The linked page simply has one extra hurdle; it requires an entrepreneur to first click on:
> Self-Employed? Solopreneur? NIST Has a Cybersecurity Guide Just for You.
then follow the steps already outlined i.e. click on the abstruse Small Business Cybersecurity: Non-Employer Firms (NIST Cybersecurity White Paper 50), which directs to an academic style page with the report.
If anything, the linked page makes it harder to find, since it requires an additional step.
Since this is intended for small business owners with a thousand competing priorities, hiding the guide between walls of text and down a rabbit hole of unfamiliar links and titles will result in significant drop-off.
trentor 25 minutes ago [-]
You are exaggerating so hard it's impossible to take you serious. People can click a link on a website without hyperventilating.
youareundersell 16 seconds ago [-]
You have clearly not worked with regular people. I clicked the link and the parent is right, it's complete insanity. This does not fly. At all.
nomilk 17 minutes ago [-]
We (technical folk) can (mostly; some of the terminology is needlessly unfamiliar). A florist, beautician, candle maker, restaurateur or scuba tour operator is unlikely to find themselves on the NIST website pilfering through webpages that may as well be in another language.
xvxvx 13 hours ago [-]
‘a lay-language resource‘.
IMO this misses the mark. Yes, it’s a decent attempt at simplifying cybersecurity, but if this is aimed at entry-level, non-technical people, it’s not gonna work.
One of my earliest jobs was to redesign training materials for one of the worlds largest companies. I stripped the training to its core, the true basics, and started there. The results were remarkable. I feel the urge to do the same with this document…
pluralmonad 24 minutes ago [-]
What is your go to heuristic / mental model you use when stripping down to the essential core? Lots of marginal items needing judgment calls. What was your guiding light?
jaggederest 13 hours ago [-]
I'd be interested in a small sample of what you're talking about. I suspect that's a marketable product these days even if all you do is deslopify generated documentation.
philosopherNoob 12 hours ago [-]
I’m seconding the request. Anything specific that you (xvxvx) would explain to a layman differently? Even the briefest of examples would be a nice thought to chew on. “A should be B because C.”
I do a lot of explaining to non-techy people. My approach would be to print out the document and walk through it with them. Have the goal first be understanding of why certain things are a priority. Like it’s a baseball game: the three outfielders and three infielders are important to covering all your bases. We’re talking about this angle, in this context, and once the “why” is understood it’ll help them interpret the document correctly.
mcmcmc 11 hours ago [-]
Have to agree with you. You can’t introduce concepts like phishing and MFA without actually explaining what they are.
Sn0wCoder 9 hours ago [-]
To be fair the linked paper links to both MFA and Phishing along with links to almost every topic it touches.
Kind proves the point it’s not written for the layperson no?
rramadass 8 hours ago [-]
Read the document; it does explain phishing/etc. for a layperson in simple terms in the document itself. The gp just pointed to more resources for further study mentioned in the document.
z3ratul163071 3 hours ago [-]
i'm technical person and the contents of the document are non-sense academic mumbo jumbo that will not improve anyone's security an iota.
zoeysmithe 10 hours ago [-]
Have you read CSWP50? Its not exactly written on the 3rd grade level. I think its a pretty good compromise between something only your IT department can understand and what a small employer needs to know. If anything, it leans too technical and verbose.
Not only are there links to go deeper into each subject matter but also a part telling the employer how to hire help if they need cybersecurity help and with a link to the "Small Business Cybersecurity Support Programs Finder" directory. Ideally they should be asking around in the small business community for a local vendor, but this document does a lot of things right.
I think this is an excellent document for small business and doesn't really talk down to them.
rramadass 8 hours ago [-]
> I think this is an excellent document for small business and doesn't really talk down to them.
Right, the gp has not read it or are intentionally trying to spread FUD.
This is a good document as is generally the case for all NIST documents. It is even more relevant for the "general public" since every home has similar problems as far as cybersecurity is concerned.
Cybersecurity knowledge is vital for everyone nowadays. Hence I highly encourage people to read this and other documents linked to.
NIST is one of the few orgs who still do a pretty good job and hence should always be taken seriously. Based on their recommendations create your own checklist/workflow and have everybody at your org/home follow it.
philosopherNoob 12 hours ago [-]
This is my first time seeing “SI” in the wild. That is such a wrong term. It’s jargon in a place where it doesn’t belong.
