3 ms·

I can attest that I have ran tests in a very similar vein at least three times. One of which also caused an uproar. I also prefer my security measures procedur

• lawnchair_larry 6y ago
  Can you elaborate on the uproar?
  • SCHiM 6y ago
    It was pretty much this scenario years back, as a result of that exact same scenario being used by bad actors. The real thing happened, was detected and shut down. Then they did some trainings over the course of a year, and had us test the same thing again next year. Results were not particularly good, and people got upset that they did not receive the promised Christmas gifts. Afaict, these trainings stop being effective at around 10%. That is, 10% of all people being phished like this will do everything you tell them to. Up to and including sending your their password and installing malware on their machines following your e-mail instructions.
• selykg 6y ago
  Can you say who you work for? I don’t want to work for you either. You seem oblivious to the fact that you can still be effective but not a shitty security team. Your way of approaching this literally makes people who should listen to you and trust you want to do the opposite. What an awful security team you’re part of.
  • SCHiM 6y ago
    Over time security measures always cause friction. You'll always be the annoying presence, the naysayer, the 'needlessly' difficult person. Effective security imposes restrictions, hurts egos and interferes in natural social responses. It's funny you say that my way of working literally makes people want to do the opposite of trust me, when I send them a phishing e-mail that's exactly what I'm aiming for ;P
    • runlevel1 6y ago
      I've worked at a place where the security team were a detached, nagging presence. Devs only interacted with them when they had to, so security became an afterthought. I've also worked at a place where the security team were trusted collaborators. Devs were comfortable communicating with them. Their security skills improved over time, and so did the security of the software they wrote. The latter strategy is far more effective at moving the needle over the long term.
  • bluntfang 6y ago
    can you rephrase this without the acerbic vitriol? I can't really take a security discussion seriously with someone who can't communicate professionally.
    • eropple 6y ago
      Treating people this way is not itself professional. The inhumanity of the people with power and the willingness to exert it upon others in this fashion is deserving of a little, as you say, vitriol. (I would say "contempt".) Treat. People. Decently.
      • bluntfang 6y ago
        Why did you post this to GP? He's being an asshole.
        • jakelazaroff 6y ago
          Weren't you just complaining about profanity and name-calling?
          • selykg 6y ago
            Beginning to think he’s just a troll
    • jakelazaroff 6y ago
      Ah, yes — merely supporting fake bonuses during a historic economic crisis is perfectly professional, but describing that as awful is “acerbic vitriol”.
      • bluntfang 6y ago
        I'm sorry, did you read the post? It is full of profanity and name calling.
        • 6y ago
• __turbobrew__ 6y ago
  > Security measures always suck, are less efficient and cause no end of headaches, you mostly have 0 goodwill anyway. Isn’t your job to make sure security measures don’t suck, aren’t less efficient, and don’t cause headaches? This seems to be a very defeatist attitude to take. From my personal experience one of the following happens when a security team takes your perspective: 1.) users work around security mitigations, causing worse security issues 2.) workers quit the company due to friction when working 3.) the security manager gets fired because they won’t ever compromise