3 ms·

We already covered this, but advice distilled from earlier comments bears repeating; One special class of vulnerable targets is security experts, and top ranks

We already covered this, but advice distilled from earlier comments bears repeating; One special class of vulnerable targets is security experts, and top ranks. I remind my students that "pride comes before a fall" and nobody is immune. While doing some training for <BIG INTERNATIONAL BANK> someone told me they call it the "cocks problem". It's the handful of 7 figure salary high flyers that get regularly pwned and cause grief for everybody else, because they are "too cocky". Lowly secretaries and desk staff are much harder marks. The more training you give to people who think they're above it the worse they get. It has to be pitched as participatory advice, as an invitation to co-create a secure practice. We saw this cavalier attitude just the other day with Boris Johnson [0]. I bet Johnson was told time and again to use equipment that had been checked by his security detail. And I still cringe thinking of this one [1]. I suggest there's no correlation between domain knowledge and behavioural invulnerability. Good security posture is a mind-set. I also think it's a very strange combination of contradictory qualities (or attitudes you can be trained to adopt) that are hard to describe, such as high conscientiousness and humility mixed with utterly cynical disrespect for "authority", high openness but brutally meticulous self-checking and introspection. And definitely, never call yourself an 'expert'. [0] https://news.ycombinator.com/item?id=31075558 https://news.ycombinator.com/item?id=31075558 [1] https://www.arrse.co.uk/community/threads/77-bde-twitter-feed-hacked.290788/ https://www.arrse.co.uk/community/threads/77-bde-twitter-fee...

resoluteteeth 4y ago
It sort of reminds me of this: https://driving.ca/auto-news/news/why-advanced-driver-training-makes-teens-worse-drivers https://driving.ca/auto-news/news/why-advanced-driver-traini... I guess the common factor is that the most important thing is to be careful and follow the proper procedure to not get caught in a problematic situation in the first place, not to be overconfident and assume you are safe because you can handle any situation with your knowledge or skills.
- nonrandomstring 4y ago
  > procedure to not get caught in a problematic situation in the first place Totally. I saw this Krav Maga instructor say: "Now. I'm going to tell you one of the most effective self defence moves known in any martial art... run away!"
karmakaze 4y ago
The same shows here: > security engineers need to design systems that are resilient to them The problem here, to a security engineer, is that we need better systems. I suspect they mean the hardware and software systems, although the 'system' includes the participants. The problem and solution space should strongly include people as it just was clearly demonstrated. Could be an occupational hazard, having seen so many insecure and poorly designed system to have low opinions of them. Having low expectation of security practices sets a lower bar for acceptance of what's authentic. I can't say if I would be caught in similar circumstances without being in the moment. The two things I hope I'd do is see the tx in my own history and not tell a human a code. These are for machines to verify. I recall when everyone switched their system so PINs could be entered for machine verification and the human returning after. A machine sent code should also be checked by a machine. A practice that does bother me greatly is how many different domain names are used by a company. Only subdomains should be used for any kind of official interaction (or perhaps period).

resoluteteeth 4y ago

It sort of reminds me of this: https://driving.ca/auto-news/news/why-advanced-driver-training-makes-teens-worse-drivers https://driving.ca/auto-news/news/why-advanced-driver-traini... I guess the common factor is that the most important thing is to be careful and follow the proper procedure to not get caught in a problematic situation in the first place, not to be overconfident and assume you are safe because you can handle any situation with your knowledge or skills.

nonrandomstring 4y ago
> procedure to not get caught in a problematic situation in the first place Totally. I saw this Krav Maga instructor say: "Now. I'm going to tell you one of the most effective self defence moves known in any martial art... run away!"

karmakaze 4y ago

The same shows here: > security engineers need to design systems that are resilient to them The problem here, to a security engineer, is that we need better systems. I suspect they mean the hardware and software systems, although the 'system' includes the participants. The problem and solution space should strongly include people as it just was clearly demonstrated. Could be an occupational hazard, having seen so many insecure and poorly designed system to have low opinions of them. Having low expectation of security practices sets a lower bar for acceptance of what's authentic. I can't say if I would be caught in similar circumstances without being in the moment. The two things I hope I'd do is see the tx in my own history and not tell a human a code. These are for machines to verify. I recall when everyone switched their system so PINs could be entered for machine verification and the human returning after. A machine sent code should also be checked by a machine. A practice that does bother me greatly is how many different domain names are used by a company. Only subdomains should be used for any kind of official interaction (or perhaps period).