Workers Get Security Wake-Up Call

(CNET News.com) March 21, 2006 -- What's the best way to rattle employees who are more inclined to nod off during information security training sessions than to absorb tips for keeping their machines safe?

Show them just how vulnerable they may be, speakers suggested Tuesday at a meeting of the Federal Information Systems Security Educators' Association (FISSEA) just outside Washington, D.C.

Nanette Poulios, director of the information assurance program at Walsh College in Michigan, said she often sets up a PC in the back of the training room during security workshops and asks participants to enter a username and password of their choice to, say, sign up for an e-mail list. Little do they know that the computer is running software that can both crack weak passwords and record keystrokes, instantly sending the results via e-mail to their instructor, who reveals them at the end of the class--"a real eye-opener" to those who thought they trusted the system, she said.

Another tactic of choice: downloading free programs that capture and analyze network traffic and then showing users how easily their instant message conversations can be sniffed and reviewed. That's "a real education," Poulios pronounced.

William Pelgrin, director of New York's Office of Cyber Security and Infrastructure Coordination, said he recently tested the cybersavviness of employees at a number of state agencies by simulating a scam. Pelgrin's office sent them a series of e-mails: first, a warning about phishing scams, and then, a message asking recipients check the likelihood of their passwords being cracked by entering them at a fake external site masquerading as part of the cybersecurity office's Web presence.

The prior warning didn't stop 17 percent of the recipients from clicking on the e-mail's embedded link to the password checker and 15 percent from starting to enter their information into the Web-based form. But no information was actually collected in the exercise--the mere click of a cursor in the form brought up a new page containing further written warnings and a two-minute video about the perils of phishing. Thankfully, Pelgrin reported, a follow-up exercise brought improvements in the volume of gullible clickers.