It’s a darn fancy algorithm and a cool tool. Putting it on a pedestal instead of grounding it to reality is not going to help anyone. My condolences to the authors.
cowlevel 11 hours ago [-]
"SI" is a shibboleth. It's designed for the present government to know who's loyal to them.
tomrod 11 hours ago [-]
Its worse than that though, as it isn't a loyalty test -- US federal executive agencies have to adopt it whether they like it or not.
cowlevel 8 hours ago [-]
Federal executive agencies have to be loyal to the government because they are the government. Working for the government and refusing to do what it wants is at best dereliction of work duties and at worst treason.
blitzar 2 hours ago [-]
Must cover for child abusers and bomb schools - not a great time (or maybe a great time if you are into that sort of thing) to be a government employee
antonvs 6 hours ago [-]
There are exceptions to that - government employees are not required to follow illegal orders. The law says you can't be retaliated against for refusing such orders. There are also legal protections for whistleblowers reporting wrongdoing, at least theoretically (ask Snowden about that.)
This doesn't apply to executive orders renaming things of course, since they're not illegal. But the point is that working for the government is not some sort of legal suicide pact.
cowlevel 6 hours ago [-]
Even when asked to do something illegal, your options are to quit or to be in big trouble one way or another.
If you do the thing then you're a criminal. If you don't do it, your employer will still do everything they can to make your life hell, such as illegally firing you for insubordination to an illegal order - you might get your backpay in court if you're lucky later, but you're never getting your job back.
dboreham 5 hours ago [-]
That's the literal definition of a loyalty test.
avaer 10 hours ago [-]
It's even worse than that; the president has declared anyone using the term "AI" is the Enemy, and aiding the Enemy is a capital crime.
You could say the president is just joking about such things; I don't think this will actually be acted upon, but the political/legal situation is quite rough.
coderatlarge 8 hours ago [-]
maybe it should be re interpreted as silicon intelligence
pamcake 7 hours ago [-]
I like "service(d) inference". It works both ways.
walrus01 9 hours ago [-]
I hear they have great "AI" programs in El Salvador! If you say the right things you might even be selected for a free trip here. Such a bargain. And the weight loss plan their nutrition experts have put together is top tier.
tomrod 11 hours ago [-]
Yeah, I dislike it too. As do most of the agencies forced to swap over to it I reckon, since "SI" is a vanity project and "AI" is what the rest of the world understands it to be.
7 hours ago [-]
benjy3379 1 hours ago [-]
A backup that a compromised host can write, replace, is override with everything in ransonwhere event.
We need a immutable and off site copy. And escentialy a backup never tested is a schroding-backup, not a real.
A best way is completly test your backup, in trashable environment, if successful restore, your right, if not...
tkdb 12 hours ago [-]
I'm not a security expert.
Requests for comments from career security experts: is this any good?
NIST generally publishes excellent guidelines on operational security for academics, and commercial firms.
As a "solo" anything you are going to fail sooner or later. At minimum one requires a gray-beard IT person/consultant with a vested interest in your survival, legal consultant in corporate contract/employment laws, legal consultant in Intellectual Property (Copyright/Trademarks/Patents), a commercial Accountant familiar with tax laws, and a customs broker to handle international shipping rules.
No one is an "expert" all the time, but without key people a small firm will get squashed pretty quickly. =3
grodriguez100 6 hours ago [-]
“The publication is an update to what was previously titled Small Business Information Security: The Fundamentals (NISTIR 7621). While that publication was aimed at small businesses of varying sizes and covered the broader topic of information security, the revision is narrower in scope [...]”
The original publication is now withdrawn and replaced with this new one, which targets self-employed people / solopreneurs specifically. So, there is no current guide for small businesses anymore?
May something aimed at a average home-owner / individual -- dealing with a ton of digotal equipment from routers to Macs/PCs to home camera and security systems to smart TV and smart bidets could probably use of good use too (of course it may need update every few months though)
0x4e 10 hours ago [-]
As the target audience for this white paper, I’d appreciate HN’s take on the accuracy of this. Whether it misses something, deserves praise or any resources you can point out to make this advice even more actionable.
What’s your advice to a non-technical / non-tech savvy small business owner? Say, for example, people used to buy anti virus as a solution. What could they do now that resembles that?
—-
I work with lots of non-technical / non-tech savvy small business owners and many of them are showing concern. So, I’d love to share as much as possible with the people who are not Palo Alto networks clients.
mmooss 10 hours ago [-]
IMHO NIST advice is highly reliable but it's often too complicated to be useful, which seems to be the case here (that's up to you, of course).
