4 ms·

Companies are hiring and working with tons of physical security pentesters to assess how much easy is it to enter their offices. At the same time nobody is payi

by polote 6y ago

Companies are hiring and working with tons of physical security pentesters to assess how much easy is it to enter their offices. At the same time nobody is paying anyone to assess for the security of my house. But I'm sure it is easier to enter a Google office than my home

kerng 6y ago
Good point, that's why the industry is moving (some companies have already moved to) an approach that assumes your device is compromised and your work laptop and identity is treated as untrusted by default which does not get you unvetted access to everything. You might have todo many things to get more access... and still there is no 100% security, just a little more security
- denimnerd42 6y ago
  We don't get anything by default. Not even slack clone or email. And if we don't use something for 90 days we lose it. It's not uncommon in my role to have to request something every day. Then have to wait for manager approval, sometimes one up approval, Then resource owner approval, Then wait for provisioning etc. Even read only github access requires senior manager approval (A relatively high role, like 3-4 away from the CEO at a Fortune 50 company) We can't plug in USB drives either and our database queries are logged and suspicious queries (the heuristics for "suspicious" is not great admittedly) automatically get sent to your manager. Even the files on the hard drive are scanned. I've had so many false positives for the prior two things. Also we're totally moving away from laptops. Everything will be a thin client. The performance on the things is miserable due to oversubscription and technical limitations.
- marcosdumay 6y ago
  That's exactly opposite of what I see the industry going, with single sign on and authentication services being all the buzz everywhere. Anyway, how do all those services authenticate your users? By checking their passwords in the MS AD server?
  - deleted 6y ago
    [deleted]

by polote 6y ago

kerng 6y ago

Good point, that's why the industry is moving (some companies have already moved to) an approach that assumes your device is compromised and your work laptop and identity is treated as untrusted by default which does not get you unvetted access to everything. You might have todo many things to get more access... and still there is no 100% security, just a little more security

denimnerd42 6y ago
We don't get anything by default. Not even slack clone or email. And if we don't use something for 90 days we lose it. It's not uncommon in my role to have to request something every day. Then have to wait for manager approval, sometimes one up approval, Then resource owner approval, Then wait for provisioning etc. Even read only github access requires senior manager approval (A relatively high role, like 3-4 away from the CEO at a Fortune 50 company) We can't plug in USB drives either and our database queries are logged and suspicious queries (the heuristics for "suspicious" is not great admittedly) automatically get sent to your manager. Even the files on the hard drive are scanned. I've had so many false positives for the prior two things. Also we're totally moving away from laptops. Everything will be a thin client. The performance on the things is miserable due to oversubscription and technical limitations.
marcosdumay 6y ago
That's exactly opposite of what I see the industry going, with single sign on and authentication services being all the buzz everywhere. Anyway, how do all those services authenticate your users? By checking their passwords in the MS AD server?
- deleted 6y ago
  [deleted]