9 ms·
Our Approach to Employee Security Training
- cube00 8y agoWonder if Fox will demand their artwork be pulled down.
- flipp3r 8y ago> Concepts such as rainbow tables can then be explained without having to refer to the actual name; we can just demonstrate that you can create a lookup and call it a “magic list”. Names are there for a reason. "magic list" instead of "rainbow table", seriously? You're teaching a concept and then giving it a slightly different name just to make it sound more edgy. People won't be able to find anything about "magic lists" when they want to read more about rainbow tables. Let alone the completely mad communication you'll get with people in the company. > We implemented magic sodium suffix in our application this week, attackers won't be able to use magic lists when our magic data leaks. >> What? > You know, irreversible magic? >> ...
- merrington 8y agoHow many non-engineers would you expect to take the interest/time to investigate rainbow tables after this? Also, if you follow the link to the actual presentation (https://sudo.pagerduty.com/for_everyone/#hashing https://sudo.pagerduty.com/for_everyone/#hashing for the lazy) then you'll see the author DOES indeed call it hashing, before switching to "magic" so as to make it easier for individuals without a technical background to not have to constantly think about what the term means. Also, if you continue to RTFA, > That said, I didn’t want to mislead people. So we chose to be clear to them that there is a technical term; it’s just not going to be important for the rest of the content. If it's someone job to provide reports/updates on something related to the concept, yes they should know it, for anyone else in a non-technical role, why does it really matter?
- flipp3r 8y ago> Also, if you continue to RTFA, I RTFpresentations even. Naming Hashing and then switching to Magic is just confusing for everyone involved. Again; it completely ruins effective communication. > for anyone else in a non-technical role, why does it really matter? They're getting security training on the topic of hashing. How does it not matter?? Employees will have to adjust their communication to toddler level anytime they need to talk about security to others.
- scrollaway 8y ago> They're getting security training on the topic of hashing. How does it not matter?? They're getting taught good password health. You don't need to know what hashing is to know good password health. I shouldn't get upset over comments but it's headdeskingly frustrating to read comments like yours from people who should know better and who, ultimately, contribute to worse personal security for everybody. Comments like yours are one of the causes behind many people turning their head away at security, not bothering because the barrier of entry is too high and they're made to feel like if they don't have it perfect why bother. Damn it. The guy communicated pretty damn well if he got 30 employees switching to password managers on their own without actually saying it's required. So instead of criticizing, take it as an opportunity to learn and revise your beliefs.
- sillysaurus3 8y agoThere's no reason to get personal. We're all on the same side here.
- fjsolwmv 8y agoIt doesn't make it easier though. Hashing makes a hash of the password -- chops it and scrambles it so you can see what it came from. Calling everything "magic" just conflates everything with e everything else, confusing everyone.
- alexcnwy 8y agoI think you totally miss the point. Explaining something by analogy can be the most effective way of "getting it". Everyone is different. You definitely cannot make such a bold statement about whether the approach was valid.
- zachrose 8y agoDevising a new, more familiar name for something like hashing is a good idea here because it communicates that “this is a complex thing handled by specialists, but it’s implications are important to us.”
- deleted 8y ago[deleted]
- deleted 8y ago[deleted]
- cbhl 8y agoConcepts can have more than one name. An important part of preparing a training or presentation is understanding your audience, and using names that resonate with them. If this had been a freshman college crypto class, the word "oracle" (https://security.stackexchange.com/questions/10617/what-is-a-cryptographic-oracle https://security.stackexchange.com/questions/10617/what-is-a...) may have been used instead, to indicate that the exact details of hash reversing can be abstracted away and that the key detail is that it's much faster than brute force would suggest.
- mightybyte 8y agoCompletely agree. In particular I think the word "hash" is easy to explain. Just tell them it's kind of like the process of creating corn beef hash. Something goes into the process, and when it comes it it's unrecognizable and and you can reverse the process to get a cow back.
