Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Security Lessons From My Doctor
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
2/29/2016 | 7:00:30 PM
Re: PW mgrs.
Well, it's all risk management, let's not forget.  Security and accessibility are at constant odds at each other.  Sacrifice the one for the enhancement of the other.  The real issue is balancing both so that people are educated in terms of engaging in "best practices" -- or, at least, if they're going to ignore those best practices, that they do so knowing the consequences and the risks.

And a related best practice: Minimizing the data you 1) collect and 2) put out onto others' systems about yourself.
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
2/28/2016 | 10:48:57 PM
Re: Change is difficult
Baby steps.  Start walking for 15 minutes every other day.  Build it into your habit over a few weeks.  Then increase the lengths of the walks or frequency.  Take steps to make vegetables more accessible.  Try vaping instead of smoking (it's how two family members and several friends of mine have quit!).  Is BIG change difficult?  Sure -- if you try to do it all at once.

But as the adage goes: How do you eat an elephant? One bite at a time.

So too with security habits in user behavior.
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
2/28/2016 | 10:46:33 PM
Re: PW mgrs.
While we can all agree that putting your password on a sticky note on your monitor or in your top desk drawer is a terrible idea, many security experts have over the past few years reversed conventional wisdom and suggested that people DO write down their passwords -- on the condition that the password is lengthy, has a lot of entropy, and is otherwise nothing on the order of what a human would naturally select for him- or herself (i.e., the password is pseudorandom if not truly random) -- and then put the piece of paper somewhere truly secure, like your wallet.

Of course, even better -- should the piece of paper get compromised somehow anyway -- is to write down a hint that is meaningful to you but not meaningful to anyone else.

Doing this in a password manager is simply another approach to this thinking.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
2/27/2016 | 6:54:48 PM
Re: PW mgrs.
Good question. I would suggest to anybody, if they could not manage putting a hint into a password manager they should not be online. Also agree, security is less of problem for many, they are concern on privacy.
Dr.T
0%
100%
Dr.T,
User Rank: Ninja
2/27/2016 | 6:52:26 PM
Re: PW mgrs.
Agree. This is a good idea. Do not write your whole password anywhere. Or you can keep all those hints in your brain. 
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
2/27/2016 | 6:50:59 PM
Re: Thank you for educating your readers about the importance of online security
Agree. The change is difficult. Starting using a password manager would be a change too. Ultimate goal should be getting rid of whole username/password.
Dr.T
0%
100%
Dr.T,
User Rank: Ninja
2/27/2016 | 6:48:42 PM
Re: Thank you for educating your readers about the importance of online security
1Password is good, some others are good too. But I suggest nobody should be using any password manager. If one could not manage a password they could not manage a password manager, they would put themselves in more risks.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
2/27/2016 | 6:45:27 PM
Change is difficult
Agree with the article. We could not stop smoking or start eating more vegetables or going to 30 minutes' walk every day or having a complex password since all these things are changes in our life styles. And change is difficult.
adamshostack
50%
50%
adamshostack,
User Rank: Apprentice
2/27/2016 | 5:39:32 PM
Re: PW mgrs.
Joe--that's an interesting approach.  Would you suggest it to someone who's busy or forgetful?

 

For many folks I've talked to, security is a side effect: the real win is it's easier to use.
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
2/27/2016 | 5:36:04 PM
PW mgrs.
I great piece of advice I got recently regarding password managers: Don't put your actual passwords in them; instead, put your hints in them.
Page 1 / 2   >   >>


DevSecOps: The Answer to the Cloud Security Skills Gap
Lamont Orange, Chief Information Security Officer at Netskope,  11/15/2019
Attackers' Costs Increasing as Businesses Focus on Security
Robert Lemos, Contributing Writer,  11/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19037
PUBLISHED: 2019-11-21
ext4_empty_dir in fs/ext4/namei.c in the Linux kernel through 5.3.12 allows a NULL pointer dereference because ext4_read_dirblock(inode,0,DIRENT_HTREE) can be zero.
CVE-2019-19036
PUBLISHED: 2019-11-21
btrfs_root_node in fs/btrfs/ctree.c in the Linux kernel through 5.3.12 allows a NULL pointer dereference because rcu_dereference(root->node) can be zero.
CVE-2019-19039
PUBLISHED: 2019-11-21
__btrfs_free_extent in fs/btrfs/extent-tree.c in the Linux kernel through 5.3.12 calls btrfs_print_leaf in a certain ENOENT case, which allows local users to obtain potentially sensitive information about register values via the dmesg program.
CVE-2019-6852
PUBLISHED: 2019-11-20
A CWE-200: Information Exposure vulnerability exists in Modicon Controllers (M340 CPUs, M340 communication modules, Premium CPUs, Premium communication modules, Quantum CPUs, Quantum communication modules - see security notification for specific versions), which could cause the disclosure of FTP har...
CVE-2019-6853
PUBLISHED: 2019-11-20
A CWE-79: Failure to Preserve Web Page Structure vulnerability exists in Andover Continuum (models 9680, 5740 and 5720, bCX4040, bCX9640, 9900, 9940, 9924 and 9702) , which could enable a successful Cross-site Scripting (XSS attack) when using the products web server.