5 ms·

Caring about corporate cyber security is work that is unrewarded. What’s the benefit to me the employee of caring about it? I use a password that is found in l

Caring about corporate cyber security is work that is unrewarded. What’s the benefit to me the employee of caring about it? I use a password that is found in leaks at my jobs.

Nextgrid 4y ago
I’m not sure why this is downvoted - this is true (not saying this is right or wrong, just that from a selfish point of view it makes total sense). There is no reason to care. Your company won’t pay you extra to complicate your life with security practices so it’s rational to do the bare minimum when there’s no downside. From a typical office drone’s perspective, they’re already not paid enough, so why put any more effort or good faith than strictly necessary? Not to mention, why is password management still a thing? On a corporate machine, the only place that should require a password is the system-provided login screen. Everything else should transparently inherit this authentication. The tech is absolutely there (and you can set up Keycloak/etc to seamlessly proxy between that and SAML for external services) so there’s absolutely no excuse for it. With machine authentication, even obtaining the password shouldn’t allow any remote attacker in because they lack the machine keys (in AD, this can be done with smart cards - the “machine auth” is actually the smart card, and the password its PIN). This is an area where the industry has actively regressed from the early days, but I guess Okta/etc shareholders need to eat too, despite significantly reducing security by training users to enter their password regularly in a browser after a chain of multiple redirects.
- ruskyhacker 4y ago
  There's more to cs than passwords mate. Your view is ultra narrow minded, and shockingly selfish. Sure they don't pay you to "put up with security" but they also don't need to pay you at all What do you do for a living?
  - version_five 4y ago
    > shockingly selfish The poster you replied to is being realistic. Calling names doesn't change human nature. People in charge of security can work to build something that gets used properly, or they can nag and at best get people to go through the motions the absolutely have to. The latter options is what leads to findings like in the article
  - throwawaysleep 4y ago
    I work for selfish reasons.
  - Nextgrid 4y ago
    I'm not saying my view is the way things should be. However when it comes to security, you always need to assume the worst and plan accordingly. I'd rather assume the worst and be pleasantly surprised than the other way around.

Caring about corporate cyber security is work that is unrewarded. What’s the benefit to me the employee of caring about it? I use a password that is found in leaks at my jobs.

Nextgrid 4y ago

I’m not sure why this is downvoted - this is true (not saying this is right or wrong, just that from a selfish point of view it makes total sense). There is no reason to care. Your company won’t pay you extra to complicate your life with security practices so it’s rational to do the bare minimum when there’s no downside. From a typical office drone’s perspective, they’re already not paid enough, so why put any more effort or good faith than strictly necessary? Not to mention, why is password management still a thing? On a corporate machine, the only place that should require a password is the system-provided login screen. Everything else should transparently inherit this authentication. The tech is absolutely there (and you can set up Keycloak/etc to seamlessly proxy between that and SAML for external services) so there’s absolutely no excuse for it. With machine authentication, even obtaining the password shouldn’t allow any remote attacker in because they lack the machine keys (in AD, this can be done with smart cards - the “machine auth” is actually the smart card, and the password its PIN). This is an area where the industry has actively regressed from the early days, but I guess Okta/etc shareholders need to eat too, despite significantly reducing security by training users to enter their password regularly in a browser after a chain of multiple redirects.

ruskyhacker 4y ago
There's more to cs than passwords mate. Your view is ultra narrow minded, and shockingly selfish. Sure they don't pay you to "put up with security" but they also don't need to pay you at all What do you do for a living?
- version_five 4y ago
  > shockingly selfish The poster you replied to is being realistic. Calling names doesn't change human nature. People in charge of security can work to build something that gets used properly, or they can nag and at best get people to go through the motions the absolutely have to. The latter options is what leads to findings like in the article
- throwawaysleep 4y ago
  I work for selfish reasons.
- Nextgrid 4y ago
  I'm not saying my view is the way things should be. However when it comes to security, you always need to assume the worst and plan accordingly. I'd rather assume the worst and be pleasantly surprised than the other way around.