4 ms·

>not fake stuff where an employee can initiate a breach by posting something to slack This alone tells me that your first sentence is not true. Do you work in

>not fake stuff where an employee can initiate a breach by posting something to slack This alone tells me that your first sentence is not true. Do you work in IT security? Have you used DLP tools? Have you seen the process to certify technologies for use and secure them when they are being used? Have you seen the cost of those tools, and how much time/manpower it takes to run them? If Google Docs is not approved for company use, how does the security team identify SSNs in Google Docs? They don't. So the security team approves Google Docs and buys a product to monitor Google Docs. But now people want Dropbox, which means more cost. And Box, which means more cost. And OneDrive which means more cost. And Bobby only uploads his stuff to S3 buckets, which means more cost. All of these services cost money and all of the tools required to monitor them cost money too. And while the security team is spending tens of millions of dollars per year (probably a low number actually) to monitor all these approved cloud storage services, Maria uploads a thousand W2 tax forms to her personal Gmail account and brings down the company anyway. Or if Gmail is blocked, she puts it on a USB drive and loses it when her car is broken into. Or if the security team locks down USB storage, she prints the documents and accidentally leaves the folder on the bus. Or if there's a DLP tool watching the printers... she shares it in a personal Slack channel so she can work on it at home. Security is hard, and the mindset of users who say "you can't stop me" makes it almost impossible. The security team needs to be right 100% of the time, but an attacker only needs to be right once. The risky part isn't banning functionality, it's employees who refuse to follow the rules. And in any job, if you refuse to follow the rules, you get fired.

prepend 6y ago
>If Google Docs is not approved for company use, how does the security team identify SSNs in Google Docs? Part of my argument is that Google Docs is popular and widely used by users, so IT should support it. Then there’s training on how to use unsupported stuff (ie don’t email ssns, don’t upload ssns, etc). Then there’s DLP as the source file was a PowerPoint on the partner’s laptop. Back then, I don’t know what products existed but today I have implemented DLP that if a file has a social it is flagged for review immediately and will present visual cues to the user for sensitivity and it is blocked from lots of different transfer methods. This helps prevent users who don’t know the file is sensitive (most of the potential breaches I’ve encountered) but users can get around it (screenshot, phone, etc) if they are really determined. My point is mostly about rules being better rather than rigid. The best rules fit into a mental model and should be easy to follow. The “Just say no” style rules work just as well for security as for drugs and smoking. Usability is really important, I think, in security.
p2t2p 6y ago
> Or if there's a DLP tool watching the printers... she shares it in a personal Slack channel so she can work on it at home. And here we are. An idiotically simple use case that is not covered by IT. If instead of locking the shit out of infrastructure people in IT in your story focused on providing a comfortable solution to work on a document from home, none of that would happen. It repeat of the story with passwords. Muh security guys establish rules that your password should be a crazy something and you must rotate it every month and then are surprised that those passwords end up to be written on sticky notes beneath the keyboard. Try to be human-first and address use cases and nobody will need to use third party tool to get on with their work.

prepend 6y ago

>If Google Docs is not approved for company use, how does the security team identify SSNs in Google Docs? Part of my argument is that Google Docs is popular and widely used by users, so IT should support it. Then there’s training on how to use unsupported stuff (ie don’t email ssns, don’t upload ssns, etc). Then there’s DLP as the source file was a PowerPoint on the partner’s laptop. Back then, I don’t know what products existed but today I have implemented DLP that if a file has a social it is flagged for review immediately and will present visual cues to the user for sensitivity and it is blocked from lots of different transfer methods. This helps prevent users who don’t know the file is sensitive (most of the potential breaches I’ve encountered) but users can get around it (screenshot, phone, etc) if they are really determined. My point is mostly about rules being better rather than rigid. The best rules fit into a mental model and should be easy to follow. The “Just say no” style rules work just as well for security as for drugs and smoking. Usability is really important, I think, in security.

p2t2p 6y ago

> Or if there's a DLP tool watching the printers... she shares it in a personal Slack channel so she can work on it at home. And here we are. An idiotically simple use case that is not covered by IT. If instead of locking the shit out of infrastructure people in IT in your story focused on providing a comfortable solution to work on a document from home, none of that would happen. It repeat of the story with passwords. Muh security guys establish rules that your password should be a crazy something and you must rotate it every month and then are surprised that those passwords end up to be written on sticky notes beneath the keyboard. Try to be human-first and address use cases and nobody will need to use third party tool to get on with their work.