Stupid Security Tricks

This article is 9-days old but it’s kind of an IMPORTANT point in day-2-day SECURITY practices.

February 25, 2005

Wayne Rash: Stupid Security Tricks
By Wayne Rash

I'd just finished tying my shoes, and then looked up at the conveyor belt as the flood of personal items emerged from the X-ray machine. The security screeners at Washington-Dulles International Airport were trying their best to be helpful, but were clearly harried. One of them started to hand me an IBM ThinkPad as it came toward me, but it wasn't mine. I'd just placed my nearly identical laptop in my briefcase.

Then I saw something I couldn't believe. As the TSA guy put the laptop back into the gray plastic tray, I saw a piece of yellow paper attached to the surface. On it was a list of access numbers, user names and passwords, all neatly typed. Clearly, this computer was owned by someone who couldn't remember their login information. I wasn't surprised, considering that there were a half dozen logins written out.

That was alarming, but what happened next was even more alarming: I noticed that the owner of the computer had a government ID card around his neck, identifying him as working for an agency heavily involved with fighting terrorism. An attacker could compromise agency security simply by being fast with a camera phone, or just by remembering what he read.
You'd think that with all the focus on security, such things wouldn't happen. But if you think that, you'd think wrong. Despite all of warnings, people do still write down their passwords. Even so: attaching those passwords directly to the laptop is a new low.

That lapse was more obvious than usual, but no more stupid than usual. While there are limits to most types of human behavior, stupidity knows no bounds.

Simply avoiding stupidity can go a long way toward enhancing security on your system and network.
Avoiding Stupid Security Errors

So how do you avoid stupid security errors? Ask yourself three questions every time you work with an asset that must be kept secure:

- Does the action I'm considering make sense? I was so interested in solving the problem with the server that I ignored my own normal practices. That was pretty stupid.

- Does the action I'm considering violate published security practices? Don't write down your passwords, much less the logon details and user names. Even a second's worth of thinking should have reminded the government employee that attaching the information to their laptop was a really stupid idea.

- Does the action take all aspects of security into account? The office server had a firewall, it required users to log in, and it was designed so that people could only get to information they needed to have access to. But if someone steals the computer, they can have their way with it, regardless of protections you've put into place. Forgetting about physical security was pretty stupid.
Source here - http://www.securitypipeline.com/60403728

Kindly read the whole article, you’ll see. You’ll find the situations somewhat related to us or much more to the people around us.

Yo!