IMO this misses the mark. Yes, it’s a decent attempt at simplifying cybersecurity, but if this is aimed at entry-level, non-technical people, it’s not gonna work.
One of my earliest jobs was to redesign training materials for one of the worlds largest companies. I stripped the training to its core, the true basics, and started there. The results were remarkable. I feel the urge to do the same with this document…
Read the document; it does explain phishing/etc. for a layperson in simple terms in the document itself. The gp just pointed to more resources for further study.
No, Phishing is not there in the glossary but explained in section 3.3.1. of CSWP50 document itself. The document also talks about how to enable phishing-resistant MFA etc.
Similar is the case with other concepts; It is all simply explained and not some deep security bits-and-bytes stuff. You need to read the document.
Since this is the Internet, you can claim anything but one only need accept it if it matches with one's own (and fellow tech. colleagues) experiences.
I have explained cybersecurity concepts to a lot of laypeople and it has never been the case that they could not understand any individual technical concept. The problem has always been walking them through all the links in the end-to-end chain and explaining where the vulnerabilities lie so they get the big picture. Do this at a simple high-level with proper analogies and almost everybody gets it.
This document is a very good start and should be recommended to everybody.
Links are almost an anti-pattern. The reader should not have to click links unless they're really interested in diving deep on that particular topic (and ideally it's more of an endnote thing, not inline)
Have you read CSWP50? Its not exactly written on the 3rd grade level. I think its a pretty good compromise between something only your IT department can understand and what a small employer needs to know. If anything, it leans too technical and verbose.
Not only are there links to go deeper into each subject matter but also a part telling the employer how to hire help if they need cybersecurity help and with a link to the "Small Business Cybersecurity Support Programs Finder" directory. Ideally they should be asking around in the small business community for a local vendor, but this document does a lot of things right.
I think this is an excellent document for small business and doesn't really talk down to them.
> I think this is an excellent document for small business and doesn't really talk down to them.
Right, the gp has not read it or are intentionally trying to spread FUD.
This is a good document as is generally the case for all NIST documents. It is even more relevant for the "general public" since every home has similar problems as far as cybersecurity is concerned.
Cybersecurity knowledge is vital for everyone nowadays. Hence I highly encourage people to read this and other documents linked to.
NIST is one of the few orgs who still do a pretty good job and hence should be always taken seriously. Based on their recommendations create your own checklist/workflow and have everybody at your org/home follow it.
What is your go to heuristic / mental model you use when stripping down to the essential core? Lots of marginal items needing judgment calls. What was your guiding light?
Prompts for what? Reference information can be built to help agents out, but this is for humans - Agent prompts themselves are extremely fragile to the model they are used with, as well as incomplete and not really intended for human readability despite being natural language.
For something coming from NIST, I would expect six 9s performance at a minimum. Benchmarks are all over the place for prompts.
No, no, you're missing the point! Today its only "super" intelligence, then soon enough as it improves it will go to ludicrous intelligence, at which point its intelligence will have reached plaid!
We're not living in the bad timeline; we're living in the absolute clown timeline.
1.9. Super Intelligence (SI)
Small businesses are increasingly leveraging SI products and services to extend limited resources and run an efficient, competitive, innovative business. For example, SI systems are often used to write code, automate workflows, generate content, or provide customer support.
Fortunately, I can use Even Superiorer Intelligence (ESI) to fix this PDF and replace this dumb-ass term with the proper nomenclature.
This is my first time seeing “SI” in the wild. That is such a wrong term. It’s jargon in a place where it doesn’t belong.
It’s a darn fancy algorithm and a cool tool. Putting it on a pedestal instead of grounding it to reality is not going to help anyone. My condolences to the authors.
Yeah, I dislike it too. As do most of the agencies forced to swap over to it I reckon, since "SI" is a vanity project and "AI" is what the rest of the world understands it to be.
NIST generally publishes excellent guidelines on operational security for academics, and commercial firms.
As a "solo" anything you are going to fail sooner or later. At minimum one requires a gray-beard IT person/consultant with a vested interest in your survival, legal consultant in corporate contract/employment laws, legal consultant in Intellectual Property (Copyright/Trademarks/Patents), a commercial Accountant familiar with tax laws, and a customs broker to handle international shipping rules.
