Mastodawn

Tech workers - what did your IT Security team do that made your life hell and had no practical benefit?

https://lemmy.world/post/7232834

Tech workers - what did your IT Security team do that made your life hell and had no practical benefit? - Lemmy.World

One chestnut from my history in lottery game development: While our security staff was incredibly tight and did a generally good job, oftentimes levels of paranoia were off the charts. Once they went around hot gluing shut all of the “unnecessary” USB ports in our PCs under the premise of mitigating data theft via thumb drive, while ignoring that we were all Internet-connected and VPNs are a thing, also that every machine had a RW optical drive.

body_by_make Oct 23, 2023

Often times you’ll find that the crazy things IT does are forced on them from higher ups that don’t know shit.

A common case of this is requiring password changes every x days, which is a practice that is known to actively make passwords worse.

Krudler Oct 23, 2023

That’s super true, so many times to stay ISO compliant, security policies need to align with other recommendations and best practices that are often insane.

But then there’s a difference between those things which at least we can rationalize WHY they exist… and then there’s gluing USB plugs shut because they read about it on slashdot and had a big paranoia. Lol

dual_sport_dork 🐧🗡️Oct 23, 2023

Or it prompts people to just stick their “super secure password” with byzantine special character, numeral, and capital letter requirements to their monitor or under their keyboard, because they can’t be arsed to remember what nonsensical piece of shit they had to come up with this month just to make the damn machine happy and allow them to do their jobs.

SpaceNoodle Oct 23, 2023

I do this in protest of asinine password change rules.

Nobody’s gonna see it since my.monitor is at home, but it’s the principle of the thing.

residentmarchant Oct 23, 2023

A truly dedicated enough attacker can and will look in your window! Or do fancier things like enable cameras on devices you put near your monitor

Not saying it’s likely, but writing passwords down is super unsafe

Krudler Oct 23, 2023

What you’re describing is the equivalent of somebody breaking into your house so that they can steal the key off your desk when you’re sleeping, duplicating it, returning it to the same place so that you won’t notice, then using the key to break in and rob your house later.

Krudler Oct 23, 2023

What you are describing is the equivalent of somebody breaking into your house so they can steal your house key.

curve_empty_buzz Oct 23, 2023

No, they’re breaking into your house to steal your work key. The LastPass breach was accomplished by hitting an employee’s personal, out of date, Plex server and then using it to compromise their work from home computer. Targeting a highly privileged employees personal technology is absolutely something threat actors do.

Krudler Oct 23, 2023

The point is if they’re going to get access to your PC it’s not going to be to turn on a webcam to see a sticky note on your monitor bezel. They’re gonna do other nefarious shit or keylog, etc.

residentmarchant Oct 24, 2023

Why keylog and pick up 10k random characters to sift through when the password they want is written down for them?

Rooty Oct 24, 2023

Again, how is the attacker going to see a piece of paper that is stuck to the side of the screen? This rule makes sense in high traffic areas, but in a private persons home? The attacker would also need to be a burglar.

Krudler Oct 24, 2023

You’re talking to people that can’t follow a basic conversation.

Krudler Oct 24, 2023

You’re talking to people that cannot seem to follow a basic conversation.

Krudler Oct 24, 2023

It seems that some people are having trouble following the conversation and a basic stream of topical logic.

The initial premise was that somebody could see your passwords by pwning your machine… And using that to… Turn on webcam so they could steal your password so they could… pwn your machine?

Lol

Hobo Oct 24, 2023

Nope. The premise is they pwn ANOTHER, less secure, personal device and use the camera from the DIFFERENT device to pwn your work computer. For example, by silently installing Pegasus on some cocky “security is dumb lol” employee’s 5 year out-of-date iphone via text message while they’re sleeping, and use the camera from that phone to recon the password.

They probably wouldn’t want the $3.50 that person has in their bank account, but ransoming corporate data pays bank, and wire transfering from a corporate account pays even better! If you’re in a highly privileged position, or have access to execute financial transactions at a larger company, pwning a personal device isn’t outside of the threat model.

Most likely that threat model doesn’t apply to you, but perhaps at least put it under the keyboard out of plain sight?

Krudler Oct 24, 2023

This is one of the dumbest things I’ve ever read.

Krudler Oct 25, 2023

This is one of the stupidest things I’ve read today.

Krudler Oct 25, 2023

Would you just stop.

Hobo Oct 25, 2023

I made one comment to you clarifying the other person’s point because you clearly didn’t understand what they were saying. Personally seen a couple of small companies fold because they were ransomed from a password on a post it. But you do you.

BastingChemina Oct 25, 2023

Your coworkers put their password under the keyboard ? Mine just leave a post it on the side of the monitor.

xkforce Oct 23, 2023

The DOD was like this. And it wasn’t just that you had to change passwords every so often but the requirements for those passwords were egregious but at the same time changing 1 number or letter was enough to pass the password requirements.

vagrantprodigy Oct 23, 2023

Even better is forcing changes every 30 or 60 days, and not allowing changes more than every week. Our users complain daily between those rules and the password requirements that they are too dumb to understand.

