4 ms·
> If someone actively tries to circumvent the policy or the process, odds are that most software shops would fall victim to the same thing. Too often the focus
by mieseratte 8y ago
> If someone actively tries to circumvent the policy or the process, odds are that most software shops would fall victim to the same thing.
Too often the focus is entirely on outside attacks, with little consideration given to insider attacks. Previous job was at a cyber security firm. We'd routinely come under attack from criminal and, we believed, occasional nation state attacks as our researchers attributed a few "Axis-of-Evil" nation-state operations.
Then you'd come back from lunch and find the mantrap doors propped open, or someone left a workstation unlocked with root access to something important, or random guests just wandering around. It's a miracle we never were compromised by a disgruntled employee (of which there were many).
New job, new industry, same behavior. Folks leaving "secure" doors open, workstations unlocked with root access, and all that jazz. They're happy to cite a vague SEC regulation that may have applied at their last job, but doesn't apply to ours and even then, it's not like an attacker would ever give a flying fuck about what the SEC thinks.
I'm starting to wonder if this isn't all a comically bad dream.
- arcticfox 8y ago> Then you'd come back from lunch and find the mantrap doors propped open, or someone left a workstation unlocked with root access to something important, or random guests just wandering around. It's a miracle we never were compromised by a disgruntled employee (of which there were many). Maybe not the most technical solution to this, but one of my previous employers had a workplace culture of setting the desktop background to a rainbow with unicorns if someone left their computer unlocked. Sometimes even teams of two would work together to pwn some of the more alert members, by temporarily keeping them distracted while the other "attacker" did the business. 3 or more fails and the background bumped up to something pretty gross that nobody wanted, simply as a practical matter. I actually thought gamifying it made it pretty fun, and at least for workstation locking, we were elite. Even today I'm sharp about it. Maybe it could be extended to physical access to areas as well.
- woliveirajr 8y agoDoesn't even need to use unicorns or something gross, the simple fact that the person was perceived as a "he got caught" is enought. Yes, shaming has its uses...
- simonbw 8y agoI worked at a place that did something similar. If you walked away from your unlocked computer, when you came back you might find you'd sent an email to everyone in the office saying that you're buying lunch today.
- softawre 8y agoYeah, this is funny, but a bad idea. You getting on somebody elses workstation, under their login - what happens if they are doing bad shit to the company? Now you have to explain why you were seen on their workstation.
- tlavoie 8y agoYup, we had two approaches. You could send out an "I love purple flowers" email to everyone, or the victim would be "Hoffed." That meant setting the desktop background to that picture of David Hasselhoff, nude with strategically-placed pups.
- glenneroo 8y agoWe used to do this at LAN parties in the 90s... of course goatse was the preferred background. People quickly learned never to leave their seats for more than 30 seconds. Most people would just do a 5-10 minute power-nap in their chairs.
- lovich 8y agoSecurity isn't really valued. How many companies get fines that actually hurt them for poor security? On top of that, anything that relies on human discipline is going to fail. Everyone forgets sometims and an attacker only needs in once