5 ms·
I work at a large company and against the opinion of many engineers and infosec folks, lastpass was picked as our preferred corporate password storage. I'm just
by bigmattystyles 4y ago
I work at a large company and against the opinion of many engineers and infosec folks, lastpass was picked as our preferred corporate password storage. I'm just waiting for a call from infosec asking me to log on and to rotate a bunch of creds. Happy Holidays.
- jiggawatts 4y agoOur new parent company -- that works in a security-sensitive industry -- rolled out LastPass over the last few months. I sent a warning letter to the CISO listing the previous hacks and vulnerabilities in LastPass. Then this new hack happened, and the CISO sent out a letter saying that there is nothing to be concerned about and that all is well. When the news broke that the breach was worse than predicted, I sent another letter to the CISO highlighting the concern. So far, I've had zero responses to any of my emails. Just radio silence. The cold shoulder treatment. Dogs barking in the distance. Etc... I'm starting to suspect that the CISO is getting some sort of kickback from LastPass, because he's doubling down with every breach on a bad decision. Has anyone else had any experience with LastPass offering outright bribes to senior staff to get sales? If I can point to a precedent, that would be helpful.
- jacksnipe 4y agoHe doesn’t need to be getting a kickback. He probably just wants to spin as hard as he can that his poor choice cost did not cost the company a bunch of money.
- fabian2k 4y agoI wouldn't suspect kickbacks immediately, simply trying to avoid blame for the initial decision seems motive enough.
- KMag 4y agoIt's human nature to repeatedly double-down on any strongly stated opinion until its defence becomes untenable. It takes repeated intentional practice to keep your ego in check.
- random_kris 4y agoYou are reading too much into it. Probably ciso is busy with other things and cannot respond to every's smartass wishes.
- daemoens 4y agoHow much of a smartass can you be when Lastpass keeps lying about how bad each of the numerous hacks actually were?
- kortilla 4y agoThere is absolutely no reason to suspect kickbacks when there is already a massive incentive to not be seen as responsible for a massive blunder and waste of company resources. The moment some exec pushes for some tech or process change, they become incentivized to ignore all problems and sell it as a success.
- fghorow 4y agoYeah. Kinda like deploying SAP. But this one bolted to another unsuspecting org when the shitshow that everybody was warning them about became reality. Feh.
- jacquesm 4y agoYou may want to reach to a higher level on this one.
- _the_inflator 4y agoI totally side with you. But what do you expect? That some senior manager admits he did a mistake? This will never happen. Too many times did I witness similar situations. The only thing possible would be something like "reevaluating the situation due to new informations" or an otherwise heroic element, that shows how important CISO is will change the situation. This must come from outside channels: "The prophet has no honor - or at least, little - in his own country" ;)
- neilv 4y ago> I'm starting to suspect that the CISO is getting some sort of kickback from LastPass, because he's doubling down with every breach on a bad decision. Corporate Occam's Razor says that either the CISO thinks that reverting the LastPass move right now would be a business mistake, or that ordinary big-company politics is a factor (in either doubling-down to protect from political fallout, or having to do things delicately behind the scenes). On corporate politics, your paper trail letters to the CISO could be awkward. You might've tried collegial verbal dialogue with them first. Corporate INFOSEC has a lot of nonsense, the CISO is often the predetermined fall-person when something inevitably goes wrong, and a paper trail that looks like the CISO made an oops despite being warned isn't a great situation for the CISO. Fortunately for the CISO, mess-ups by vendors like LastPass are commonplace in enterprise software, and people routinely go unscathed for much obviously worse corporate purchasing/deployment decisions. Bad decisions are almost the norm.
- mrjin 4y agoOh dear, what you were doing was just a little bit less than pointing at the CISO's nose and saying: "Look, you don't know what you are doing by choosing such a sh*tty product!" Of course, nothing going to happen. As any actions taken afterwards to mitigate the issues you highlighted can be and amlost for sure will be taken as evidence of failing to do his/her job. All office politics, nothing to do with facts.
- sys_64738 4y agoAt my previous employer I remember saying don't do it with LastPass as the credentials will get stolen. The so-called tech lead said, "I hear what you're saying but it's been decided." I wonder what he is thinking now when he hears about this. Probably nothing.