3 ms·

Don't just test your backups. Make sure your automation can't clobber or tamper with your backups. This includes both local and disaster recovery sites. Give

Don't just test your backups. Make sure your automation can't clobber or tamper with your backups. This includes both local and disaster recovery sites. Give your pen-test team super-user privs on your automation and give them Amazon gift cards if they can tamper with your backups. If they can't mess with the backups, give the gift cards to whoever designed and hardened your infrastructure.

wizzwizz4 5y ago
Why not actual money? Amazon gift cards leak metadata to Amazon, and can only be used to buy stuff from Amazon.
- jagged-chisel 5y ago
  And they support Amazon.
  - wizzwizz4 5y ago
    Oh, of course. Can't believe I forgot the biggest reason.
- LinuxBender 5y ago
  Good point. Cash bonus and maybe RSU's if they company is public.
- jonas21 5y ago
  It used to be that you could give employees gift cards up to a certain amount as awards and it would not be considered taxable income (but I believe that's no longer the case).
  - jagged-chisel 5y ago
    Any gift(s) up to a total value of ... $13k? -ish? I don't know what the limit is now. Google's cafeteria is (was? depending on that limit...) an example of how to benefit employees without causing the employee additional tax.
    - mikeyouse 5y ago
      That's a different issue - IRS clamped down on gift cards and non-cash compensation that used to be considered de minimis. Now most employers gross up and report any gift card type gift over ~$5. https://www.irs.gov/government-entities/federal-state-local-governments/de-minimis-fringe-benefits https://www.irs.gov/government-entities/federal-state-local-...
    - dmoy 5y ago
      Setting aside the gift card bit (addressed in above comment), $13k sounds way too high. Like two orders of magnitude too high. From irs.gov > Whether an item or service is de minimis depends on all the facts and circumstances. In addition, if a benefit is too large to be considered de minimis, the entire value of the benefit is taxable to the employee, not just the excess over a designated de minimis amount. The IRS has ruled previously in a particular case that items with a value exceeding $100 could not be considered de minimis, even under unusual circumstances. Which about matches with what I've seen at BigCo. $40 box of tools as a gift? Did not show up on my paycheck. $150 electronic device as a gift? Showed up on my paycheck.
      - mikeyouse 5y ago
        There's another about other fringe benefits being taxed - with a prime example being tech cafeterias. https://taxnews.ey.com/news/2019-0493-employer-must-substantiate-necessity-of-employer-provided-meals-for-value-to-be-excluded-from-employee-income-irs-tam-emphasizes https://taxnews.ey.com/news/2019-0493-employer-must-substant... In the past few years, guidance has shifted toward accounting for employer-provided food with employee income as well.
        dmoy 5y ago
        I don't think that's actually enforced yet though. I would bet the IRS wins that particular fight, but it'll take awhile.
- bentcorner 5y ago
  I think logistically its easier for a team within an org to spend "their" money on gift cards for intermittent activities and hand them out as necessary. Getting stuff onto the actual payroll is probably more complicated.
  - edoceo 5y ago
    Hey Payroll, edoceo needs an off-cycle bonus of $$$. Your manager should be able to write a similar email.
    - Volundr 5y ago
      At least at the company I recently left, this kicks off an approval process within both the HR and accounting departments. Meanwhile an Amazon purchase (and thus an Amazon gift card) is something I could put on my card and expense, or approve someone else doing myself. I get it doesn't make sense, but that's corporate America for you. That said, be careful of the gift card route. Depending on the amount you can find yourself in the wrong side of the IRS that way.
      - gowld 5y ago
        I wouldn't want to embezzle funds and commit income/payroll tax fraud just to bypass paperwork
    - rad_gruchalski 5y ago
      It doesn’t work like that in every place in the world. Those gift cards also aren’t that easy. It’s all taxable benefit to the employee and a cost for the company to put on the books. That needs to be justified and tax office may really slap you on the wrist for doing so.
    - Smoosh 5y ago
      Forget the backups - the pen test team can just produce fake emails requesting they get the $$$.
    - benhurmarcel 5y ago
renewiltord 5y ago
Which organizations currently do this?

