Discussion
I'm doing a short workshop around email security this week.
I work in IT so I know the issues but I'd be really interested in knowing how those of who do whatever you do but aren't necessarily that interested in IT view this issue.
The idea of the workshop is to invite questions rather than just have me rabbiting on but to put a little focus around the slides are there any particular things that you struggle with?
Be grateful if this could stay in The Lounge.
I work in IT so I know the issues but I'd be really interested in knowing how those of who do whatever you do but aren't necessarily that interested in IT view this issue.
The idea of the workshop is to invite questions rather than just have me rabbiting on but to put a little focus around the slides are there any particular things that you struggle with?
Be grateful if this could stay in The Lounge.
Companies seem to be migrating to online all-singing all-dancing style email account which are inherently more vulnerable than basic email. Do you solely rely on the company/host virus scanners when defaults can be set to autoplay/autoload content?
The biggest faux pas I see appears to be the reply-to-all when the "all" is the whole comapny mail list ..especially nuggets who then reply to unsubsribe from the email thread and then others that reply back to that, so you get massive spam email. Reply-to-all should have some sort of extra validation stage? Or be higher on the reply list header
The biggest faux pas I see appears to be the reply-to-all when the "all" is the whole comapny mail list ..especially nuggets who then reply to unsubsribe from the email thread and then others that reply back to that, so you get massive spam email. Reply-to-all should have some sort of extra validation stage? Or be higher on the reply list header
Go and hire an ethical hacking company, who will go and hack your CEO and senior management. Reveal this at the end of the session 
There is a great episode of the podcast "Reply All' where they covered exactly this. An excellent episode! https://gimletmedia.com/episode/97-what-kind-of-id...
There is a great episode of the podcast "Reply All' where they covered exactly this. An excellent episode! https://gimletmedia.com/episode/97-what-kind-of-id...
One story for you.
Major investment bank. Worried about people clicking on the wrong things in emails... and so IT (rightly) mandate security training for everyone - CEO downwards.
A week after IT sent some test emails to the senior teams; a well crafted, but fake email. About 80% of the operational board clicked through.
It turned out that there were a mix:
Major investment bank. Worried about people clicking on the wrong things in emails... and so IT (rightly) mandate security training for everyone - CEO downwards.
A week after IT sent some test emails to the senior teams; a well crafted, but fake email. About 80% of the operational board clicked through.
It turned out that there were a mix:
- Some PAs had intercepted the email, sat the course to cover their boss and then the boss had clicked on the email. More worryingly of course - they had their bosses username AND password.
- Some execs had sat the course and still clicked on the damn thing
techiedave said:
OK
I use standard outlook e mails but accessed vis office 2016 Outlook
I have standard passwords known to me not that obvious and which conveniemtly have a mix of caps/ lower case and numbers.
Dave perfect.. so if I guess "Di1nE A88oT" can I destroy your online (and possibly parts of you real) life?I use standard outlook e mails but accessed vis office 2016 Outlook
I have standard passwords known to me not that obvious and which conveniemtly have a mix of caps/ lower case and numbers.
If I said "Password Manager" or "Two Factor" would it mean anything to you?
Not trying to catch you out but like I said this is for the "normals"
I expect everybody does something different, but I fell into something convenient for me about seven years ago.
I use two email accounts. One through a typical website and email provider, the other using Apple.
I had been having problems with my first email, when I started using Apple. I arranged to (temporarily, I expected) forward onto the iCloud account while I was having issues, and it's stayed in place ever since.
So I get emails just in to my iCloud for certain things I do, but the majority of both work-related and cr@p stuff comes into the main account.
When it gets forwarded on, the Apple system is much more sensitive at finding junk. So basically anything which is in one box and not the other is immediately suspicious
From there it's easy to question the usual suspects: "PayPal", "Fleabay", "Banks", "Social Media" etc, no matter where I'm viewing my mails.
So, my particular take as a non-tech type is that they're a fact of life, but no great risk to me. Using Apple, I feel a little more secure that my iOS and OS are all up-to-date security wise.
But I almost never click a link in an email, unless it is totally expected in line with something else I am doing.
What pisses me off more than scam email attempts is people who ring you up unsolicited and "just want to take you through security".....
I use two email accounts. One through a typical website and email provider, the other using Apple.
