Security Insights: User Security

Users – the Achilles heel Users interaction Security technology protects: Machine <> Machine User > Machine Machine > user

Why are people so dangerous? Very vulnerable to mistakes and manipulation Not good at estimating risk Often too willing to extend trust Duped by pleas for help—it’s our natural desire to want to be helpful And can undermine all technical countermeasures Often the weakest part  should be accorded more scrutiny!

Policy: Determine its impact Security is inconvenient Recognize and respect security’s disruption Build “user impact” into design; invite discussion Avoid excessive complexity Use tools that are already tested and proven Controls costs; lessens chances of attack To prosecute or not? Decide in advance how far to go If yes: know what evidence to collect and train staff Make the punishment fit the crime Often reprimands are sufficient But what about the person who hacks the payroll?

Enforcement: Be visible Make security overt Badges even in small firms—has huge psychological effects and increases sensitivity Remind constantly Regular briefings and logon notices Include reminders of information value Emergency service Coordinate with physical security people Drill the troops Know where legitimate users are so you can more easily find attackers Perform drills to test procedures

Enforcement: Be visible Walk in your users’ shoes Use the same systems and software they do Operate with the same privileges they do Helps to spot areas where they might try to circumvent the security Keeps you from making disastrous mistakes

User education Security management campaign Periodic refreshers Newsletters Group meetings Screensavers Signatures on acceptable use policies Regular audits

Security awareness Know what has value What to do if you suddenly lost all access? Friends aren’t always friends Don’t allow trust to be exploited Over-the-phone friendships lack trust Passwords are personal And always undervalued Uniforms are cheap Mutually authenticate when your bank calls you!

Ongoing reminders Regular reminders to keep people aware One training session won’t last forever Police departments do this continually Be creative Don’t become yet another source of noise to be ignore Make the policy itself available easily Post on a web server Provide simple searching and navigation Keep it current!

Demo on the stand Free eval. from the stand Expert assistance on the stand Resources on-line Resources

Security Insights – Coming Up 11:15Secure Messaging 11:45Identity Theft 12:15How Microsoft Secures IT 12:45User Security 13:15Secure Messaging 13:45Spyware 14:15Identity Theft 14:45How Microsoft Secures IT 15:15User Security 15:45Spyware

© 2006 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, IN THIS SUMMARY.