No one is an "expert" all the time, but without key people a small firm will get squashed pretty quickly. =3
What would consulting a corporate contracting expert do if you have no employees? Not to mention the customs broker... I doubt my local plumber or a freelance software engineer has any of these.
The fact you have to ask means one should consider talking with the noted experts. I am surprised some people get petulant over the simple fact of dealing with around 1:15 customers that are going to be a problem.
Contracts and trade rules can leave you with a warehouse full of widgets you are obligated to pay to store at a loss as things get sorted out ($74k/quarter.) Also, legal mistakes can end up with you paying for nonsense services due to shady EULA ($14k annual recurring fees for some SaaS a-hole), or a subcontractor decides to declare dependent-contractor status on their tax return putting you on the hook for $70k in additional taxes.
There are dozens of scenarios people learn the expensive way (down-votes are proof a few people will try), but getting paid gets trickier as the business gets larger. This funny talk is a bare minimum crash course on the core of building a business, which is capturing revenue for delivered products and services:
>I doubt my local plumber or a freelance software engineer has any of these.
Sure, up until they buy consumables wholesale, track customer service, preserve accounting records, and or need to recover money from someone that can't or won't pay for services rendered and products consumed.
If people try to do it all themselves, they will either end up conned, over-worked, in court or fined for naively doing something silly. ymmv =3
Fair enough, you clearly speak from experience! :) Seems a natural step in scaling up then, to me. Though my impression is still that providing freelance services and running a business with physical product differ significantly in how many experts you need to support you.
It is actually harder to quantify what something intangible was worth... when someone decides you are no longer necessary to the equation.
In general, it is great when everything goes right, but I have had a few close calls over the years by extending far too much credit to large clients. When I advise kids turn down any deal larger than 15% of annual revenue, it is a policy that will keep a sustained growth with mitigated risk.
When you are a small firm, burning $50k/month on labor means you don't get to make too many mistakes before you are out of business. About 1:22 startups succeed past 3 years, and product based firms are 5 to 7 times lower odds.
The software business isn't about writing software, but reselling the same software many times over. If you let one client use you as a staffing agency, there is no product at the end of your labors.
Good luck, and never try to do it all by yourself. =3
If you succeed to read it (the admin writing style of NIST is quite dense), it's quite good.
It's a bit procedural and admin focus... but if you execute all of it, at least it's easier to defend yourself during an hack towards your clients or third parties.
I would have prefer something a bit more technical, but it's a good entrypoint, at least to help hire or consult a security professional.
As the target audience for this white paper, I’d appreciate HN’s take on the accuracy of this. Whether it misses something, deserves praise or any resources you can point out to make this advice even more actionable.
What’s your advice to a non-technical / non-tech savvy small business owner? Say, for example, people used to buy anti virus as a solution. What could they do now that resembles that?
—-
I work with lots of non-technical / non-tech savvy small business owners and many of them are showing concern. So, I’d love to share as much as possible with the people who are not Palo Alto networks clients.
IMHO NIST advice is highly reliable but it's often too complicated to be useful, which seems to be the case here (that's up to you, of course).
Otherwise, you need to start with an idea of what valuables you have and what threats you're protecting against. No security will be perfect. You need to make it more expensive to steal your data than it's worth to the attacker.
A few general tips off the top of my head:
* As much as possible, don't store anything on a computer that you don't want to read in the news or hear read to you in court. The safest data doesn't exist. For any communications, set a retention period (e.g., delete messages in 30 days), and just save separately anything you need to keep.
* Store confidential data (passwords, credit card numbers, anything that can cost money or reputation) only in a secure database; the only exception is when the data is actually requird. Password databases, if they have long-enough fields, can work here. Do not keep it in emails - don't email around passwords, credit card numbers, etc.; otherwise when the hacker accesses your email, all is lost. This especially applies to confidential client data - you don't want to have to explain to all your clients, 'you're confidential data might have been stolen - I don't really know if they hacker found it or will use it.' With a secure database, you have peace of mind.
* Use Apple products. They prioritize security and have the resources to deliver on it; they are the fastest route to security. Windows' value is to larger organizations managing large numbers of computers. Linux is too complicated to secure for non-technical users (and probably isn't as secure as Apple). It does require trusting Apple, but you need to trust someone.
