Slashdot is powered by your submissions, so send in your scoop

 


Forgot your password?
Close
typodupeerror
×
Communications Security IT

Ask Slashdot: How To Communicate Security Alerts? 84

Posted by Soulskill from the your-computer-is-broadcasting-an-ip-address dept.
Capt.Michaels writes: "I need to start sending security alerts and warnings to employees at my somewhat sizable company. My problem: I'm not sure how to send these alerts without freaking everyone out and causing the help desk to get flooded with phone calls. For example, let's take the current Internet Explorer exploit that caused US-CERT to recommend switching browsers. I don't want everyone killing our limited help desk with ridiculous questions like, 'I downloaded $New_Browser, how can I get my toolbar? How do I bookmark things in this browser? Can you tell me which browser you recommend?' Simply put: some vulnerabilities are worth major changes, but many aren't. If we switched software every time a new vulnerability came out, we'd never get anything done. Sooner or later, a patch will come out, and everything will be back to normal. But how do I communicate to end users that they should be aware of an issue and take extra care until it's fixed, without causing panic?"
This discussion has been archived. No new comments can be posted.

Ask Slashdot: How To Communicate Security Alerts? More

Ask Slashdot: How To Communicate Security Alerts?

Comments Filter:

  • Don't tell them. (Score:1)

    by Anonymous Coward

    Problem solved. Just relay on your backend infrastructure.

    - NSA guy

    • I like my method:

      "FIRE!"

    • Re:Don't tell them. (Score:5, Interesting)

      by Tuidjy ( 321055 ) on Friday May 02, 2014 @04:56PM (#46902997)

      They ask. They hear something from their friends and colleagues, and retain a garbled version ranging from "OMG, everything Microsoft needs to be erased!" to "Go to this website and it will fix your IE". If you are lucky, they call you before they try to do something astoundingly stupid.

      I'm the IT director for a aftermarket auto-manufacturer, and we keep our Internet facing network and our production/POS/ERP networks physically separate. Each of our Internet facing PCs has IE, and a crippled version of Chrome (same idea as Iron) installed.

      A few nights ago, I ran a script that stored everyone's IE bookmarks in a backup, and overwrote them with a list of less than a twenty bookmarks, including the company's website, the banking sites for scanning checks, the website that stores our scanned invoices... you get the idea.

      I sent an email instructing them to use IE only for the sites for which there is a bookmark, and use the crippled Chrome for everything else. Last night I restored the bookmarks, and while I was at it, checked a few histories here and there. People seem to have complied with the instructions. I saw only one clear violation, and it was work related, to a website that I may have added to the bookmarks, if I had thought of it.

      Today, according to my assistant, there have been three calls from people who did not get their bookmarks back, and a few from people who did not know about bookmarks before, and now want the 'official list' back.

      All in all, I'm glad how it went.

  • EMET (Score:1)

    by Anonymous Coward

    Try EMET from Microsoft.

  • Type it; print it; deliver it.

    It worked for generations.

  • Run around in panic... (Score:5, Funny)

    by sinij ( 911942 ) on Friday May 02, 2014 @02:28PM (#46901397)
    Ruining around the office in panic screaming that we are all going to die worked well for me so far.

    Also, what kind of security events are we talking about here?

  • Kill them all (Score:1)

    by Anonymous Coward

    Easy, kill all your users. Seriously.

    You are fighting a loosing battle. Everytime i try and make a process more idiot proof 10x more wild moron users appear.

  • My thoughts. (Score:4, Insightful)

    by TMYates ( 1946034 ) on Friday May 02, 2014 @02:30PM (#46901427)
    In the case of the browser, there are a couple of things I would have done:

    1) IT should have selected a viable alternative. Whether it is Chrome, FireFox, etc... IT should be deciding on one to use. You are right in not wanting to bog down the help desk with these calls. By selecting one you can send a message out to your users stating that to improve security, reliability, and performance of your system, we will begin rolling out a new web browser for everyone to use. Be sure to include time for a quick training session. There are various methods for pushing software out behind the scenes as well to install it without bothering many of the workers.

