Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Security Lessons From My Car Mechanic
Newest First  |  Oldest First  |  Threaded View
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
2/22/2016 | 8:15:27 PM
Re: Don't know what kind of car you drive
Further compounding the issue is the lack of agreement on what some of the acronyms and other terminology should be.  (Is it XSRF or CSRF?  Depends whom you ask.)
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
2/22/2016 | 8:13:05 PM
oil change
If it makes you feel any better, mechanics know that the "3,000" miles or "5,000" miles recommended for oil change intervals is largely hooey.  ;)
chofijeff1
50%
50%
chofijeff1,
User Rank: Apprentice
2/22/2016 | 9:08:27 AM
Re: Don't know what kind of car you drive
Adam,

Thanks for a great article and analogy. I'm sharing it with my ITSEC department. I am very strong on explainng the TLA's and FLA's and have made it my mission in life to check and make sure everyone understands the Three Letter Acronyms and Four Letter Acronyms and even more importantly what they mean and what we are discussing. I get a lot of respect and appreciation for that.

On a personal note, why an engine had to come out for a pump, I don't know, and I don't know what you drive, but pulling an engine out of any car and replacing an oil pump can't be cheap and I'm sorry that happened to you. It's pretty unusual. I'm into classic cars as a hobby. Be safe and thanks again for a great article.

Geoff
Hal Elujah
50%
50%
Hal Elujah,
User Rank: Apprentice
2/19/2016 | 1:03:20 PM
Re: Don't know what kind of car you drive
I bet your mechanic told you the oil pump, not the pan, was the problem. The pan bolts on to the bottom of the engine; the pump is inside. This kind of reinforces your point about being precise and understandable in the use of terminology.
adamshostack
50%
50%
adamshostack,
User Rank: Apprentice
2/19/2016 | 11:46:59 AM
Re: Don't know what kind of car you drive
Thanks Randy!  True story!  And to extend the idea a bit: how do I go about finding a new mechanic?  It takes a lot of time and energy, and at least my car runs welll after he drains my wallet. 
RandyA007
50%
50%
RandyA007,
User Rank: Apprentice
2/19/2016 | 9:33:48 AM
Don't know what kind of car you drive
-but if your story is true, it may be time to get another car mechanic. But the analogy is right on target.

"Eschew Obfuscation"
scottw50
50%
50%
scottw50,
User Rank: Apprentice
2/19/2016 | 9:23:46 AM
Great Article
Appreciate your approach and understanding of how the "user" sees security and tech.  Your allegory is excellent.  Anything you can do to simplfy and clarify security exchanges between tech and client is appreciated.  I'm no dummy, but I left business eight years ago and keeping up is difficult.  Thanks for a great article.
Charlie Babcock
50%
50%
Charlie Babcock,
User Rank: Ninja
2/18/2016 | 3:59:52 PM
From oil pan to buffer overflow
Adrian makes a nice, down to earth analogy between car repair and system repair, and how each is preceived by the customer.


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Enterprises are Attacking the Cybersecurity Problem
Concerns over supply chain vulnerabilities and attack visibility drove some significant changes in enterprise cybersecurity strategies over the past year. Dark Reading's 2021 Strategic Security Survey showed that many organizations are staying the course regarding the use of a mix of attack prevention and threat detection technologies and practices for dealing with cyber threats.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2011-4126
PUBLISHED: 2021-10-27
Race condition issues were found in Calibre at devices/linux_mount_helper.c allowing unprivileged users the ability to mount any device to anywhere.
CVE-2011-4574
PUBLISHED: 2021-10-27
PolarSSL versions prior to v1.1 use the HAVEGE random number generation algorithm. At its heart, this uses timing information based on the processor's high resolution timer (the RDTSC instruction). This instruction can be virtualized, and some virtual machine hosts have chosen to disable this instru...
CVE-2020-7867
PUBLISHED: 2021-10-27
An improper input validation vulnerability in Helpu solution could allow a local attacker to arbitrary file creation and execution without click file transfer menu. It is possible to file in arbitrary directory for user because the viewer program receive the file from agent with privilege of adminis...
CVE-2021-26610
PUBLISHED: 2021-10-27
The move_uploaded_file function in godomall5 does not perform an integrity check of extension or authority when user upload file. This vulnerability allows an attacker to execute an remote arbitrary code.
CVE-2021-32951
PUBLISHED: 2021-10-27
WebAccess/NMS (Versions prior to v3.0.3_Build6299) has an improper authentication vulnerability, which may allow unauthorized users to view resources monitored and controlled by the WebAccess/NMS, as well as IP addresses and names of all the devices managed via WebAccess/NMS.