Showing posts with label Security. Show all posts
10 Benefits of Computer-Based Developer Security Training
Discover 10 compelling reasons why your next developer security training course should be computer-based, and not classroom-based.
1) Fit Training Around Developer Commitments
Application developers work to incredibly tight deadlines, and it's never feasible to dedicate entire days of work to classroom-based security training. When training is forced upon developers, it can seriously impact project work, creating a conflict of interest for the attending developers.
Thankfully, computer-based security training is designed to accommodate developer workloads. It can be engaged with in short, manageable snippets, and fitted around existing commitments - allowing developers to improve their security knowledge without impacting their day-to-day responsibilities.
2) Improve Developer Engagement
As well as fitting in around existing responsibilities, computer based training can be used to improve how developers engage with their training: using real code examples and practical hands-on training.
3) Reduce Training Costs
Classroom-based training can be expensive. In addition to the costs of hiring a venue, organising transport and finding a speaker, there's the opportunity cost associated with pulling your developers away from several days of billable work. With a more flexible structure, computer-based training can be rolled-out in a much more cost-effective way - allowing training to happen without decimating your development capabilities.
4) Measure Attendance and Analyse efficiency
Computer-based training offers visibility into crucial performance metrics, from attendance rates through to course completion. It's also easy to gauge the efficacy of each training program, as small end-of-module tests can be used to test a developer's security knowledge, and identify areas that need supplementary training,
5) Self-Paced Learning is More Effective
Traditional classroom-based training forces all participants to engage with the course at the same speed - irrespective of different learning styles or levels of existing knowledge.
Some developers will already be familiar with aspects of the course, and require less time to understand the teaching. For other developers, the course will cover entirely new material, and require additional time to become familiar with the concepts introduced.
Computed-based training facilitates these different learning styles, allowing developers to progress at their own pace, and engage with material as little, or as often, as required.
6) Standardize Core Training
Computer-based training makes it easy to role out essential training to both in-house and remote staff, and easily monitor their attendance and completion rates. As well as improving organisation-wide security awareness, this can be extremely helpful for monitoring essential compliance training (like PCI compliance).
7) Customize Role-Specific Training
Computer based training is extremely modular in nature, making it possible to pick-and-choose only the most relevant training modules. Instead of forcing developers to engage with irrelevant material (like C++ security for a Java developer), or topics they're already familiar with, you can build a customized syllabus to suit the role-specific requirements of each participant.
8) Supplement with Additional Resources
With unparalleled visibility into course completion and pass rates, it becomes easy to identify areas that need supplementary training. Thanks to the flexible nature of computer-based training, it's a simple process to schedule additional training around existing commitments - whether it's a short Q&A with a security expert, or setting up an organisation-specific developer knowledge base.
9) Improve Knowledge Retention
For developer security training to be effective, completed courses and passed exams need to translate into a real-world reduction in vulnerabilities.
The insights learned in a single classroom-based session can be hard to remember and act upon. Thankfully, the flexible, ongoing nature of computer-based training will help developers practice and apply the principles of their training in the real-world, consulting supplementary resources (like a training knowledge base) whenever they need to revisit their training.
10) Future-Proof Your Training
The best practices of application security change faster than most classroom-based courses can update their syllabus, and very quickly, important elements of the course's content can become outdated and irrelevant.
Thankfully, computer-based developer security training can be updated much more readily. Outdated modules can be updated remotely, and revisions can be pushed-out on a regular basis - allowing developers to learn how to combat the newest threats and vulnerabilities as soon as they appear.
How to Avoid Malware Infection from a Phishing Email
One of the most common methods used to distribute malware is a phishing (fraudulent) email. Embedded in the email will be a “call to action” link, asking you to click here to learn more. The seemingly benign action of clicking on the link can start a destructive chain of events that culminates in compromising your computer, your identity, or even your business.
Here is a common scenario. You receive an email announcing a big sale at a national retailer. The email entices you to click on a link to get your exclusive 50% off coupon. The link looks like this: http://www.national-retailer.com/coupon.
You click the link and the coupon appears on your screen. End of story? Not necessarily. What a link says it is and what a link is programmed to do can be vastly different. That same link could just as easily be taking you to http://www.verybadguy.ru/malware.exe, where malicious code is programmed to download and execute on your computer. This type of redirection doesn’t require any programming skill. It is built into any application that uses hyperlinks.
So what should you do? DON’T CLICK! Instead, open your browser and type or paste in a known good URL. Not clicking is a fool-proof way to avoid malware infection from a phishing email.
Top 10 Network Security Threats
Vendor researcher includes USB drives, smartphones as top security risks. With cyber-threats becoming a daily headache for IT security staff, it helps to have some advice, or at least know what to look out for. A network security software provider, offered his observations on the top 10 threats that can harm networks from the inside and ways to combat them.
“The ways that the networks can be compromised five years ago internally, certainly still exist. It’s just that today, that list is really growing, and that’s why this is ongoing research,”
“It’s really an ongoing case again of all this data that we’re seeing worldwide, all this feedback we’re getting, all the new threats that we’re seeing and how those threats can potentially affect systems,”
According to the researchers, the top 10 internal network vulnerabilities are:
- USB drives
- Laptops and netbooks
- Wireless access points
- Miscellaneous USB devices (digital cameras, MP3 players, etc.)
- Employees borrowing others’ machines or devices
- The Trojan Human (attackers who visit sites disguised as employee personnel or contractors)
- Optical media (CDs, DVDs, etc.)
- Lack of employee alertness
- Smartphones
The list also includes advice for prevention and mitigation, with tips like implementing asset control policies to handle removable media threats and implementing an encrypted file system for sensitive data.
Some potential security threats such as smartphones can be dangerous in part because people don’t see them as threats. And even though they can house viruses, the devices can threaten networks in ways people may not think of.
“If you have any sort of confidential information and you have access to that, even if the document doesn’t leave the quarantined area and you take a picture of that with a smartphone, you can send that over [a] 3G network. You can just keep it on the smartphone and walk out with it,”
But when it comes to locking down networks and implementing security protocols, the government may be in a different position than the private sector when it comes to enforcement.
“They have a heavier hand. They can enforce this and say, ‘OK, across all agencies, we are banning this until we can think of what’s going on with this.’ So that is a good thing in my view because if you can properly enforce something, and you can take action on that, then it’s a step forward,”But there could be drawbacks.