* Use Signal for communication, as much as possible.
* Security is much too hard to do yourself. Depending on need, use products that a vendor remotely manages (but then you need to trust the vendor). Use your firewall to filter viruses, though that's imperfect and you need to be careful about it slowing down throughput.
makes me wonder how many super markets would have thoughts to include the food in their freezers as part of their securables before the recent cyber attacks that spoiled food by taking control of the cooling systems. it’s a good framework but hard to apply…
I was in Colombia a couple of months ago and I got my phone stolen (iPhone 16). I rushed home to mark it as stolen using the find my feature using my Mac. It went through and I felt incredibly relieved. Then, a couple of minutes after, I receive a bunch of emails from many of my online accounts sending auth codes and making sure it was me changing the password. I then spent several hours in a back and forth trying to get a hold of the situation which thankfully was solved. I just know that my grandma would’ve had a different story to tell…
I’ve heard the same story from friends that have had their phones stolen also.
So, how secure is Apple? I think it is and feels like it’s transforming to an it used to be.
It feels like anything that’s now connected to the internet holds a back door waiting to be discovered sooner or later.
So, from what I’m learning, it’s not really about stopping the breaches because it’s hard to say you’re ever going to be free from breaches, but creating a system of data storage that takes potential breaches in mind.
I have no idea what happened. I expect any experienced attacker knows about remote lock and remote wipe, and their first step would be extract everything they can ASAP.
Then they can load the extracted bits onto something else and go forward from there.
> it’s not really about stopping the breaches because it’s hard to say you’re ever going to be free from breaches, but creating a system of data storage that takes potential breaches in mind.
It's all of the above; generally it's called 'defense in depth': you don't just want a hard shell, you also want to secure the internal components - data and code.
Again, you want to start with a census of what is valuable and focus on protecting those things. You don't have resources to secure everything.
If I see a document that uses "SI" seriously I'm going to treat everything in it with a very high degree of suspicion. Whatever people produced this document have clearly been required to kiss the ring by using the new federal mandate for SI, which makes its entire content suspect.
Hopefully the Canadian, Australian or some European governments have a better and functionally equivalent guide that can be better trusted not to mislead the reader.
No, there is a clear and explicit "Download URL" in 2 clicks which any 5th-grader/grandpa who has used the web knows to look for and click.
We must not encourage useless comments like these particularly when it comes to publications from NIST. NIST is one of the best sources for technical information. While they have traditionally focused on govt. agencies and experts, they have also majorly expanded their offerings targeted at general public/small businesses/solopreuners/etc.
“The publication is an update to what was previously titled Small Business Information Security: The Fundamentals (NISTIR 7621). While that publication was aimed at small businesses of varying sizes and covered the broader topic of information security, the revision is narrower in scope [...]”
The original publication is now withdrawn and replaced with this new one, which targets self-employed people / solopreneurs specifically. So, there is no current guide for small businesses anymore?
May something aimed at a average home-owner / individual -- dealing with a ton of digotal equipment from routers to Macs/PCs to home camera and security systems to smart TV and smart bidets could probably use of good use too (of course it may need update every few months though)
A backup that a compromised host can write, replace, is override with everything in ransonwhere event.
We need a immutable and off site copy. And escentialy a backup never tested is a schroding-backup, not a real.
A best way is completly test your backup, in trashable environment, if successful restore, your right, if not...
Some part of it can already be tested during creating the backup. It's not 100% foolproof of course and you should still test restoring once in a while but my backuping procedure goes kinda like this (simplifying for the sake of explaining):
- compress backup
- encrypt backup
- add cryptographic checksum to encrypted backup file(s)
- pass the newly created backup to a container that only has access in read-only to the volume with the backup
- verify the cryptographic hash
- decrypt
- decompress
- verify everything that can be verified
- if all passes, whitelist the cryptographic hash for that backup as "known restorable backup"
So the very process of creating the backup already contains a lot of the checks needed to make sure you can restore the backup.
I still, once in a while, take a backup at random and verify that it can be restored but basically already by verifying that the cryptographic checksum matches, I'm pretty confident it's gonna work.
Never failed.
A proper backup procedure can be so much more than simply: compress/encrypt.
A real cycle, before whitelisting the backup as "probably restorable", is way more involved than that.
Is very nice backup setup !