    2) Used something like Group Policy to push out the workaround and disable the DLL in question. This could have easily been done using a login script or GPO. Then you could sit tight waiting on a patch for your existing browser. You may still want to remind everyone to be on the lookout for anything suspicious and report it should something happen.

    The sad fact is that nothing is bulletproof. It could just as easily be Chrome or Safari next week. Don't forget Safari had a nasty SSL flaw not too long ago too. You are right in not wanting to scare your users, but that is where I say you need to put effort into education on the basics of security. Let them know you have their back. And above all, be creative.

    • A lot of corporate users are still stuck with backends that require ActiveX.

      Ten years ago, people kept telling me I shouldn't worry about it and everyone would be using Windows and Internet Explorer forever. Idiots.

      • Re: (Score:2)

        by pavon ( 30274 )

        He recommended deploying an alternative browser, not replacing IE altogether. That way when IE has a bad vulnerability you notify everyone to temporarilly use the alternate on external sites, use group policy to disable vulnerable features, or even block it at the firewall depending on the severity. They can keep using IE internally during that time. Then when a patch comes out you deploy it and lift the restrictions. The next week when firefox has a zero-day, you do the same for it, and recommend people us

      • Chrome can be deployed with extensions via GPO-- like IETab. IETab could be preconfigured to load those specific sites.

        Presumably the few sites you would be using IETab for would either be internal, or restricted access, and so unlikely to have the exploit code.

    • Re: (Score:2, Informative)

      by Anonymous Coward

      Then you could sit tight waiting on a patch for your existing browser

      That patch he was waiting for? it was pushed yesterday ... FYI.

      If he followed your advice, he would have spent more time creating, testing, and implementing the scripts/GPO's you suggested, than it took to get the patch. Plus he'd get to have all the fun of hearing from the Help Desk about users who're confused by a different browser appearance, and oh, hey, where'd all of my favourites go?

      Not to mention, if the enterprise also uses GPO's to manage browser functionality / appearance / behaviour, woops, non

      • Not to mention, if the enterprise also uses GPO's to manage browser functionality / appearance / behaviour, woops, none of that on Chrome/Safari/Firefox...

        There are custom administrator templates available for firefox and chrome. I'm sure there are some for Safari I've just never used them.

        https://support.google.com/chr... [google.com]

        http://sourceforge.net/project... [sourceforge.net]

      • This response was supposed to be a general "what should I do" not "what can I do" type of question. I used the browser topic as a sample, but yes they have released the patch. If a vulnerability was published today, you cannot just assume tomorrow they will have a patch ready to ship and hence why the question was asked how to handle a situation of such.

        It depends on the size of the shop and the IT staff. As a one man IT shop, I would be the one creating, testing, and implementing. Not saying everyone is
  • Anticipate all questions (smart or dumb), and create a howto/faq addressing each one.

    • Anticipating all dumb questions is easier said than done. As soon as you make something idiot-proof, they go and make a better idiot.

  • You don't (Score:2, Interesting)

    by Anonymous Coward

    To be blunt, you don't need to tell every employee about every security problem, precisely for the reasons you stated: they'll panic.

    The best thing you can to is to try to mitigate the problem until a fix is available, and then deploy a fix. Mitigation can mean anything from blocking access to the offending program, malicious website, etc., but nothing beats good old fashioned user education. Instructing your users on safe computing habits goes a long way toward keeping your network secure, and as long as y

  • The security alerts should come from the help desk and the support staff. They are much more in touch with the types of problems that will occur, as well as how to best communicate with the users. You can work with the support staff to craft an accurate and helpful message without causing chaos.

  • Goddamn hippy.

  • be as concise as possible. carry a giant hammer. "There is a vulnerability in IE. If you're paying attention, you will not have any issues. [procedure or new policy]. If you cannot comply with [new policy] please bring your machine to [your office] for molecular realignment."

  • Simple (Score:1)

    by Anonymous Coward

    Stop locking people's machines down. Make IT into a department that trains people to be responsible, not a department that locks their machines up.

