Opinions about information security from a risk management perspective
Anticipating The Future of User Account Access Sharing.
Insightful post by Lenny Zeltser regarding teenagers and adults sharing sharing accounts. i.e. sharing passwords.
Of course, those of us in security find this horrifying. Teenagers see this as a way of expressing affection. Adults in business do this to expedite accomplishing goals.
Can Security Awareness Training effectively communicate the risks of this behavior?
I had an interesting conversation last week about the importance of security awareness training. I know this is a controversial topic, with many in the industry believing that it’s a waste of time. Ben Tomhave makes a really important point about getting users to pay attention to security policies.
The problem is this: people are once again falling into that rut of blaming the users for making bad security decisions, all the while having created, sustained, and grown an enablement culture that drastically abstracts users from the impact of those decisions. Plainly put: if the users don’t feel the pain of their bad decisions, then they have no incentive to make a change. This is basic psychology.
It’s time to quit trying the same old stupid donkey tricks. What we’re doing has failed, and will continue to fail. The rules of this game mean we lose – every. single. time. We need to change those rules, and fast. Specifically, we need to:
- Include security responsibilities in all job descriptions.
- Tie security performance into employee performance reviews.
- Include disciplinary actions for all security incidents.
Tomhave calls this psychology. I relate it to the “economics of security” as described by Tyler Moore and Ross Anderson.