I had been having problems with my first email, when I started using Apple. I arranged to (temporarily, I expected) forward onto the iCloud account while I was having issues, and it's stayed in place ever since.
So I get emails just in to my iCloud for certain things I do, but the majority of both work-related and cr@p stuff comes into the main account.
When it gets forwarded on, the Apple system is much more sensitive at finding junk. So basically anything which is in one box and not the other is immediately suspicious
From there it's easy to question the usual suspects: "PayPal", "Fleabay", "Banks", "Social Media" etc, no matter where I'm viewing my mails.
So, my particular take as a non-tech type is that they're a fact of life, but no great risk to me. Using Apple, I feel a little more secure that my iOS and OS are all up-to-date security wise.
But I almost never click a link in an email, unless it is totally expected in line with something else I am doing.
What pisses me off more than scam email attempts is people who ring you up unsolicited and "just want to take you through security".....
Jacko.1 said:
Hi, what's wrong with yahoo mail?
It would be simple to just say "they're s
t" but for examplehttps://www.theguardian.com/technology/2016/dec/14...
https://www.theregister.co.uk/2017/09/04/yahoo_mus...
You couldn't pay me to use them.
Slightly off topic, but does PistonHeads run on that forum software that doesn't allow you to write your own password? Like if you try, only you can see it and everyone else just sees stars?
If this doesn't work, please don't hack me... ********
EDIT: Can someone please tell me ASAP if you just see stars or if you can actually see ******** written above? If you can see ******** please tell me so I can delete my post before someone hacks my account
If this doesn't work, please don't hack me... ********
EDIT: Can someone please tell me ASAP if you just see stars or if you can actually see ******** written above? If you can see ******** please tell me so I can delete my post before someone hacks my account
Those scams where the sender manages to make it LOOK as if they are sending from a genuine email address, which requires a bit more investigation by the receiver to confirm - how do they work, and know what to look for.
For example I've had a couple recently which are perpetrating to be from Amazon, which have by coincidence (I assume) arrived when I am at the end of my Amazon Prime membership for the year. The email was "From" auto-confirm@amazon.com and in the usual field it said "noreply@amazon.com" or similar. The only thing that made me twig was that it said my "price" had gone up to £180 for the year, click here if this is incorrect etc etc. I'd have ignored it otherwise but clearly that was how they were trying to lure me in. When I then clicked on the sender, it was of course from hoh833171@yandex.com or some such nonsense email. But it took me clicking on that on my phone to see who the real sender was, the fact they are able to hide that info in quite a convincing way is clearly something tor non-nerds to know about. I've shown both my parents this as they would otherwise probably not know how to check this themselves.
For example I've had a couple recently which are perpetrating to be from Amazon, which have by coincidence (I assume) arrived when I am at the end of my Amazon Prime membership for the year. The email was "From" auto-confirm@amazon.com and in the usual field it said "noreply@amazon.com" or similar. The only thing that made me twig was that it said my "price" had gone up to £180 for the year, click here if this is incorrect etc etc. I'd have ignored it otherwise but clearly that was how they were trying to lure me in. When I then clicked on the sender, it was of course from hoh833171@yandex.com or some such nonsense email. But it took me clicking on that on my phone to see who the real sender was, the fact they are able to hide that info in quite a convincing way is clearly something tor non-nerds to know about. I've shown both my parents this as they would otherwise probably not know how to check this themselves.
bhstewie said:
hstewie said: We already do that kind of thing
I was hoping for the "normals" non-IT perspective i.e. why people still use st like Yahoo or POP3 for their personal email, views on keeping their PC updated, attitudes to passwords, that kind of thing,
Because why wouldn't you use Yahoo? It's one of the biggest email providers on the planetI was hoping for the "normals" non-IT perspective i.e. why people still use s
t like Yahoo or POP3 for their personal email, views on keeping their PC updated, attitudes to passwords, that kind of thing,Because they've never heard of POP3, let alone why it is a poor choice.
Updates are a pain in the ass, as they always take ages, require a restart, and want to do it when you want to do something else.
Passwords are easy. Use the same one for everything and you won't forget it. Having a hundred different passwords is impossible - how would you remember them all?
Other ones are:
How do I know if an email is genuinely from who it says it is?
If a friend's account has been hacked, will the hackers be able to steal my details and password from her computer?
a said:
Slightly off topic, but does PistonHeads run on that forum software that doesn't allow you to write your own password? Like if you try, only you can see it and everyone else just sees stars?
