4 ms·

I was recently told by an old-timer at my current company that at one point security tried to remove Visual Studio from developers machines because it had repor

I was recently told by an old-timer at my current company that at one point security tried to remove Visual Studio from developers machines because it had reported security incidents. The problem with security people is that they think security is the most important thing.

denton-scratch 4y ago
Well, for them, it is and should be the most important thing. The problem bites when management shares that view.
happimess 4y ago
The most secure option is to bury everyone's computer in concrete.
unethical_ban 4y ago
The problem with devs is they think all security admins are reductionist. <3 A good security admin will work within the bounds of compliance to make the business work. And any good blocks will be apparent to the user. Trust me, security doesn't enjoy pissing people off, we just accept that it happens sometimes.
- P5fRxh5kUvp2th 4y ago
  last week a former co-worker called me laughing. He was on the phone with the CISO who was explaining it's impossible to give him access to SPLUNK because of the network segmentation. While he's ON THE PHONE, he received an email from the IT group with credentials to access splunk. And to be clear, I left specifically because of their security stance. I was once told they couldn't automate pulling data from production because of the same reason as mentioned above, the network segmentation wouldn't allow it. So no, developers aren't just whining because they can't directly access PAN. Security people always think their concerns should trump everything else. I would almost be willing to bet 70% of the mind-numbingly stupid decisions made across the industry had some security justification behind it. If human beings took the same approach to safety that Security people do to security, they'd insist the wheels on your vehicle should only be able to turn straight and right. That the vehicle should _actively_ prevent you from turning your wheels left because left turns are more dangerous than right turns and they can show that you can _always_ get to your destination with just right turns.
  - slt2021 4y ago
    Security people usually hate adhoc and one-off requests for random stuff from random people. If you are part of the required business process - then there is 100% established and approved way of doing things. For example for Splunk - CISO simply needs to be added to a AD group that is designated to have Splunk access, something like SOC-analysts group. For pulling data from prod - this is often discussed. Data in production should not be pulled in lower environments (dev and test), because of segmentation, but you can absolutely operate with Prod data within prod environment, like by using approved production datalake or data warehouse or something. Believe for every security decision that you think is stupid - there are many incidents that happened, and every rule and ban has happened because of these incodents/breaches/data corruption, etc. It is like workplace safety instructions, they were written because of workplace injury, same for traffic laws.
    - P5fRxh5kUvp2th 4y ago
      yeah, lets equate someone getting a limb ripped off with allowing developers to have local admin rights. That's everything that's wrong with the security mindset.
      - slt2021 4y ago
        Developers dont need local admin rights to develop software, plenty of devs at regulated industries work with user rights. And statistics of developers falling victim of phish attack, credentials stealing that leads to major breach - there are plenty. The most recent Uber hack or Okta hack - were all tied to developer clicking on stupid stuff, opening executables from Internet and getting his a$$ owned. You just gotta accept the fact that developers are not security specialists, most of them cant even create a software without introducing plenty of bugs and vulnerabilities. They mostly google stuff and copypaste from stackoverflow, install shady barely working packages and copypaste directly into production whatever code snippet they found on the first page of Google results. Thats why they need extra control from security specialists
        4y ago
deleted 4y ago
[deleted]

denton-scratch 4y ago

Well, for them, it is and should be the most important thing. The problem bites when management shares that view.

happimess 4y ago

The most secure option is to bury everyone's computer in concrete.

unethical_ban 4y ago

The problem with devs is they think all security admins are reductionist. <3 A good security admin will work within the bounds of compliance to make the business work. And any good blocks will be apparent to the user. Trust me, security doesn't enjoy pissing people off, we just accept that it happens sometimes.

P5fRxh5kUvp2th 4y ago
last week a former co-worker called me laughing. He was on the phone with the CISO who was explaining it's impossible to give him access to SPLUNK because of the network segmentation. While he's ON THE PHONE, he received an email from the IT group with credentials to access splunk. And to be clear, I left specifically because of their security stance. I was once told they couldn't automate pulling data from production because of the same reason as mentioned above, the network segmentation wouldn't allow it. So no, developers aren't just whining because they can't directly access PAN. Security people always think their concerns should trump everything else. I would almost be willing to bet 70% of the mind-numbingly stupid decisions made across the industry had some security justification behind it. If human beings took the same approach to safety that Security people do to security, they'd insist the wheels on your vehicle should only be able to turn straight and right. That the vehicle should _actively_ prevent you from turning your wheels left because left turns are more dangerous than right turns and they can show that you can _always_ get to your destination with just right turns.
- slt2021 4y ago
  Security people usually hate adhoc and one-off requests for random stuff from random people. If you are part of the required business process - then there is 100% established and approved way of doing things. For example for Splunk - CISO simply needs to be added to a AD group that is designated to have Splunk access, something like SOC-analysts group. For pulling data from prod - this is often discussed. Data in production should not be pulled in lower environments (dev and test), because of segmentation, but you can absolutely operate with Prod data within prod environment, like by using approved production datalake or data warehouse or something. Believe for every security decision that you think is stupid - there are many incidents that happened, and every rule and ban has happened because of these incodents/breaches/data corruption, etc. It is like workplace safety instructions, they were written because of workplace injury, same for traffic laws.
  - P5fRxh5kUvp2th 4y ago
    yeah, lets equate someone getting a limb ripped off with allowing developers to have local admin rights. That's everything that's wrong with the security mindset.
    - slt2021 4y ago
      Developers dont need local admin rights to develop software, plenty of devs at regulated industries work with user rights. And statistics of developers falling victim of phish attack, credentials stealing that leads to major breach - there are plenty. The most recent Uber hack or Okta hack - were all tied to developer clicking on stupid stuff, opening executables from Internet and getting his a$$ owned. You just gotta accept the fact that developers are not security specialists, most of them cant even create a software without introducing plenty of bugs and vulnerabilities. They mostly google stuff and copypaste from stackoverflow, install shady barely working packages and copypaste directly into production whatever code snippet they found on the first page of Google results. Thats why they need extra control from security specialists
      - 4y ago

deleted 4y ago

[deleted]