All right for the essencial. But a readable backup is not a ready to start system.
You have a pg_dump in you compressed and encrypted backup, so when you extract it in ephemeral container, why don't restore it to check completly.
Yesterday I was reading through the Stanford Security Standards and thought is was very wellbeing made, simple UI, efficient and easy to follow - considering most subjects are complex for the general public they did a really great job
These sorts of guides, although well-intentioned, are almost invariably very ineffective. It is like asking a techy to produce a cyber-security guide and getting a PDF document with a ton of text and tables in it instead of stepping back and thinking about it.
If you want market penetration, you should instead:
1) Brand it to something that people can recognize on its own website "Cyber Basics", "A simple set of guidelines from the people who protect the USA's infrastructure" or whatever. Give it branded colours, a logo and put it in the media so people recognise it.
2) Think about the UX. You will have people with 0 knowledge, people with IT knowledge but no cybersecurity knowledge, people with a bit of both and you need all of them to have access to this data one size does not fit all.
3) We have had web applications for decades now, why are you producing a PDF? Have interactive content that people can click through, maybe some intro videos, maybe the scary stats, the details for the IT people etc.
4) Make sure that the information is up-to-date, which the PDF will invariably not be since it is likely to involve various cycles of approvals and production before the next version is ready.
This is something that SwiftOnSecurity used to do really well. They didn't try and encourage best practice, just easy things that you could do that were better, presented in a simple and fun style.
It's not perfect, but the UK NCSC has a load of guidance for individuals and small businesses that's a hell of a lot more approachable than the NIST document:
I like those little tidbits for kids like “don’t be like this kid (showing a bad habit), instead be like this kid (showing a good habit)”. It may not be 100% PC but it’s easy to remember. Hah The Simpsons parodied those in a scene showing a booklet titled “Don’t do what Donny-Don’t does”.
Sharing pdf is not inherently bad actually, in fact it is better this way to feed ai clients. But it did surprise me given that the title mentioned the lay language and then what I see is hoops of links I need to jump to get to the main content, this pdf, and no good summary in the landing page.
84 comments
[ 0.21 ms ] story [ 65.7 ms ] threadIMO this misses the mark. Yes, it’s a decent attempt at simplifying cybersecurity, but if this is aimed at entry-level, non-technical people, it’s not gonna work.
One of my earliest jobs was to redesign training materials for one of the worlds largest companies. I stripped the training to its core, the true basics, and started there. The results were remarkable. I feel the urge to do the same with this document…
https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.50.pdf
https://www.cisa.gov/sites/default/files/publications/fact-s...
https://www.cisa.gov/sites/default/files/publications/MFA-Fa...
Similar is the case with other concepts; It is all simply explained and not some deep security bits-and-bytes stuff. You need to read the document.
Since this is the Internet, you can claim anything but one only need accept it if it matches with one's own (and fellow tech. colleagues) experiences.
I have explained cybersecurity concepts to a lot of laypeople and it has never been the case that they could not understand any individual technical concept. The problem has always been walking them through all the links in the end-to-end chain and explaining where the vulnerabilities lie so they get the big picture. Do this at a simple high-level with proper analogies and almost everybody gets it.
This document is a very good start and should be recommended to everybody.
Not only are there links to go deeper into each subject matter but also a part telling the employer how to hire help if they need cybersecurity help and with a link to the "Small Business Cybersecurity Support Programs Finder" directory. Ideally they should be asking around in the small business community for a local vendor, but this document does a lot of things right.
I think this is an excellent document for small business and doesn't really talk down to them.
Right, the gp has not read it or are intentionally trying to spread FUD.
This is a good document as is generally the case for all NIST documents. It is even more relevant for the "general public" since every home has similar problems as far as cybersecurity is concerned.
Cybersecurity knowledge is vital for everyone nowadays. Hence I highly encourage people to read this and other documents linked to.
NIST is one of the few orgs who still do a pretty good job and hence should be always taken seriously. Based on their recommendations create your own checklist/workflow and have everybody at your org/home follow it.
For something coming from NIST, I would expect six 9s performance at a minimum. Benchmarks are all over the place for prompts.
1.9. Super Intelligence (SI)
Small businesses are increasingly leveraging SI products and services to extend limited resources and run an efficient, competitive, innovative business. For example, SI systems are often used to write code, automate workflows, generate content, or provide customer support.