  • they'll know how to communicate and what things to mention. and if they don't, they will learn quickly.

  • Email and Proper Security Policy (Score:5, Insightful)

    by CanHasDIY ( 1672858 ) on Friday May 02, 2014 @02:44PM (#46901605) Homepage Journal

    All your issues can be addressed with 2 things - an email to employees that explains everything they need to know about the security update, and a security policy that prevents the installation of unauthorized software.

    Then, for the handful of dumbasses that will ignore the email, try to install an unapproved browser, then call your helpdesk, they have the ammo they need to politely inform the user that if they like getting a paycheck, they should read their messages and abide by the computer usage policy*.

    * Save veeps and members of the board, since they not only believe that company policy doesn't apply to them, but also have the ability to fire you. But that's, like, maybe 20 people, so not a big deal.

  • I need to start sending security alerts and warnings to employees at my somewhat sizable company.

    Presuming this is a Windows network, just do a net send / msg to all users.

    My problem: I'm not sure how to send these alerts without freaking everyone out

    Aw, but that's half the fun of net send!!!

    Spoilsport.

    • For the most part that was restricted or disabled since the XP days (after one of the updates. Cannot remember which). You reminded me of the old school spam I used to get...

      • For the most part that was restricted or disabled since the XP days (after one of the updates. Cannot remember which). You reminded me of the old school spam I used to get...

        I had thought that myself, but apparently a user with admin rights can still use msg to send pop-up notifications across the network. Thus, I've had a good ol' time fucking with some of my co-workers ever since rediscovering that command earlier today :)

  • Send out a note and post an FAQ (Score:1)

    by Anonymous Coward
    Send them something like this:

    "Recently you may have heard about a vulnerability in Internet Explorer. Why this made the news and the Flash vulnerability from the same week didn't nobody knows. But please be aware that we know about this vulnerability - and, just like the last 5 zero-day vulnerabilities in Internet Explorer - we are monitoring the situation and will take any action deemed appropriate. At the present time we are protected by EMET - which we first deployed in 2011 - and do not have any expos

  • huh? (Score:5, Insightful)

    by Charliemopps ( 1157495 ) on Friday May 02, 2014 @02:53PM (#46901677)

    Is this even a question? If the IE bug isn't important to you, and you don't want people switching browsers, then why the hell would you communicate the bug to anyone? You should only be sending out notifications if your users need to take action or you're trying to communicate an outage. If you're email consists of "There's this problem you don't need to do anything about..." then you're wasting their time and they will quickly learn to ignore your notifications.

    Users do not care about security issues or bugs. They want you to tell them if they need to do something. Otherwise leave them alone. If you have a few users that are worry warts and want to know about that thing they heard on the radio this morning, start a wiki page and just post it there. They can come and look at it if they have questions. But I'd avoid that. Documenting the reasons for your lack of action on a security issue is not a good idea. You may very well have good reasons, but uneducated poorly informed managers can make your life miserable if the bug ends up costing the company money.

  • Military Basic training method (Score:4, Funny)

    by Whorhay ( 1319089 ) on Friday May 02, 2014 @02:54PM (#46901699)

    Don a utilitarian yet heavily starched and pressed uniform, wear a funny hat and a hitler style mustache. Then get a ridding crop and an air horn. Go from cubicle to cubicle screaming and yelling obscenities and personal insults while instructing your vic.... users to apply patches or whatever. If anyone tries asking a question blow the air horn in their face then belittle them and kick up the crazyness of the insults a notch or two.

    Or you could send out a friendly and professionally written email with precise directions with a picture for every step. But that honestly doesn't seem like much fun to me.

    • That'll be twenty push-ups for sending lol cats through corperate e-mail to your co-workers.

      I'm not so sure the boss would go for that.

    • Re: (Score:1)

      by laejoh ( 648921 )
      Watch Fawlty Towers, "The Germans", for a HOW-TO on how to actually perform the required silly walk!

