Corporate Cybersecurity Training

Posted on by
Reply

It isn’t very effective, apparently.

To measure the effectiveness of different methods of cybersecurity training, the authors [of a study] divided employees into four groups. After each attack, each group received a different training method: one received generic tips about avoiding phishing attacks, a second received an interactive Q&A on cybersecurity, a third was informed about the specific methods used in the most recent attack, and the fourth received an interactive Q&A that also included details about the most recent attack. A fifth group was also created, and the employees in that group received no training.
The authors found that on average, employees who received training of any sort had only a 1.7% lower failure rate than employees who had no training.

The authors’ solution?

The study’s takeaway for organizations, says [lead author Grant] Ho, is to rely on measures other than training, like phishing-detection software that automatically eliminates the need for employees to detect phishing attacks.

Software aids are important in this milieu, but the weak link remains the human. Software aids by themselves are insufficient.

There needs to be more to the training than just a slide presentation and some lectures, or in the present case, “interactive” Q&As. The training sessions need to be plussed up, a lot, but that can’t be the end of it. Schools and responsible companies run fire drills that run to completion with evacuation of the building and head counts and roll calls while the evacuees are gathered up at their assigned evacuation points. So it must be with cybersecurity training. Simulated cyber attacks (phishing, social engineering, etc) attacks should be run against a rotating collection of employees to test their training and their responses to the attacks. Those simulations should be run some weeks after the training and more frequently than those fire drills, and they should not use IT-ginned up attacks, either; they should use serious real-world attacks, altered only to get them targeted to the collection of employees being tested.

Beyond that, there needs to be teeth attached to the training and to employees’ failure to take the training seriously.

There are three outcomes from this. One is an empirical assessment of the quality of training, its durability, and identification of weaknesses in the training program, which then can be corrected (not given up on). A second results from those teeth: once management is satisfied with the training quality, employees still falling for the attacks should be terminated. They’re too great a risk to the company.

The third outcome is a very great increase in the cyber safety of the company and of its employees (with a follow-on: those employees will be better able to maintain security in their homes’ cyber environment). The added training and testing will incur costs to the company, but the risk of the far greater cost of a cyber breach—both direct and indirect through liability—is too great to ignore.

Willful Ignorance

Posted on by
Reply

Or preferring her Newspeak Dictionary definitions over those in actual American English dictionaries.

That’s Arizona Progressive-Democrat Representative Yassamin Ansari’s view. In response to the hue and cry over her terming illegal aliens members of her constituency, she had this:

So, I didn’t realize this was such a controversy until the right-wing media started attacking me for using the word, so I Googled the word constituent. The definition of constituent is somebody who is part of a community, doesn’t matter what their legal status is,

She Googled for the definition of “constituent.” She could have consulted an actual dictionary of the American English language, but she chose not to. ‘Course, if she had, she would have seen her narrative collapse around her. This is what Merriam-Webster, for instance, has to say about the American English meaning of the term:

constituent
1 : a member of a constituency
pledged to help her elderly constituents

Following that first and thus primary definition over to constituency, we get this first and primary definition:

constituency
1 a : a body of citizens entitled to elect a representative (as to a legislative or executive position)
the governor’s liberal constituency

Citizens. Not illegal aliens. Even the second part of that first definition lends no support for Ansari’s Newspeak definition:

b : the residents in an electoral district
The senator’s constituency includes a large minority population.

Since illegal aliens are not legally resident, they are outside even the residents of an electoral district.

Inconvenient facts are, to a Party member, inconvenient.

Tipped Wages or Not?

Posted on by
Reply

McDonald’s is insisting that every restaurant—especially fast food restaurants—should be required to do away with tip-based wages and pay servers at least the Federal-level minimum wage. There are a couple of major disingenuosities in the surrounding argument.

McDonald’s Chief Executive Chris Kempczinski:

Right now, there’s an uneven playing field,

because casual-dining restaurants, bars, and other establishments to pay below the typical minimum wage to tip-earning workers. If he thinks so, he should push for getting his restaurant able to similarly pay his workers rather than demanding that others kowtow to his business model.

Kempczinski went on:

If you are a restaurant that allows tips or has tips as part of your equation, you’re essentially getting the customer to pay for your labor[.]

