5 ms·

I dunno, in about 2/3 of our clients the security team could be summed up as ivory tower that throws decrees and enforces half-useless constraints. Like, we HA

by xani_ 4y ago

I dunno, in about 2/3 of our clients the security team could be summed up as ivory tower that throws decrees and enforces half-useless constraints. Like, we HAD TO change our passwords every 30 days.... but our default modus operandi was not having password auth in first place + hardware tokens for authentication, which made whole password thing totally irrelevant, but no, security, change your password you don't use every 30 days.

adrr 4y ago
What’s was your second factor if you didn’t use passwords? Webauth is relatively new and I have yet to see any company use it.
- kccqzy 4y ago
  Webauthn is well supported by the top websites. Even if they didn't support Webauthn, security keys were supported long before Webauthn.
coredog64 4y ago
At my last employer, the security guy’s gig was “run Qualys”. He didn’t help us filter anything, he didn’t provide context, he didn’t provide guidance on how to correct or implement a compensating control. There was a business need to run Qualys, and so he was the human crontab. The rest of the time he spent vaping and complaining about compensation.
- 9wzYQbTYsAIc 4y ago
  The next iteration of that terrible idea is to have a security contractor do that role and report to someone else who decides whether to read the report or not. DevSec is next, right?
  - deleted 4y ago
    [deleted]
- peteradio 4y ago
  > human crontab That's good. Scrum manager as a crontab: Every week, scheduled per developer 1/2 hour: "[90%: How's your progress? Any blockers? I don't have any updates on any blockers you may or may not have previously mentioned. Your dog is good? You have a dog right? I thought so. See you., 10%: The [CEO;CTO;COO] is pissed. The velocity is not on target. I'm not saying this to anyone in particular but I am saying this to all of you. There's going to be a retrospective and I'm not sure what we are going to say. Look I got another meeting. See you.]" Every Tuesday & Thursday: "[90%: Look I don't have much, you guys know what your working on I'm not gonna waste your time; 10%: The [CEO;CTO;COO] is pissed. The velocity is not on target. I'm not saying this to anyone in particular but I am saying this to all of you. There's going to be a retrospective and I'm not sure what we are going to say. Look I got another meeting, feel free to stay on if ya'll have anything to talk about.] Every other week, meeting scheduled with all developers: "The [CEO;CTO;COO] is pissed. The velocity is not on target. I'm not saying this to anyone in particular but I am saying this to all of you. There's going to be a retrospective and I'm not sure what we are going to say. Look I got another meeting, feel free to stay on if ya'll have anything to talk about."
- talideon 4y ago
  Qualys is one of the most useless pieces of software I've ever come across. It purely exists for ass-covering and box-ticking purposes, and requires so much access to run its scans (it runs random things as root and ssh's into your whole fleet) that it's one compromise away from taking down a significant chunk of the tech industry. It's one massive backdoor into everything. And on top of that, if you use a cloud provider, the data you get back is next to useless because it still thinks hostnames/IPs are a remotely useful way to identify stuff, which they aren't. It looks like they might finally be providing some remotely useful identifying metadata, like instance tags, but only after years of begging for it.
tails4e 4y ago
Another example, files we upload to the corporate one drive would be auto scanned for export compliance after upload, sometimes triggering a security person to come down hard on you for making a mistake. After being hit with it once I asked if I could run that scanning tool before I upload, and was told no. I was pretty surprised they preferred to catch mistakes than prevent them. Wouldn't prevention be better than cure?
- peteradio 4y ago
  > prevention be better than cure Not really. If you wanted to find a way to exfiltrate it would be in your favor to have the tool client side that you were trying to bypass.
- spydum 4y ago
  If there are no incidents to respond to, we have to cut the secops team. Ohhhhhh.
- ethbr0 4y ago
  My favorite was IT at a health insurance company enabling OneDrive on user desktop / personal folders without notice, then yelling at users that sensitive files were being "uploaded" to OneDrive instead of kept local.

by xani_ 4y ago

adrr 4y ago

What’s was your second factor if you didn’t use passwords? Webauth is relatively new and I have yet to see any company use it.

kccqzy 4y ago
Webauthn is well supported by the top websites. Even if they didn't support Webauthn, security keys were supported long before Webauthn.

coredog64 4y ago

At my last employer, the security guy’s gig was “run Qualys”. He didn’t help us filter anything, he didn’t provide context, he didn’t provide guidance on how to correct or implement a compensating control. There was a business need to run Qualys, and so he was the human crontab. The rest of the time he spent vaping and complaining about compensation.

9wzYQbTYsAIc 4y ago
The next iteration of that terrible idea is to have a security contractor do that role and report to someone else who decides whether to read the report or not. DevSec is next, right?
- deleted 4y ago
  [deleted]
peteradio 4y ago
> human crontab That's good. Scrum manager as a crontab: Every week, scheduled per developer 1/2 hour: "[90%: How's your progress? Any blockers? I don't have any updates on any blockers you may or may not have previously mentioned. Your dog is good? You have a dog right? I thought so. See you., 10%: The [CEO;CTO;COO] is pissed. The velocity is not on target. I'm not saying this to anyone in particular but I am saying this to all of you. There's going to be a retrospective and I'm not sure what we are going to say. Look I got another meeting. See you.]" Every Tuesday & Thursday: "[90%: Look I don't have much, you guys know what your working on I'm not gonna waste your time; 10%: The [CEO;CTO;COO] is pissed. The velocity is not on target. I'm not saying this to anyone in particular but I am saying this to all of you. There's going to be a retrospective and I'm not sure what we are going to say. Look I got another meeting, feel free to stay on if ya'll have anything to talk about.] Every other week, meeting scheduled with all developers: "The [CEO;CTO;COO] is pissed. The velocity is not on target. I'm not saying this to anyone in particular but I am saying this to all of you. There's going to be a retrospective and I'm not sure what we are going to say. Look I got another meeting, feel free to stay on if ya'll have anything to talk about."
talideon 4y ago
Qualys is one of the most useless pieces of software I've ever come across. It purely exists for ass-covering and box-ticking purposes, and requires so much access to run its scans (it runs random things as root and ssh's into your whole fleet) that it's one compromise away from taking down a significant chunk of the tech industry. It's one massive backdoor into everything. And on top of that, if you use a cloud provider, the data you get back is next to useless because it still thinks hostnames/IPs are a remotely useful way to identify stuff, which they aren't. It looks like they might finally be providing some remotely useful identifying metadata, like instance tags, but only after years of begging for it.

tails4e 4y ago

Another example, files we upload to the corporate one drive would be auto scanned for export compliance after upload, sometimes triggering a security person to come down hard on you for making a mistake. After being hit with it once I asked if I could run that scanning tool before I upload, and was told no. I was pretty surprised they preferred to catch mistakes than prevent them. Wouldn't prevention be better than cure?

peteradio 4y ago
> prevention be better than cure Not really. If you wanted to find a way to exfiltrate it would be in your favor to have the tool client side that you were trying to bypass.
spydum 4y ago
If there are no incidents to respond to, we have to cut the secops team. Ohhhhhh.
ethbr0 4y ago
My favorite was IT at a health insurance company enabling OneDrive on user desktop / personal folders without notice, then yelling at users that sensitive files were being "uploaded" to OneDrive instead of kept local.