4 ms·

> make sure a random employee isn't uploading credit card data to Box Except you aren't making sure, and there are many ways sensitive data can be exported. Le

> make sure a random employee isn't uploading credit card data to Box Except you aren't making sure, and there are many ways sensitive data can be exported. Let's be honest with ourselves here, these measures are often implemented under the guise of security but really are just liability and risk reduction approaches. The practical security benefit is very low IME, especially considering the burdens these measures put on employees' ability to work their best (and, as this article points out, burdens on others as well).

g-clef 9y ago
Defensive infosec is mostly "liability and risk reduction." Why is "risk reduction" seen as a bad thing?
- kodablah 9y ago
  It isn't always, but when it is, it's because the costs outweigh the benefits. Usually this is in the form of lack of employee flexibility to do the best for the company (i.e. red tape and hoops become an impediment). However, in this case the cost is employee privacy. You might argue that they have none and spying on all traffic is reasonable, but many times these policies encourage employees to use workarounds that are even more dangerous just so they can have a modicum of privacy (e.g. alternative and less-vetted software packages, non-company hardware, etc).
  - g-clef 9y ago
    Having worked defensive infosec for almost 2 decades, the privacy-invasion-leading-to-insecure-workarounds is not my experience. (US-based, I'll grant. I'm sure my experience would be different in Germany, for example.) As long as the inspection was transparent (which it was until the TLS 1.3 discussion started), employees mostly didn't know they were being monitored, and they didn't care even when they learned they were. Folks who got caught downloading porn or running their side-business over the work network were surprised that we were looking for that stuff, but no one felt like their privacy had been violated.
marcoperaza 9y ago
Email attachments and a few other mediums account for almost ALL nonmalicious leaks and MOST malicious leaks. Seems pretty good to me. >Let's be honest with ourselves here, these measures are often implemented under the guise of security but really are just liability and risk reduction approaches This is a fundamental misunderstanding of security. It is ALWAYS about risk and liability reduction.
unethical_ban 9y ago
Which is harder for a call center employee or server admin? 1) Upload a file via GDrive or Box 2) base64 encode the data andsend it to a remote DNS server over the course of several days via TXT record requests As another poster says, it's all about reduction of risk. It's about balance. And on a corporate network that owns the workstation and server configuration, running a root CA cert and installing it in a gold load is pretty easy for the level of inspection and prevention it provides. This is not the end all of security, either. It's one of many steps.
- kodablah 9y ago
  I think it's mostly security theater without significant benefits. There are many parallels with the TSA here. It's not about ease of implementation as much as it's about employee trust. We shouldn't pretend that it doesn't also scoop up personal communications. Or you can say absolutely no personal communications using the computer you use for 8 hours a day if you're that type of person. Many SMBs survive without these measures, yet somehow they're sold as requirements by those with IT departments and the means. I hope "byopc" and remote work become more popular.
  - unethical_ban 9y ago
    >Or you can say absolutely no personal communications using the computer you use for 8 hours a day Exactly. It's a company resource. Most people seem to have / can afford a mobile device with cel/Wifi connectivity. Why should you feel so privileged to go to reddit, Gmail, Box, etc. on a bank network?

g-clef 9y ago

Defensive infosec is mostly "liability and risk reduction." Why is "risk reduction" seen as a bad thing?

kodablah 9y ago
It isn't always, but when it is, it's because the costs outweigh the benefits. Usually this is in the form of lack of employee flexibility to do the best for the company (i.e. red tape and hoops become an impediment). However, in this case the cost is employee privacy. You might argue that they have none and spying on all traffic is reasonable, but many times these policies encourage employees to use workarounds that are even more dangerous just so they can have a modicum of privacy (e.g. alternative and less-vetted software packages, non-company hardware, etc).
- g-clef 9y ago
  Having worked defensive infosec for almost 2 decades, the privacy-invasion-leading-to-insecure-workarounds is not my experience. (US-based, I'll grant. I'm sure my experience would be different in Germany, for example.) As long as the inspection was transparent (which it was until the TLS 1.3 discussion started), employees mostly didn't know they were being monitored, and they didn't care even when they learned they were. Folks who got caught downloading porn or running their side-business over the work network were surprised that we were looking for that stuff, but no one felt like their privacy had been violated.

marcoperaza 9y ago

Email attachments and a few other mediums account for almost ALL nonmalicious leaks and MOST malicious leaks. Seems pretty good to me. >Let's be honest with ourselves here, these measures are often implemented under the guise of security but really are just liability and risk reduction approaches This is a fundamental misunderstanding of security. It is ALWAYS about risk and liability reduction.

unethical_ban 9y ago

Which is harder for a call center employee or server admin? 1) Upload a file via GDrive or Box 2) base64 encode the data andsend it to a remote DNS server over the course of several days via TXT record requests As another poster says, it's all about reduction of risk. It's about balance. And on a corporate network that owns the workstation and server configuration, running a root CA cert and installing it in a gold load is pretty easy for the level of inspection and prevention it provides. This is not the end all of security, either. It's one of many steps.

kodablah 9y ago
I think it's mostly security theater without significant benefits. There are many parallels with the TSA here. It's not about ease of implementation as much as it's about employee trust. We shouldn't pretend that it doesn't also scoop up personal communications. Or you can say absolutely no personal communications using the computer you use for 8 hours a day if you're that type of person. Many SMBs survive without these measures, yet somehow they're sold as requirements by those with IT departments and the means. I hope "byopc" and remote work become more popular.
- unethical_ban 9y ago
  >Or you can say absolutely no personal communications using the computer you use for 8 hours a day Exactly. It's a company resource. Most people seem to have / can afford a mobile device with cel/Wifi connectivity. Why should you feel so privileged to go to reddit, Gmail, Box, etc. on a bank network?