4 ms·

Almost every one at all institutions I have worked in the past was guilty of a security breach of some sort. One org mandated that you were not allowed to have

Almost every one at all institutions I have worked in the past was guilty of a security breach of some sort. One org mandated that you were not allowed to have the 2FA token and your laptop in the same bag. But almost everyone, including me, at some point had their token on the keyring - if you’d throw that in your backpack, put the laptop in you had a security breach. In another, you were not allowed to leave the laptop in a car unattended - leave it in at the gas station while going to pay: security breach. And so on. Security breaches are convenient as cause: If rules are sufficiently byzantine, everyone breaches them at some point or another. “Security breach” also sounds bad enough that few will question the decision to fire. “But everyone does it.” is no defense against an alleged security breach. Whether the rules actually increase security doesn’t matter.

loopz 6y ago
Somehow, such dishonesty is tolerated for corporations. That will eventually bite the people back. Security is personal. Very few people in companies don't violate exposing their user sessions to others unattended, which is a security breach. With GDPR, such lax security may carry million dollar fines, and prison time.
Hamuko 6y ago
We have that same rule about leaving our work laptop in a car unattended. I've followed that rule pretty religiously, so if I go to the grocery store on my way home, I do my grocery shopping with my laptop bag strapped to my back. But even I've violated that rule at least once when I've left my laptop in the car while I sprint to get my lunch that I forgot in the fridge. And even though the security risk from the laptop being unattended in the car for less than 60 seconds is a violation, if someone was so determined to get my laptop within that kind of a timespan, they'd be determined enough to grab it off of me in person. So the practical security risk there is zero, but you could still grill my ass for it.

loopz 6y ago

Somehow, such dishonesty is tolerated for corporations. That will eventually bite the people back. Security is personal. Very few people in companies don't violate exposing their user sessions to others unattended, which is a security breach. With GDPR, such lax security may carry million dollar fines, and prison time.

Hamuko 6y ago

We have that same rule about leaving our work laptop in a car unattended. I've followed that rule pretty religiously, so if I go to the grocery store on my way home, I do my grocery shopping with my laptop bag strapped to my back. But even I've violated that rule at least once when I've left my laptop in the car while I sprint to get my lunch that I forgot in the fridge. And even though the security risk from the laptop being unattended in the car for less than 60 seconds is a violation, if someone was so determined to get my laptop within that kind of a timespan, they'd be determined enough to grab it off of me in person. So the practical security risk there is zero, but you could still grill my ass for it.