3 ms·

I'm using that headline as our thought of the day in group chat at work. Because that is just egregious and negligent. Nobody thought to raise that? to anyone?

I'm using that headline as our thought of the day in group chat at work. Because that is just egregious and negligent. Nobody thought to raise that? to anyone? Although I can understand. I have several people who now call themselves DevOps on a project who have practically zero experience with systems operations _or_ development, and have done some utterly incomprehensibly stupid things. It doesn't matter how fancy your cloud tech is, if someone creates VPCs with default ALLOW ALL rules, stuff is going to get compromised. Worse yet, some are _fighting_ against changing the ingress rules because that would show that they were wrong! I'd at the very least rotate them out and replace them if I could. (rant over)

teddyuk 7y ago
It happens quite a lot - nowadays services are deployed into the cloud where people are more security concious but when people deploy on-prem they are often more negligent
- jfoster 7y ago
  Interesting point. Does having physical access to the hardware make people feel overly secure?
  - nerdponx 7y ago
    In my personal experience, yes. There is an unbelievable amount of sensitive data, whether corporate or personal, unencrypted on network shared drives and laptops across corporate America. I'm pretty much a lay person when it comes to security, so I don't know generally how safe or unsafe that is. But there is definitely a sense that, as long as you don't get phished, everything on-prem is basically "secure" and IT is just taking care of it. For example my employer had strict rules about data that can be stored on a cloud service, but less-strict rules about data that can be stored on an on-prem network drive.
kiallmacinnes 7y ago
It happens pretty often. $thing is installed, individual user accounts are created, and the default login is forgotten about. Nobody uses it, so nobody noticed it. Another variation is not even knowing default accounts exist. i.e. where there is a CLI command to add a new user, which was done during install. This obviously isn't always the case - but it happens a lot.
matwood 7y ago
This can happen for many reasons. People just want to get whatever it is working. There is probably a lot of time delivery pressure and something like IAM is complicated. IMO, the first step to fixing the problem is give DevOps the proper amount of time to design the required permissions. It sounds easy from the outside, but again IAM can be very complex. Additionally, DevOps must think security first. That means a newly deployed service has zero access and goes from there. Developers are going to be annoyed, but DevOps needs work with them and vice versa.
- bloopernova 7y ago
  Yes, least possible permissions is a tried and tested axiom that should be foremost in people's minds. The same with layered security in depth, disabling unneeded accounts, etc etc. I'm seeing a lot more inexperienced people getting access to stage/production systems (i.e. internet-facing to a greater or lesser extent) due to the DevOps paradigm. Of course the role sounds cool so people advertise for it, and apply for it, but there's a serious lack of understanding of just what it is! Developers need a good understanding of Operations, and Operations Admins need a good understanding of Development. Things like not understanding the reason why you'd want to test the network access and DNS lookup from the stage pods instead of their local machine. Or not knowing how to perform basic source control tasks. Of course, I can be dismissed as a grumpy old man. I am, I'm in my 40s and 23ish years of Linux operations has, I hope, taught me a couple of lessons. But I'm not yelling at the kids to get off my lawn, I want to teach the kids about correct garden maintenance, weeding, and when to plant bulbs and seeds (to stretch a metaphor way too far!). I find people are resistant to learning basics "because the cloud", or putting in due diligence because they're paid too little (which I fully understand!) Sorry, grumpy old sysadmin who is now a team lead with lots of responsibility and too little time to brain dump his 20+ years into some younger heads. I'll try to lighten up :)
- navigatesol 7y ago
  >People just want to get whatever it is working. There is probably a lot of time delivery pressure and something like IAM is complicated. Inexcusable. Change the login/password to anything more secure, even if it's temporary.
xondono 7y ago
And you are talking software, which is known for being quite dynamic. You'd be surprised how much "inertia" there is in other sectors, some stuff keeps happening even when alternatives are not just better, but also cheaper.
navigatesol 7y ago
>Nobody thought to raise that? to anyone? Unbelievable, no? And yet, when things like this happen, people want to blame the CEO. Sure, the buck stops there and that person is really responsible for everything. But should the executives really be concerning themselves with the database password? It's an utterly irresponsible thing, and those actually working on the product should have known better. Unpopular opinion around here, I know....
- MichaelBurge 7y ago
  Maybe not the specifics, but "get a passing security audit" is high-level enough that a CEO might consider it important.