Otherwise, you need to start with an idea of what valuables you have and what threats - hackers? lawsuits? competitors? how well-resourced? - you're protecting against. No security will be perfect. You need to make it more expensive to steal your data than it's worth to the attacker.
A few general tips off the top of my head:
* As much as possible, don't store anything on a computer that you don't want to read in the news or hear read to you in court. The safest data doesn't exist. For any communications, set a retention period (e.g., delete messages in 30 days), and just save separately anything you need to keep.
* Store confidential data (passwords, credit card numbers, anything that can cost money or reputation) only in a secure database; the only exception is when the data is actually requird. Password databases, if they have long-enough fields, can work here. Do not keep it in emails - don't email around passwords, credit card numbers, etc.; otherwise when the hacker accesses your email, all is lost. This especially applies to confidential client data - you don't want to have to explain to all your clients, 'you're confidential data might have been stolen - I don't really know if they hacker found it or will use it.' With a secure database, you have peace of mind.
* Use Apple products. They prioritize security and have the resources to deliver on it; they are the fastest route to security. Windows' value is to larger organizations managing large numbers of computers. Linux is too complicated to secure for non-technical users (and probably isn't as secure as Apple). It does require trusting Apple, but you need to trust someone.
* Use Signal for communication, as much as possible.
* Security is much too hard to do yourself. Depending on need, use products that a vendor remotely manages (but then you need to trust the vendor). Use your firewall to filter viruses, though that's imperfect and you need to be careful about it slowing down throughput.
0x4e 7 hours ago [-]
Thanks! Solid input.
—-
An anecdote on Apple:
I was in Colombia a couple of months ago and I got my phone stolen (iPhone 16). I rushed home to mark it as stolen using the find my feature using my Mac. It went through and I felt incredibly relieved. Then, a couple of minutes after, I receive a bunch of emails from many of my online accounts sending auth codes and making sure it was me changing the password. I then spent several hours in a back and forth trying to get a hold of the situation which thankfully was solved. I just know that my grandma would’ve had a different story to tell…
I’ve heard the same story from friends that have had their phones stolen also.
So, how secure is Apple? I think it is and feels like it’s transforming to an it used to be.
It feels like anything that’s now connected to the internet holds a back door waiting to be discovered sooner or later.
So, from what I’m learning, it’s not really about stopping the breaches because it’s hard to say you’re ever going to be free from breaches, but creating a system of data storage that takes potential breaches in mind.
mmooss 4 hours ago [-]
I have no idea what happened. I expect any experienced attacker knows about remote lock and remote wipe, and their first step would be extract everything they can ASAP.
Then they can load the extracted bits onto something else and go forward from there.
> it’s not really about stopping the breaches because it’s hard to say you’re ever going to be free from breaches, but creating a system of data storage that takes potential breaches in mind.
It's all of the above; generally it's called 'defense in depth': you don't just want a hard shell, you also want to secure the internal components - data and code.
Again, you want to start with a census of what is valuable and focus on protecting those things. You don't have resources to secure everything.
coderatlarge 8 hours ago [-]
makes me wonder how many super markets would have thoughts to include the food in their freezers as part of their securables before the recent cyber attacks that spoiled food by taking control of the cooling systems. it’s a good framework but hard to apply…
0x4e 7 hours ago [-]
I suppose they saw them as IRL items that are more at risk of being robbed than spoiled maliciously.
At least we now know that making things go bad is yet another attack vector they have.
They were talking about people other than HN readers, and they're absolutely right about that.
rramadass 3 hours ago [-]
No, there is a clear and explicit "Download URL" in 2 clicks which any 5th-grader/grandpa who has used the web knows to look for and click.
We must not encourage useless comments like these particularly when it comes to publications from NIST. NIST is one of the best sources for technical information. While they have traditionally focused on govt. agencies and experts, they have also majorly expanded their offerings targeted at general public/small businesses/solopreuners/etc.
I wonder how this relates to the ongoing ambiguity with CMMC 2.0 rollout.
walrus01 9 hours ago [-]
If I see a document that uses "SI" seriously I'm going to treat everything in it with a very high degree of suspicion. Whatever people produced this document have clearly been required to kiss the ring by using the new federal mandate for SI, which makes its entire content suspect.
