topic Re: Looking for a case study in Tech Talk

Looking for a case study

Quireboy — Mon, 09 Oct 2023 09:15:03 GMT

I'm looking for a case study on why 'you' should bookmark your bank, investment company and other important sites you use, and never use a Google or similar search engine to 'look up' your important sites, i.e., preaching about why not to type in the URL and to always use your bookmark.

If anyone has links, please share!

Thanks,

Re: Looking for a case study

rslade — Wed, 03 Jul 2019 04:22:26 GMT

> Quireboy (Viewer) posted a new topic in Tech Talk on 07-02-2019 06:38 PM

> I'm looking for a case study on why 'you' should bookmark your bank, investment
> company and other important sites you use, and never use a Google or similar
> search engine to 'look up' your important sites, i.e., preaching about why not
> to type in the URL and to always use your bookmark.

I'm not sure I could find a resource to support that contention.

In fact, I'm not sure I agree with that position ...

Re: Looking for a case study

Shannon — Wed, 03 Jul 2019 05:04:12 GMT

@Quireboy wrote:
I'm looking for a case study on why 'you' should bookmark your bank, investment company and other important sites you use, and never use a Google or similar search engine to 'look up' your important sites, i.e., preaching about why not to type in the URL and to always use your bookmark.

@Quireboy, a bookmark is essentially a pointer to a web page. What benefit does it offer --- other than saving you the trouble of remembering the pages & typing out the URLs?

Re: Looking for a case study

dcontesti — Wed, 03 Jul 2019 15:26:41 GMT

@Shannon wrote:

@Quireboy wrote:
I'm looking for a case study on why 'you' should bookmark your bank, investment company and other important sites you use, and never use a Google or similar search engine to 'look up' your important sites, i.e., preaching about why not to type in the URL and to always use your bookmark.

@Quireboy, a bookmark is essentially a pointer to a web page. What benefit does it offer --- other than saving you the trouble of remembering the pages & typing out the URLs?

I have to agree with @rslade and @Shannon on this one.

I see limited benefit to bookmarking unless folks cannot remember the URL. I can understand not wanting to do a google search based on bogus sites that are one or two characters off.

I suspect my question is what is wrong with typing in the URL?

Regards

Re: Looking for a case study

denbesten — Wed, 03 Jul 2019 17:16:19 GMT

I think you need to start with the problem you are trying to solve. The prototypical problem statement is a URL embedded in a seemingly trustworthy, but easily-compromisable source, such as unsolicited email. The real trick here is that users need training to better identify the risky scenario and to know the mitigation. Specifically, that URLs used to access important sites should come from sources you trust , rather than blindly clicking the link.

I can remember "www.discover.com", so there is no harm in me typing that one in, and when I type "mellon bank" into Google, pagerank and anti-fraud departments do a great job at ensuring that the first answer is trustworthy. Other viable options are to use browser history and as you suggest, bookmarks.

Another great trick is to use a password manager (lastpass is my personal choice) and to use random passwords for each site. If it does not auto-fill, the natural response is to say WTF, which will quickly expose a fraudulent URL. Plus it is "harder" to get tricked because one need to find the password and then copy/paste. In addition to being a PITA, it gives one more time to consider if there might be a reason it did not auto-fill.

Finally, don't get fooled by MFA. It is a great tool to combat a wide variety of attacks, but MFA is insufficient to combat URL fraud. Introducing MFA forces the bad-actor to work real-time, but it does not preclude them obtaining a complete set of valid credentials.

In direct answer to your request, I concur with @rslade that a case study recommending bookmarks is unlikely because it is far from the only way to skin this cat.

Re: Looking for a case study

Get_In_The_Robo — Wed, 03 Jul 2019 19:30:20 GMT

So there's two things:

1) SEO Poisoning / spamdexing is a thing, though I don't think I've ever seen it posted about in a long time... anywhere...

2) Interestingly enough, the Chrome STIG from DISA has an item related to disabling search suggestions so it doesn't auto-fill something bad or unintended. This would fall under the "use your bookmark" suggestion to combat if that setting didn't exist.

Those are the 2 cases I can think of. But honestly I'd rather be focusing on bigger fish to fry than to create procedural docs or whatever. Would rather dive into website whitelisting if it's a concern

Re: Looking for a case study

CraginS — Thu, 04 Jul 2019 22:02:24 GMT

@Quireboy wrote:
I'm looking for a case study on why 'you' should bookmark your bank, investment company and other important sites you use, and never use a Google or similar search engine to 'look up' your important sites, i.e., preaching about why not to type in the URL and to always use your bookmark.

@Quireboy please provide us the theoretical framework or risk discussion, or the actual evidence you have, that tells you this is solid advice. I, and many others, see no particular reason fo avoid Google searches, except for the fundamental Google privacy-invading records Google keeps on all of our searches.If you have such information, that might lead you to case studies you are seeking.

Thanks,

Re: Looking for a case study

JoePete — Mon, 08 Jul 2019 20:47:34 GMT

@Quireboy wrote:
I'm looking for a case study on why 'you' should bookmark your bank, investment company and other important sites you use, and never use a Google or similar search engine to 'look up' your important sites, i.e., preaching about why not to type in the URL and to always use your bookmark.

I think, maybe, what you are trying to get at is that people often type the servername (www.example.com) and not the protocol (i.e. https://www.example.com). Typing the https protocol gives a slightly better chance of guarding against some sort of impersonation (provided someone knows enough to recognize a missing or self signed certificate).

The other issue is the vomit-laden nemesis of security HTML email. Never click a link in HTML email. More directly the age old advice when dealing with impersonation is "Always initiate the conversation." Whether it is a phone call from your bank, an email from your college, or a text from your nephew - never respond directly. Instead hang up, etc., and then call the published customer service number, etc. But back to HTML email, it really is the worst sort of garbage, and yet it has become "standard" in today's workplace.

