the world were asked for their views of corporate IT security. They seemed to wail in unison at the lesser and more unwashed. Oh, an objective 30 percent insisted that external hackers were the biggest cause for concern. A teeth-gritting 54 percent, however, said the most extreme threat to corporate IT security came from employee mistakes.
[...] Yet now I've been confronted with another survey. This one was performed by the Ponemon Institute at the behest of security-for-your-security company nCipher. Its sampling was depressingly large. 5,856 IT and security professionals from around the world were asked for their views of corporate IT security. They seemed to wail in unison at the lesser and more unwashed. Oh, an objective 30 percent insisted that external hackers were the biggest cause for concern. A teeth-gritting 54 percent, however, said the most extreme threat to corporate IT security came from employee mistakes.
This is not new news. User have forever been a problem.
http://progressquest.com/spoltog.php?name=Son+Of+Son+Of+DarkRookie
n/t
We all know it's true; when it comes to technology, most employees are idiots. Management too.
I want to blame the technology companies a bit here; UX design is the root cause of a lot of these problems. It's bad enough on it's own, but companies like MS continually make radical UX changes between versions making it even worse.
Back to employees, however; a lot of them don't see the need to increase their skillset. They grudgingly use the technology, but refuse to becoming proficient with it. They adamantly refuse to accept that were they more knowledgeable with the tech they were using they'd do their jobs better.
So these results don't surprise me at all.
Mod me down with all of your hatred and your journey towards the dark side will be complete!
...normal people think IT guys are just the worst, and they're both right from their point of view.
What a scoop...
...passwords and two factor authentication simply because they'd chose such simple passwords to remember.
People hate having to learn something complex to remember, even if it just takes the effort of putting a small note in your wallet for 4 days to help you remember, you'd be SHOCKED if you just knew what passwords even professionals choose, it's hopeless.
So what we did at our big corporate, was to implement an Password A.I guide engine that helps people avoid bad passwords, so it picks stuff from a HUGE database of simpleton passwords (you know, guitar1234567) etc. it will simply explain to people why their passwords are not very good (we're polite, so we don't tell them that theyr'e simple and ...essentially not very IT savvy, they're good at something else, right?)
People just want an easy life, most people working with computers as just a tool to get the job done, don't want a huge advanced routine to do their job, and when the password becomes a chore and hard to remember, it will stop them from doing their job, and since we're nagging people to change their password 4 times a year, with reminders that pop up every day for 14 days before it expires, people simply get seriously annoyed. And they will go through hellfire to find an easy to memorize password before they even try to train for a complex one (Here's a complex one for you, for those who simply don't get what that would be:
J4Al4&/rO1.P9DeErxL ) Yes, that's the kind of passwords you should use, even with a secondary two factor authentication device, and it's not hard to learn to remember it, sure - it's not as easy as guitar1234567, and it takes effort to learn it - but most people (if they just kept that note for a few days in the wallet, had to enter it 10 times a day) they WILL remember it, even the average Joe - and their personal security on the net would sky rocket in comparison.
But...people are ...simple.
What this world is coming to - is for you and me to decide.
I dont think long passwords are an issue, more like not being able to use the last 4 previously used passwords and having to change every 2 months. Yeah no, that's going on a post it. My job isn't my life.
We've forced our workforce to use advanced passwords and two factor authentication
What you've actually done: Doubled the workplace's sticky note budget.
If you are doing two factor why torture everyone with bullshit complexity requirements? For the LOLs?
"There is more worth loving than we have strength to love." - Brian Jay Stanley
A few points:
- Users are "unwashed" compared to IT personnel? Have you *worked* in IT?
- The first thing IT professionals forget (speaking as one) is that computer management isn't the user's job. It may be *your* expertise, but it isn't *theirs*. They have a different job to do which you would probably suck at. Expecting them to be IT professionals on top of their regular job is an unreasonable expectation. So stop fussing about it.
- That said, often security issues really are kinda the user's fault. We told 'em and TOLD 'em, don't do that, you'll infect your.. ok, too late.
Oliver's law of assumed responsibility: If you're seen fixing it, you will be blamed for breaking it.
Here's the thing - every computer out there is insecure. We basically don't have the knowledge on how to build a secure computer that most of the population can use while remaining connected to the Internet.
There are really only two choices now: 1) disconnect from the Internet and don't face these risks 2) expect risks and pay to avoid incidents and/or clean up after them.
IT people are the worker bees of 2). Blaming the users for using faulty equipment is a waste of time.
Nobody seems to want to do 1) because overall there are profits to be made by being Internet connected. If your place of business wants to do 1) but not 2), then just run for the exits before it's too late.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
A developer for one of my past organizations, a true rocket scientist, posited it the best: "The network would be great, if it wasn't for all of those users!" Cheers, Ron.
Professor Oak, director of the Ponemon Institute, had this to say about security bugs: "Gotta catch 'em all!"
#DeleteChrome
A password on a post-it at least requires physical access. More troubling are short easy to remember passwords that don't need to be written down, like "passsword" (or if you need a capital, number and special character, "Passw0rd.")
I apologize to everyone whose password I've just exposed.
You're kidding, right? Otherwise, it sounds like a narcissistic case of "I'm capable of remembering long random gobbledygook, so you should be also."
And, I don't understand why the password file cannot be implemented in a dedicated-hardware "lock-box" such that it cannot be file-copied, preventing say 500,000,000,000,000 attempts at it. Using regular-file-based password repositories is just a speed-race to the bottom.
Typically you'd have 2 of these lock-boxes, 1 as a mirror spare*. The only way to get file access would be to break it open, or find the physical key. Otherwise, all access is through a throttled API. The per account throttling would be tighter than the per lock-box throttling. I'm not saying such is completely unhackable, but far less so than a regular server file because it's designed to do one and only one job. (Crap, I sound like Al Gore.)