Fortunately, I can use Even Superiorer Intelligence (ESI) to fix this PDF and replace this dumb-ass term with the proper nomenclature.
It’s a darn fancy algorithm and a cool tool. Putting it on a pedestal instead of grounding it to reality is not going to help anyone. My condolences to the authors.
Requests for comments from career security experts: is this any good?
As a "solo" anything you are going to fail sooner or later. At minimum one requires a gray-beard IT person/consultant with a vested interest in your survival, legal consultant in corporate contract/employment laws, legal consultant in Intellectual Property (Copyright/Trademarks/Patents), a commercial Accountant familiar with tax laws, and a customs broker to handle international shipping rules.
No one is an "expert" all the time, but without key people a small firm will get squashed pretty quickly. =3
Contracts and trade rules can leave you with a warehouse full of widgets you are obligated to pay to store at a loss as things get sorted out ($74k/quarter.) Also, legal mistakes can end up with you paying for nonsense services due to shady EULA ($14k annual recurring fees for some SaaS a-hole), or a subcontractor decides to declare dependent-contractor status on their tax return putting you on the hook for $70k in additional taxes.
There are dozens of scenarios people learn the expensive way (down-votes are proof a few people will try), but getting paid gets trickier as the business gets larger. This funny talk is a bare minimum crash course on the core of building a business, which is capturing revenue for delivered products and services:
"Mike Monteiro: F*ck You, Pay Me" ( https://www.youtube.com/watch?v=jVkLVRt6c1U )
>I doubt my local plumber or a freelance software engineer has any of these.
Sure, up until they buy consumables wholesale, track customer service, preserve accounting records, and or need to recover money from someone that can't or won't pay for services rendered and products consumed.
If people try to do it all themselves, they will either end up conned, over-worked, in court or fined for naively doing something silly. ymmv =3
In general, it is great when everything goes right, but I have had a few close calls over the years by extending far too much credit to large clients. When I advise kids turn down any deal larger than 15% of annual revenue, it is a policy that will keep a sustained growth with mitigated risk.
When you are a small firm, burning $50k/month on labor means you don't get to make too many mistakes before you are out of business. About 1:22 startups succeed past 3 years, and product based firms are 5 to 7 times lower odds.
The software business isn't about writing software, but reselling the same software many times over. If you let one client use you as a staffing agency, there is no product at the end of your labors.
Good luck, and never try to do it all by yourself. =3
https://en.wikipedia.org/wiki/Founder's_syndrome
It's a bit procedural and admin focus... but if you execute all of it, at least it's easier to defend yourself during an hack towards your clients or third parties.
I would have prefer something a bit more technical, but it's a good entrypoint, at least to help hire or consult a security professional.
What’s your advice to a non-technical / non-tech savvy small business owner? Say, for example, people used to buy anti virus as a solution. What could they do now that resembles that?
—-
I work with lots of non-technical / non-tech savvy small business owners and many of them are showing concern. So, I’d love to share as much as possible with the people who are not Palo Alto networks clients.
Otherwise, you need to start with an idea of what valuables you have and what threats you're protecting against. No security will be perfect. You need to make it more expensive to steal your data than it's worth to the attacker.
A few general tips off the top of my head:
* As much as possible, don't store anything on a computer that you don't want to read in the news or hear read to you in court. The safest data doesn't exist. For any communications, set a retention period (e.g., delete messages in 30 days), and just save separately anything you need to keep.
* Store confidential data (passwords, credit card numbers, anything that can cost money or reputation) only in a secure database; the only exception is when the data is actually requird. Password databases, if they have long-enough fields, can work here. Do not keep it in emails - don't email around passwords, credit card numbers, etc.; otherwise when the hacker accesses your email, all is lost. This especially applies to confidential client data - you don't want to have to explain to all your clients, 'you're confidential data might have been stolen - I don't really know if they hacker found it or will use it.' With a secure database, you have peace of mind.
* Use Apple products. They prioritize security and have the resources to deliver on it; they are the fastest route to security. Windows' value is to larger organizations managing large numbers of computers. Linux is too complicated to secure for non-technical users (and probably isn't as secure as Apple). It does require trusting Apple, but you need to trust someone.
