Penetration Testing mailing list archives
Re: Testing the user community
From: Don Turnblade <Arctific () cox net>
Date: Tue, 6 Feb 2007 18:27:44 +0000 (UTC)
Thor (Hammer of God <thor <at> hammerofgod.com> writes:
Not withstanding the value of the other replies, the problem with this method is that the outcome doesn't really prove anything one way or the other. If he sends a mock virus out and no one opens it, it doesn't mean that they won't open a real one that comes out the next day. If they do open his, that doesn't mean they'll actually open a real one in the future. You can always prove that your users will do something stupid. That's trivial. If the goal is to actually improve the security posture of your userbase, then engage in continued user education - not waste your time trying to get them to open a virus. t On 2/1/07 6:55 AM, "Schanulleke" <schalulleke <at> gmail.com> spoketh to all:webmaster <at> absolutenetworks.biz wrote:We all know our weak link but how do you identify just how weak they are?
I
think it's time to pen test my user community and have a couple ideas to gather statistics on just how nonaware they really are.What is the point you are trying to make, what is the goal you are trying to achieve?Maybe a simple phishing scam and bogus email with a fake virus attachment that emails me when it's
opened
so I can track how many folks actually opened it. Has anyone ever done this before? I can't find any information about it on the web.. thoughts and
ideas
anybody?It all has been done before for real. THere are plenty of real examples out there. If you have AV check how often it is triggered. Or are you really trying to prove that your users at 1d10ts? Frank ------------------------------------------------------------------------ This List Sponsored by: Cenzic Need to secure your web apps? Cenzic Hailstorm finds vulnerabilities fast. Click the link to buy it, try it or download Hailstorm for FREE. http://www.cenzic.com/products_services/download_hailstorm.php?
camp=7016000000
08bOW ------------------------------------------------------------------------------------------------------------------------------------------------ This List Sponsored by: Cenzic Need to secure your web apps? Cenzic Hailstorm finds vulnerabilities fast. Click the link to buy it, try it or download Hailstorm for FREE. http://www.cenzic.com/products_services/download_hailstorm.php?
camp=701600000008bOW
------------------------------------------------------------------------
Please consider your security enhancement metrics very carefully, because your user training will evolve to improve user training scores against your metrics. For example, training in user passsword selection used password cracking tool results to select users for further training. Futher, post instruction password cracking was done to help calibrate instructor training advice. In the example of password strength, it was learned that capable users could take the advice to "not user dictionary words" in a password to mean "do not use an English dictionary". The mistake in instructional advice was uncovered and changed. If the average cracking time per password is a meaningful measure of password strength, then this method lead to a trained user base with a significant improvement. Incomming statistic: Untrained user population: 50% of passwords would crack in less than 3 seconds. Population selected for training, the first 50% Trained user population: 50% of password would crack in less than 2 weeks. General user population: 50% of passwords would crack in less than 72 hours. Using this metric, 6 generational improvments in password training advice for instructors occurred. What is really learned by this method is how to evolve beyond "feel good" user awareness training toward something that works. ------------------------------------------------------------------------ This List Sponsored by: Cenzic Need to secure your web apps? Cenzic Hailstorm finds vulnerabilities fast. Click the link to buy it, try it or download Hailstorm for FREE. http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW ------------------------------------------------------------------------
Current thread:
- Re: Testing the user community, (continued)
- Re: Testing the user community Pete Herzog (Feb 01)
- Re: Testing the user community Schanulleke (Feb 01)
- RE: Testing the user community Paul Melson (Feb 01)
- RE: Testing the user community webmaster (Feb 01)
- RE: Testing the user community Paul Melson (Feb 01)
- RE: Testing the user community webmaster (Feb 01)
- Re: Testing the user community Mister Coffee (Feb 01)
- Re: Testing the user community Thor (Hammer of God) (Feb 02)
- Re: Testing the user community Gadi Evron (Feb 05)
- Re: Testing the user community M . B . Jr . (Feb 06)
- Message not available
- Re: Testing the user community M . B . Jr . (Feb 07)
- Re: Testing the user community Gadi Evron (Feb 05)
- Re: Testing the user community Don Turnblade (Feb 07)
- Re: Testing the user community R. DuFresne (Feb 07)