Hacker News Reader

Comment by xvxvx | Hacker News Reader

‘a lay-language resource‘.

IMO this misses the mark. Yes, it’s a decent attempt at simplifying cybersecurity, but if this is aimed at entry-level, non-technical people, it’s not gonna work.

One of my earliest jobs was to redesign training materials for one of the worlds largest companies. I stripped the training to its core, the true basics, and started there. The results were remarkable. I feel the urge to do the same with this document…

View on HN

I'd be interested in a small sample of what you're talking about. I suspect that's a marketable product these days even if all you do is deslopify generated documentation.

I’m seconding the request. Anything specific that you (xvxvx) would explain to a layman differently? Even the briefest of examples would be a nice thought to chew on. “A should be B because C.”

I do a lot of explaining to non-techy people. My approach would be to print out the document and walk through it with them. Have the goal first be understanding of why certain things are a priority. Like it’s a baseball game: the three outfielders and three infielders are important to covering all your bases. We’re talking about this angle, in this context, and once the “why” is understood it’ll help them interpret the document correctly.

Have to agree with you. You can’t introduce concepts like phishing and MFA without actually explaining what they are.

To be fair the linked paper links to both MFA and Phishing along with links to almost every topic it touches.

https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.50.pdf

https://www.cisa.gov/sites/default/files/publications/fact-s...

https://www.cisa.gov/sites/default/files/publications/MFA-Fa...

Kind proves the point it’s not written for the layperson no?

Read the document; it does explain phishing/etc. for a layperson in simple terms in the document itself. The gp just pointed to more resources for further study mentioned in the document.

Sure, in the glossary. But you have to explain it first before you start throwing jargon around. Otherwise people will bounce off it or go off their own incorrect perception of the word because vanishingly few people in the target audience will bother with the glossary, or even realize one is there without a specific callout up front

I work in the MSP world and have supported hundreds of small businesses. Trust me when I tell you >80% of the people who should read this won’t make it past the first couple pages

Links are almost an anti-pattern. The reader should not have to click links unless they're really interested in diving deep on that particular topic (and ideally it's more of an endnote thing, not inline)

i'm technical person and the contents of the document are non-sense academic mumbo jumbo that will not improve anyone's security an iota.

What is your go to heuristic / mental model you use when stripping down to the essential core? Lots of marginal items needing judgment calls. What was your guiding light?

Have you read CSWP50? Its not exactly written on the 3rd grade level. I think its a pretty good compromise between something only your IT department can understand and what a small employer needs to know. If anything, it leans too technical and verbose.

Not only are there links to go deeper into each subject matter but also a part telling the employer how to hire help if they need cybersecurity help and with a link to the "Small Business Cybersecurity Support Programs Finder" directory. Ideally they should be asking around in the small business community for a local vendor, but this document does a lot of things right.

I think this is an excellent document for small business and doesn't really talk down to them.

> I think this is an excellent document for small business and doesn't really talk down to them.

Right, the gp has not read it or are intentionally trying to spread FUD.

This is a good document as is generally the case for all NIST documents. It is even more relevant for the "general public" since every home has similar problems as far as cybersecurity is concerned.

Cybersecurity knowledge is vital for everyone nowadays. Hence I highly encourage people to read this and other documents linked to.

NIST is one of the few orgs who still do a pretty good job and hence should always be taken seriously. Based on their recommendations create your own checklist/workflow and have everybody at your org/home follow it.

Reply on news.ycombinator.com