Endpoint

Why Most Security Awareness Training Fails (And What To Do About It)

100%
0%

BLACK HAT USA 2017 -- Arun Vishwanath, associate professor at the University at Buffalo and faculty associate at Harvard University's Berkman Klein Center, visits the Dark Reading News Desk to discuss the need for better cybersecurity awareness "diagnostics." Vishwanath says training often tries to apply the same cure to every ailment then blames the patient when the treatment doesn't work.

Watch the full, two-day Dark Reading News Desk show and all 45 interviews at DarkReading.com/DRNewsDesk.

Learn from the industry’s most knowledgeable CISOs and IT security experts in a setting that is conducive to interaction and conversation. Click for more info and to register.

Comment  | 
Print  | 
Comments
Newest First  |  Oldest First  |  Threaded View
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
8/27/2017 | 9:40:11 AM
Re: First and last line of defense ..... and yet
Fear is another motivator. It doesn't have to be a refund invoice. It could be a bill or a warning or some such thing. It could also be an updated HR policy. Something that would hold just enough interest rather than something that stands out as extraordinary.

After all, for many checking their email, anything that's not obvious spam is going to stand out as extraordinary.
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
8/25/2017 | 2:58:47 PM
First and last line of defense ..... and yet
People still open up a jpg file or a pdf invoice partly because they are curious to see what it does.  If this simple rule of email was really observed, infections would go way down.  Human nature however, is a very powerful thing indeed.  Greed too.  That refund invoice for $375 from the Liberty Wine company.  That is far less obvious that the emails about $7,203,230 from a late relative now held in the Bank of Nigeria.  

We're human after all.
What We Talk About When We Talk About Risk
Jack Jones, Chairman, FAIR Institute,  7/11/2018
Ticketmaster Breach Part of Massive Payment Card Hacking Campaign
Jai Vijayan, Freelance writer,  7/10/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Locked device, Ha! I knew there was another way in.
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-2638
PUBLISHED: 2018-07-16
It was found that the REST API in Infinispan before version 9.0.0 did not properly enforce auth constraints. An attacker could use this vulnerability to read or modify data in the default cache or a known cache name.
CVE-2017-7468
PUBLISHED: 2018-07-16
In curl and libcurl 7.52.0 to and including 7.53.1, libcurl would attempt to resume a TLS session even if the client certificate had changed. That is unacceptable since a server by specification is allowed to skip the client certificate check on resume, and may instead use the old identity which was...
CVE-2018-13387
PUBLISHED: 2018-07-16
The IncomingMailServers resource in Atlassian JIRA Server before version 7.6.7, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3 and from version 7.10.0 before version 7.10.2 allows remote attackers to inject arbitrary HTML or ...
CVE-2018-14071
PUBLISHED: 2018-07-16
The Geo Mashup plugin before 1.10.4 for WordPress has insufficient sanitization of post editor and other user input.
CVE-2018-5229
PUBLISHED: 2018-07-16
The NotificationRepresentationFactoryImpl class in Atlassian Universal Plugin Manager before version 2.22.9 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the name of user submitted add-on names.