4 ms·

This quietly, but I think significantly, changes the considerations for IAM and similar access controls. In the wild, these always trend towards overly permiss

This quietly, but I think significantly, changes the considerations for IAM and similar access controls. In the wild, these always trend towards overly permissive. Almost every company, tech or not, mature or not, deals with this. This ruling shifts a fair amount of responsibility to IAM teams to get it right now, as CFAA won’t back them up as much anymore.

NovemberWhiskey 5y ago
I don't know it makes much difference for internal controls. The implicit threat that backs the control is the disciplining of the employee, not their criminal prosecution.
- dogman144 5y ago
  Disagree as someone who’s built these, prosecution is an ultimate fallback in AUPs, employee handbooks, etc. HR teams ultimately don’t have a ton of teeth or willpower unless there are laws involved, and now there is not legal coverage.
  - NovemberWhiskey 5y ago
    If it matters, I was speaking as someone who led the authorization platform team for a Fortune 100 company. I do suppose this depends significantly on company culture. In my experience: failure to abide by company policy is first-and-foremost a compliance issue; the company policy framework definitely goes above and beyond the scope of "what is criminal". HR is primarily there to provide to manage records of employee conduct (e.g. in case of a pervasive pattern of misconduct across a number of different controls) and a sanctioning mechanism (hard conversation; formal reprimand; separation).
    - dogman144 5y ago
      Yeah def a company culture thing. I agree it’s a compliance issue, this is def GRC, and agree with your def of HR. What I notice is HR likes to really move on employees when it has legal protection to do so. What a “pervasive pattern of misconduct” is often has a law behind it in some form, as otherwise you risk a wrongful termination lawsuit. So, if you have a situation where an employee’s pattern of misconduct sources back to only, or at the root, IAM allowing it (say an extreme scenario like consistently nuking prod), there is now some gray area for those wrongful termination suits.
driverdan 5y ago
If a company's first line of defense for an employee violating internal policies is getting them charged with a federal felony then there is something very wrong with that company.
- dogman144 5y ago
  Hence “quietly but significantly.” I certainly never said a felony was the first option. From a defense in depth standpoint, the CFAA served as sort of a final stopgap, in that it gives HR legal precedent to fire someone who did something moronic with their IAM.
vageli 5y ago
Company policy does not have the force of law, and violating company policy should not be met with legal ramifications unless those violations also transgress the law. Most company policies forbid installing games on company laptops—should that be treated as a felony?
- dogman144 5y ago
  Not apples to apples at all. IAM mistakes easily touch prod, laptop games don’t.
  - vageli 5y ago
    I don't see how "touching prod" has anything to do with the unauthorized use of computer resources.
    - dogman144 5y ago
      Sure, good question. Have you ever built/audited IAM policies before? That helps with understanding the context. You can get fired for HR reasons through a pattern of misbehavior. That misbehavior needs to be safely within legal territory such that a wrongful termination suit can't occur (to really generalize). Prod example: A not inconceivable pattern of misbehavior could be repeatedly causing prod events simply because the IAM allows the user to touch prod, because the user has an overly permissive IAM policy. Policies like that are very, very common in the wild, and almost equally at small or large companies (but for different reasons). This could be hedged by an AUP or prod access policies, but then what wins out... the company might have an internal prod-access policy in place, but the laws, per this change, clearly state that if the IAM allows them to do it, it's not illegal to do so solely based on that reason. So, HR loses legal precedent to support their firing, which isn't an area HR loves being in I think. You can generalize prod events to over-permissive IAM causing any number of moronic environment problems by a single user, but if they're only doing it because the IAM allows it and the user doesn't know any better, this legal change means it's not illegal (at least under the CFAA).
      - 5y ago

NovemberWhiskey 5y ago

I don't know it makes much difference for internal controls. The implicit threat that backs the control is the disciplining of the employee, not their criminal prosecution.

dogman144 5y ago
Disagree as someone who’s built these, prosecution is an ultimate fallback in AUPs, employee handbooks, etc. HR teams ultimately don’t have a ton of teeth or willpower unless there are laws involved, and now there is not legal coverage.
- NovemberWhiskey 5y ago
  If it matters, I was speaking as someone who led the authorization platform team for a Fortune 100 company. I do suppose this depends significantly on company culture. In my experience: failure to abide by company policy is first-and-foremost a compliance issue; the company policy framework definitely goes above and beyond the scope of "what is criminal". HR is primarily there to provide to manage records of employee conduct (e.g. in case of a pervasive pattern of misconduct across a number of different controls) and a sanctioning mechanism (hard conversation; formal reprimand; separation).
  - dogman144 5y ago
    Yeah def a company culture thing. I agree it’s a compliance issue, this is def GRC, and agree with your def of HR. What I notice is HR likes to really move on employees when it has legal protection to do so. What a “pervasive pattern of misconduct” is often has a law behind it in some form, as otherwise you risk a wrongful termination lawsuit. So, if you have a situation where an employee’s pattern of misconduct sources back to only, or at the root, IAM allowing it (say an extreme scenario like consistently nuking prod), there is now some gray area for those wrongful termination suits.

driverdan 5y ago

If a company's first line of defense for an employee violating internal policies is getting them charged with a federal felony then there is something very wrong with that company.

dogman144 5y ago
Hence “quietly but significantly.” I certainly never said a felony was the first option. From a defense in depth standpoint, the CFAA served as sort of a final stopgap, in that it gives HR legal precedent to fire someone who did something moronic with their IAM.

vageli 5y ago

Company policy does not have the force of law, and violating company policy should not be met with legal ramifications unless those violations also transgress the law. Most company policies forbid installing games on company laptops—should that be treated as a felony?

dogman144 5y ago
Not apples to apples at all. IAM mistakes easily touch prod, laptop games don’t.
- vageli 5y ago
  I don't see how "touching prod" has anything to do with the unauthorized use of computer resources.
  - dogman144 5y ago
    Sure, good question. Have you ever built/audited IAM policies before? That helps with understanding the context. You can get fired for HR reasons through a pattern of misbehavior. That misbehavior needs to be safely within legal territory such that a wrongful termination suit can't occur (to really generalize). Prod example: A not inconceivable pattern of misbehavior could be repeatedly causing prod events simply because the IAM allows the user to touch prod, because the user has an overly permissive IAM policy. Policies like that are very, very common in the wild, and almost equally at small or large companies (but for different reasons). This could be hedged by an AUP or prod access policies, but then what wins out... the company might have an internal prod-access policy in place, but the laws, per this change, clearly state that if the IAM allows them to do it, it's not illegal to do so solely based on that reason. So, HR loses legal precedent to support their firing, which isn't an area HR loves being in I think. You can generalize prod events to over-permissive IAM causing any number of moronic environment problems by a single user, but if they're only doing it because the IAM allows it and the user doesn't know any better, this legal change means it's not illegal (at least under the CFAA).
    - 5y ago