- cyberferret 8y ago> it's unrecognizable and and you can reverse the process to get a cow back. I am assuming you meant to type "can't reverse the process" here? (and drop the extra 'and'). Apologies for being seemingly pedantic, but the distinction is important here for the very definition of a hash.
- mightybyte 8y agoYep, thanks for the correction.
- alangpierce 8y agoTo be clear, the "magic list" thing is focused on non-engineers, who likely will never need to read or write the term "rainbow table" as part of their job, they just need to be convinced that it's important to use a password manager. The presentation also mentions the technical terminology but switches to less intimidating terminology afterward. The presentation for engineers uses "hash", "rainbow table", etc without ever using the less intimidating terminology: https://sudo.pagerduty.com/for_engineers/ https://sudo.pagerduty.com/for_engineers/
- SilasX 8y agoWhen teaching about bitcoin, I say “scrambler function” instead of “hash function” because it better conveys the intuition of what they do — even though it’s longer and non-standard. (Most people I talk to don’t immediately associate “hash” with “make a hash of the whole thing” ie mess it up). Although I also make sure to give the “decoder ring” and the end to list the actual standard terms for the concepts discussed.
- sverige 8y agoOK, so "rainbow table" is what we all call them, but frankly I've always found that name to be baffling. Why are they called that? What is the origin of the name? What do they have to do with rainbows? Yes, googling "magic list" will not produce the same results as "rainbow table," but it's a good substitute when teaching non-technical people the concept. It might even help them avoid googling unsuccessfully for the origin of the actual name. (If you know the origin, I'd love to know, and so would the people at Wikipedia.)
- ams6110 8y agoA real rainbow represents all colors: the full spectrum. A rainbow table has all possible passwords within its spectrum (8 characters, alphanumeric, or however it's defined). A non-technical term I might use is to call a rainbow table a "reverse phone book for passwords"
- sverige 8y agoFair enough, but many (probably most) of the people this training is aimed at have no idea what a reverse phone book is. I haven't seen a physical copy of one for a couple of decades. Do you have a source for the origin of the name, or is it just what comes to your mind when you think of it?
- ams6110 8y agoI don't have a source, but the analogy seems obvious to me. If you're more curious, I guess you could do your own research?
- techman9 8y ago> That said, I didn’t want to mislead people. So we chose to be clear to them that there is a technical term; it’s just not going to be important for the rest of the content.
- neotrope 8y ago> 2. Don’t shy away from technical details. > The mere mention of the word “hashing” is probably enough to make non-technical employees’ eyes gloss over. So instead I just call it “Magic”. What..? Why state a principle and then tell us how you violate it a few sentences later.
- deleted 8y ago[deleted]
- craftyguy 8y agoTo be fair, they did say it was "our approach", they did not say it was a "good approach."
- alangpierce 8y agoI think the point is that technical terminology and technical details are different things, and the latter is much more important. The alternative is to say "hashing is a technical topic, and technical terms intimidate and confuse people, so we won't mention hashing". Instead, the article says that you should try to make hashing approachable and non-intimidating, since understanding the ideas around hashing will help people understand why strong passwords and password managers are important.
- deleted 8y ago[deleted]
- Natsu 8y agoI've taught this exact concept to a non-technical audience before. I simply told them it was like scrambling an egg--you can't "unscramble" it and then explained with hashing, you could scramble an identical egg and get identical results and compare the two scrambled eggs to see if they were identical before being scrambled. That said, I do wonder how well they understood that explanation.
- andai 8y agoAnd the scrambles form a unique fingerprint!
- cup-of-tea 8y agoIf they can't understand hashing then there's no hope of teaching them security so why even bother?
- TheRealWatson 8y agoNot everyone thinks like an engineer. I thought the approach was very appropriate.
- FLUX-YOU 8y agoThis is the security culture infosec has been trying to get everyone to do.
