5 ms·
At my previous gig I observed a few worrying things that were not fixed with security training: - People still stored passwords on Slack channels, emails, Conf
by mkl95 4y ago
At my previous gig I observed a few worrying things that were not fixed with security training:
- People still stored passwords on Slack channels, emails, Confluence, etc.
- People still used simple passwords such as "password".
- Literally nobody who wasn't already using a password manager started to use one.
In my opinion SSO, 2FA, etc. are absolutely needed at many places where people can't be trusted with following basic advice and training.
- powerslacker 4y agoSSO/2FA should be required. It's less burdensome on the end users than expecting training to fix their bad behavior.
- ironmagma 4y agoIf that’s true, why even bother with the training?
- powerslacker 4y agoI wouldn't.
- coredog64 4y agoCounterpoint: Poorly configured SSO devolves to “sign-on every single time”, which will then put you back in that same situation.
- hnlmorg 4y agoIt doesn’t put you in the same situation. You’re still more secure than the former situation while also being unnecessarily more annoying to your users. Plus I don’t think anyone on here is recommending infrastructure should be poorly configured. ;)
- ShakataGaNai 4y ago100% true. Poorly configured anything puts you into a terrible situation. If you setup a firewall and do a DENY ALL or ALLOW ALL blindly, you're going to have a bad time. But IN GENERAL, properly configured SSO (heck, the defaults for most of the SSO providers) makes for a better user experience while increasing security.
- jrochkind1 4y ago> Literally nobody who wasn't already using a password manager started to use one I assume you offered one that was easy to use and supported and any cost paid for by the employer?
- cj 4y agoWe offer Dashlane (fully paid). Adoption doesn't occur organically, without badgering folks.
- aliswe 4y agoSounds like you needed a change management officer or compliance responsible, or similar. They would know how to get people to see the benefits of security and keeping to process (without being pushy)