4 ms·

It can actually be comical just how _bad_ things can be at large orgs. Anyone have details, theories, or a book on how such inefficiencies come about? I can't

by robswc 4y ago

It can actually be comical just how _bad_ things can be at large orgs. Anyone have details, theories, or a book on how such inefficiencies come about? I can't speak to tech-oriented large orgs but I've worked with others and its just... I'm not shocked at all. I've seen public facing API keys in HTML, private SSH keys that do god knows what in plaintext on FTP servers... I just don't understand how they seem to care so much but in reality, care so little. Just lazy?

nomel 4y ago
In my experience, security is so far removed from the actual job description/day to day cares that it's perpetually "somebody else's problem", seen as an unnecessary time sink. Usually there's a couple of people that actually care, but they're ignored and lack the power to influence change. Not lazy, just overburdened by more important things.
- robswc 4y ago
  That seems to match what I've seen. Especially the last line. It's just so weird the dynamic between "pretending to care" and "actually caring." I've worked at or consulted on small teams that were very "lax" about security but everyone seemed to take it seriously so it "worked." At larger orgs, I notice they take it "seriously" but that results in people finding creative loopholes... like pasting in all the important production keys/passwords into a google doc and sharing the google doc because they "can't send secrets over slack" ... lol
0xbadcafebee 4y ago
You're the receptionist at a high-security facility. Lots of people work there. Your job is to make sure the people get in and out quickly. The building has multiple methods of access at different stages. During the course of doing your job, you don't follow the proper protocols a few times. You closed a door without re-entering a lock code. You didn't check someone's badge and ID at the third floor access gate. You forgot to make sure someone swiped out on exit. Nobody actually trained you on any of those protocols; they just made you watch a "security is everyone's responsibility" video and then expected you to know all the protocols. Maybe once or twice you were lazy, but it's equally likely you just didn't know what to do. And once you make that mistake, somebody can exploit it as long as you don't follow the protocol. In facilities where security is important, there are safeguards. Doors left open sound an alarm, automatically lock when closed, and sensors detect if more than one person walks through without badging in. These safeguards exist because people are fallible and need help to enforce security. Companies without security safeguards either don't care, or are ignorant.
useful 4y ago
every organization is held back by the slowest adopter. If you advance too quickly compared to your colleges then you will likely leave because everyone else feels like they are trying to pull you back into their crap. Innovation is a depreciating asset. If you don't reward the people who make a quantum leap, they will leave, and all their progress will revert to the mean. I bet someone made a security key because it was the right thing to do but they didn't have the controls in place to manage it in their build system and give another key to developers/engineers/etc. So someone else copied it for convivence rather than have to explain to every moron in the whole company how to use it to access the database or run their monolith tests or get access from the dude that no longer works there who was the "giver" of access keys.
prepend 4y ago
There’s a book by John Gall called the Systems Bible [0] that goes into how big systems form and fall apart. Mostly anecdotes and no real solution, but a decent read that isn’t full of the usual BS that’s required because usually only large systems can afford high speaker fees. [0] https://www.goodreads.com/book/show/583785.The_Systems_Bible https://www.goodreads.com/book/show/583785.The_Systems_Bible
eitally 4y ago
The reality is that most companies can't afford an IT budget it would require to implement, and then force adherence to, a standard set of best practices for much of anything. As another commenter said, though, this is not the case in regulated industries, in the parts of those companies dealing with regulated processes, controls and data access.
alfalfasprout 4y ago
Because the importance of security isn't respected until it's too late. At any medium to large company in your team's planning process you always need to justify the business or customer impact (even on infra teams). And security related efforts are much harder to sell because the impact is a "what if" and not $$ saved, products being easier/faster to develop, or customers benefiting in some way. Also basic security knowledge isn't screened for in hiring nor is it really taught in most orgs (aside from trainings that people skip or optional stuff).

by robswc 4y ago

nomel 4y ago

In my experience, security is so far removed from the actual job description/day to day cares that it's perpetually "somebody else's problem", seen as an unnecessary time sink. Usually there's a couple of people that actually care, but they're ignored and lack the power to influence change. Not lazy, just overburdened by more important things.

robswc 4y ago
That seems to match what I've seen. Especially the last line. It's just so weird the dynamic between "pretending to care" and "actually caring." I've worked at or consulted on small teams that were very "lax" about security but everyone seemed to take it seriously so it "worked." At larger orgs, I notice they take it "seriously" but that results in people finding creative loopholes... like pasting in all the important production keys/passwords into a google doc and sharing the google doc because they "can't send secrets over slack" ... lol

0xbadcafebee 4y ago

You're the receptionist at a high-security facility. Lots of people work there. Your job is to make sure the people get in and out quickly. The building has multiple methods of access at different stages. During the course of doing your job, you don't follow the proper protocols a few times. You closed a door without re-entering a lock code. You didn't check someone's badge and ID at the third floor access gate. You forgot to make sure someone swiped out on exit. Nobody actually trained you on any of those protocols; they just made you watch a "security is everyone's responsibility" video and then expected you to know all the protocols. Maybe once or twice you were lazy, but it's equally likely you just didn't know what to do. And once you make that mistake, somebody can exploit it as long as you don't follow the protocol. In facilities where security is important, there are safeguards. Doors left open sound an alarm, automatically lock when closed, and sensors detect if more than one person walks through without badging in. These safeguards exist because people are fallible and need help to enforce security. Companies without security safeguards either don't care, or are ignorant.

useful 4y ago

every organization is held back by the slowest adopter. If you advance too quickly compared to your colleges then you will likely leave because everyone else feels like they are trying to pull you back into their crap. Innovation is a depreciating asset. If you don't reward the people who make a quantum leap, they will leave, and all their progress will revert to the mean. I bet someone made a security key because it was the right thing to do but they didn't have the controls in place to manage it in their build system and give another key to developers/engineers/etc. So someone else copied it for convivence rather than have to explain to every moron in the whole company how to use it to access the database or run their monolith tests or get access from the dude that no longer works there who was the "giver" of access keys.

prepend 4y ago

There’s a book by John Gall called the Systems Bible [0] that goes into how big systems form and fall apart. Mostly anecdotes and no real solution, but a decent read that isn’t full of the usual BS that’s required because usually only large systems can afford high speaker fees. [0] https://www.goodreads.com/book/show/583785.The_Systems_Bible https://www.goodreads.com/book/show/583785.The_Systems_Bible

eitally 4y ago

The reality is that most companies can't afford an IT budget it would require to implement, and then force adherence to, a standard set of best practices for much of anything. As another commenter said, though, this is not the case in regulated industries, in the parts of those companies dealing with regulated processes, controls and data access.

alfalfasprout 4y ago

Because the importance of security isn't respected until it's too late. At any medium to large company in your team's planning process you always need to justify the business or customer impact (even on infra teams). And security related efforts are much harder to sell because the impact is a "what if" and not $$ saved, products being easier/faster to develop, or customers benefiting in some way. Also basic security knowledge isn't screened for in hiring nor is it really taught in most orgs (aside from trainings that people skip or optional stuff).