Hello, welcome to the Thursday, October 6, 2016 edition of the Sand Center at Storm Center's Stormcast.

My name is Johannes Ulrich, and the day I'm recording from Honolulu, Hawaii.

Today, the sand securing the human project released the next monthly edition of its Oach newsletter.

This is again targeting a non-technical audience, so not the

average listener of this podcast. But this is something great that you can share with friends,

families, and colleagues. This time it just sort of focuses on four relatively straightforward

things to communicate, to stay safe online.

Things like general awareness of the user himself, then also passwords, patching, and backups.

Probably if you get those four things reasonably done well, then you really can evade most of the threats out there.

And please remember, when you talk to non-technical users, keep it simple, focus on a couple of easy items that are actually doable,

not something that's too complex and then doesn't get done anyway.

And well, just to confirm this, we do have a new study that was created by NIST,

the National Institute of Standards and Technology, that did interviews with regular users about computer security. And what they found is something they describe as

security fatigue. Essentially, users are just overwhelmed with all the things they have to do,

they have to remember when it comes to security. Like for example, advice that's often given that you do need different

passwords for different sites and they have to be, well, hard to guess, which also makes them

hard to remember.

And then you don't give users tools like password managers in order to manage all these passwords,

which, of course, then users essentially just give up on it and go back to using the same password over and over.

This particular study came up with three different points that you should consider when you are designing security programs.

Number one, limit the number of security decisions

users need to make, and then make it simple for users to choose the right security action,

...