5 ms·

It is kind of ridiculous how the police manage to damage their computers. As people in positions of power, they really need better training on security and hand

It is kind of ridiculous how the police manage to damage their computers. As people in positions of power, they really need better training on security and handling equipment. I've seen Toughbooks with severe physical damage... and those things are REALLY hard to damage. At the very least, they need to be taught not to open email attachments from people they don't know.

dmix 13y ago
I wouldn't be so quick to judge their lack of ability - it seems pretty hard to prevent spearphising among a broad set of non-technical users. Training would ideally involve the organization testing by spearphishing their own employees internally like a lot of security companies often do: http://www.darkreading.com/end-user/how-lockheed-martin-phishes-its-own/240153683 http://www.darkreading.com/end-user/how-lockheed-martin-phis...
- yuhong 13y ago
  Yea, but CryptoLocker generally use a zip attachment with a exe file.
  - deleted 13y ago
    [deleted]
- nwh 13y ago
  Cryptolocker spreads with a really stupid email message, and an attachment you have to extract and then execute. You have to be incredibly technically inept to get hit with it.
  - mattmanser 13y ago
    I thought it was spreading with HMRC notices and fake invoice corrections? The ones I've seen are pretty good, all the lingo is correct. They're pushing all the right buttons in the email which would immediately get an accountant or business owner to open it immediately to find out what was wrong. The only obvious warning sign is the zip attachment.
    - ksrm 13y ago
      What's bad about .zips? Surely it's the .exe that's the issue.
      - Kequc 13y ago
        Compression can obfuscate the virus from being easy to detect and therefore is more likely to arrive at its destination. There are tricks which can crash anti-virus applications that try to open specially crafted zips once it is on the user's computer.
  - GhotiFish 13y ago
    So lets say you have to be so inept with computers that literally 98% of the population is more competent on them than you. If you hire 40 people, you have a better than 50% chance of getting someone that inept.
    - deleted 13y ago
      [deleted]
    - thaumasiotes 13y ago
      This is only true if your hiring method is "select people at random and draft them into working for you". Suppose I chose any 40 people who were currently developing software for Microsoft. What are my chances of getting one person among those who is at or below the 2nd percentile of computer literacy? Followup questions: How does Microsoft avoid hiring people below the 2nd percentile in computer literacy? They have way more than 50 developers. Should the police force screen applicants in any way? Is using a computer part of a police officer's job? Are the police even able to compel randomly-chosen people to work for them? If not, the premise of your numbers is fatally flawed.
      - GhotiFish 13y ago
        it's true, my numbers are flawed. Though I would ask, flawed in what way? Is it more or less likely? The police don't hire on technical skill, presumably people of high skill in this area end up in different careers? The accuracy of the numbers is, frankly, unimportant. What I was illustrating was the multiplicative effect, which remains relevant. I freely admit the numbers themselves were made up.
        thaumasiotes 13y ago
        Well, you're right about how independent probabilities combine. But the situation you describe has so little relationship to hiring that I don't see how it's relevant to anything. In general, I don't expect to see someone at the 2nd percentile of ability holding down a job at all. Even very basic screening will keep them away with great reliability, because they're so far out of the norm. So I don't see this as a case of "sure, I made up figures that might be off by a factor of 10-100", I see this as you describing a situation utterly unrelated to any aspect of reality I'm familiar with. You can't just make some numeric tweaks to the model; the whole thing is fundamentally at odds with what you're trying to describe. Now, it's definitely not true that you have to be below the second percentile to get phished: http://www.locusmag.com/Perspectives/2010/05/cory-doctorow-persistence-pays-parasites/ http://www.locusmag.com/Perspectives/2010/05/cory-doctorow-p... But if it were true, phishing would be largely a nonissue for workforces (other than the police, who often do set ultra-low thresholds for their screening).
w1ntermute 13y ago
> It is kind of ridiculous how the police manage to damage their computers. As people in positions of power, they really need better training on security and handling equipment. I've seen Toughbooks with severe physical damage They probably just don't care because they're not paying for it themselves. A construction manager told me once that the rate at which his workers' phones were breaking dropped significantly when the workers were made to pay for the new phones themselves.

