Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Why Cyber Security Starts At Home
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
sbynoe
50%
50%
sbynoe,
User Rank: Apprentice
10/12/2016 | 7:14:09 AM
reply
A very good post.
CNACHREINER981
50%
50%
CNACHREINER981,
User Rank: Author
11/18/2014 | 12:40:32 PM
Re: Is it Time for Mandatory Infosec Training in Schools?
I like the idea of the Infosec community helping... however, I do have a strong belief that the reason some training has failed is that users don't care, or can't "Get it," but because many of the technical folks I interact with aren't great teachers... They make assumptions about what people should know about their field, and judgements if other don't know certain things... For training to work, the training can't act like the snarky, know-it-all, cliche idea we have of the IT guy. I know many IT guys aren't that person, but I have seen enough cynical IT guys that would not make good teachers.

 
CNACHREINER981
50%
50%
CNACHREINER981,
User Rank: Author
11/18/2014 | 12:37:37 PM
Re: Is it Time for Mandatory Infosec Training in Schools?
Heh... Geriatric, sounds like we both like the car analogies... I was responding to charles before I saw you reply which uses the same car analogy I did! ^_^... Great minds...
CNACHREINER981
50%
50%
CNACHREINER981,
User Rank: Author
11/18/2014 | 12:36:14 PM
Re: Retailer Responsibility
I only half agree with you. I totally agree that software vendors and system designers bear a huge responsibility and should focus more on secure design... but I still think the user needs to follow safe practices. Look at cars... manufacturers have responsibility (legal and ethical) to create safe vehicles... but an idiot driver can still crash despite all that. Which is why we require drivers to go through training and be responsible for their driving practices... Both the software vendors and the users bear some responsibility.
Robert McDougal
50%
50%
Robert McDougal,
User Rank: Ninja
11/18/2014 | 11:40:38 AM
Re: Trying to do their part...
@Thomas It's funny that you mention that, I do the same for my wife and kids.  Although I think they get tired of hearing from me....
GonzSTL
50%
50%
GonzSTL,
User Rank: Ninja
11/18/2014 | 10:59:25 AM
Re: Is it Time for Mandatory Infosec Training in Schools?
I have no problem with my tax money being used to educate school kids in the basics of infosec. I would even volunteer my time to help develop training material. It really is important to provide basic infosec training to as much of the general public as possible because as the article points out, any everyday person can become an unwitting conduit for spreading malicious activity. Even more importantly, the lack of cyber security awareness can be very dangerous for children, who are very likely to be involved in online activity.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
11/18/2014 | 9:16:09 AM
Re: Is it Time for Mandatory Infosec Training in Schools?
Yes it is time, @geriatric, in fact it is long overdue. But I think that  user security training has to be baked in to everyday classroom activities, just as computing is at home , at school and at work. Problem is that the typical classrom teacher has neither the time or knowledge to take on that role. Maybe it's something the infosec commuity should pick up as a public service...
geriatric
50%
50%
geriatric,
User Rank: Moderator
11/18/2014 | 7:07:36 AM
Is it Time for Mandatory Infosec Training in Schools?
You make a great point about the computer actions/inactions of another impacting everyone. An analogy can be made to automobile drivers. You may be doing everything you're supposed to, and still get t-boned from a joker who doesn't pay attention.

A couple decades ago, I was working with a school district on their computing initiatives, and the subject of typewriter courses came up. They commented how irrelevant it was, and after discussion, we morphed it into keyboarding/basic computing. Point being, things change.

A great place to raise awareness and train future generations is in our schools. Like many other subjects, starting at the genesis of their experiences is the answer. Although computer illiteracy is not generational (my octogenarian mother is one of the most aware computer users I know), we have to make sure everyone who needs trained is getting it, and what better place than our educational institutions?

Start 'em young.
RetiredUser
100%
0%
RetiredUser,
User Rank: Ninja
11/17/2014 | 5:45:13 PM
Retailer Responsibility
I definitely agree with your thesis here but I truly believe there are some folks out there who will never get, don't want to get it, and frankly shouldn't have to.  For that segment of society, I believe there needs to be more responsibility taken on by retailers of computing systems.  There has always been pressure on software and service providers to write more secure software.  Microsoft, Facebook, Apple – all regularly badgered when holes appear and regular folks get hurt as a result.  But on the retail end of things, there isn't much onus on BestBuy or CompUSA to keep its customers up-to-date on their purchases from the perspective of your three tips.  I think sending that guy who will never get security home with a PC and no support is like sending someone home with a gun and absolutely no training or follow-up licensing requirements, and then also handing them a bag of bullets.  An ecosystem of unsecured wireless networks and computers is exactly how some cyber criminals excel in what they do, having that many more hop spots or dark Internet corners to work from.  There securely written software, and then common sense and community self-support, but then there is that group that will never be secure if left on their own.  How do we make retailers of computing systems more accountable for the extended care of customers, and that they are contributing to the greater security of the Internet?  Should we?
Thomas Claburn
50%
50%
Thomas Claburn,
User Rank: Ninja
11/17/2014 | 5:29:03 PM
Re: Trying to do their part...
In my family, I make a point of talking about security issues, so the kids keep that in mind when they see similar scams. Awareness helps a lot.
Page 1 / 2   >   >>


Manchester United Suffers Cyberattack
Dark Reading Staff 11/23/2020
As 'Anywhere Work' Evolves, Security Will Be Key Challenge
Robert Lemos, Contributing Writer,  11/23/2020
Cloud Security Startup Lightspin Emerges From Stealth
Kelly Sheridan, Staff Editor, Dark Reading,  11/24/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-29378
PUBLISHED: 2020-11-29
An issue was discovered on V-SOL V1600D V2.03.69 and V2.03.57, V1600D4L V1.01.49, V1600D-MINI V1.01.48, V1600G1 V2.0.7 and V1.9.7, and V1600G2 V1.1.4 OLT devices. It is possible to elevate the privilege of a CLI user (to full administrative access) by using the password [email protected]#y$z%x6x7q8c9z) for the e...
CVE-2020-29379
PUBLISHED: 2020-11-29
An issue was discovered on V-SOL V1600D4L V1.01.49 and V1600D-MINI V1.01.48 OLT devices. During the process of updating the firmware, the update script starts a telnetd -l /bin/sh process that does not require authentication for TELNET access.
CVE-2020-29380
PUBLISHED: 2020-11-29
An issue was discovered on V-SOL V1600D V2.03.69 and V2.03.57, V1600D4L V1.01.49, V1600D-MINI V1.01.48, V1600G1 V2.0.7 and V1.9.7, and V1600G2 V1.1.4 OLT devices. TELNET is offered by default but SSH is not always available. An attacker can intercept passwords sent in cleartext and conduct a man-in-...
CVE-2020-29381
PUBLISHED: 2020-11-29
An issue was discovered on V-SOL V1600D V2.03.69 and V2.03.57, V1600D4L V1.01.49, V1600D-MINI V1.01.48, V1600G1 V2.0.7 and V1.9.7, and V1600G2 V1.1.4 OLT devices. Command injection can occur in "upload tftp syslog" and "upload tftp configuration" in the CLI via a crafted filename...
CVE-2020-29382
PUBLISHED: 2020-11-29
An issue was discovered on V-SOL V1600D V2.03.69 and V2.03.57, V1600G1 V2.0.7 and V1.9.7, and V1600G2 V1.1.4 OLT devices. A hardcoded RSA private key (specific to V1600D, V1600G1, and V1600G2) is contained in the firmware images.