Yet another Hacker News

Self-Employed? Solopreneur? NIST Has a Cybersecurity Guide Just for You

54 points tomrod 5 hours ago 15 comments

xvxvx 1 hour ago | parent

‘a lay-language resource‘.

IMO this misses the mark. Yes, it’s a decent attempt at simplifying cybersecurity, but if this is aimed at entry-level, non-technical people, it’s not gonna work.

One of my earliest jobs was to redesign training materials for one of the worlds largest companies. I stripped the training to its core, the true basics, and started there. The results were remarkable. I feel the urge to do the same with this document…

jaggederest 1 hour ago | parent

I'd be interested in a small sample of what you're talking about. I suspect that's a marketable product these days even if all you do is deslopify generated documentation.

philosopherNoob 1 hour ago | parent

I’m seconding the request. Anything specific that you (xvxvx) would explain to a layman differently? Even the briefest of examples would be a nice thought to chew on. “A should be B because C.”

I do a lot of explaining to non-techy people. My approach would be to print out the document and walk through it with them. Have the goal first be understanding of why certain things are a priority. Like it’s a baseball game: the three outfielders and three infielders are important to covering all your bases. We’re talking about this angle, in this context, and once the “why” is understood it’ll help them interpret the document correctly.

mcmcmc 53 minutes ago | parent

Have to agree with you. You can’t introduce concepts like phishing and MFA without actually explaining what they are.

dkobia 1 hour ago | parent

Instead of a guide. Why not a prompt?

312c 1 hour ago | parent

Guide loses all credibility when it uses "Super Intelligence"

mxuribe 43 minutes ago | parent

No, no, you're missing the point! Today its only "super" intelligence, then soon enough as it improves it will go to ludicrous intelligence, at which point its intelligence will have reached plaid!

esseph 31 minutes ago | parent

Maybe, but they would not be legally allowed to release the guide without using that term.

philosopherNoob 1 hour ago | parent

This is my first time seeing “SI” in the wild. That is such a wrong term. It’s jargon in a place where it doesn’t belong.

It’s a darn fancy algorithm and a cool tool. Putting it on a pedestal instead of grounding it to reality is not going to help anyone. My condolences to the authors.

cowlevel 43 minutes ago | parent

"SI" is a shibboleth. It's designed for the present government to know who's loyal to them.

tomrod 33 minutes ago | parent

Its worse than that though, as it isn't a loyalty test -- US federal executive agencies have to adopt it whether they like it or not.

tomrod 34 minutes ago | parent

Yeah, I dislike it too. As do most of the agencies forced to swap over to it I reckon, since "SI" is a vanity project and "AI" is what the rest of the world understands it to be.

alhirzel 1 hour ago | parent

I wonder how this relates to the ongoing ambiguity with CMMC 2.0 rollout.

tkdb 1 hour ago | parent

I'm not a security expert.

Requests for comments from career security experts: is this any good?

mxuribe 42 minutes ago | parent

I didn't review it, but i for one appreciate that at least there is an attempt to help small business owners in this area.