<html><body><div><blockquote type="cite"><div class="msg-quote"><div class="_stretch">1. Eva mentioned that <a href="http://bettercrypto.org/" data-mce-href="http://bettercrypto.org">bettercrypto.org</a> could use a section on how to convince your boss that the company needs hardened Crypto settings and that the sysadmins should invest time into that. Do you agree with that point of view?<br>Should we add such a section?</div></div></blockquote><span><div><span><br></span></div>From my experience as a System administrator i can say "Yes we need such a document". </span></div><div><span>But mostly its not about convincing your Boss that the company needs hardened crypto settings, its about enabling cryptography at all.</span></div><div><span>If the Boss commits to Security, its the Administrators job to provide a proper Security installation. </span></div><div><span>The Boss does not need and want any detailed information. He already expects that the company's encryption is secure.</span></div><div><span>So maybe its not the right place for such a section.</span></div><div><span><br></span></div><div><blockquote type="cite"><div class="msg-quote"><div class="_stretch">2. Threat modelling: Eva mentioned that most guides first focus on a threat model. We don't really do that so much in ours. <br>Are we missing something here?</div></div></blockquote></div><div><span><br></span></div><div>I Don't think that we need a Threat model because it shrinks the focus onto this model. Everything else is left out.</div><div>I Think we should provide an overall preventive security configuration and not how to defend specific threats. (Maybe there can be smaller document with different threats that can be referenced)</div><div><br><blockquote type="cite"><div class="msg-quote"><div class="_stretch">3. Understanding your target audience: it seems we have been doing something right, because we first focused on our clearly defined target audience. However, I think we need to improve even more in this field: we should hand this guide to multiple sysadmins and let them test the guide and collect as much feedback as possible. <br></div></div></blockquote></div><div><pre style="font-family: 'Helvetica Neue', Helvetica, sans-serif; font-size: 15px; white-space: pre-wrap" data-mce-style="font-family: 'Helvetica Neue', Helvetica, sans-serif; font-size: 15px; white-space: pre-wrap;">i totally agree...</pre><pre style="font-family: 'Helvetica Neue', Helvetica, sans-serif; font-size: 15px; white-space: pre-wrap" data-mce-style="font-family: 'Helvetica Neue', Helvetica, sans-serif; font-size: 15px; white-space: pre-wrap;"><br></pre><pre style="font-family: 'Helvetica Neue', Helvetica, sans-serif; font-size: 15px; white-space: pre-wrap" data-mce-style="font-family: 'Helvetica Neue', Helvetica, sans-serif; font-size: 15px; white-space: pre-wrap;">Mit freundlichen Grüßen
Andreas Mirbach
Zum Römersprudel 101
54294 Trier
+49 160 94980084</pre></div><div><br>On 14 Jan, 2014,at 01:07 AM, "L. Aaron Kaplan" <kaplan@cert.at> wrote:<br><br></div><div><blockquote type="cite"><div class="msg-quote"><div class="_stretch">Hi list,<br> <br> I finally came around to watching evacide's talk "The Internet (Doesn't) need another security guide" [1]<br> where she mentions our small project in minute ~ 18 or 19 [2] (Yay! Thanks). Spoiler alert: Eva actually says that we need more (targeted, good, correct and well defined) guides for sure.<br> <br> It's a good talk and I encourage you to watch it as well.<br> <br> There are a couple of things that stuck:<br> <br> 1. Eva mentioned that <a href="http://bettercrypto.org" data-mce-href="http://bettercrypto.org">bettercrypto.org</a> could use a section on how to convince your boss that the company needs hardened Crypto settings and that the sysadmins should invest time into that. Do you agree with that point of view?<br> Should we add such a section?<br> <br> 2. Threat modelling: Eva mentioned that most guides first focus on a threat model. We don't really do that so much in ours. <br> Are we missing something here?<br> <br> 3. Understanding your target audience: it seems we have been doing something right, because we first focused on our clearly defined target audience. However, I think we need to improve even more in this field: we should hand this guide to multiple sysadmins and let them test the guide and collect as much feedback as possible. <br> <br> <br> So much for my thoughts after watching this talk.<br> Hope my thoughts helped or at least inspired you :)<br> <br> a.<br> <br> <br> [1] <a href="https://www.youtube.com/watch?v=VHgs3YcxzXw" data-mce-href="https://www.youtube.com/watch?v=VHgs3YcxzXw">https://www.youtube.com/watch?v=VHgs3YcxzXw</a><br> [2] <a href="https://www.youtube.com/watch?v=VHgs3YcxzXw&t=18m0s" data-mce-href="https://www.youtube.com/watch?v=VHgs3YcxzXw&t=18m0s">https://www.youtube.com/watch?v=VHgs3YcxzXw&t=18m0s</a><br> <br> <br> --- <br> // L. Aaron Kaplan <<a href="mailto:kaplan@cert.at" data-mce-href="mailto:kaplan@cert.at">kaplan@cert.at</a>> - T: +43 1 5056416 78<br> // CERT Austria - <a href="http://www.cert.at/" data-mce-href="http://www.cert.at/">http://www.cert.at/</a><br> // Eine Initiative der nic.at GmbH - <a href="http://www.nic.at/" data-mce-href="http://www.nic.at/">http://www.nic.at/</a><br> // Firmenbuchnummer 172568b, LG Salzburg<br> <br> <br> <br> <br></div><div class="_stretch">_______________________________________________<br> Ach mailing list<br> <a href="mailto:Ach@lists.cert.at" data-mce-href="mailto:Ach@lists.cert.at">Ach@lists.cert.at</a><br> <a href="http://lists.cert.at/cgi-bin/mailman/listinfo/ach" data-mce-href="http://lists.cert.at/cgi-bin/mailman/listinfo/ach">http://lists.cert.at/cgi-bin/mailman/listinfo/ach</a><br></div></div></blockquote></div></body></html>