6 ms·

But are the security experts actually safer online? The study seems to assume that they are. It may be a fair assumption, but it would be interesting to know i

But are the security experts actually safer online? The study seems to assume that they are. It may be a fair assumption, but it would be interesting to know if it actually is true or not. It would also help validate the security practices. If it turns out that the security experts got infected just as much, or only slightly less than the non-experts, then following their practices might not be worth the effort...

theseatoms 11y ago
If they aren't safer online, that'd be a sign to me that I shouldn't bother trying to do everything right. I don't want invest the time and energy developing expertise when even those that have it don't use it.
TempaTaccount 11y ago
Are the security experts are target more likely to attract those who might want to compromise them for bragging rights?
- joosters 11y ago
  Yes, plus it might be true that security experts visit riskier websites because of the nature of their research. It's a difficult task to try and balance these factors out to make a useful comparison.
dublinben 11y ago
It depends on what your definition of safety is. The perspective of this paper probably relates to compromised accounts and information leaks, not adware infections.
- joosters 11y ago
  I haven't completely read the full paper yet (it's pretty big), but in a brief scan, I can't actually find any definition they use for staying safe. They talk about 'protecting their security online' and 'to stay safe online', however I didn't spot anything more specific. As you point out, there are a variety of attacks and big differences between e.g. leaking a password or getting a virus infection. But since their highlighted techniques cover both of these attacks (virus scanners, password best practices), you have to assume that they are relating to a whole range of attacks.
  - iulia_ion 11y ago
    We did not provide a definition of what "staying safe online" means. As a result, some participants might have thought more of protecting online accounts, while others focussed on keeping their systems from getting compromised, etc. But coming from a non-technical user the question would be likely to be framed just like that: vague, because users don't know what the biggest threats are and what they should defend from first.
lucb1e 11y ago
Very good question, but I'm not sure how you imagine this could be addressed. Security experts may use a lot more password managers and want to use unique passwords, but you could say that's just because they have a lot more accounts than normal people. Most people have a couple accounts for social networking, their bank, perhaps a local library... experts usually work in the field, spend their days online in an office, and have lots of accounts for various tasks or activities. The attack surface is very different: lots of accounts versus just a couple. Lots of time online browsing various sites versus browsing your average social network in spare time. Perhaps I'm overgeneralizing, but it probably matches a good percentage. And then there is the definition of "safer" or "expert". Are you an expert when you got a degree in the field? When you followed some online courses? When you work in the field? Or when you read a lot about security?
- joosters 11y ago
  The paper acknowledges the problem in defining a security expert (see 5.1: Limitations) Defining a security “expert” is challenging, and we settled upon a definition that is simple (5+ self-reported years of experience in the area)
  - innguest 11y ago
    Traits of a security "expert": - charges by the hour - has no product to sell but hype and fear - conflates "vulnerability" with "attackability" for profit - thinks by breaking people's products they are helping fix them - does not know the meaning of phrases such as "practical" and "real-world" Security experts are snake oil peddlers. They sell tougher doors so thieves can't knock them down, while the government furnishes thieves with universal jigglers/lockpickers. The first security expert will be the person that stops the government from putting backdoors everywhere. They won't do that because to them, government backdoors are not a problem. Only your vulnerabilities, which do not prove a service can actually be attacked, are a problem in their eyes. Which is why they charge you by the hour while working for the government implementing the backdoors that they use to scare you into paying them their high consultancy fees.
- lallysingh 11y ago
Florin_Andrei 11y ago
> But are the security experts actually safer online? s/security experts/technical users/ Yes, we are. Whenever you see a laptop full of malware, that's a non-technical user. We're not safe from it entirely, nobody is 100% safe, but we're in much better shape than the regular folks.
- joosters 11y ago
  Citation needed! Not just being pedantic here for the sake of it, I think it would be good to know how much safer experts generally are. Just saying "we're better than them!" isn't very convincing or useful.
  - scintill76 11y ago
    I'm skeptical too. "The experts", e.g. HBGary, get pwned worse than having a bunch of crapware on their desktop, but it's for the same types of mistakes: "So what do we have in total? A Web application with SQL injection flaws and insecure passwords. Passwords that were badly chosen. Passwords that were reused. Servers that allowed password-based authentication. Systems that weren't patched. And an astonishing willingness to hand out credentials over e-mail, even when the person being asked for them should have realized something was up. [...] Most frustrating for HBGary must be the knowledge that they know what they did wrong, and they were perfectly aware of best practices; they just didn't actually use them. Everybody knows you don't use easy-to-crack passwords, but some employees did. Everybody knows you don't re-use passwords, but some of them did. Everybody knows that you should patch servers to keep them free of known security flaws, but they didn't." [1] Granted, this doesn't prove that experts are generally unsafe, and maybe somebody with a beef with these ones in particular would say they're just semi-knowledgeable salesmen cashing in on the cyber scare, but it lends some weight to the idea that too many experts aren't much safer. [1] http://arstechnica.com/tech-policy/2011/02/anonymous-speaks-the-inside-story-of-the-hbgary-hack/ http://arstechnica.com/tech-policy/2011/02/anonymous-speaks-...
    - pixl97 11y ago
      Experts in what? Where I work the actual IT staff/server admins are pretty safe. They update, patch, and in general choose good passwords. The programmers... ugh, good lord. They have the worst practices ever.
iulia_ion 11y ago
The truth is that we don't know if security experts are actually safer. Maybe the fact that they are experts makes them more confident that they can deal with an incident if such a thing arises. So it might be that they take more risks, but then are simply better at fixing things when they break. We also don't have a ground truth for what users should do to stay safe online. Do updates work better than a strong password? Measuring the effectiveness of different security actions as scale is so challenging, that we don't now how to do it.

theseatoms 11y ago

If they aren't safer online, that'd be a sign to me that I shouldn't bother trying to do everything right. I don't want invest the time and energy developing expertise when even those that have it don't use it.