If this doesn't work, please don't hack me... ********
EDIT: Can someone please tell me ASAP if you just see stars or if you can actually see ******** written above? If you can see ******** please tell me so I can delete my post before someone hacks my account
OMG - I can't believe you use the same password as me!If this doesn't work, please don't hack me... ********
EDIT: Can someone please tell me ASAP if you just see stars or if you can actually see ******** written above? If you can see ******** please tell me so I can delete my post before someone hacks my account
password security...I tend to use 3 passwords over all the sites i use. All 3 are what I would say are random gibberish and a mix of numbers, upper/lower & symbols. It does concern me in that if one was to be hacked, 1/3 of my internet logins would also be at risk. I don't have the memory to remember more though and I feel these password "vaults" that remember lots of passwords and you only need to type one into it to un-encrypt them are a hazard in themselves in that it's like having all the passwords in one place, hack the access password and you have it all.
On the password front though, I am more worried about people resetting my accounts using memorable things such as mothers maiden name etc than I am from hacking my password, however. At the same time though most online accounts will e-mail me to say the password has been reset so I would at least be alerted.
As my company grows, the risk of being hacked...or the risk I perceive there to be, is growing. I take further steps to protect my business security more than I do personally simply because if my personal e-mail was hacked, for example, you would find nothing more than some PayPal receipts for things I had purchased and some random links from friends. More of an inconvenience. My business would obviously cost money to sort and repair any damage done. For that reason, I tend to alternate my passwords between different things on the same account (web hosting and webmail both from the same supplier, on the same server but totally different passwords and server is set up so that neither can be taken off without being able to confirm both etc)
I do work for lots of companies however that don't seem very arsed by security. Directors passwords with full admin rights and the web browser set to auto login to every account they own...just the username plus the year the company was started, file-hosting running on default passwords etc. That stuff worries me.
On the password front though, I am more worried about people resetting my accounts using memorable things such as mothers maiden name etc than I am from hacking my password, however. At the same time though most online accounts will e-mail me to say the password has been reset so I would at least be alerted.
As my company grows, the risk of being hacked...or the risk I perceive there to be, is growing. I take further steps to protect my business security more than I do personally simply because if my personal e-mail was hacked, for example, you would find nothing more than some PayPal receipts for things I had purchased and some random links from friends. More of an inconvenience. My business would obviously cost money to sort and repair any damage done. For that reason, I tend to alternate my passwords between different things on the same account (web hosting and webmail both from the same supplier, on the same server but totally different passwords and server is set up so that neither can be taken off without being able to confirm both etc)
I do work for lots of companies however that don't seem very arsed by security. Directors passwords with full admin rights and the web browser set to auto login to every account they own...just the username plus the year the company was started, file-hosting running on default passwords etc. That stuff worries me.
As mentioned phishing would be the key one, secondly password sharing, again mentioned above.
Then there's whaling (big phish....) - the CEO email to an assistant to transfer money - millions have been lost because people haven't checked the validity of such requests.
Doing a talk on email security should include a section about DLP. What are they sending and to whom and most importantly should they be doing it. Mention DLP monitoring if you want to scare them into compliance, I'm sure there's case studies on the interweb, but one that sticks in my mind was someone trying to download 28gb of data to cloud storage the day before they were leaving for a competitor.
With GDPR on the horizon data breaches are going to be significant for any company. So talk of attachments and securing them is relevant. Things like password protecting a file and then sending the password by a different means - text or phone - so if one is either intercepted or simply sent to the wrong recipient then it can't be opened.
Then there's whaling (big phish....) - the CEO email to an assistant to transfer money - millions have been lost because people haven't checked the validity of such requests.
Doing a talk on email security should include a section about DLP. What are they sending and to whom and most importantly should they be doing it. Mention DLP monitoring if you want to scare them into compliance, I'm sure there's case studies on the interweb, but one that sticks in my mind was someone trying to download 28gb of data to cloud storage the day before they were leaving for a competitor.
With GDPR on the horizon data breaches are going to be significant for any company. So talk of attachments and securing them is relevant. Things like password protecting a file and then sending the password by a different means - text or phone - so if one is either intercepted or simply sent to the wrong recipient then it can't be opened.
Gassing Station | The Lounge | Top of Page | What's New | My Stuff