This is an especially blatant bit of disingenuousness. The customer already is paying for the restaurant’s labor. The customer also is paying for the restaurant’s cooking, food and food preparation inputs, rent, management salaries, every cost the restaurant incurs. Those costs are included in the prices the restaurant puts on its menu. Tipping is just a customer-facing line item on the bill.

This is nothing but a regulated business manager venally and self-servingly trying to capture the regulators and impose added costs on his smaller and weaker competitors.

What, Me Worry?

Posted on by
2

President Donald Trump (R) authorized the US Navy to destroy a drug smuggling boat in international Caribbean Sea waters. The Left and their Party politicians are in an uproar. Trump has said that the drug smuggler was a threat to national security.

But that claim was sharply disputed by legal experts and some lawmakers, who said that Trump exceeded his legal authority by using lethal military force against a target that posed no direct danger to the US and doing so without congressional authorization.

Last bit first: Trump—any President—has constitutional authority to address threats to our nation’s security, including using lethal force. That’s at the core of the President’s job.

Then there’s this from Frank Kendall, ex-Biden SecAF:

The casualties “weren’t engaged in anything like a direct attack on the United States….” “Frankly, I can’t see how this can be considered anything other than a nonjudicial killing outside the boundaries of domestic and international law.”

The bit about the drug smuggling boat being no danger to the US is, at best, disingenuous in the present environment. That environment consists of drugs being smuggled into our nation on the scale it is, the movement of particularly lethal drugs like fentanyl and their precursors (the latter sourced from an enemy nation) into the hands of drug cartels in Mexico and Venezuela (among other receiving nations), and the resulting scale of American deaths directly from those drugs and indirectly from the smuggling operations. To insist that a single smuggling boat is no threat to our national security is akin to insisting that a single enemy combat ship in the course of a different type of ongoing conflict is no particular national threat and so, don’t worry about it, we shouldn’t sink it.

Rights from Men, Not from God

Posted on by
Reply

That’s the view of Virginia’s Progressive-Democrat Senator Tim Kaine.

The notion that rights don’t come from laws and don’t come from the government, but come from the Creator—that’s what the Iranian government believes. It’s a theocratic regime that bases its rule on Sharia law and targets Sunnis, Bahá’ís, Jews, Christians and other religious minorities. And they do it because they believe that they understand what natural rights are from their Creator. So the statement that our rights do not come from our laws or our governments is extremely troubling.

Kaine is deliberately distorting (because I don’t believe so intelligent a man doesn’t know better the logic he’s tacitly using) the situation: he claims that because others make similar claims, they must all be equally false. Analogies, as Kaine is using here, can be useful in clarifying phenomena, but they also can be useful, as Kaine is doing here, to obfuscate and to seem to disprove phenomena (without any capability to prove or disprove anything).

Kaine chooses to ignore the differences between a culture, one the one hand, in which its citizens believe fundamental rights come from our Creator and that government is subordinate to the sovereign people. In our culture, our laws are intended to defend and implement those fundamental rights, not to create them.

That’s in contrast with nations (not necessarily the cultures of those nations) whose governing men and women insist that government is sovereign and its people subordinate and whose governing men and women speak words of rights coming from God but who appoint themselves as God’s interpreter and then define those rights for themselves, adjusting them from time to time at need to maintain their power.

In Kaine’s view, our fundamental rights would come from men like Kaine, who Knows Better and would define our rights in accordance with his superior knowledge, and women like Kamala Harris, whose handed-down rights would be salads of words, or Nancy Pelosi, whose handed-down rights would be State Secrets, allowing us to know what is in them only after she chooses to publish them.

In Kaine’s world, too, “rights” would evolve as the men and women in power change over time, and that would evolve as the men and women in power change their minds over time while they’re in power. Because they are rights created by men and women, they cannot be fundamental, intrinsic in our being. They are merely political rights, politically granted and politically taken away as the men and women in power deem fit.

This is entirely consistent with the Progressive-Democratic Party’s goal of fundamentally transforming our nation (Barack Obama) and of fundamentally changing our economy (Joe Biden). This is the risk we face in 2026, 2028, and subsequent elections.

H/t ralflongwalker