Full Disclosure mailing list archives
RE: [inbox] Re: CyberInsecurity: The cost of Mo nopoly
From: Chris Cozad <ccozad () sci-aust com au>
Date: Tue, 30 Sep 2003 16:09:51 +1000
Do you really think you could convince the average user that they need to know this much about security? I mean, most users see their computers (and the network, servers, phones, faxes, etc...) as a tool to do business with. Nothing else. The computers are there to do a job, or help get a job done, and nothing else. It is not so much that they don't know, it is that they don't need to know. To actually get users to attend this level of training would be fantastic. Our jobs would be so much easier. But it just aint gunna happen in the real world. It is definitely up to us, as security professionals, to effectively "idiot proof" our systems, so that users only need to know some basic security rules. Thats my 2 cents worth, anyway... Chris Cozad (ccozad () scia com au) Infrastructure Manager SCIA Pty. Ltd. -----Original Message----- From: Paul Schmehl [mailto:pauls () utdallas edu] Sent: Tuesday, 30 September 2003 2:58 PM To: full-disclosure () lists netsys com Subject: RE: [inbox] Re: [Full-disclosure] CyberInsecurity: The cost of Monopoly --On Monday, September 29, 2003 19:30:24 -0600 Bruce Ediger <eballen1 () qwest net> wrote:
I realize you're from Texas and everything, but are you nuts? An 8-year old with a handgun should cause vast feelings of insecurity in you, with or without proper training on her part.
Hmmm...I am from Texas, and I can tell you that many an eight year old learns to handle firearms down here. Not all of Texas is citified, you know. We still have a lot of open range with coyotes and ground hogs and other things to shoot at.
Besides that, what do you mean by "proper safety training" for a computer used? If you mean the failed "don't click on any attachments, don't open email from someone you don't know" recipe-style of training, then no to that too.
No, I meant proper security training. Is that so hard to understand? Regardless of the OS, every user should know how and why to patch. Every user should understand what social engineering is, how to detect it and what to do about it. Every user should understand physical security, locking your workstation, why you should logout and when, etc., etc. Every user should understand the basics of malicious code, how to spot it, what to do about it, how to recognize hoaxes, where the resources are when they need help. Without user training and an educated user community, no security program can ever hope to succeed. Paul Schmehl (pauls () utdallas edu) Adjunct Information Security Officer The University of Texas at Dallas AVIEN Founding Member http://www.utdallas.edu _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html ---------------------------------------------------------------------------- ---------------------------------------- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the originator of the message. This footer also confirms that this email message has been scanned for the presence of computer viruses. Any views expressed in this message are those of the individual sender, except where the sender specifies and with authority, states them to be the views of Service Corporation International Australia. Scanning of this message and addition of this footer is performed by SurfControl SuperScout Email Filter software in conjunction with virus detection software. -------------------------------------------------------------------------------------------------------------------- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the originator of the message. This footer also confirms that this email message has been scanned for the presence of computer viruses. Any views expressed in this message are those of the individual sender, except where the sender specifies and with authority, states them to be the views of Service Corporation International Australia. Scanning of this message and addition of this footer is performed by SurfControl SuperScout Email Filter software in conjunction with virus detection software.
Current thread:
- RE: [inbox] Re: CyberInsecurity: The cost of Mo nopoly Chris Cozad (Sep 29)
- Re: CyberInsecurity: The cost of Mo nopoly Thomas Binder (Sep 30)
- Re: [inbox] Re: CyberInsecurity: The cost of Mo nopoly Valdis . Kletnieks (Sep 30)
- RE: [inbox] Re: CyberInsecurity: The cost of Mo nopoly Michael Smith (Sep 30)
- Re: [inbox] Re: CyberInsecurity: The cost of Mo nopoly Ron DuFresne (Sep 30)
- Re: [inbox] Re: CyberInsecurity: The cost of Mo nopoly Frank Bridges (Sep 30)