  • Define actions (instant, daily, weekly alerts) for ranges of CVSS scores http://nvd.nist.gov/cvss.cfm?c... [nist.gov]

    Track incoming CVEs (http://nvd.nist.gov/download.cfm) , assign CVSS scores specific to your organization. Also have a organization specific remediation approach.

    As you find out who is using what software, and use the CVE CPE (http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-2168) information to target more specific users.

    In the blast emails, you could potentially harvest who thinks they may be

  • Set policy. Like, you have a list of recommended software. I'd say at least two browsers and a bunch of utility software. You support those, and beyond that it's best-effort. Curate the collection. With a clear idea of what's in use, you can even start to assemble the whole thing from FOSS and eventually move to a non-proprietary OS to underpin the tools. But that really is but a side-effect of having a good grasp of the needs of your shop. See the LiMux project.

    Communicate. Not just this one thing, your en

  • First, I would title them IT Security Alerts, rather than Security Alerts. One has to do with your computer, the other has to do with thrreats to your personal safety. You don't want people overreacting.
  • You can use Group Policy or your network login scripts to disable the svg vulnerability that was recently in IE without even telling your exployees.

    You can ask slashdot all day "How do I write an email?", or you can just be an administrator.

  • Email Alert (Score:3)

    by HideyoshiJP ( 1392619 ) on Friday May 02, 2014 @03:13PM (#46901849)
    Security Email Alerts
    Summary

    Often times, email works great for something like this. Make sure you use a standardized and easy to read template that makes important information stand out.

    Affected Items

    • Make sure you list what is going to be affected and how it will affect people's jobs.
    • Make each item stand out from drab text, so people's eyes immediately find whether or not it affects them.

    Your Actions

    Here's where you try to calm people down and/or tell them what they need to do. This section can be a lengthy if necessary, but make sure to break out individual items if this section grows to a text wall.

  • Tell them there is some magical device on you network that prevent all secuity issues that can happen. They are safe and they can keep working in peace. Rainbows and unicorns bla bla bla...

  • They are annoying, flood the text inbox and hide other stuff. Have/buy an alert app for android & iphone (& maybe blackberry) which can actually handle things sanely. Not to mention the cost.

    If there's a holdout with an L7089, texts may be acceptable for them but smartphone users have better options.

  • Meaningless Goal (Score:3)

    by zieroh ( 307208 ) on Friday May 02, 2014 @03:37PM (#46902163)

    Assuming that you find a way to communicate these alerts without freaking everyone out (which is a tall order to start with) I think your goal -- of having people "take extra care until it is fixed" is so completely vague an inactionable as to be completely meaningless.

  • fix it at the proxy level (Score:4, Informative)

    by SethJohnson ( 112166 ) on Friday May 02, 2014 @03:49PM (#46902279) Homepage Journal
    Modify your outbound proxy rules to redirect every outbound http request that has a useragent string belonging to the affected browser. Send them to an internal HTML page that explains the security threat and provides a link to download and install the browser preferred by the organization.

    This will:
    1. Selectively communicate the issue to only the affected users.
    2. Prevent anyone on the internal network from being compromised due to this vulnerability.
    3. Prevent anyone from ignoring the 'advisory.'

    If you're not using an outbound proxy, god help you.

  • I had to create a warning protocol/process about 15 years ago but it might work for you. 1. We color coded the warnings kinda like the first DHS warnings ... colors are associated with threat levels. 2. When a threat or a vulnerability became a concern, we sent out global company emails to employees, contractors, and clients. The emails had a standard format, including color-coded stationary. 3. We created a short PDF for each threat/vuln that was sent as an attachment with the global email warning. This wa

  • Include the solution or recommended course of action in the alert email. Don't just say there's a problem, tell them how to fix it.

    Ex. download this hotfix at this link
    Ex. enable/disable this setting
    Ex. Be careful while using Internet Explorer and use an alternative browser such as firefox or chrome (I wouldn't include links here but thats just me)

    Oh and no technical jargon, the unknown scares people, if your boss can understand it based on just your email (before you send it), you've achieved this.

Slashdot Top Deals

"If it ain't broke, don't fix it." - Bert Lantz

Close