4 ms·

> and just start firing those in your employ who willfully and joyously thumb their noses at basic security hygiene. Until it's your top salesperson who 2x'd t

by lbotos 8y ago

> and just start firing those in your employ who willfully and joyously thumb their noses at basic security hygiene. Until it's your top salesperson who 2x'd the quarterly revenue target... I'd like to live in a world where everyone knew basic security hygiene, but we have to teach it first, not punish.

Severian 8y ago
But then it can be over emphasized, and no one in your organization trusts any links or attachments because of phishing. Then it all becomes a horrible mess of skype/slack IMs with the actual links to Sharefile or Dropbox shares. Then you wave goodbye to async communication because everytime someone sends you a hyperlink they _absolutely need_ to know if you were able to get the file...
- mannykannot 8y ago
  I have worked at financial companies where they get it right, and it is not a problem. Having crappy infrastructure and procedures is never an excuse for poor security.
ecolonsmak 8y ago
well if he/she is such a fantastic earner they should be held personally liable for the banks losses stemming from their reckless conduct (clicking on email links or opening strange documents)
- alex_anglin 8y ago
  The power in corporations will pretty much always lie with profit centers (i.e. sales) over cost centers (i.e. security). I'd doubt that almost any company will be able to overcome that. Better to focus on mitigation of risks than fight political battles that you're not going to win as an infosec team IMHO.
ergothus 8y ago
Considering the current lessons are "if you don't use frequently changed garbage passwords with a mix of cased characters, numbers, and special characters you aren't secure" and "...but we'll allow you to reset the lockout because you can never remember your password using this self-service reset guarded by unchanging common answers to facebook quizzes", I'd say the solutions is ( Find the right thing to teach > teach it > expect it).

by lbotos 8y ago

Severian 8y ago

But then it can be over emphasized, and no one in your organization trusts any links or attachments because of phishing. Then it all becomes a horrible mess of skype/slack IMs with the actual links to Sharefile or Dropbox shares. Then you wave goodbye to async communication because everytime someone sends you a hyperlink they _absolutely need_ to know if you were able to get the file...

mannykannot 8y ago
I have worked at financial companies where they get it right, and it is not a problem. Having crappy infrastructure and procedures is never an excuse for poor security.

ecolonsmak 8y ago

well if he/she is such a fantastic earner they should be held personally liable for the banks losses stemming from their reckless conduct (clicking on email links or opening strange documents)

alex_anglin 8y ago
The power in corporations will pretty much always lie with profit centers (i.e. sales) over cost centers (i.e. security). I'd doubt that almost any company will be able to overcome that. Better to focus on mitigation of risks than fight political battles that you're not going to win as an infosec team IMHO.

ergothus 8y ago

Considering the current lessons are "if you don't use frequently changed garbage passwords with a mix of cased characters, numbers, and special characters you aren't secure" and "...but we'll allow you to reset the lockout because you can never remember your password using this self-service reset guarded by unchanging common answers to facebook quizzes", I'd say the solutions is ( Find the right thing to teach > teach it > expect it).