JigglySackles Oct 24, 2023

Password changes that frequent are shown to be ineffective, especially for the hassle. Complexity is a better protection method.

vagrantprodigy Oct 24, 2023

I’m aware. Apparently everyone who read my post has misread it. I’m saying that the requirements above are terrible, and they make my users complain constantly. Our security team constantly comes up with ways to increase security theater at the detriment of actual security.

JigglySackles Oct 24, 2023

Ahh my bad. That sounds like a sec team that needs a reality check.

Ookami38 Oct 23, 2023

So glad we opted for a longer password length, with fewer arbitrary limits, and expiry only after 2 years or a suspected breach.

linearchaos Oct 24, 2023

Forcing password expiration does cause people to make shittier passwords. But when their passwords are breached programitically or through social engineering They don’t just sit around valid for years on the dark web waiting for someone to buy them up.

body_by_make Oct 24, 2023

This requirement forces people who can’t otherwise remember passwords to fall into patterns like (kid’s name)(season)(year), this is a very common password pattern for people who have to change passwords every 90 days or so. Breaching the password would expose the pattern and make it easy enough to guess based off of.

linearchaos Oct 24, 2023

It’s still not in a freaking list that they can run a programmatic attack against. People that give this answer sound like a f****** broken record I swear.

body_by_make Oct 24, 2023

Secops has been against this method of protection for many years now, I’d say you’re the outdated one here

linearchaos Oct 24, 2023

Years ago phishing and 2fa breaches werent as pervasive. Since we can’t all go to pass key right now, nobody’s doing a damn thing about the phishing campaigns. Secops current method of protection is to pay companies that scan the dark web by the lists and offer up if your password’s been owned for a fee.

That’s a pretty s***** tactic to try to protect your users.

body_by_make Oct 24, 2023

We’re on the internet, you can say shit.

If your user is just using johnsmithfall2022 as their password and they update the season and year every day, it’s pretty easy for hackers to identify that pattern and correct it. This is not the solution and it actively makes life worse for everyone involved.

Natanael Oct 24, 2023

Password crackers says you’re wrong

linearchaos Oct 24, 2023

No never minded people that think that all passwords are being cracked tell me I’m wrong. Lists emails and passwords grabbed from fishing attacks tell me the people that are too lazy to change their passwords and once in awhile don’t deserve the security.

glue_snorter Oct 25, 2023

I’m a native English speaker. I can’t understand your comment. I sense that you have a useful perspective, could you rephrase it so it’s understandable?

linearchaos Oct 24, 2023

99% of password theft currently comes from phishing. Most of the people that get fished don’t have a freaking clue they got fished oh look the Microsoft site link didn’t work.

Complex passwords that never change don’t mean s*** when your users are willing to put them into a website.

Natanael Oct 24, 2023

NIST now recommends watching for suspicious activity and only force rotation when there’s risk of compromise

linearchaos Oct 24, 2023

Tell me, can your users identify suspicious activity cuz mine sure as hell can’t.

Natanael Oct 24, 2023

That’s why password leak detection services exists

(And a rare few of them yes)

dditty Oct 24, 2023

For our org, we are required to do this for our cybersecurity insurance plan

Natanael Oct 24, 2023

Tell them NIST now recommends against it so the insurance company is increasing your risks

Hobo Oct 24, 2023

The guideline is abundantly clear too with little room for interpretation:

5.1.1.1 Memorized Secret Authenticators

Verifiers SHOULD NOT impose other composition rules (e.g., requiring mixtures of different character types or prohibiting consecutively repeated characters) for memorized secrets. Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically). However, verifiers SHALL force a change if there is evidence of compromise of the authenticator.

pages.nist.gov/800-63-3/sp800-63b.html

NIST Special Publication 800-63B

NIST Special Publication 800-63B

kent_eh Oct 24, 2023

And in my company the password change policies are very different from one system to another. Some force a change monthly, some every 28 days, some every 90 days, and thwn there is rhat one legacy system that no longer has a functioning password change mechanism, so we can’t change passwords there if we wanted to.

And the different systems all want different password formats, have different re-use rules.

And, with all those uncoordinated passwords, they don’t allow password managers to be used on corporate machines, despite the training materials that the company makes us re-do every year recommending password managers…

xubu Oct 24, 2023

I’m in IT security and I’m fighting this battle. I want to lessen the burden of passwords and arbitrary rotation is terrible.