Re: Looking for a case study

Shannon — Tue, 09 Jul 2019 05:17:10 GMT

There've been 7 replies here, with some of us stating that there's no point in this, while others have interpreted the requirement differently.

@Quireboy, please clarify what you're looking for.

Re: Looking for a case study

Quireboy — Sat, 13 Jul 2019 11:25:37 GMT

I gave you an exact precis of what I’m asking for, and instead of saying “I have no CASE STUDIES I can refer you to, you all argued the premise. Doesn’t anyone here know how to just answer the question that was asked? I thought y’’all were professionals.

Re: Looking for a case study

Shannon — Sat, 13 Jul 2019 11:44:43 GMT

@Quireboy wrote:
I gave you an exact precis of what I’m asking for, and instead of saying “I have no CASE STUDIES I can refer you to, you all argued the premise. Doesn’t anyone here know how to just answer the question that was asked? I thought y’’all were professionals.

@Quireboy, if no one's provided case studies, take it to mean that we have none.

If someone asks me if I have a case study to show that you can safely connect to an un-trusted network without using a firewall, I won't just say 'no, I don't' --- I'll also advise him that it usually isn't the case.

All of us have attempted to make it clear that what you asked doesn't make much sense, at least the way you put it.

If that message hasn't sunk in yet, I suppose we aren't professionals after all...

Re: Looking for a case study

rslade — Sat, 13 Jul 2019 18:27:39 GMT

> Quireboy (Viewer) posted a new reply in Tech Talk on 07-13-2019 07:25 AM in the

> I gave you an exact precis of what Iâ€™m asking for, and instead of saying â€œI
> have no CASE STUDIES I can refer you to, you all argued the premise. Doesnâ€™t
> anyone here know how to just answer the question that was asked?

Well, we did. As I pointed out in my first post, the reason we can't give you any
good source literature to support your premise is because it's a stupid premise.

(And I *do* know my source literature:
http://victoria.tc.ca/int-grps/books/techrev/mnbksc.htm )

> I thought
> yâ€™â€™all were professionals.

Yeah, *we* thought it was mostly professionals here, too ...

(No, that's not strictly true. I've known there were a lot of whiners and crybabies
here for a long time ...)

====================== (quote inserted randomly by Pegasus Mailer)
rslade@vcn.bc.ca slade@victoria.tc.ca rslade@computercrime.org
All the things I really like to do are either illegal, immoral,
or fattening. - Alexander Woollcott
victoria.tc.ca/techrev/rms.htm http://twitter.com/rslade
http://blogs.securiteam.com/index.php/archives/author/p1/
https://is.gd/RotlWB

Re: Looking for a case study

denbesten — Sun, 14 Jul 2019 03:43:12 GMT

@rslade wrote:
Yeah, *we* thought it was mostly professionals here, too ...
(No, that's not strictly true. I've known there were a lot of whiners and crybabies
here for a long time ...)

Professionals are not a disjoint set from whiners and crybabies.

Re: Looking for a case study

Shannon — Sun, 14 Jul 2019 05:28:08 GMT

@rslade wrote:

Yeah, *we* thought it was mostly professionals here, too ...

(No, that's not strictly true. I've known there were a lot of whiners and crybabies
here for a long time ...)

@rslade, there's just no hiding from you...

Re: Looking for a case study

dcontesti — Sun, 14 Jul 2019 15:46:19 GMT

@Quireboy wrote:
I'm looking for a case study on why 'you' should bookmark your bank, investment company and other important sites you use, and never use a Google or similar search engine to 'look up' your important sites, i.e., preaching about why not to type in the URL and to always use your bookmark.

@Quireboy wrote:
I gave you an exact precis of what I’m asking for, and instead of saying “I have no CASE STUDIES I can refer you to, you all argued the premise. Doesn’t anyone here know how to just answer the question that was asked? I thought y’’all were professionals.

@Quireboy Your question did not ring true with many of us and we were trying as professionals to understand what you were looking for and maybe help you (that's the mark of a professional).

I for one would not waste my time on your premise as I find it flawed so would therefor not have any Case Studies.

I wish you well in trying to convince folks to bookmark URLs.

Re: Looking for a case study

denbesten — Mon, 15 Jul 2019 12:49:42 GMT

I concur with @dcontesti. She stated my position better than I could have.

Re: Shannon mentioned you in (ISC)Â² Community

rslade — Mon, 15 Jul 2019 17:51:39 GMT

> Shannon (Community Champion) mentioned you in a post! Join the conversation

> @rslade, there's just no hiding from
> you...

I lurk in the shadows and sarchasm of the Internet, seeking whom I may deride ...

Which reminds me. Saw a news story on TV last night, Data breach. Reporter
saying that experts feared the data had ended up on the "Dark Web." And I
wanted to shake the reporter and scream at him, "DO YOU KNOW WHAT THE
DARK WEB IS? IT'S ANYTHING YOU CAN'T FIND ON GOOGLE ..."

====================== (quote inserted randomly by Pegasus Mailer)
rslade@vcn.bc.ca slade@victoria.tc.ca rslade@computercrime.org
Atheism turns out to be too simple. If the whole universe has no
meaning, we should never have found out that it has no meaning.
- C. S. Lewis
victoria.tc.ca/techrev/rms.htm http://twitter.com/rslade
http://blogs.securiteam.com/index.php/archives/author/p1/
https://is.gd/RotlWB

Re: Looking for a case study

rslade — Mon, 15 Jul 2019 18:14:43 GMT

> denbesten (Community Champion) posted a new reply in Tech Talk on 07-13-2019

> Professionals are not a disjoint set from whiners
> and crybabies.

Sadly true ...