4 ms·

I think there is a slight tension here between what you can ethically test and what an attacker is likely to do. I've worked for a company where armed forces s

• gpm 4y ago
  If your threat model includes "armed forces storming our office" it seems like you should just tell the people in that office that you're running a drill, and that they're to help out the red team to the same extent that a more cowardly version of them would if they were held at gunpoint.
  • steffan 4y ago
    > ...a more cowardly version of them... Outside of military / national security or if your agreement with your employer stipulates that you would give up your life before corporate secrets (and you are compensated accordingly) it's not reasonable to characterize cooperating at gunpoint as "cowardly"
    • gpm 4y ago
      I agree, I still think it's a reasonable word to include in the instructions though. What you don't want is them holding back how much they co-operate with the red team in the drill because they think that's how they would act, or they'd like others to think that's how they would act. Even if it is how they would act, you'd presumably like to know that your security measures would still work even if someone else was in their positions. But also, it's pretty obvious that no-one (or very very few people) know how they'd really act in that sort of situation. I thought (edit: And still think, but acknowledge that it is not yet a well thought out plan) putting that word in was a nice short form way of achieving that goal, though in a real drill you'd want to communicate a whole lot more about that than the 3 words I used. And probably also communicate that were this to happen in a non-drill form, that you don't expect them to resist. Incidentally, it's hard for me to imagine that there are many organizations outside of the military / national security that include armed invasion of their offices in their threat model, though I suppose some multinational corporations might.
      • imwillofficial 4y ago
        The idea of drilling an armed invasion to test security protocols of IT systems and access is absolutely insane. I’ve worked in the highest levels of NatSec and have never even heard of this. Either the story is exaggerated, or it’s in a country where shenanigans like this are allowed.
        • TeMPOraL 4y ago
          I can see the engineering appeal in this idea: testing beyond the expected operational envelope will tell you which parts of the process break first. As for applicability, every now and then you hear a disturbing story of some office being raided by the police / anti-corruption force - this is not unrealistic if you're e.g. a news agency in a country whose government doesn't always respect the freedom of press.
          • imwillofficial 4y ago
            But having actual armed with (fake or not guns for a drill?) Nah, too much could go wrong, security guard shoots them, somebody gets brave and jumps one of the “terrorists”, etc…
      • avgcorrection 4y ago
        Spending four paragraphs justifying how well a word communicates something when you could just replace it with the phrase “to simulate not brown-nosing (I would die for this job)”. Hail corporate.
        • gpm 4y ago
          You know the saying "I didn't have time to write a short letter, so I wrote a long one instead" (Mark Twain, maybe). Ya, that's what I did, your version is just better.
  • dementiapatent 4y ago
    This sounds like such a bad idea, what if one of your employees has a concealed carry permit and chooses to defend themselves?
    • PoignardAzur 4y ago
      I think GP meant "tell employees that there's going to be a drill with men carrying fake weapons, act as if you were too terrified to defend yourself".
      • gpm 4y ago
        Er, definitely no fake weapons either, that seems like a massive unneeded risk and stress factor. Tell them that there is a drill and they're supposed to work with the red team to the same extent that someone might if being coerced with guns. They're not actually on the red team since they aren't working as trusted team members, but they are also helping the red team/not working against them. It's more like they're part of the environment and their job is to help run the simulation. The adversary for the red team is the rest of the company that isn't being occupied, not the office that they did "occupy".
• avgcorrection 4y ago
  > where armed forces stormed one of the offices and made the workers perform certain actions at gunpoint. Either the workers weren’t supposed to have enough knowledge to perform those actions or they were expected to have suicide pills hidden in their mouths.