4 ms·

Your comment raised some questions for me: * Just curious, how do you enforce against, for example, a Facebook group? Would you have to totally block Facebook?

• dogman144 5y ago
  To preface, “insider threat” is a bit of a harsh way to name the program this behavior falls under- it also covers “good” employees behaving in non-malicious but mistaken ways that will harm a company. Also, all work-related actions taking place off work devices gets covered under an AUP. So heading into this, Apple has both the program and policy to enforce a few different legal/HR actions against employees who’d go this route. With insider threat, the idea isn’t to force the behavior into concealed channels, but instead into “cleartext” channels where the data exfil, or I guess in this case subversive employee behavior, can be watched/snapshotted. Once that’s done, it goes over to HR/legal. So it’s not so much make it inconvenient to participate, but to make it easy to catch that participation is occurring, with some safeguards around what that participation is - chatter is ok, but have safeguard for Apple intellectual property landing in that activist slack. So with FB and Blind, a company has two ways to ID that’s occurring, take evidence,nand then over to HR /Legal it goes. If it occurs on work computers, one is device management tools like Forcepoint that allow an insider threat team to see your real time action. They see the employee going to this Slack/Blind, insider threat team starts taking artifacts, and that’s evidence. Other device mgmt tools aren’t as invasive, but achieve similar ends. All in all, regardless of the forum, the behavior can get caught, and it’s shipped to HR. If all of the activism occurs off work computers, I’d bet the behavior gets caught by two ways. One, 3rd party vendors who scan social media/GitHub for company branding existing outside of company channels (so on FB “Apple Activist Group” would fire). Two, and more likely, is the activists suck at OPSEC because Bob or Susan from marketing who join the group but computers are Google-machines to them talk about it on work devices or the water cooler/Slack. Gotta remember a place like Apple has insider threat programs dealing with industrial/corporate espionage. A bunch of pissed off activist employees trying to sneak around aren’t the same challenge. If Apple did have an employee activist group with ironclad OPSEC, Apple prob has big problems and those employees need to balance how important the cause is and why can’t they just talk about it to mgmt vs how that would look from the outside to a company/law enforcement.
  • wheelinsupial 5y ago
    Do these device management tools extend to personal cell phones that have corporate software installed on them? For example, using a token that’s generated on the phone to log in to the corporate VPN while working remotely from home, would this give a company the same device management access?
    • dogman144 5y ago
      It depends on what that corporate software is. Only a few of them skew towards real-time viewing of behavior. If what you’re referring to just generates a token that you then use to log onto a Vpn on a work device, that token generation is likely really limited in its access. The less like Google Auth, and the more like a custom solution the tool is, the more you have to think about device access you’re giving. I operate under the assumption any work business I do on any device is potentially logged extensively. The tools you want to be aware of installing on personal devices are “MDM” or similar, at a high level. Those get potentially large access.
      • wheelinsupial 5y ago
        Thanks for the response. I am not familiar with either Google Auth of MDM. The token is installed with a suite of Microsoft apps such as Outlook and Teams. I definitely assume work provided devices are logged and I've been told work provided cell phones are logged, but I don't know if that extends to personal devices. Of course best case would be to try and find out if there is a way to use an external token generator to keep work off a personal device.
        • dogman144 5y ago
          If you name the app, can prob give a guesstimate
          • wheelinsupial 5y ago
            It's called SecureAuth Authenticate. Thanks for your time!
• deleted 5y ago
  [deleted]