Hacker News Reader

Comment by ranger207 | Hacker News Reader

> Make then not defenceless.

This, simply put, doesn't work in an enterprise context. I'd argue that relying on people for security doesn't work in any context, and that it's about as effective as relying on programmers to not code memory leaks, but in companies where there's people whose _only_ use of a desktop computer is at work, as is increasingly common nowadays, it's simply not possible to get half the people out there to learn more than absolutely required to do their job. Go look at /r/sysadmin or /r/talesfromtechsupport: for some people it's a critical emergency if their desktop icons are rearranged because then their muscle memory to click on Chrome is broken. And that's not to mention executives who believe they're above things like "phishing awareness campaigns". Technical measures are much cheaper and vastly more effective than social measures directed at people who don't want to learn

View on HN

It takes inner work to overcome a bleak view of people. It's too easy to eschew compassion and faith in fellow humans to improve themselves. I think the rehabilitation of our digital world asks us to give people greater "benefit of the doubt".

Perhaps the hopeless people you describe are the product of a hopeless context - the "enterprise context" you mention. That culture seems to encourage intellectual sloth and shrugging ambivalence, and you give good examples.

> Go look at /r/sysadmin or /r/

Please, I'd rather not :)

> executives who believe they're above things like "phishing awareness campaigns

My goodness I've met them. They're basically paid too much. I had to make a humint/influence piece for a major bank in London. Cybersec referred to it as "the cock problem"; basically mostly male with high six figure salaries whose security weakness was they "don't give a fuck". Same kind of fellas who would get pissed-up and drive their Aston Martin DB into a children's play-park. Major liability. They've learned they can transgress with impunity and just use money to solve it. What do they care if other people's money gets hacked? Not the best model for business, which requires a more upright mind-set to excel at. But banks don't exactly need to compete in a real business world.

> Technical measures are much cheaper and vastly more effective

Only in the short term. You'll need to forever keep your technical measures one step ahead of the mixture of malice and idiocy out there. A changed culture replicates and even grows itself.

I don't want my users to be clueless. I want them to better understand the technical systems they use every day so they can employ them more effectively. But they and I have a job as well. When I was in tech support, I spent hours some weeks with one particular user working on her software and teaching her more effective use of her computer. But I could only do that during slow weeks: I didn't have enough time to do that every week, and I certainly couldn't do it for everyone in the building. If we'd wanted to teach the whole building how to use computers, we would've needed probably a good quarter of the employees teaching other employees, during which time those employees under training wouldn't've been able to perform the work they were hired to do. We tried making documentation for users to read, but while you can lead a horse to water, you can't make him drink.

But ultimately, while I always wanted people to take training courses in computer use, I still implemented security measures, because I knew that people were at the company to work, not to take training courses. I want security measures in place for the same reason I want computers in the first place: so that I can let the computer worry about it for me. I don't want to have phishing awareness campaigns when I can just make the spam filter more effective. I don't want to tech people not to click the flashing greed download button when I can just roll out an ad blocker across the entire organization. I don't want to send an emergency email blast to my coworkers telling them not to download TOTALLY_NOT_A_VIRUS.PDF.EXE from the chain email going around and keep one step ahead of the mixture of malice and idiocy out there when I can just set up a system to scan email attachments for viruses in the first place. Yes, I want a more informed and educated workplace, and I worked to make that happen, but I want computers to work for me and do the hard part for me as well

Sounds like you're a good sysadmin and mentor. There's no possible way you should have to take on the burden of schooling everyone. You probably already go far beyond the call of duty.

What we need to do with Digital Self Defence is raise awareness of civic cyber-security needs from school ages 5 upwards (My government in the UK have started on this project). We also need to screen for digital literacy.

I admire your positive view on people but I feel like you vastly overestimates both the ability to learn and the willingness to care of a huge chunk of the population. If we talk about corporate environments with hundreds of thousands of employees, you will absolutely always have malicious or drunk or just plain uncaring people that will not care at all what happens when they click that one blinking link in that one special email from the long lost relative.

The goal to teach people how technology works is admirable and necessary, but it is no defence against a motivated attacker. The attackers will always have a massive information advantage just because they have so much more time to aquire it.

Reply on news.ycombinator.com