User Education

Hey Folks,

I am a network admin for a school district. Periodically, I send out emails warning about new phishing scams, malicious websites, etc.

I also have an internal web server with examples of scam emails, and a separate site with definitions of security terms and ways to mitigate different attacks. I am trying to take a common sense approach. Basically coaching the users to be very skeptical when it comes to links/attachments in email and social networking sites. [most of which are blocked during school hours, but open up a bit 30 minutes after school lets out].

Are any of you attempting to educate your users? If so, what methods are you using?

It really doesn't matter who you are giving advice to, whether it is users, or your family members... what approaches do you take?

I am just looking for additional ideas here, to cut down on scams making use of social engineering, etc.

Any suggestions, stories, ideas, etc. would be most appreciated.

Threats of violence and service termination does wonders. ;)

Seriously, I focus on NOT opening email from senders not in an address book or clicking on links from unknown sources. I have a sandbox available for users to open suspicious mail. Clicking on links remains an issue, but loss of access privileges carries a strong message.

The threat doesn't come in the form of phishing or malicious sites.

Legitimate business sites are rooted. Everything from ebay to facebook accounts are taken over through password redundancy through those sites. Botnets are out of the equation too. Just pick popular sites and use javascript to refresh multiple hidden iframes to ddos.

Either the kids are doing it wrong these days, public perception, or both.

Hi westin,

In my circumstances I find personal tuition the most effective. The problem with the written word is that not many of those at risk are inclined to read it, and probably wouldn't understand anyway.

Least privileged accounts and sandboxed browsers.

With my business customers it is easy as I just tell them to use the business computer for business only, as their livelihoods depend on it. Use their laptop or a more powerful computer for any other stuff.

I guess none of that is much good in a schools environment which I guess is a public/multi-user scenario?

I guess that I would look at something like Faronics DeepFreeze. From a user education viewpoint I think that I would be inclined to emphasize the multiple user aspect?

"If someone before you has been an asshat you won't know, but the bad guys will have all the passwords and other personal data that you key into it. If it's you that goes to an attack site then the same thing will happen."

Public computing is a very messy area as there are people, especially kids, who will click on something "just to see what happens" because it isn't their computer?

Quote:

---

Legitimate business sites are rooted.

---

That is very true, and I would add "popular interest" sites as well.

Good luck mate! :)

Hi Westin,

In our company (roughly 20-30) , I do an every two weeks ask me whatever you want story and I also throw in examples of certain things to watch out for.

I presume you are talking about the educators that are getting scammed or pupils? If its the teachers then have a few of them at a time and go through it with them.

Quote:

---

Are any of you attempting to educate your users? If so, what methods are you using?

---

You don't! You're job is to setup policies. Leave training and management to someone else. Only do whats listed on the job description. Else you'll get arthritis before you even reach the age of forty. Don't bother. Work smarter not harder. Oh, and exercise all worker-related benefits before they dry you up and toss you into the streets. Outsourcing has caused alot of IT related unions to form, join them!

Quote:

---

I presume you are talking about the educators that are getting scammed or pupils?

---

People need to take their money elsewhere. Ebay is just a hedge fund (except you atleast have a 50-50 chance of getting something) as opposed to a certificate that says "you own gold".

People kept tossing money into the internet bubble and now you can't escape it. The internet has gone the way of television and the radio. (Looks at ads on AO with anger). Stay away from online billing and purchases. Its not only dangerous but its a complete disservice to the internet at large.

Quote:

---

People need to take their money elsewhere. Ebay is just a hedge fund (except you atleast have a 50-50 chance of getting something) as opposed to a certificate that says "you own gold".

People kept tossing money into the internet bubble and now you can't escape it. The internet has gone the way of television and the radio. (Looks at ads on AO with anger). Stay away from online billing and purchases. Its not only dangerous but its a complete disservice to the internet at large.

---

Are we talking about the same subject???

Yes.

Quote:

---

I presume you are talking about the educators that are getting scammed or pupils?

---

Those scams are always finacially motivated or eventually leading up to something that is. Ergo, keep the internet and your wallet seperate.

But I don't blame your reading skill or my lack of spelling. We where both likely ruined by the same school systems. Now THAT is off topic.

Quote:

---

You don't! You're job is to setup policies. Leave training and management to someone else.

---

Hmmm.................. now that attitude does sound familiar............... rather like that of US legislators regarding privacy and data protection?

"O.K. we'll pass these marvelous regulations into law, then it's someone else's problem"

If you are responsible for policy you are also responsible for it being understood and adhered to.

Quote:

---

Stay away from online billing and purchases. Its not only dangerous but its a complete disservice to the internet at large.

---

As I have told you before, e-commerce is just a modern manifestation of the old mail order and catalogue shopping business models. It is extremely convenient to those who do not have ready access to their desired goods and services providers.

