4 ms·

I feel like a large part of the responsibility lies with the people implementing these networks to be able to document, compatramentalize, and organize these va

I feel like a large part of the responsibility lies with the people implementing these networks to be able to document, compatramentalize, and organize these various systems in the least convoluted manner. The biggest problems I see achieving that are all the different ways of accomplishing the same goals. For example, many endpoints in a network will have 3 or 4 DRM agents on them for licensing certain products. What do they connect to? What are they sending? What infrastructure variables need to be in place to support those connections? How do I configure or troubleshoot this service/ connections? Most of these agents are critically ineffectual and simply add bloat. I've done pentests in my own environment and broken, cracked, or bypassed three. My point is, the company who hired you can't change their entire operation because of your requirements. That's why we go to work. Especially at small or medium size businesses with limited resources. "Stop using the ERP system with 12gb of data that you've had 30 people using for the past 15 years! We found a bug and the vendor won't fix it!" You can see how that's not viable. So you find a way to mitigate the bug yourself. "You need to get rid of XXX in engineering. They keep falling for phishing emails." No. You need to find some resources or setup training to combat phishing. Create rules or modify this person's environment to reduce surface area and increase visibility on that endpoint. And sometimes you can't solve it! But you can usually pick off some low hanging fruit and iterate to a more secure state than you started at.

naravara 7y ago
> You need to find some resources or setup training to combat phishing. Honesty it’s so bad I think we’re best off just figuring out ways to do away with email as a primary communication mechanism altogether. When my company was smaller we had more technically savvy people, but as we’ve grown the average level of competence has sunk just to meet staffing needs and it’s impossible to keep up with training and expect people to actually really listen. So if I had my druthers it would be a blanket ban on email for all internal communication. Formal taskings get done through a PM tool, general requests for information done through Slack, and documents managed and shared by the GDrive. Email restricted only to communication with outside partners. All links and URLs are blocked. All attachments are stripped and send an email telling them to send it via an upload portal that pings the person on Slack that they have a [filename] waiting for them. Part of the problem is how much we’ve habituated people’s email habits to behave badly. We tell people over and over again not to blindly click URLs, and then by default Microsoft Teams is here emailing people every time they get mentioned in a chat with a big “view in Teams” button to click through. Users get mixed messages all the time so can we blame them for not knowing what to do? And the worst part is that the worst actors in this request are senior executives. The higher up the chain the less regard they have for following established processes.

naravara 7y ago

> You need to find some resources or setup training to combat phishing. Honesty it’s so bad I think we’re best off just figuring out ways to do away with email as a primary communication mechanism altogether. When my company was smaller we had more technically savvy people, but as we’ve grown the average level of competence has sunk just to meet staffing needs and it’s impossible to keep up with training and expect people to actually really listen. So if I had my druthers it would be a blanket ban on email for all internal communication. Formal taskings get done through a PM tool, general requests for information done through Slack, and documents managed and shared by the GDrive. Email restricted only to communication with outside partners. All links and URLs are blocked. All attachments are stripped and send an email telling them to send it via an upload portal that pings the person on Slack that they have a [filename] waiting for them. Part of the problem is how much we’ve habituated people’s email habits to behave badly. We tell people over and over again not to blindly click URLs, and then by default Microsoft Teams is here emailing people every time they get mentioned in a chat with a big “view in Teams” button to click through. Users get mixed messages all the time so can we blame them for not knowing what to do? And the worst part is that the worst actors in this request are senior executives. The higher up the chain the less regard they have for following established processes.