teddyuk 7y ago

It happens quite a lot - nowadays services are deployed into the cloud where people are more security concious but when people deploy on-prem they are often more negligent

jfoster 7y ago
Interesting point. Does having physical access to the hardware make people feel overly secure?
- nerdponx 7y ago
  In my personal experience, yes. There is an unbelievable amount of sensitive data, whether corporate or personal, unencrypted on network shared drives and laptops across corporate America. I'm pretty much a lay person when it comes to security, so I don't know generally how safe or unsafe that is. But there is definitely a sense that, as long as you don't get phished, everything on-prem is basically "secure" and IT is just taking care of it. For example my employer had strict rules about data that can be stored on a cloud service, but less-strict rules about data that can be stored on an on-prem network drive.

kiallmacinnes 7y ago

It happens pretty often. $thing is installed, individual user accounts are created, and the default login is forgotten about. Nobody uses it, so nobody noticed it. Another variation is not even knowing default accounts exist. i.e. where there is a CLI command to add a new user, which was done during install. This obviously isn't always the case - but it happens a lot.

matwood 7y ago

This can happen for many reasons. People just want to get whatever it is working. There is probably a lot of time delivery pressure and something like IAM is complicated. IMO, the first step to fixing the problem is give DevOps the proper amount of time to design the required permissions. It sounds easy from the outside, but again IAM can be very complex. Additionally, DevOps must think security first. That means a newly deployed service has zero access and goes from there. Developers are going to be annoyed, but DevOps needs work with them and vice versa.

bloopernova 7y ago
Yes, least possible permissions is a tried and tested axiom that should be foremost in people's minds. The same with layered security in depth, disabling unneeded accounts, etc etc. I'm seeing a lot more inexperienced people getting access to stage/production systems (i.e. internet-facing to a greater or lesser extent) due to the DevOps paradigm. Of course the role sounds cool so people advertise for it, and apply for it, but there's a serious lack of understanding of just what it is! Developers need a good understanding of Operations, and Operations Admins need a good understanding of Development. Things like not understanding the reason why you'd want to test the network access and DNS lookup from the stage pods instead of their local machine. Or not knowing how to perform basic source control tasks. Of course, I can be dismissed as a grumpy old man. I am, I'm in my 40s and 23ish years of Linux operations has, I hope, taught me a couple of lessons. But I'm not yelling at the kids to get off my lawn, I want to teach the kids about correct garden maintenance, weeding, and when to plant bulbs and seeds (to stretch a metaphor way too far!). I find people are resistant to learning basics "because the cloud", or putting in due diligence because they're paid too little (which I fully understand!) Sorry, grumpy old sysadmin who is now a team lead with lots of responsibility and too little time to brain dump his 20+ years into some younger heads. I'll try to lighten up :)
navigatesol 7y ago
>People just want to get whatever it is working. There is probably a lot of time delivery pressure and something like IAM is complicated. Inexcusable. Change the login/password to anything more secure, even if it's temporary.

xondono 7y ago

And you are talking software, which is known for being quite dynamic. You'd be surprised how much "inertia" there is in other sectors, some stuff keeps happening even when alternatives are not just better, but also cheaper.

navigatesol 7y ago

>Nobody thought to raise that? to anyone? Unbelievable, no? And yet, when things like this happen, people want to blame the CEO. Sure, the buck stops there and that person is really responsible for everything. But should the executives really be concerning themselves with the database password? It's an utterly irresponsible thing, and those actually working on the product should have known better. Unpopular opinion around here, I know....

MichaelBurge 7y ago
Maybe not the specifics, but "get a passing security audit" is high-level enough that a CEO might consider it important.