5 ms·

It never got old. Phishing+macros+lateral movement are still a very significant vector. The industry exacerbates this by running with the feel-good "don't blame

It never got old. Phishing+macros+lateral movement are still a very significant vector. The industry exacerbates this by running with the feel-good "don't blame the user!" mantra. At some point you really do need to give up on your fancy canaries, gateway and host IDS, perimeter blinky boxes, threat intelligence feeds, endpoint protection products, etc, and just start firing those in your employ who willfully and joyously thumb their noses at basic security hygiene.

lbotos 8y ago
> and just start firing those in your employ who willfully and joyously thumb their noses at basic security hygiene. Until it's your top salesperson who 2x'd the quarterly revenue target... I'd like to live in a world where everyone knew basic security hygiene, but we have to teach it first, not punish.
- Severian 8y ago
  But then it can be over emphasized, and no one in your organization trusts any links or attachments because of phishing. Then it all becomes a horrible mess of skype/slack IMs with the actual links to Sharefile or Dropbox shares. Then you wave goodbye to async communication because everytime someone sends you a hyperlink they _absolutely need_ to know if you were able to get the file...
  - mannykannot 8y ago
    I have worked at financial companies where they get it right, and it is not a problem. Having crappy infrastructure and procedures is never an excuse for poor security.
- ecolonsmak 8y ago
  well if he/she is such a fantastic earner they should be held personally liable for the banks losses stemming from their reckless conduct (clicking on email links or opening strange documents)
  - alex_anglin 8y ago
    The power in corporations will pretty much always lie with profit centers (i.e. sales) over cost centers (i.e. security). I'd doubt that almost any company will be able to overcome that. Better to focus on mitigation of risks than fight political battles that you're not going to win as an infosec team IMHO.
- ergothus 8y ago
  Considering the current lessons are "if you don't use frequently changed garbage passwords with a mix of cased characters, numbers, and special characters you aren't secure" and "...but we'll allow you to reset the lockout because you can never remember your password using this self-service reset guarded by unchanging common answers to facebook quizzes", I'd say the solutions is ( Find the right thing to teach > teach it > expect it).
bigmanwalter 8y ago
The issue at hand is the faulty Windows security model. Users have been trained to give full admin rights to anything that asks.
- jessaustin 8y ago
  "Users" probably shouldn't have that option. When I have to be responsible for Windoze boxes, no one gets admin except myself.
solatic 8y ago
The problem is that most endpoint protection is a joke. Companies buy enormously expensive enterprise endpoint protection systems with big dashboards to tell them if their endpoints are protected, and one of two things happens: either the dashboard falsely reports that everything is up to date (and you have Outlook 2007 running in the wild) or the dashboard reports that you have 4,394,665 security issues that need fixing, and not only does nobody have a clue where to get started, the minute they move laterally in the org to try to update anything, users scream DON'T YOU DARE TOUCH THAT! You can't fix your security posture until you fix your update culture.
dtauzell 8y ago
Train the employees by sending fake Phishing attempts and then letting them know when they have clicked on them. Do this regularly.
- nkrisc 8y ago
  My employer does this. Some people laugh about falling for every single one.
  - unholythree 8y ago
    I worked somewhere where we received a yearly Christmas bonus of some maximum amount reduced by various factors. Maybe the threat of loosing 10% of some yearly bonus for: "fails to meet security standards" would work well as a deterrent.
  - anonymousbank 8y ago
    My employer does this as well. Even though I have been on the internet since the early 1990s, I still fell for one. There is just no way around it, if you process 300 emails a day you are going to slip once or twice. The human brain just works that way. I think they have other mitigation strategies. Like probably quietly installing extra scanners on the email of the most "problematic" people who open anything and forward chain letters constantly.
- walshemj 8y ago
  or use those physical devices that google hands out as well as training.
- jmbohlen 8y ago
  The company I work for (in the utility industry) does this regularly and there are disciplinary actions for falling for the attack The consequences range in severity based on the number of times an employee is caught over a 12 month period, or if, as part of the attack, the employee enters their credentials on the webpage linked in the email (a big no-no). They range from: a meeting with your manager to discuss, a requirement to park outside the security gate and walk in for at least 2 weeks, to your vacation accrual rate being reduced, all the way to unpaid suspension or termination with 4 failures in 12 months. Of course as part of the on-boarding process the company provides pretty extensive training on how to spot a phishing attempt but some attacks can still get a large portion of our company. The downside is now some employees who have been burned before are terrified of opening any external emails. This ironically resulted in an exceptionally low participation rate in our company's annual employee engagement survey conducted by, you guessed it, an external party.
Jach 8y ago
If we're going to start firing people, first on my chopping block would be IT staff who implement security theater policies which go against NIST recommendations (like forced rotation of passwords every x days) and create security hygiene problems as side effects.
- monocasa 8y ago
  Unfortunately PCI compliance requires rotating passwords last time I checked. : \
  - analogmemory 8y ago
    and then you get Password1990!!!!!!
  - MaxGabriel 8y ago
    That's correct :( > 8.2.4 Change user > passwords/passphrases at least once > every 90 days.
  - downtown_ 8y ago
    No. You are free to reference nist and use a compensating control for that. No more pw changes :) Source: QSA
    - monocasa 8y ago
      I guess I was under the impression that compensating controls don't really let you question the efficacy of the point of the original requirement, but instead "we're meeting the requirement in this other way"?
pavel_lishin 8y ago
Let he who is without sin initiate the first termination process with HR.

lbotos 8y ago

> and just start firing those in your employ who willfully and joyously thumb their noses at basic security hygiene. Until it's your top salesperson who 2x'd the quarterly revenue target... I'd like to live in a world where everyone knew basic security hygiene, but we have to teach it first, not punish.

