Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Database Security
Authentication
Mobile
Privacy
Compliance
Careers and People
Identity & Access Management
Security Monitoring
Advanced Threats
Insider Threats
Vulnerability Management
Comments
End Users Causing Bulk Of Infosec Headaches
Newest First  |  Oldest First  |  Threaded View
RyanSepe
RyanSepe,
 User Rank: Ninja
2/26/2015 | 8:29:55 AM
Re: Stop blaming the user
One cool proactive step that can be done to promote user security awareness is phishing exercises. I know tools such as metasploit have the capability to perform these test runs and output statistical data to see where your company is lacking.
Kwattman
Kwattman,
 User Rank: Black Belt
2/25/2015 | 11:55:14 AM
Re: Stop blaming the user
Agreed. Sadly, the majority of companies either do not train or reply on 1x-2x a year training for users. This is not enough to raise awarenress and train users effectively. Aberdeen is right and we've seen massive reduction in risk, APTs and attacks when users are trained AND kept aware with regularly phishing tests. 
Dr.T
Dr.T,
 User Rank: Ninja
2/24/2015 | 1:11:13 PM
Re: Stop blaming the user
I agree mainly, I would add unsecured network to that list. At the end of the day security is a layered journey.
Dr.T
Dr.T,
 User Rank: Ninja
2/24/2015 | 1:08:30 PM
Re: Stop blaming the user
Phishing is one thing and emails with attachments and links are very common these days. A few friends I know experienced malware coming via email in their networks recently.
Dr.T
Dr.T,
 User Rank: Ninja
2/24/2015 | 12:59:41 PM
Re: Stop blaming the user
I agree, the users are just trying to get their talks done, they do not want anytugn to do with the system to start with, they want to finish their daily tasks and go home and have a peaceful night. :--))
Dr.T
Dr.T,
 User Rank: Ninja
2/24/2015 | 12:56:26 PM
Blame users?
We can continue to blame users, that is an each approach for IT professionals, the problem is that that would not change the ultimate outcome. We will continue to be in fighting security problems with that approach.
macker490
macker490,
 User Rank: Ninja
2/21/2015 | 9:15:41 AM
Re: Stop blaming the user
(1) email should be authenticated.   the means of doing this has been available for years: use PGP/Desktop or ENIGMAIL with Thunderbird if you are into FSF

(2) your operating software should not allow itself to be compromised by the actions of an erroneous or improper application program.    that has been a guideline since System/360 -- date 1964.  It was baked into x86 witht he release of 80386,-- but theO/S must properly implement the available tools
macker490
macker490,
 User Rank: Ninja
2/21/2015 | 9:12:16 AM
Re: Stop blaming the user
no, Erica : it's INSECURE SOFTWARE that is the problem.
RyanSepe
RyanSepe,
 User Rank: Ninja
2/20/2015 | 9:30:40 AM
Re: Stop blaming the user
I agree @Marilyn Cohodas. Phishing emails are becoming more and more authentic looking and even the most security savvy users will fall victim when going through a routine. Drive by downloads are also difficult to tackle as user interaction is not required. Yes user awareness training is defintely a monumental help but will not be a silver bullet.
Marilyn Cohodas
Marilyn Cohodas,
 User Rank: Strategist
2/19/2015 | 9:36:55 AM
Stop blaming the user
Let's not blame the victim here. Sure users can be careless sometimes (alright , lots of times), but given the sophistication of attacks today, many of the most knowledgeable information security professionals concede that they too can be tricked by a well-crafted phishing email. Don't believe me? ICYMI, read 5 Myths: Why We Are All Data Security Risks.


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The 10 Most Impactful Types of Vulnerabilities for Enterprises Today
Managing system vulnerabilities is one of the old est - and most frustrating - security challenges that enterprise defenders face. Every software application and hardware device ships with intrinsic flaws - flaws that, if critical enough, attackers can exploit from anywhere in the world. It's crucial that defenders take stock of what areas of the tech stack have the most emerging, and critical, vulnerabilities they must manage. It's not just zero day vulnerabilities. Consider that CISA's Known Exploited Vulnerabilities (KEV) catalog lists vulnerabilitlies in widely used applications that are "actively exploited," and most of them are flaws that were discovered several years ago and have been fixed. There are also emerging vulnerabilities in 5G networks, cloud infrastructure, Edge applications, and firmwares to consider.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2023-1172
PUBLISHED: 2023-03-17
The Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the full name value in versions up to, and including, 21.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that w...
CVE-2023-1469
PUBLISHED: 2023-03-17
The WP Express Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘pec_coupon[code]’ parameter in versions up to, and including, 2.2.8 due to insufficient input sanitization and output escaping. This makes it possible for authenti...
CVE-2023-1466
PUBLISHED: 2023-03-17
A vulnerability was found in SourceCodester Student Study Center Desk Management System 1.0. It has been rated as critical. This issue affects the function view_student of the file admin/?page=students/view_student. The manipulation of the argument id with the input 3' AND (SELECT 2100 FROM (SELECT(...
CVE-2023-1467
PUBLISHED: 2023-03-17
A vulnerability classified as critical has been found in SourceCodester Student Study Center Desk Management System 1.0. Affected is an unknown function of the file Master.php?f=delete_img of the component POST Parameter Handler. The manipulation of the argument path with the input C%3A%2Ffoo.txt le...
CVE-2023-1468
PUBLISHED: 2023-03-17
A vulnerability classified as critical was found in SourceCodester Student Study Center Desk Management System 1.0. Affected by this vulnerability is an unknown functionality of the file admin/?page=reports&date_from=2023-02-17&date_to=2023-03-17 of the component Report Handler. The manipula...