* Use Signal for communication, as much as possible.
* Security is much too hard to do yourself. Depending on need, use products that a vendor remotely manages (but then you need to trust the vendor). Use your firewall to filter viruses, though that's imperfect and you need to be careful about it slowing down throughput.
At least we now know that making things go bad is yet another attack vector they have.
—-
An anecdote on Apple:
I was in Colombia a couple of months ago and I got my phone stolen (iPhone 16). I rushed home to mark it as stolen using the find my feature using my Mac. It went through and I felt incredibly relieved. Then, a couple of minutes after, I receive a bunch of emails from many of my online accounts sending auth codes and making sure it was me changing the password. I then spent several hours in a back and forth trying to get a hold of the situation which thankfully was solved. I just know that my grandma would’ve had a different story to tell…
I’ve heard the same story from friends that have had their phones stolen also.
So, how secure is Apple? I think it is and feels like it’s transforming to an it used to be.
It feels like anything that’s now connected to the internet holds a back door waiting to be discovered sooner or later.
So, from what I’m learning, it’s not really about stopping the breaches because it’s hard to say you’re ever going to be free from breaches, but creating a system of data storage that takes potential breaches in mind.
Then they can load the extracted bits onto something else and go forward from there.
> it’s not really about stopping the breaches because it’s hard to say you’re ever going to be free from breaches, but creating a system of data storage that takes potential breaches in mind.
It's all of the above; generally it's called 'defense in depth': you don't just want a hard shell, you also want to secure the internal components - data and code.
Again, you want to start with a census of what is valuable and focus on protecting those things. You don't have resources to secure everything.
Hopefully the Canadian, Australian or some European governments have a better and functionally equivalent guide that can be better trusted not to mislead the reader.
Therefore, the laypeople this is aimed at will never find it.
Or you could download it directly from the link given by a user here - https://news.ycombinator.com/item?id=50345842
We must not encourage useless comments like these particularly when it comes to publications from NIST. NIST is one of the best sources for technical information. While they have traditionally focused on govt. agencies and experts, they have also majorly expanded their offerings targeted at general public/small businesses/solopreuners/etc.
Here is their main portal for the above; Small Business Cybersecurity Corner - https://www.nist.gov/itl/smallbusinesscyber
This speculation suggests that you haven't ever done much support work.
The original publication is now withdrawn and replaced with this new one, which targets self-employed people / solopreneurs specifically. So, there is no current guide for small businesses anymore?
yet its title is:
> Small Business Cybersecurity: Non-Employer Firms (NIST Cybersecurity White Paper 50)
Small businesses don't identify as 'Non-Employer Firms', have no idea what 'NIST' is, most wouldn't know what a White Paper is, nor number 50.
'A Crash Course in Cybersecurity for Small Businesses' would be an improvement.
Everything is available if you had cared to look - https://news.ycombinator.com/item?id=50349123
I still, once in a while, take a backup at random and verify that it can be restored but basically already by verifying that the cryptographic checksum matches, I'm pretty confident it's gonna work.
Never failed.
A proper backup procedure can be so much more than simply: compress/encrypt.
A real cycle, before whitelisting the backup as "probably restorable", is way more involved than that.
I suggest that you submit it to HN with your comment/recommendations so people can benefit from it.
I submitted the NIST portal here - https://news.ycombinator.com/item?id=50349123
If you want market penetration, you should instead:
1) Brand it to something that people can recognize on its own website "Cyber Basics", "A simple set of guidelines from the people who protect the USA's infrastructure" or whatever. Give it branded colours, a logo and put it in the media so people recognise it.
2) Think about the UX. You will have people with 0 knowledge, people with IT knowledge but no cybersecurity knowledge, people with a bit of both and you need all of them to have access to this data one size does not fit all.
3) We have had web applications for decades now, why are you producing a PDF? Have interactive content that people can click through, maybe some intro videos, maybe the scary stats, the details for the IT people etc.
4) Make sure that the information is up-to-date, which the PDF will invariably not be since it is likely to involve various cycles of approvals and production before the next version is ready.
It's not perfect, but the UK NCSC has a load of guidance for individuals and small businesses that's a hell of a lot more approachable than the NIST document:
https://www.ncsc.gov.uk/section/advice-guidance/self-employe...