Security
by tigerbright
by rschmid1
I've had to do several training sessions to explain to my users what social enguineering and email have in common. I have a program that shows how fast a few viruii move thru email systems. The training seemed to make an impact.
Plus they liked the free lunch!!
by rschmid1
by cool_iceman9
by tigerbright
by marcpen
I recently tried installing Zonealarm on a site with 40 users, using the free version as this was a charity.
It caused absolute confusion when the popup windows started appearing. I had 'allowed' all of the obvious programs on each computer, but there are still some that don't try to access the net for days, even weeks, after the install.
I had just about sorted that one when the popups demanding an update started appearing. Some users braved it and followed the link. Others just panicked.
I thought that involving the users in the security process would be a good thing, but I was wrong.
Users want everything to be just as it was yesterday. They don't like change.
I'm not their line manager; I can't force them to alter their working practices, and I can't make them learn something they don't want to.
So I just bite the bullet and do it myself. I have managed to squeeze the cost of a hardware firewall out of them though. It's about the best I can hope for.
by rschmid1
You basically dropped this on them with out explaining why or how? Then you expect them not to complain or make mention when things pop up on thier screen??
"Thud" here's a 3 " thick manual figure it out and have it running by tomorrow morning!
by w2ktechman
I have found that many people on a large network, do not want to deal with it. They download crap and freak when something unexpected happens. Even if you send an announcement saying "Do Not Open an Email with this attachment" more than 20% will open it within an hour after you tell them not to.
If you give regular announcements, they will stop paying attention to them (unless someone close by was hit).
So, the best way is to try to block it before it gets to the end user, only announce a problem when the problem is on the network, and a threat, and block websites known to be a problem. Also, have the dept managers bring this up in meetings
1. Never open an attachment that you are not expecting
2. If you receive an unexpected attachment, verify with the sender what it is BEFORE opening it.
When their managers started sending this info out, the virus calls have started to drop, and company infections are not as bad.
SpyWare is another game, and is not played the same. The best way is to block websites from the proxy server or outsource this to another company.
I have told people that "this or that is SpyWare and needs to be uninstalled" and have received some strange results "you cant take that away from me", "I will reinstall it when you leave", "Its not that harmful, just fix the bad part", etc.
The more info the better here. But do not hit everyone with weekly emails, instead, write a good article, short and to the point, explaining how SpyWare and AdWare can harm them. Do not forget to mention keyloggers, Identity theft. Give them a small task (or script it) to delete cookies and temp IE files often. Then, the end users wont hate you so much, and less crap gets downloaded (hopefully), but there are still pockets of people that will never get it, so keep with the website blocking, and find a good source to control it.
by jadal
by leumas eluht
I now my users don't like changes, and honestly i don't think any user likes a change but this is where we can make the things to change with out asking, is simple, for instans we are administrators therefor we can put the security on the servers, I belived no one of us allows a dail up conection on every maching, but we provide the service, well then install all security on the server that provides those services, install not only a firewall but also a proxy allowing those programs you want out and in and forbidening those who not, and also making restrictions about the pages they can access.
You can let them know by e-mail your new politics i assure that if anyone is browsing a bad web page or running a web game they won't give complains, or at least you must not be runing from one office to another just to say the same thing over and over.
by admin
~LoL~ not really of course.
I just read a post about a guy here at TR who was making wireless keyboards to log keystrokes and suggested social engineering is simpler and more cost effective.
We do include training in New Employee Orientation on our policies which mainly try and cut down on password and identity theft. Strategies like shoulder surfing, sticky note retrieval and authentication of IT staff are covered, but out of our about 350 employees at any given time anyone could probably go into the main workstation area and if they gave an attractive enough story, someone would unfortunately give them access. Management here has wanted to install security cameras for some time, but haven't for various reasons.
We also cover identity theft because it has happened to a number of people here, all using their home computers. We still cover it because it costs our company when this happens to an employee. We cover anti-virus and software licensing as well.
When all is said and done, they learn a lot about too many things right off in orientation and only so much gets remembered that day IMO, but at least it is of some benefit.
This discussion is closed to new replies.
Sort by Trending