* If one breaks, the other is physically unlocked and a new spare hooked up directly up for re-mirroring, cable to cable.
Table-ized A.I.
Have gnu, will travel.
A thousand times this. Having to change your password every X months to something you're never going to remember anyway is the polar opposite of good security policy.
Fully licensed blockchain psychiatrist
Users will constantly say things like "I just don't understand technology." or "I don't care whats wrong, I just want it to work". This used to put me in a bad frame of mind. I find it hard these days not to laugh at them. I wonder how long it took them to learn that fire will burn or not to walk down the middle of the freeway. They live in the same world as us but refuse to put a minimum amount of effort into learning how it works.
No matter what profession each of us is in, I am certain that we all have stories about "stupid users". They surely do exist. But there is a flip side to this story.
Many "stupid users' are not stupid at their jobs or life in general. They just do not cooperate well with the paradigms of computing and technology they are handed to them by "the industry". The makers of the technology are quite savvy about such things. But, they might forget that not everyone is so, or be dismissive of ordinary smart (or dumb) people who are not as learned about those things as the manufacturers and technical folk are. Those people decrying the IT "stupid user" are likely to be the butt of jokes about how dumbass they are when it comes to accounting their taxes or fixing their car or managing their own diabetes.
If there are too many stupid users, perhaps it is not the users. Perhaps the technologists who make techno products ought to produce better devices and software and computing paradigms that place greater emphasis on user interface, usability, human factors engineering, ergonomics, and just plain wtf common sense. It seems to me that too many IT people are so wrapped up in the technology and their own familiarity with it that they are suffocating from a lack of reality and some sympathy to how their mom or grandma might use the technologies they are making or managing. Turn your propeller head beanies upside down and air out some of the supercilious cobwebs in your IT skulls.
Just print out and laminate individual password cards. 12 columns and 6 rows fits easily on a CC sized card. Users can stick them in their wallet. Make a bunch of different ones and let the users pick a card, any card, so yiu don't even know it.
Need a password? Pick a starting point and go right/left/up/down, or Fibonacci it if you want to make your life difficult. If you force password changes, have them go down a row and follow the same pattern if they want.
It's a really cheap, effective and simple solution. Even physical access isnt a complete failure like with a postit, because the actual password has 72 starting points, 8 bits of directionality times ten plus characters.
It's pointless. If it doesn't get written down, then it just gets incremented. I had a former co-worker who was up to $password43. Not exactly difficult to guess either.
If you can't trust the average user not to do something stupid like this or can't impress upon them the importance of security, then set up two-factor authentication of some sort or a security system that takes user apathy into account. Otherwise you're just asking for trouble.
I'm burning mod points to post this but I just can't let this go by. A huge part of the problem with security is IT itself. We have learned that long passwords are good and use of weird characters (numbers, capital letters, punct, etc) are bad. Plus most users shouldn't be required to know more than 2 passwords (normal and maybe an elevated one). But many IT personal keep with the same broken password policies from the past that we now know are bad. If you still use these outdated and problematic password policies, you can't blame the users, IT is still at fault...
"Those that start by burning books, will end by burning men."
That comment does NOT deserve "insightful" moderation.
It's just cheap-shot victim blaming. The people who are supposed to make things better blaming the victims they failed to help and protect.
Actually I blame Microsoft. One of the main keys to Microsoft's "success" and perhaps the main source of their YUGE profits was their leadership in escaping responsibility for mistakes. Read your EULA. Whatever happens to you, whatever damage you, your company, or your customers suffer, no matter how egregious the phuckup, you will find that Microsoft's "legal" liability is quite precisely limited, and in most cases limited to nothing at all. It didn't have to be that way, and if Microsoft (and other corporate cancers) had been held liable for their their mistakes, you can be certain they would have been more careful. There's a reason they call it moral hazard.
(Microsoft's other key tactic was minimizing direct sales to the suckers... Er victims... Er, I mean end users. The very honorable end users, and it doesn't matter how much they wind up cursing Microsoft after the fact. Just recently I provided some technical advice on some new machines, but I could not persuade them to even consider skimping on one of the Microsoft taxes. They insisted on paying the OS tax and the MS Office tax to boot.)
Not the saddest part. That's the lack of a solution approach. The solution is obvious, but it will never happen.
Imagine cutting Microsoft into competing companies. NOT vertically, but horizontally. Each baby Microsoft would start with a copy of the source code and an equal share of all the corporate resources. Windows and Office would be standards, and the people would actually have the freedom to buy from the baby company that gets most serious about improving the security of the software.
(My delusional implementation strategy would involve a progressive profits tax linked to market share. It is not a penalty for success. Rather the higher tax rate is a penalty for reducing freedom and the lower tax rate (after dividing the company as needed) is a reward for reproducing the good ideas into separate companies.)
As usual, time's up, but I bid you ADSAuPR, atAJG.
Freedom = (Meaningful - Coerced) Choice != (Speech | Beer^2), and sad sock puppets' bad mods avail them naught.
These rules have been in my sig (and are better explained there) going on for a decade now. For how old these rules are, they still apply. Every virus in that last 10 years exploits 1 or more of these rules. The more you are aware of them as an IT professional, the better your system design will be to mitigate risk.
Laws of computer stupidity
1) 99% of computer users do not know what they are doing.
2) Computer users do not read.
3) If a computer user can click on it, they will. conversely, if a computer user needs to click on it, they won't.
4) You can patch software, but you can't (legally) patch stupid.
5) The premise of monkey rule: If you can't train a monkey to use it, you can't train a human to use it.
In Soviet Russia, Trojan exploits YOU!