- kenrose 8y agoNo, if they can’t understand hashing, then you’ve failed as a teacher. What Rich has done amazingly well here is use the correct term, but then made the “magic” analogy that allows the concept to be more easily understood by people not within engineering. Think sales, marketing, HR, biz dev, etc. For those who are interested, they can look up more about hashing afterwards. But for everyone, the concept of how hashes are used was taught with high retention rates.
- cup-of-tea 8y agoHow is it even a good analogy? Hashing literally means chopping something up and making a mess. Heard of a hash brown? Hash is a dictionary word coming from French. You chop something up into a mess that you can't reassemble, but you get the same mess each time. The word magic needs to stay the hell away from computers.
- c22 8y agoI'm all for the power of analogy, but I agree with others here that "magic" is a pretty lame choice of words. Anything you don't understand can be described as magic, it's a meaningless analogy that doesn't have any more explanatory power than the word hash does to people who don't know it. The presentation was good, but I bet it would have had similar impact if the word hash had just been used throughout.
- jrudolph 8y agoVery interesting read, can't emphasise enough how important _practicing_ for security is as opposed to mere education. A couple of folks I went to Uni with launched a startup that helps companies conduct automated phishing awareness training and continuous employee sensibilisation by sending "white-hat" phishing emails: IT-Seal https://www.it-seal.de/en.html https://www.it-seal.de/en.html I can highly recommend giving it a try. The first few levels of difficulty are easy to spot, but it's been eye opening for me how sophisticated phishing emails can get.
- gukov 8y agoKevin Mitnick's KnowBe4 does it too.
- wpietri 8y agoI worked at one place that sent a fake phishing email in the employee's first month, and I loved it. I wish they had kept it going, though, doing random re-tests. It reminds me of the luggage-scanner technology Threat Image Projection: https://www.rapiscansystems.com/en/products/rapiscan-threat-image-projection https://www.rapiscansystems.com/en/products/rapiscan-threat-... Basically I think there's an optimum frequency window for humans detecting and responding to problems. Once real occurrences drop below that frequency, we need to supplement with simulations. Fire drills are the obvious example, but I think we could use a lot more of it.
- CaptainZapp 8y ago"It reminds me of the luggage-scanner technology Threat Image Projection" Yeah, thanks to those I once was asked what that huge hypodermic needle is doing in my hand luggage. I didn't really have a clue and it disappeared, when they scanned it for the second time. It was an European airport with reasonable security scanners so overall it was a quite funny experience.
- wpietri 8y agoHah! As I understand it, machines with TIP have a button they're supposed to press as soon as they see a threat. Then any fake threats go away. Weird that they didn't do that in your case.
- u801e 8y agoAre there any initiatives out there that offer training/guidance in designing systems where even if someone's credentials are compromised, it doesn't really matter. When there are systems out there that still store passwords in an insecure manner and don't require a second form of authentication, then all the training in the world about password hygiene and recognizing phishing attempts won't fix the actual problem.
- zephharben 8y ago"security in depth". This is the kind of problem that can't be solved via specific technology choices, or technical standards. Instead, it's a matter of understanding that most attacks involve several pivot points; and that these pivots are possible because we treat internal networks as if they are "safe spaces" where we can let our guard down.
- fjsolwmv 8y agoIn the research this is called "capabilities", limiting your account, not giving everyone root. Also, there is fraud detection, stuff like automatic alerts when the same credential is used in two places at once, or with unusual access patterns. Obviously it's impossible for compromising credentials to have no consequences -- if case, why do you have credentials?
- u801e 8y ago> Obviously it's impossible for compromising credentials to have no consequences -- if case, why do you have credentials? For systems that only require a username and password to log in, someone else obtaining/guessing my credentials would have the consequence of someone being able to access my account. But if there's a second credential I have to enter in addition to the username and password, then someone trying to use the username and password alone would not be able to access the account. Where I work, this second credential is the RSA token along with a PIN. But this could also be accomplished by using a client side TLS certificate on the work provided device or U2F with a work issued Yubi key.