dmix 13y ago

I wouldn't be so quick to judge their lack of ability - it seems pretty hard to prevent spearphising among a broad set of non-technical users. Training would ideally involve the organization testing by spearphishing their own employees internally like a lot of security companies often do: http://www.darkreading.com/end-user/how-lockheed-martin-phishes-its-own/240153683 http://www.darkreading.com/end-user/how-lockheed-martin-phis...

yuhong 13y ago
Yea, but CryptoLocker generally use a zip attachment with a exe file.
- deleted 13y ago
  [deleted]
nwh 13y ago
Cryptolocker spreads with a really stupid email message, and an attachment you have to extract and then execute. You have to be incredibly technically inept to get hit with it.
- mattmanser 13y ago
  I thought it was spreading with HMRC notices and fake invoice corrections? The ones I've seen are pretty good, all the lingo is correct. They're pushing all the right buttons in the email which would immediately get an accountant or business owner to open it immediately to find out what was wrong. The only obvious warning sign is the zip attachment.
  - ksrm 13y ago
    What's bad about .zips? Surely it's the .exe that's the issue.
    - Kequc 13y ago
      Compression can obfuscate the virus from being easy to detect and therefore is more likely to arrive at its destination. There are tricks which can crash anti-virus applications that try to open specially crafted zips once it is on the user's computer.
- GhotiFish 13y ago
  So lets say you have to be so inept with computers that literally 98% of the population is more competent on them than you. If you hire 40 people, you have a better than 50% chance of getting someone that inept.
  - deleted 13y ago
    [deleted]
  - thaumasiotes 13y ago
    This is only true if your hiring method is "select people at random and draft them into working for you". Suppose I chose any 40 people who were currently developing software for Microsoft. What are my chances of getting one person among those who is at or below the 2nd percentile of computer literacy? Followup questions: How does Microsoft avoid hiring people below the 2nd percentile in computer literacy? They have way more than 50 developers. Should the police force screen applicants in any way? Is using a computer part of a police officer's job? Are the police even able to compel randomly-chosen people to work for them? If not, the premise of your numbers is fatally flawed.
    - GhotiFish 13y ago
      it's true, my numbers are flawed. Though I would ask, flawed in what way? Is it more or less likely? The police don't hire on technical skill, presumably people of high skill in this area end up in different careers? The accuracy of the numbers is, frankly, unimportant. What I was illustrating was the multiplicative effect, which remains relevant. I freely admit the numbers themselves were made up.
      - thaumasiotes 13y ago
        Well, you're right about how independent probabilities combine. But the situation you describe has so little relationship to hiring that I don't see how it's relevant to anything. In general, I don't expect to see someone at the 2nd percentile of ability holding down a job at all. Even very basic screening will keep them away with great reliability, because they're so far out of the norm. So I don't see this as a case of "sure, I made up figures that might be off by a factor of 10-100", I see this as you describing a situation utterly unrelated to any aspect of reality I'm familiar with. You can't just make some numeric tweaks to the model; the whole thing is fundamentally at odds with what you're trying to describe. Now, it's definitely not true that you have to be below the second percentile to get phished: http://www.locusmag.com/Perspectives/2010/05/cory-doctorow-persistence-pays-parasites/ http://www.locusmag.com/Perspectives/2010/05/cory-doctorow-p... But if it were true, phishing would be largely a nonissue for workforces (other than the police, who often do set ultra-low thresholds for their screening).

w1ntermute 13y ago

> It is kind of ridiculous how the police manage to damage their computers. As people in positions of power, they really need better training on security and handling equipment. I've seen Toughbooks with severe physical damage They probably just don't care because they're not paying for it themselves. A construction manager told me once that the rate at which his workers' phones were breaking dropped significantly when the workers were made to pay for the new phones themselves.