Ever find yourself just click click clicking through every message box that pops up? Most people click through a warning (which in the land of Web Browsers usually means STOP DON’T GO THERE!!) in less than 2 seconds. The facts seem to be due to be from habituation – basically, you are used to clicking, and now we have the brain scans to prove it!
What does this mean for you? Well specifically you won’t be able to re-wire your brain, but perhaps you can turn up the settings on your web browser to not allow you to connect to a site that has the issues your web browser is warning against. Simple – let the browser deal with it and take away one nuisance.
From the study:
The MRI images show a “precipitous drop” in visual processing after even one repeated exposure to a standard security warning and a “large overall drop” after 13 of them. Previously, such warning fatigue has been observed only indirectly, such as one study finding that only 14 percent of participants recognized content changes to confirmation dialog boxes or another that recorded users clicking through one-half of all SSL warnings in less than two seconds.
via MRIs show our brains shutting down when we see security prompts | Ars Technica. (photo credit Anderson, et al)
Don’t forget to check out – www.facebook.com/hntbh if you are looking for quick reminders. The book is coming along and chapter releases are (finally) coming in April!
Posted in information security, Security
Tagged ars technia, book, brain scan, habituation, hntbh, james deluccia, jdeluccia, mri, research, security warnings
While not a complicated or strategic topic that I would normally highlight, this one bit of news is from my home airport and personally meaningful.
Basically the report shows that 1,600 badges were lost or stolen in a 2 year period. This seems like a big number (2.6%), but this is a control that should (and not highlighted in broadcast) secondary supportive controls, such as:
- Key card access review logs to prevent duplicate entries (i.e., same person cannot badge in 2x)
- Analytics on badge entries against the work shifts of the person assigned
- Access to areas not zoned for that worker
- Termination of employees who don’t report in 12 hours on lost/missing badge
There are safeguards highlighted in broadcast that are good, but easily modified to the point of not being any value, and include:
- Pin (can be easily observed due to tones and no covering)
- Picture (every movie ever shows how easy this is done)
- An old badge could be re-programmed and be a duplicate of another higher ranking / alternate security zone
Bottom line is organizations, especially those tasked with safety of human life, must have the primary and secondary controls in place. Hopefully the remarks of a minor risk are based on their security assessments with the considerations above (and more perhaps).
Hundreds of ID badges that let airport workers roam the nation’s busiest hub have been stolen or lost in the last two years, an NBC News investigation has found.
While experts say the missing tags are a source of concern because they could fall into the wrong hands, officials at Hartsfield-Jackson Atlanta International Airport insist they don’t pose “a significant security threat.”
via Hundreds of Security Badges Missing From Atlanta Airport – NBC News.com.
Also thanks to the new new aggregator (competitor to AllTops) Inside on Security or the clean new interface.
Posted in audit, Compliance, Risk Management
Tagged 2015, airport security, atl, cio, ciso, cyber, domestic, hartsfield, infosec, inside, james deluccia, jdeluccia, nbc, news, strategy, TSA
TOP-SECRET GCHQ documents reveal that the intelligence agencies accessed the email and Facebook accounts of engineers and other employees of major telecom corporations and SIM card manufacturers in an effort to secretly obtain information that could give them access to millions of encryption keys.
-The Great SIM Heist: How Spies Stole the Keys to the Encryption Castle.
This news made a number of people upset, but after studying it for several weeks and trying to consider the macro effects to regular end users and corporations I have reached a contrarian point in my analysis.
Who cared? Nobody (enough)
Sure the implications are published and are known, but who ever considered their cell phone encrypted and secure mobile device? I don’t think any consumer ever had that feeling and most professionals that WANT security in their communications use special precautions – such as the Black Phone.
So, if nobody expected it, demanded it, and the feature was primarily used to help billing than what SHOULD happen moving forward?
- The primary lesson here is that our assumptions must be revisited, challenged, valued, and addressed at the base level of service providers
- Second, businesses that depend (if they ever did so for instance on mobile device encrypted communication) on such safeguards – must pay for it
I would be interested in others points of view on the lessons forward. I have spent a good deal of time coordinating with leaders in this space and believe we can make a difference if we drop the assumptions, hopes, and focus on actual effective activities.
Helpful links on the Black Phone by SGP:
Blackphone was created by the best minds in cryptology, security and mobile technology.
The Blackphone is a smartphone developed by SGP Technologies
Posted in Compliance
Tagged chief strategy officer, cio, ciso, cyber, innovaiton, james deluccia, jdeluccia, nsa, privacy, Security, sim heist, strategy, technology
Google released details on how an attacker can take advantage of the physical design and setup of some memory chips in computers. This exploit basically is based on setting and releasing a charge on one memory block to the point it leaks over to the neighbor block (simplifying here). Stated another way – Imagine cutting an onion and then using the same knife to cut a tomato… the taste of the onion would definitely transfer to the tomato, ask any toddler 😉
- What does this mean to enterprises – well it is early, but this type of risk to an organization should be addressed and covered in your third party supplier / procurement security team. Leading organizations are already vetting hardware vendors and the components included in each purchase to prevent malicious firmware and snooping technology.
- In addition, the supplier team managing all of the deployed cloud and virtualization relationships (your Cloud Relationship Manager) should begin a process of reviewing their provider evaluations.
Of course this is a new release and the attack is not simple, but that doesn’t mean it won’t and could not occur.
The attack identified by Google plus the virtualized environment creates a situation where an attacker “…can design a program such that a single-bit error in the process address space gives him a 70% probability of completely taking over the JVM to execute arbitrary code” – Research paper
Given the probability of success, it is definitely valuable to have this on your risk and supplier program evaluations.
Here is the full analysis by Google and the virtualized research paper.