TempaTaccount 11y ago

Are the security experts are target more likely to attract those who might want to compromise them for bragging rights?

joosters 11y ago
Yes, plus it might be true that security experts visit riskier websites because of the nature of their research. It's a difficult task to try and balance these factors out to make a useful comparison.

dublinben 11y ago

It depends on what your definition of safety is. The perspective of this paper probably relates to compromised accounts and information leaks, not adware infections.

joosters 11y ago
I haven't completely read the full paper yet (it's pretty big), but in a brief scan, I can't actually find any definition they use for staying safe. They talk about 'protecting their security online' and 'to stay safe online', however I didn't spot anything more specific. As you point out, there are a variety of attacks and big differences between e.g. leaking a password or getting a virus infection. But since their highlighted techniques cover both of these attacks (virus scanners, password best practices), you have to assume that they are relating to a whole range of attacks.
- iulia_ion 11y ago
  We did not provide a definition of what "staying safe online" means. As a result, some participants might have thought more of protecting online accounts, while others focussed on keeping their systems from getting compromised, etc. But coming from a non-technical user the question would be likely to be framed just like that: vague, because users don't know what the biggest threats are and what they should defend from first.

lucb1e 11y ago

Very good question, but I'm not sure how you imagine this could be addressed. Security experts may use a lot more password managers and want to use unique passwords, but you could say that's just because they have a lot more accounts than normal people. Most people have a couple accounts for social networking, their bank, perhaps a local library... experts usually work in the field, spend their days online in an office, and have lots of accounts for various tasks or activities. The attack surface is very different: lots of accounts versus just a couple. Lots of time online browsing various sites versus browsing your average social network in spare time. Perhaps I'm overgeneralizing, but it probably matches a good percentage. And then there is the definition of "safer" or "expert". Are you an expert when you got a degree in the field? When you followed some online courses? When you work in the field? Or when you read a lot about security?

joosters 11y ago
The paper acknowledges the problem in defining a security expert (see 5.1: Limitations) Defining a security “expert” is challenging, and we settled upon a definition that is simple (5+ self-reported years of experience in the area)
- innguest 11y ago
  Traits of a security "expert": - charges by the hour - has no product to sell but hype and fear - conflates "vulnerability" with "attackability" for profit - thinks by breaking people's products they are helping fix them - does not know the meaning of phrases such as "practical" and "real-world" Security experts are snake oil peddlers. They sell tougher doors so thieves can't knock them down, while the government furnishes thieves with universal jigglers/lockpickers. The first security expert will be the person that stops the government from putting backdoors everywhere. They won't do that because to them, government backdoors are not a problem. Only your vulnerabilities, which do not prove a service can actually be attacked, are a problem in their eyes. Which is why they charge you by the hour while working for the government implementing the backdoors that they use to scare you into paying them their high consultancy fees.
lallysingh 11y ago

Florin_Andrei 11y ago

> But are the security experts actually safer online? s/security experts/technical users/ Yes, we are. Whenever you see a laptop full of malware, that's a non-technical user. We're not safe from it entirely, nobody is 100% safe, but we're in much better shape than the regular folks.

joosters 11y ago
Citation needed! Not just being pedantic here for the sake of it, I think it would be good to know how much safer experts generally are. Just saying "we're better than them!" isn't very convincing or useful.
- scintill76 11y ago
  I'm skeptical too. "The experts", e.g. HBGary, get pwned worse than having a bunch of crapware on their desktop, but it's for the same types of mistakes: "So what do we have in total? A Web application with SQL injection flaws and insecure passwords. Passwords that were badly chosen. Passwords that were reused. Servers that allowed password-based authentication. Systems that weren't patched. And an astonishing willingness to hand out credentials over e-mail, even when the person being asked for them should have realized something was up. [...] Most frustrating for HBGary must be the knowledge that they know what they did wrong, and they were perfectly aware of best practices; they just didn't actually use them. Everybody knows you don't use easy-to-crack passwords, but some employees did. Everybody knows you don't re-use passwords, but some of them did. Everybody knows that you should patch servers to keep them free of known security flaws, but they didn't." [1] Granted, this doesn't prove that experts are generally unsafe, and maybe somebody with a beef with these ones in particular would say they're just semi-knowledgeable salesmen cashing in on the cyber scare, but it lends some weight to the idea that too many experts aren't much safer. [1] http://arstechnica.com/tech-policy/2011/02/anonymous-speaks-the-inside-story-of-the-hbgary-hack/ http://arstechnica.com/tech-policy/2011/02/anonymous-speaks-...
  - pixl97 11y ago
    Experts in what? Where I work the actual IT staff/server admins are pretty safe. They update, patch, and in general choose good passwords. The programmers... ugh, good lord. They have the worst practices ever.

iulia_ion 11y ago

The truth is that we don't know if security experts are actually safer. Maybe the fact that they are experts makes them more confident that they can deal with an incident if such a thing arises. So it might be that they take more risks, but then are simply better at fixing things when they break. We also don't have a ground truth for what users should do to stay safe online. Do updates work better than a strong password? Measuring the effectiveness of different security actions as scale is so challenging, that we don't now how to do it.