Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Security Lessons From My Car Mechanic
Newest First  |  Oldest First  |  Threaded View
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
2/22/2016 | 8:15:27 PM
Re: Don't know what kind of car you drive
Further compounding the issue is the lack of agreement on what some of the acronyms and other terminology should be.  (Is it XSRF or CSRF?  Depends whom you ask.)
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
2/22/2016 | 8:13:05 PM
oil change
If it makes you feel any better, mechanics know that the "3,000" miles or "5,000" miles recommended for oil change intervals is largely hooey.  ;)
chofijeff1
50%
50%
chofijeff1,
User Rank: Apprentice
2/22/2016 | 9:08:27 AM
Re: Don't know what kind of car you drive
Adam,

Thanks for a great article and analogy. I'm sharing it with my ITSEC department. I am very strong on explainng the TLA's and FLA's and have made it my mission in life to check and make sure everyone understands the Three Letter Acronyms and Four Letter Acronyms and even more importantly what they mean and what we are discussing. I get a lot of respect and appreciation for that.

On a personal note, why an engine had to come out for a pump, I don't know, and I don't know what you drive, but pulling an engine out of any car and replacing an oil pump can't be cheap and I'm sorry that happened to you. It's pretty unusual. I'm into classic cars as a hobby. Be safe and thanks again for a great article.

Geoff
Hal Elujah
50%
50%
Hal Elujah,
User Rank: Apprentice
2/19/2016 | 1:03:20 PM
Re: Don't know what kind of car you drive
I bet your mechanic told you the oil pump, not the pan, was the problem. The pan bolts on to the bottom of the engine; the pump is inside. This kind of reinforces your point about being precise and understandable in the use of terminology.
adamshostack
50%
50%
adamshostack,
User Rank: Apprentice
2/19/2016 | 11:46:59 AM
Re: Don't know what kind of car you drive
Thanks Randy!  True story!  And to extend the idea a bit: how do I go about finding a new mechanic?  It takes a lot of time and energy, and at least my car runs welll after he drains my wallet. 
RandyA007
50%
50%
RandyA007,
User Rank: Apprentice
2/19/2016 | 9:33:48 AM
Don't know what kind of car you drive
-but if your story is true, it may be time to get another car mechanic. But the analogy is right on target.

"Eschew Obfuscation"
scottw50
50%
50%
scottw50,
User Rank: Apprentice
2/19/2016 | 9:23:46 AM
Great Article
Appreciate your approach and understanding of how the "user" sees security and tech.  Your allegory is excellent.  Anything you can do to simplfy and clarify security exchanges between tech and client is appreciated.  I'm no dummy, but I left business eight years ago and keeping up is difficult.  Thanks for a great article.
Charlie Babcock
50%
50%
Charlie Babcock,
User Rank: Ninja
2/18/2016 | 3:59:52 PM
From oil pan to buffer overflow
Adrian makes a nice, down to earth analogy between car repair and system repair, and how each is preceived by the customer.


News
FluBot Malware's Rapid Spread May Soon Hit US Phones
Kelly Sheridan, Staff Editor, Dark Reading,  4/28/2021
Slideshows
7 Modern-Day Cybersecurity Realities
Steve Zurier, Contributing Writer,  4/30/2021
Commentary
How to Secure Employees' Home Wi-Fi Networks
Bert Kashyap, CEO and Co-Founder at SecureW2,  4/28/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-32094
PUBLISHED: 2021-05-07
U.S. National Security Agency (NSA) Emissary 5.9.0 allows an authenticated user to upload arbitrary files.
CVE-2021-32095
PUBLISHED: 2021-05-07
U.S. National Security Agency (NSA) Emissary 5.9.0 allows an authenticated user to delete arbitrary files.
CVE-2021-32096
PUBLISHED: 2021-05-07
The ConsoleAction component of U.S. National Security Agency (NSA) Emissary 5.9.0 allows a CSRF attack that results in injecting arbitrary Ruby code (for an eval call) via the CONSOLE_COMMAND_STRING parameter.
CVE-2021-32098
PUBLISHED: 2021-05-07
Artica Pandora FMS 742 allows unauthenticated attackers to perform Phar deserialization.
CVE-2021-32099
PUBLISHED: 2021-05-07
A SQL injection vulnerability in the pandora_console component of Artica Pandora FMS 742 allows an unauthenticated attacker to upgrade his unprivileged session via the /include/chart_generator.php session_id parameter, leading to a login bypass.