4 ms·

If it were up to me every person with access to a computer where other people's personal or financial data is handled should be required to get a security certi

by seri4l 4y ago

If it were up to me every person with access to a computer where other people's personal or financial data is handled should be required to get a security certification stating they have a basic understanding of digital signatures, certificates, HTTPS, encryption and how to protect against common threats (phishing, social engineering). If people can't do that they might as well go back to typewriters and FAX machines.

mstade 4y ago
In banks (and similarly regulated institutions) there's mandatory security training to educate employees. Sadly, in my experience, this "training" is essentially like those kids rides at an amusement park where you're stuck in a trolly till the end – it's slow and mostly tedious but sometimes there's one bit of trivia that might delight. In the end, there's a very simple multiple choice test that is worded to make it more or less obvious what the correct answers are. If you do get it wrong you get infinite retries and there are only so many questions... I'd love to see mandatory education in basic cryptography and such, but in reality I'd assume that even that would end up being security theater for the sake of ticking a box on the compliance score sheet.
- j5155 4y ago
  This sounds like the OSHA 10 class I recently had to do. I think the issue here is that if a business wants workers it is incentivized to make the tests as easy as possible, not to make sure their employees know what they’re doing.
xeromal 4y ago
Agreed. On top of that, everyone who owns a car should be required to learn how to change their serpentine belts, oil, replace spark plugs, and alternator. They should be required to sign a paper saying they will change their tires with a spare on the side of the road and carry a jump starter with them at all times. The roads would be a safer place if people knew what was going on inside their cars and how to operate them.
mhb 4y ago
Definitely. And also consider whether you are in agreement with the 1500 hours of training required to be a barber: https://www.barber-license.com/rhode-island/ https://www.barber-license.com/rhode-island/

by seri4l 4y ago

mstade 4y ago

In banks (and similarly regulated institutions) there's mandatory security training to educate employees. Sadly, in my experience, this "training" is essentially like those kids rides at an amusement park where you're stuck in a trolly till the end – it's slow and mostly tedious but sometimes there's one bit of trivia that might delight. In the end, there's a very simple multiple choice test that is worded to make it more or less obvious what the correct answers are. If you do get it wrong you get infinite retries and there are only so many questions... I'd love to see mandatory education in basic cryptography and such, but in reality I'd assume that even that would end up being security theater for the sake of ticking a box on the compliance score sheet.

j5155 4y ago
This sounds like the OSHA 10 class I recently had to do. I think the issue here is that if a business wants workers it is incentivized to make the tests as easy as possible, not to make sure their employees know what they’re doing.

xeromal 4y ago

Agreed. On top of that, everyone who owns a car should be required to learn how to change their serpentine belts, oil, replace spark plugs, and alternator. They should be required to sign a paper saying they will change their tires with a spare on the side of the road and carry a jump starter with them at all times. The roads would be a safer place if people knew what was going on inside their cars and how to operate them.

mhb 4y ago

Definitely. And also consider whether you are in agreement with the 1500 hours of training required to be a barber: https://www.barber-license.com/rhode-island/ https://www.barber-license.com/rhode-island/