Dangerous? not really, when you consider that the security risk comes from your payment method if it isn't cash. If you look at the really large or common frauds, they have come from compromising business databases or intercepting transactions being made face to face in stores, restaurants, gas stations and so on.

To return to westin's original theme, his main concern is obviously the security of his infrastructure and regulatory compliance in respect of minors he is responsible for.

If people have a cavalier attitude toward their use of computers and in particular where it concerns their personal information and finances, they are a real and present threat to their administrator.

And please don't underestimate the CYA factor................ if you can demonstrate that you have warned or advised them then it cannot be taken as your responsibility if they have deliberately ignored you?

Televisions, vending machines, and computers are put in schools to distract people. They want to keep the kids away from things like free will and critical thinking. They tell you to "Shhh..." in libraries because that sort of thing is taboo.

Viacom, Google, PepsiCo... these are the real teachers and staff of these schools.

They're under a hypnotic state of consciousness. You can't "teach" them responsibility when they're not even in control of their own actions.

There is no such thing as "security" without a TRUE zero trust security model. Otherwise you're just drawing an invisible line and asking them not to cross.

Quote:

---

Televisions, vending machines, and computers are put in schools to distract people.

---

In a school environment televisions and computers are educational aids, vending machines are merely a convenience and source of revenue. If you don't understand that you belong in a facility for retards, rather than in mainstream education.

Quote:

---

They want to keep the kids away from things like free will and critical thinking.

---

There is no such thing as "free will" only discipline and criminal responsibility. Better learn those carefully, or you will be a total fail in life and/or spend most of it in the big house.

Critical thinking is what most middle and higher education is about. It cannot really be taught as such as it is mostly an innate quality; only encouraged and enhanced.

Quote:

---

You can't "teach" them responsibility when they're not even in control of their own actions.

---

Oh but you can, and you had better do it before a court of law does ;)

Quote:

---

They tell you to "Shhh..." in libraries because that sort of thing is taboo.

---

Well, this may come as a shock, but the word "library" comes from the Latin "libris" which means "book". You actually read books and most of us have mastered the art of doing this silently. If you haven't you are more of a distraction than all the televisions, vending machines and computers that you mention.

Quote:

---

There is no such thing as "security" without a TRUE zero trust security model.

---

There is no such thing as a true zero trust security model.............it's like three people keeping a secret..................it will only work if you kill the other two. :D

Quote:

---

Otherwise you're just drawing an invisible line and asking them not to cross.

---

Most laws are invisible lines if you want to look at it that way; and you are not "asking", you are telling.

:cool:

don't allow HTML mails, lock them down to plain text
helps to show the real address in links too :)

and our stand by favourite
the LART
http://www.bofh.net/man/lart.1m.html

Thanks for the responses. I am mainly dealing with educating the faculty, as student machines don't really contain much sensitive info, and if one happens to get infected, we will just re-image it. We use mainly Macs here, so infections are rare/nonexistent. We had one that got that scareware Macdefender, but other than that, we haven't seen much. Macs just aren't a large target... [as you all know]

I am trying to help teachers avoid scams as well. Not just at the school, but at home too. I encourage them to send me examples of scam emails so that I can put them on the wall of shame. I think they enjoy reading some of them.

I would just sit down with them if they are willing to listen , willing being the important word :P

Hey Westin:

You know me, i r th3 bastard so I don't educate I dictate. I use layered security models and set rules in stone.

BUT! I do send out examples every now and then for "Home Users"

For instance - I sent out a quick email telling everyone that "what's her face's" autopsy was not available on Face Book, neither was "rag_heads" assassination.

For serious users that are worried about their kids on line and other stuff I send them to the SANS reading room. Each year they do a good job of showing people how to secure their networks in simple and easy to understand terms. I also always suggest OpenDNS.

When it comes to monitoring Kids, I have gotten into trouble but stating that "the problem is not the children, it's you and your wife". SO just be careful. When it's all said and done, keeping kids safe on-line is a parents job. That's a sticky subject.

Thanks dino - Some good suggestions there. Missed seeing you around... granted I don't frequent here as much as I used to. I am trying to visit more often. :)

Quote:

---

Originally Posted by westin

granted I don't frequent here as much as I used to.

---

we only let Dino off his lead occasionally too :D
he isn't called th3 Bastard for nothing :eek:

and good luck on [L]user education :?

Quote:

---

I encourage them to send me examples of scam emails so that I can put them on the wall of shame. I think they enjoy reading some of them.

---

Tell them about alot of stuff thats happend here. An outburst of lulz will ensue.

I am so surprised for this article and so glad for efforts of making new terminology.

You might want to take a page from the Federal Government and work with leadership to institute a mandatory Annual Cyber Training Program.