Hopefully the Canadian, Australian or some European governments have a better and functionally equivalent guide that can be better trusted not to mislead the reader.
I didn't review it, but i for one appreciate that at least there is an attempt to help small business owners in this area.
jamiegodwin 2 hours ago [-]
[flagged]
chrashidnawaz 4 hours ago [-]
[flagged]
minfazhai 8 hours ago [-]
[flagged]
lunargamma676 12 hours ago [-]
[dead]
dkobia 12 hours ago [-]
Instead of a guide. Why not a prompt?
312c 12 hours ago [-]
Guide loses all credibility when it uses "Super Intelligence"
pedro_caetano 1 hours ago [-]
My old physics brain still goes to SI units (Système international) everytime I see the acronym.
mxuribe 11 hours ago [-]
No, no, you're missing the point! Today its only "super" intelligence, then soon enough as it improves it will go to ludicrous intelligence, at which point its intelligence will have reached plaid!
conorcleary 11 hours ago [-]
shh wait for the minaj release
walrus01 9 hours ago [-]
Not SI, but SA: Super Anaconda?
esseph 11 hours ago [-]
Maybe, but they would not be legally allowed to release the guide without using that term.
Rendered at 10:15:07 GMT+0000 (UTC) with Wasmer Edge.
yet its title is:
> Small Business Cybersecurity: Non-Employer Firms (NIST Cybersecurity White Paper 50)
Small businesses don't identify as 'Non-Employer Firms', have no idea what 'NIST' is, most wouldn't know what a White Paper is, nor number 50.
'A Crash Course in Cybersecurity for Small Businesses' would be an improvement.
Everything is available if you had cared to look - https://news.ycombinator.com/item?id=50349123
> Self-Employed? Solopreneur? NIST Has a Cybersecurity Guide Just for You.
then follow the steps already outlined i.e. click on the abstruse Small Business Cybersecurity: Non-Employer Firms (NIST Cybersecurity White Paper 50), which directs to an academic style page with the report.
If anything, the linked page makes it harder to find, since it requires an additional step.
Since this is intended for small business owners with a thousand competing priorities, hiding the guide between walls of text and down a rabbit hole of unfamiliar links and titles will result in significant drop-off.
IMO this misses the mark. Yes, it’s a decent attempt at simplifying cybersecurity, but if this is aimed at entry-level, non-technical people, it’s not gonna work.
One of my earliest jobs was to redesign training materials for one of the worlds largest companies. I stripped the training to its core, the true basics, and started there. The results were remarkable. I feel the urge to do the same with this document…
I do a lot of explaining to non-techy people. My approach would be to print out the document and walk through it with them. Have the goal first be understanding of why certain things are a priority. Like it’s a baseball game: the three outfielders and three infielders are important to covering all your bases. We’re talking about this angle, in this context, and once the “why” is understood it’ll help them interpret the document correctly.
https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.50.pdf
https://www.cisa.gov/sites/default/files/publications/fact-s...
https://www.cisa.gov/sites/default/files/publications/MFA-Fa...
Not only are there links to go deeper into each subject matter but also a part telling the employer how to hire help if they need cybersecurity help and with a link to the "Small Business Cybersecurity Support Programs Finder" directory. Ideally they should be asking around in the small business community for a local vendor, but this document does a lot of things right.
I think this is an excellent document for small business and doesn't really talk down to them.
Right, the gp has not read it or are intentionally trying to spread FUD.
This is a good document as is generally the case for all NIST documents. It is even more relevant for the "general public" since every home has similar problems as far as cybersecurity is concerned.
Cybersecurity knowledge is vital for everyone nowadays. Hence I highly encourage people to read this and other documents linked to.
NIST is one of the few orgs who still do a pretty good job and hence should always be taken seriously. Based on their recommendations create your own checklist/workflow and have everybody at your org/home follow it.
It’s a darn fancy algorithm and a cool tool. Putting it on a pedestal instead of grounding it to reality is not going to help anyone. My condolences to the authors.
This doesn't apply to executive orders renaming things of course, since they're not illegal. But the point is that working for the government is not some sort of legal suicide pact.
If you do the thing then you're a criminal. If you don't do it, your employer will still do everything they can to make your life hell, such as illegally firing you for insubordination to an illegal order - you might get your backpay in court if you're lucky later, but you're never getting your job back.
You could say the president is just joking about such things; I don't think this will actually be acted upon, but the political/legal situation is quite rough.
