Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
End Users Causing Bulk Of Infosec Headaches
Newest First  |  Oldest First  |  Threaded View
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
2/26/2015 | 8:29:55 AM
Re: Stop blaming the user
One cool proactive step that can be done to promote user security awareness is phishing exercises. I know tools such as metasploit have the capability to perform these test runs and output statistical data to see where your company is lacking.
Kwattman
50%
50%
Kwattman,
User Rank: Black Belt
2/25/2015 | 11:55:14 AM
Re: Stop blaming the user
Agreed. Sadly, the majority of companies either do not train or reply on 1x-2x a year training for users. This is not enough to raise awarenress and train users effectively. Aberdeen is right and we've seen massive reduction in risk, APTs and attacks when users are trained AND kept aware with regularly phishing tests. 
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
2/24/2015 | 1:11:13 PM
Re: Stop blaming the user
I agree mainly, I would add unsecured network to that list. At the end of the day security is a layered journey.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
2/24/2015 | 1:08:30 PM
Re: Stop blaming the user
Phishing is one thing and emails with attachments and links are very common these days. A few friends I know experienced malware coming via email in their networks recently.
Dr.T
0%
100%
Dr.T,
User Rank: Ninja
2/24/2015 | 12:59:41 PM
Re: Stop blaming the user
I agree, the users are just trying to get their talks done, they do not want anytugn to do with the system to start with, they want to finish their daily tasks and go home and have a peaceful night. :--))
Dr.T
0%
100%
Dr.T,
User Rank: Ninja
2/24/2015 | 12:56:26 PM
Blame users?
We can continue to blame users, that is an each approach for IT professionals, the problem is that that would not change the ultimate outcome. We will continue to be in fighting security problems with that approach.
macker490
50%
50%
macker490,
User Rank: Ninja
2/21/2015 | 9:15:41 AM
Re: Stop blaming the user
(1) email should be authenticated.   the means of doing this has been available for years: use PGP/Desktop or ENIGMAIL with Thunderbird if you are into FSF

(2) your operating software should not allow itself to be compromised by the actions of an erroneous or improper application program.    that has been a guideline since System/360 -- date 1964.  It was baked into x86 witht he release of 80386,-- but theO/S must properly implement the available tools
macker490
50%
50%
macker490,
User Rank: Ninja
2/21/2015 | 9:12:16 AM
Re: Stop blaming the user
no, Erica : it's INSECURE SOFTWARE that is the problem.
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
2/20/2015 | 9:30:40 AM
Re: Stop blaming the user
I agree @Marilyn Cohodas. Phishing emails are becoming more and more authentic looking and even the most security savvy users will fall victim when going through a routine. Drive by downloads are also difficult to tackle as user interaction is not required. Yes user awareness training is defintely a monumental help but will not be a silver bullet.
Marilyn Cohodas
100%
0%
Marilyn Cohodas,
User Rank: Strategist
2/19/2015 | 9:36:55 AM
Stop blaming the user
Let's not blame the victim here. Sure users can be careless sometimes (alright , lots of times), but given the sophistication of attacks today, many of the most knowledgeable information security professionals concede that they too can be tricked by a well-crafted phishing email. Don't believe me? ICYMI, read 5 Myths: Why We Are All Data Security Risks.


COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/9/2020
Omdia Research Launches Page on Dark Reading
Tim Wilson, Editor in Chief, Dark Reading 7/9/2020
Mobile App Fraud Jumped in Q1 as Attackers Pivot from Browsers
Jai Vijayan, Contributing Writer,  7/10/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15105
PUBLISHED: 2020-07-10
Django Two-Factor Authentication before 1.12, stores the user's password in clear text in the user session (base64-encoded). The password is stored in the session when the user submits their username and password, and is removed once they complete authentication by entering a two-factor authenticati...
CVE-2020-11061
PUBLISHED: 2020-07-10
In Bareos Director less than or equal to 16.2.10, 17.2.9, 18.2.8, and 19.2.7, a heap overflow allows a malicious client to corrupt the director's memory via oversized digest strings sent during initialization of a verify job. Disabling verify jobs mitigates the problem. This issue is also patched in...
CVE-2020-4042
PUBLISHED: 2020-07-10
Bareos before version 19.2.8 and earlier allows a malicious client to communicate with the director without knowledge of the shared secret if the director allows client initiated connection and connects to the client itself. The malicious client can replay the Bareos director's cram-md5 challenge to...
CVE-2020-11081
PUBLISHED: 2020-07-10
osquery before version 4.4.0 enables a priviledge escalation vulnerability. If a Window system is configured with a PATH that contains a user-writable directory then a local user may write a zlib1.dll DLL, which osquery will attempt to load. Since osquery runs with elevated privileges this enables l...
CVE-2020-6114
PUBLISHED: 2020-07-10
An exploitable SQL injection vulnerability exists in the Admin Reports functionality of Glacies IceHRM v26.6.0.OS (Commit bb274de1751ffb9d09482fd2538f9950a94c510a) . A specially crafted HTTP request can cause SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerabi...