THREAD: some marginalia and further reading for folks who attended my #nbpy talk and would like to explore further
👇🏻
👇🏻
On password complexity and rotation:
- Laurie Cranor, the then-Chief Technologist for the FCC, sums up the issues with rotation: ftc.gov/news-events/bl…
- Appendix A of NIST SP 800-83B is a wonderful roundup of how to think about complexity: pages.nist.gov/800-63-3/sp800…
- Laurie Cranor, the then-Chief Technologist for the FCC, sums up the issues with rotation: ftc.gov/news-events/bl…
- Appendix A of NIST SP 800-83B is a wonderful roundup of how to think about complexity: pages.nist.gov/800-63-3/sp800…
On issues of usability vs security:
- Sydney Dekker, _The Field Guide To Human Error_: amazon.com/Field-Guide-Un… - a must-read IMO
- @Pinboard's _What I learned Trying to Secure Congressional Campaigns: idlewords.com/2019/05/what_i…
- Sydney Dekker, _The Field Guide To Human Error_: amazon.com/Field-Guide-Un… - a must-read IMO
- @Pinboard's _What I learned Trying to Secure Congressional Campaigns: idlewords.com/2019/05/what_i…
@Pinboard On retrospective/post-mortem/pre-mortem practice, I consider John Allspaw's "infinate hows" technique to be the gold standard: kitchensoap.com/2014/11/14/the…
@Pinboard For scenarios to use in threat modeling / tabletop exercises:
- @badthingsdaily is a great source of realistic scenarios to prompt brainstorming
- For more formal data, try
a. Verizon's DBIR: enterprise.verizon.com/resources/repo…,
b. BI's Breaches Report ($$$): businessinsider.com/data-breaches-…
- @badthingsdaily is a great source of realistic scenarios to prompt brainstorming
- For more formal data, try
a. Verizon's DBIR: enterprise.verizon.com/resources/repo…,
b. BI's Breaches Report ($$$): businessinsider.com/data-breaches-…
@Pinboard @badthingsdaily Finally, on mitigation: a framework I've found super-effective and really grown to love is @magoo's "five factors" framework: medium.com/starting-up-se…
