Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Security Lessons From My Car Mechanic
Newest First  |  Oldest First  |  Threaded View
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
2/22/2016 | 8:15:27 PM
Re: Don't know what kind of car you drive
Further compounding the issue is the lack of agreement on what some of the acronyms and other terminology should be.  (Is it XSRF or CSRF?  Depends whom you ask.)
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
2/22/2016 | 8:13:05 PM
oil change
If it makes you feel any better, mechanics know that the "3,000" miles or "5,000" miles recommended for oil change intervals is largely hooey.  ;)
chofijeff1
50%
50%
chofijeff1,
User Rank: Apprentice
2/22/2016 | 9:08:27 AM
Re: Don't know what kind of car you drive
Adam,

Thanks for a great article and analogy. I'm sharing it with my ITSEC department. I am very strong on explainng the TLA's and FLA's and have made it my mission in life to check and make sure everyone understands the Three Letter Acronyms and Four Letter Acronyms and even more importantly what they mean and what we are discussing. I get a lot of respect and appreciation for that.

On a personal note, why an engine had to come out for a pump, I don't know, and I don't know what you drive, but pulling an engine out of any car and replacing an oil pump can't be cheap and I'm sorry that happened to you. It's pretty unusual. I'm into classic cars as a hobby. Be safe and thanks again for a great article.

Geoff
Hal Elujah
50%
50%
Hal Elujah,
User Rank: Apprentice
2/19/2016 | 1:03:20 PM
Re: Don't know what kind of car you drive
I bet your mechanic told you the oil pump, not the pan, was the problem. The pan bolts on to the bottom of the engine; the pump is inside. This kind of reinforces your point about being precise and understandable in the use of terminology.
adamshostack
50%
50%
adamshostack,
User Rank: Apprentice
2/19/2016 | 11:46:59 AM
Re: Don't know what kind of car you drive
Thanks Randy!  True story!  And to extend the idea a bit: how do I go about finding a new mechanic?  It takes a lot of time and energy, and at least my car runs welll after he drains my wallet. 
RandyA007
50%
50%
RandyA007,
User Rank: Apprentice
2/19/2016 | 9:33:48 AM
Don't know what kind of car you drive
-but if your story is true, it may be time to get another car mechanic. But the analogy is right on target.

"Eschew Obfuscation"
scottw50
50%
50%
scottw50,
User Rank: Apprentice
2/19/2016 | 9:23:46 AM
Great Article
Appreciate your approach and understanding of how the "user" sees security and tech.  Your allegory is excellent.  Anything you can do to simplfy and clarify security exchanges between tech and client is appreciated.  I'm no dummy, but I left business eight years ago and keeping up is difficult.  Thanks for a great article.
Charlie Babcock
50%
50%
Charlie Babcock,
User Rank: Ninja
2/18/2016 | 3:59:52 PM
From oil pan to buffer overflow
Adrian makes a nice, down to earth analogy between car repair and system repair, and how each is preceived by the customer.


Edge-DRsplash-10-edge-articles
7 Old IT Things Every New InfoSec Pro Should Know
Joan Goodchild, Staff Editor,  4/20/2021
News
Cloud-Native Businesses Struggle With Security
Robert Lemos, Contributing Writer,  5/6/2021
Commentary
Defending Against Web Scraping Attacks
Rob Simon, Principal Security Consultant at TrustedSec,  5/7/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: Take me to your BISO 
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-28588
PUBLISHED: 2021-05-10
An information disclosure vulnerability exists in the /proc/pid/syscall functionality of Linux Kernel 5.1 Stable and 5.4.66. More specifically, this issue has been introduced in v5.1-rc4 (commit 631b7abacd02b88f4b0795c08b54ad4fc3e7c7c0) and is still present in v5.10-rc4, so it’s l...
CVE-2021-21428
PUBLISHED: 2021-05-10
Openapi generator is a java tool which allows generation of API client libraries (SDK generation), server stubs, documentation and configuration automatically given an OpenAPI Spec. openapi-generator-online creates insecure temporary folders with File.createTempFile during the code generation proces...
CVE-2021-29022
PUBLISHED: 2021-05-10
In InvoicePlane 1.5.11, the upload feature discloses the full path of the file upload directory.
CVE-2020-27226
PUBLISHED: 2021-05-10
An exploitable SQL injection vulnerability exists in ‘quickFile.jsp’ page of OpenClinic GA 5.173.3. A specially crafted HTTP request can lead to SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability.
CVE-2020-27229
PUBLISHED: 2021-05-10
A number of exploitable SQL injection vulnerabilities exists in ‘patientslist.do’ page of OpenClinic GA 5.173.3 application. The findPersonID parameter in ‘‘patientslist.do’ page is vulnerable to authentic...