wizzwizz4 5y ago

Why not actual money? Amazon gift cards leak metadata to Amazon, and can only be used to buy stuff from Amazon.

jagged-chisel 5y ago
And they support Amazon.
- wizzwizz4 5y ago
  Oh, of course. Can't believe I forgot the biggest reason.
LinuxBender 5y ago
Good point. Cash bonus and maybe RSU's if they company is public.
jonas21 5y ago
It used to be that you could give employees gift cards up to a certain amount as awards and it would not be considered taxable income (but I believe that's no longer the case).
- jagged-chisel 5y ago
  Any gift(s) up to a total value of ... $13k? -ish? I don't know what the limit is now. Google's cafeteria is (was? depending on that limit...) an example of how to benefit employees without causing the employee additional tax.
  - mikeyouse 5y ago
    That's a different issue - IRS clamped down on gift cards and non-cash compensation that used to be considered de minimis. Now most employers gross up and report any gift card type gift over ~$5. https://www.irs.gov/government-entities/federal-state-local-governments/de-minimis-fringe-benefits https://www.irs.gov/government-entities/federal-state-local-...
  - dmoy 5y ago
    Setting aside the gift card bit (addressed in above comment), $13k sounds way too high. Like two orders of magnitude too high. From irs.gov > Whether an item or service is de minimis depends on all the facts and circumstances. In addition, if a benefit is too large to be considered de minimis, the entire value of the benefit is taxable to the employee, not just the excess over a designated de minimis amount. The IRS has ruled previously in a particular case that items with a value exceeding $100 could not be considered de minimis, even under unusual circumstances. Which about matches with what I've seen at BigCo. $40 box of tools as a gift? Did not show up on my paycheck. $150 electronic device as a gift? Showed up on my paycheck.
    - mikeyouse 5y ago
      There's another about other fringe benefits being taxed - with a prime example being tech cafeterias. https://taxnews.ey.com/news/2019-0493-employer-must-substantiate-necessity-of-employer-provided-meals-for-value-to-be-excluded-from-employee-income-irs-tam-emphasizes https://taxnews.ey.com/news/2019-0493-employer-must-substant... In the past few years, guidance has shifted toward accounting for employer-provided food with employee income as well.
      - dmoy 5y ago
        I don't think that's actually enforced yet though. I would bet the IRS wins that particular fight, but it'll take awhile.
bentcorner 5y ago
I think logistically its easier for a team within an org to spend "their" money on gift cards for intermittent activities and hand them out as necessary. Getting stuff onto the actual payroll is probably more complicated.
- edoceo 5y ago
  Hey Payroll, edoceo needs an off-cycle bonus of $$$. Your manager should be able to write a similar email.
  - Volundr 5y ago
    At least at the company I recently left, this kicks off an approval process within both the HR and accounting departments. Meanwhile an Amazon purchase (and thus an Amazon gift card) is something I could put on my card and expense, or approve someone else doing myself. I get it doesn't make sense, but that's corporate America for you. That said, be careful of the gift card route. Depending on the amount you can find yourself in the wrong side of the IRS that way.
    - gowld 5y ago
      I wouldn't want to embezzle funds and commit income/payroll tax fraud just to bypass paperwork
  - rad_gruchalski 5y ago
    It doesn’t work like that in every place in the world. Those gift cards also aren’t that easy. It’s all taxable benefit to the employee and a cost for the company to put on the books. That needs to be justified and tax office may really slap you on the wrist for doing so.
  - Smoosh 5y ago
    Forget the backups - the pen test team can just produce fake emails requesting they get the $$$.
  - benhurmarcel 5y ago

renewiltord 5y ago

Which organizations currently do this?