Requests for comments from career security experts: is this any good?
As a "solo" anything you are going to fail sooner or later. At minimum one requires a gray-beard IT person/consultant with a vested interest in your survival, legal consultant in corporate contract/employment laws, legal consultant in Intellectual Property (Copyright/Trademarks/Patents), a commercial Accountant familiar with tax laws, and a customs broker to handle international shipping rules.
No one is an "expert" all the time, but without key people a small firm will get squashed pretty quickly. =3
The original publication is now withdrawn and replaced with this new one, which targets self-employed people / solopreneurs specifically. So, there is no current guide for small businesses anymore?
What’s your advice to a non-technical / non-tech savvy small business owner? Say, for example, people used to buy anti virus as a solution. What could they do now that resembles that?
—-
I work with lots of non-technical / non-tech savvy small business owners and many of them are showing concern. So, I’d love to share as much as possible with the people who are not Palo Alto networks clients.
Otherwise, you need to start with an idea of what valuables you have and what threats - hackers? lawsuits? competitors? how well-resourced? - you're protecting against. No security will be perfect. You need to make it more expensive to steal your data than it's worth to the attacker.
A few general tips off the top of my head:
* As much as possible, don't store anything on a computer that you don't want to read in the news or hear read to you in court. The safest data doesn't exist. For any communications, set a retention period (e.g., delete messages in 30 days), and just save separately anything you need to keep.
* Store confidential data (passwords, credit card numbers, anything that can cost money or reputation) only in a secure database; the only exception is when the data is actually requird. Password databases, if they have long-enough fields, can work here. Do not keep it in emails - don't email around passwords, credit card numbers, etc.; otherwise when the hacker accesses your email, all is lost. This especially applies to confidential client data - you don't want to have to explain to all your clients, 'you're confidential data might have been stolen - I don't really know if they hacker found it or will use it.' With a secure database, you have peace of mind.
* Use Apple products. They prioritize security and have the resources to deliver on it; they are the fastest route to security. Windows' value is to larger organizations managing large numbers of computers. Linux is too complicated to secure for non-technical users (and probably isn't as secure as Apple). It does require trusting Apple, but you need to trust someone.
* Use Signal for communication, as much as possible.
* Security is much too hard to do yourself. Depending on need, use products that a vendor remotely manages (but then you need to trust the vendor). Use your firewall to filter viruses, though that's imperfect and you need to be careful about it slowing down throughput.
—-
An anecdote on Apple:
I was in Colombia a couple of months ago and I got my phone stolen (iPhone 16). I rushed home to mark it as stolen using the find my feature using my Mac. It went through and I felt incredibly relieved. Then, a couple of minutes after, I receive a bunch of emails from many of my online accounts sending auth codes and making sure it was me changing the password. I then spent several hours in a back and forth trying to get a hold of the situation which thankfully was solved. I just know that my grandma would’ve had a different story to tell…
I’ve heard the same story from friends that have had their phones stolen also.
So, how secure is Apple? I think it is and feels like it’s transforming to an it used to be.
It feels like anything that’s now connected to the internet holds a back door waiting to be discovered sooner or later.
So, from what I’m learning, it’s not really about stopping the breaches because it’s hard to say you’re ever going to be free from breaches, but creating a system of data storage that takes potential breaches in mind.
Then they can load the extracted bits onto something else and go forward from there.
> it’s not really about stopping the breaches because it’s hard to say you’re ever going to be free from breaches, but creating a system of data storage that takes potential breaches in mind.
It's all of the above; generally it's called 'defense in depth': you don't just want a hard shell, you also want to secure the internal components - data and code.
Again, you want to start with a census of what is valuable and focus on protecting those things. You don't have resources to secure everything.
At least we now know that making things go bad is yet another attack vector they have.
Therefore, the laypeople this is aimed at will never find it.
Or you could download it directly from the link given by a user here - https://news.ycombinator.com/item?id=50345842
We must not encourage useless comments like these particularly when it comes to publications from NIST. NIST is one of the best sources for technical information. While they have traditionally focused on govt. agencies and experts, they have also majorly expanded their offerings targeted at general public/small businesses/solopreuners/etc.
Here is their main portal for the above; Small Business Cybersecurity Corner - https://www.nist.gov/itl/smallbusinesscyber
Hopefully the Canadian, Australian or some European governments have a better and functionally equivalent guide that can be better trusted not to mislead the reader.