I’ve ran into a number of issues at my company that would give me the approval to reduce the frequency of expired passwords

the company gets asked this question by other customers “do you have a password policy for your staff?” (that somehow includes an expiration frequency).
on-prem AD password complexity has some nice parts built in vs some terrible parts with no granularity. It’s a single check box in gpo that does way too much stuff. I’m also not going to write a custom password policy because I don’t have the skill set to do it correctly when we’re talking about AD, that’s nightmare inducing. (Looking at specops to help and already using Azure AD password protection in passive mode)
I think management is worried that a phishing event happens on a person with a static password and then unfairly conflating that to my argument of “can we just do two things: increase password length by 2 and decrease expiration frequency by 30 days”

At the end of the day, some of us in IT security want to do the right things based in common sense but we get stymied by management decisions and precedence. Hell, I’ve brought NIST 800-63B documentation with me to check every reason why they wouldn’t budge. It’s just ingrained in them - meanwhile you look at the number of tickets for password help and password sharing violations that get reported … /Sigh

𝕸𝖔𝖘𝖘 Oct 24, 2023

I feel this. I increased complexity and length, and reduced change frequency to 120d. It worked really well with the staggered rollout. Shared passwords went down significantly, password tickets went to almost none (there’s always that ‘one’). Everything points to this being the right thing and the fact that NIST supports this was a win… until the the IT audit. The auditor wrote “the password policy changed from 8-length, moderate complexity, 90-day change frequency to 12-length, high complexity, 120-day change frequency” and the board went apeshit. It wasn’t an infraction or a “ding”, it was only a note. The written policy was, of course, changed to match the GPO, so the note was for the next auditor to know of the change. The auditor even mentioned how he was impressed with the modernity of our policy and how it should lead to a better posture. I was forced to change it back, even though I got buyin from CTO for the change. BS.

Trainguyrom Oct 24, 2023

Having been exposed to those kinds of audits before that’s really just bad handling by the CTO and other higher ups!

𝕸𝖔𝖘𝖘 Oct 25, 2023

Oh, I agree. Just one reason I decided to move on to a different employer.

partial_accumen Oct 24, 2023

At the end of the day, some of us in IT security want to do the right things based in common sense but we get stymied by management decisions and precedence. Hell, I’ve brought NIST 800-63B documentation with me to check every reason why they wouldn’t budge. It’s just ingrained in them - meanwhile you look at the number of tickets for password help and password sharing violations that get reported …

Paint the picture for management:

At one time surgery was the purview of medieval barbers. Yes, the same barbers that cut your hair. At the time there were procedures to intentionally cause people to bleed excessively and cutting holes the body to let the one of the “4 humors” out to make the patient well again. All of this humanity arrived at with tens of thousands of years of existence on Earth. Today we look at this as uninformed and barbaric. Yet we’re doing the IT Security equivalent of those medieval barber still today. We’re bleeding our users unnecessarily with complex frequent password rotation and other bad methods because that’s what was the standard at one time. What’s the modern medicine version of IT Security? NIST 800-63B is a good start. I’m happy to explain whats in there. Now, do we want to keep harming our users and wasting the company’s money on poor efficiency or do we want to embrace the lesson learned from that bad past?

Aceticon Oct 24, 2023

What I really love is password policies togther with such password change requirements that push people beyond what is humanly possible to memorize, so it all ends down written in post-its, the IT equivalent of having a spare key under a vase or the rug.

Herrmens Oct 23, 2023

Took away Admin rights, so everytime you wanted to install something or do something in general that requires higher privileges, we had to file a ticket in the helpdesk to get 10 minutes of Admin rights.

The review of your request took sometimes up 3 days. Fun times for a software developer.

Krudler Oct 23, 2023

Oh shit, you just reminded me of the time that I had to PHONE Macromedia to manually activate software because of the firewalling. This was after waiting days to get administrative permission to install it in the first place.

“Thank you” for helping resurface those horrible memories!

I don’t miss those days.

XEAL Oct 23, 2023

We used Intune Portal for a list of approved desktop apps

ArgentCorvid [Iowa]Oct 24, 2023

Let me guess, the list is about 6 items long with no provision for getting any added

XEAL Oct 25, 2023

No, it was quite extensive (20-30?) and we (I) kept expanding it. I even added icons for ecah app so it looked nice. All published software was approved by Cybersecurity.

NOT_RICK Oct 23, 2023

I too know this pain

ShunkW Oct 23, 2023

We worked around this at my old job by getting VirtualBox installed on our PCs and just running CentOS or Ubuntu VMs to develop in. Developing on windows sucks unless you’re doing .NET imo.

lightnegative Oct 25, 2023

Developing on VMs also sucks, neverending network issues on platforms like Windows which have a shitty networking stack (try forwarding ports or using VPN connections).

In fact, Windows is just a shitty dev platform in general for non-Microsoft technologies but I get that you needed to go for the least shit option

ShunkW Oct 26, 2023

Yeah fortunately we didn’t need to do any port forwarding or anything complex for networking for developing locally. It was definitely much easier for us. I don’t like Apple, but I didn’t mind my other old job that gave us MacBooks honestly.

Fixbeat Oct 24, 2023

Fighting similar shit right now. I need admin rights frequently.

Shambling Shapes Oct 24, 2023

3 days? That’s downright speedy!

I submitted a ticket that fell into a black hole. I have long since found an alternate solution, but am now keeping the ticket open for the sick fascination of seeing how long it takes to get a response. 47 days and counting…