Severian 8y ago
But then it can be over emphasized, and no one in your organization trusts any links or attachments because of phishing. Then it all becomes a horrible mess of skype/slack IMs with the actual links to Sharefile or Dropbox shares. Then you wave goodbye to async communication because everytime someone sends you a hyperlink they _absolutely need_ to know if you were able to get the file...
- mannykannot 8y ago
  I have worked at financial companies where they get it right, and it is not a problem. Having crappy infrastructure and procedures is never an excuse for poor security.
ecolonsmak 8y ago
well if he/she is such a fantastic earner they should be held personally liable for the banks losses stemming from their reckless conduct (clicking on email links or opening strange documents)
- alex_anglin 8y ago
  The power in corporations will pretty much always lie with profit centers (i.e. sales) over cost centers (i.e. security). I'd doubt that almost any company will be able to overcome that. Better to focus on mitigation of risks than fight political battles that you're not going to win as an infosec team IMHO.
ergothus 8y ago
Considering the current lessons are "if you don't use frequently changed garbage passwords with a mix of cased characters, numbers, and special characters you aren't secure" and "...but we'll allow you to reset the lockout because you can never remember your password using this self-service reset guarded by unchanging common answers to facebook quizzes", I'd say the solutions is ( Find the right thing to teach > teach it > expect it).

bigmanwalter 8y ago

The issue at hand is the faulty Windows security model. Users have been trained to give full admin rights to anything that asks.

jessaustin 8y ago
"Users" probably shouldn't have that option. When I have to be responsible for Windoze boxes, no one gets admin except myself.

solatic 8y ago

The problem is that most endpoint protection is a joke. Companies buy enormously expensive enterprise endpoint protection systems with big dashboards to tell them if their endpoints are protected, and one of two things happens: either the dashboard falsely reports that everything is up to date (and you have Outlook 2007 running in the wild) or the dashboard reports that you have 4,394,665 security issues that need fixing, and not only does nobody have a clue where to get started, the minute they move laterally in the org to try to update anything, users scream DON'T YOU DARE TOUCH THAT! You can't fix your security posture until you fix your update culture.

dtauzell 8y ago

Train the employees by sending fake Phishing attempts and then letting them know when they have clicked on them. Do this regularly.

nkrisc 8y ago
My employer does this. Some people laugh about falling for every single one.
- unholythree 8y ago
  I worked somewhere where we received a yearly Christmas bonus of some maximum amount reduced by various factors. Maybe the threat of loosing 10% of some yearly bonus for: "fails to meet security standards" would work well as a deterrent.
- anonymousbank 8y ago
  My employer does this as well. Even though I have been on the internet since the early 1990s, I still fell for one. There is just no way around it, if you process 300 emails a day you are going to slip once or twice. The human brain just works that way. I think they have other mitigation strategies. Like probably quietly installing extra scanners on the email of the most "problematic" people who open anything and forward chain letters constantly.
walshemj 8y ago
or use those physical devices that google hands out as well as training.
jmbohlen 8y ago
The company I work for (in the utility industry) does this regularly and there are disciplinary actions for falling for the attack The consequences range in severity based on the number of times an employee is caught over a 12 month period, or if, as part of the attack, the employee enters their credentials on the webpage linked in the email (a big no-no). They range from: a meeting with your manager to discuss, a requirement to park outside the security gate and walk in for at least 2 weeks, to your vacation accrual rate being reduced, all the way to unpaid suspension or termination with 4 failures in 12 months. Of course as part of the on-boarding process the company provides pretty extensive training on how to spot a phishing attempt but some attacks can still get a large portion of our company. The downside is now some employees who have been burned before are terrified of opening any external emails. This ironically resulted in an exceptionally low participation rate in our company's annual employee engagement survey conducted by, you guessed it, an external party.

Jach 8y ago

If we're going to start firing people, first on my chopping block would be IT staff who implement security theater policies which go against NIST recommendations (like forced rotation of passwords every x days) and create security hygiene problems as side effects.

monocasa 8y ago
Unfortunately PCI compliance requires rotating passwords last time I checked. : \
- analogmemory 8y ago
  and then you get Password1990!!!!!!
- MaxGabriel 8y ago
  That's correct :( > 8.2.4 Change user > passwords/passphrases at least once > every 90 days.
- downtown_ 8y ago
  No. You are free to reference nist and use a compensating control for that. No more pw changes :) Source: QSA
  - monocasa 8y ago
    I guess I was under the impression that compensating controls don't really let you question the efficacy of the point of the original requirement, but instead "we're meeting the requirement in this other way"?

pavel_lishin 8y ago

Let he who is without sin initiate the first termination process with HR.