Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
End Users Causing Bulk Of Infosec Headaches
Newest First  |  Oldest First  |  Threaded View
RyanSepe
RyanSepe,
User Rank: Ninja
2/26/2015 | 8:29:55 AM
Re: Stop blaming the user
One cool proactive step that can be done to promote user security awareness is phishing exercises. I know tools such as metasploit have the capability to perform these test runs and output statistical data to see where your company is lacking.
Kwattman
Kwattman,
User Rank: Black Belt
2/25/2015 | 11:55:14 AM
Re: Stop blaming the user
Agreed. Sadly, the majority of companies either do not train or reply on 1x-2x a year training for users. This is not enough to raise awarenress and train users effectively. Aberdeen is right and we've seen massive reduction in risk, APTs and attacks when users are trained AND kept aware with regularly phishing tests. 
Dr.T
Dr.T,
User Rank: Ninja
2/24/2015 | 1:11:13 PM
Re: Stop blaming the user
I agree mainly, I would add unsecured network to that list. At the end of the day security is a layered journey.
Dr.T
Dr.T,
User Rank: Ninja
2/24/2015 | 1:08:30 PM
Re: Stop blaming the user
Phishing is one thing and emails with attachments and links are very common these days. A few friends I know experienced malware coming via email in their networks recently.
Dr.T
Dr.T,
User Rank: Ninja
2/24/2015 | 12:59:41 PM
Re: Stop blaming the user
I agree, the users are just trying to get their talks done, they do not want anytugn to do with the system to start with, they want to finish their daily tasks and go home and have a peaceful night. :--))
Dr.T
Dr.T,
User Rank: Ninja
2/24/2015 | 12:56:26 PM
Blame users?
We can continue to blame users, that is an each approach for IT professionals, the problem is that that would not change the ultimate outcome. We will continue to be in fighting security problems with that approach.
macker490
macker490,
User Rank: Ninja
2/21/2015 | 9:15:41 AM
Re: Stop blaming the user
(1) email should be authenticated.   the means of doing this has been available for years: use PGP/Desktop or ENIGMAIL with Thunderbird if you are into FSF

(2) your operating software should not allow itself to be compromised by the actions of an erroneous or improper application program.    that has been a guideline since System/360 -- date 1964.  It was baked into x86 witht he release of 80386,-- but theO/S must properly implement the available tools
macker490
macker490,
User Rank: Ninja
2/21/2015 | 9:12:16 AM
Re: Stop blaming the user
no, Erica : it's INSECURE SOFTWARE that is the problem.
RyanSepe
RyanSepe,
User Rank: Ninja
2/20/2015 | 9:30:40 AM
Re: Stop blaming the user
I agree @Marilyn Cohodas. Phishing emails are becoming more and more authentic looking and even the most security savvy users will fall victim when going through a routine. Drive by downloads are also difficult to tackle as user interaction is not required. Yes user awareness training is defintely a monumental help but will not be a silver bullet.
Marilyn Cohodas
Marilyn Cohodas,
User Rank: Strategist
2/19/2015 | 9:36:55 AM
Stop blaming the user
Let's not blame the victim here. Sure users can be careless sometimes (alright , lots of times), but given the sophistication of attacks today, many of the most knowledgeable information security professionals concede that they too can be tricked by a well-crafted phishing email. Don't believe me? ICYMI, read 5 Myths: Why We Are All Data Security Risks.


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Incorporating a Prevention Mindset into Threat Detection and Response
Threat detection and response systems, by definition, are reactive because they have to wait for damage to be done before finding the attack. With a prevention-mindset, security teams can proactively anticipate the attacker's next move, rather than reacting to specific threats or trying to detect the latest techniques in real-time. The report covers areas enterprises should focus on: What positive response looks like. Improving security hygiene. Combining preventive actions with red team efforts.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-25878
PUBLISHED: 2022-05-27
The package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the Object.prototype. This vulnerability can occur in multiple ways: 1. by providing untrusted user input to util.setProperty or to ReflectionObject.setParsedOption ...
CVE-2021-27780
PUBLISHED: 2022-05-27
The software may be vulnerable to both Un-Auth XML interaction and unauthenticated device enrollment.
CVE-2021-27781
PUBLISHED: 2022-05-27
The Master operator may be able to embed script tag in HTML with alert pop-up display cookie.
CVE-2022-1897
PUBLISHED: 2022-05-27
Out-of-bounds Write in GitHub repository vim/vim prior to 8.2.
CVE-2022-20666
PUBLISHED: 2022-05-27
Multiple vulnerabilities in the web-based management interface of Cisco Common Services Platform Collector (CSPC) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. These vulnerabilities are due to insufficient va...