3 ms·

God this makes me appreciate working in the only section of a company that allows unmanaged devices and allows users to image their machines with whatever they

God this makes me appreciate working in the only section of a company that allows unmanaged devices and allows users to image their machines with whatever they see fit. I can't imagine the paranoia I'd feel with having spyware on my machine constantly calling home.

ianlevesque 4y ago
What why? That’s the typical configuration for very large corporations. Coping steps: 1. Do not use your work computer for personal data. 2. There is no step 2.
- MSFT_Edging 4y ago
  Its less about personal information and more that I'm never comfortable with constant observation, regardless of what I'm doing. I could be buying a bagel and feel uncomfortable with a camera or police officer. Additionally, my work requires the ability to pivot quick with software and requires root access, hardware control, etc. I've regularly worked with coworkers in other areas of the company who spend a week setting up a workaround to the managed machine. My colleagues and I all run personalized linux configurations and a typical managed machine would greatly hamper that. The company is large enough that the IT dept would not have time to manage all our exceptions so they just let us be.
acdha 4y ago
It helps to look at it from the other direction as well: if you install the wrong NPM/PyPI package and something exfiltrates your corporate credentials, data, etc. how are you going to look if the managed device configuration would have stopped it? It's a change in how we think about computing but the old styles are not very secure and attackers have considerable experience exploiting those all or nothing security models. Having something which monitors unknown binaries being launched is the right choice for most people, and even developers really need some careful sandboxing (e.g. unless a new binary is in ~/Projects it's probably malware). The other thing to consider: why should you care about what you work on being monitored? The most obvious reason is using work equipment for personal things, which is just a bad idea for a number of reasons starting with liability and data loss (e.g. if you get laid off, does anything get lost when your now-former employer does a remote wipe?). The other reason is if you don't have a good relationship with the security people, which is a social problem which needs to be addressed at a higher level since it'll show up in other areas, too. Rather than looking like you're being difficult or non-compliant, it's probably better to try to figure out what rules make sense - e.g. having some relationship with the endpoint monitoring people to get policy updates on a non-geologic time scale, having an official policy for who in IT security has access to data and how that's logged, etc. It's good to get that kind of thing nailed down before, say, the company gets hit with a lawsuit because one of the ITSec analysts thought it was okay to stalk that hot intern & spy on their personal web activity.
- account42 4y ago
  You can justify arbitrary security theater by only looking at the worst case scenario. Do you justify constant GPSs surveilance because your work keys/cards might get stolen if you visit a bad neighbourhood? I hope not. It's always a tradeoff of security vs. actually being able to do your job. Sure, a breach will cost a company but if you only have access to (mostly worthless) company "secrets" and no customer data then you really need to consider the likelyhood of having your data/credentials stolen, the cost that would have as well as the cost of the proposed security measures to your daily operation.
  - acdha 4y ago
    Something isn't security theater because you don't personally have the same threat model or exposure. Attackers can easily avoid traditional antivirus software so people with more aggressive security postures have switched to investigating or blocking any unknown executable following pretty standard advice in the field that it's not sustainable to try to enumerate all of the bad things in the world. Someone running random JavaScript out of a downloaded ZIP file matches the signature of a lot of attacks, and almost no legitimate activity: that's a super common technique to use something built-in like JScript rather than their own binary which might be blocked, and even web developers never do that intentionally since their code is running in a browser or something else like Node. > Sure, a breach will cost a company but if you only have access to (mostly worthless) company "secrets" and no customer data then you really need to consider the likelyhood of having your data/credentials stolen, the cost that would have as well as the cost of the proposed security measures to your daily operation. Some other costs to think about: 1. If you have any sort of cloud credential on your system, how quickly can you spend money before someone revokes it? 2. Can your system be used to attack any internal infrastructure? Deploy something in the cloud for further attacks? 3. Can your system be used to phish other people at your company by, say, sending realistic messages? What about customers? Now, it's true that you have to consider the impact on daily work but in this case it's pretty low unless your job actually is to run random downloads and at any organization over a certain size the majority of times that alert trips it's probably going to be something where the cost of the malware which people routinely try to run would be non-trivial, too, even if you just measured it in the time it takes to investigate and cleanup.

ianlevesque 4y ago

What why? That’s the typical configuration for very large corporations. Coping steps: 1. Do not use your work computer for personal data. 2. There is no step 2.

MSFT_Edging 4y ago
Its less about personal information and more that I'm never comfortable with constant observation, regardless of what I'm doing. I could be buying a bagel and feel uncomfortable with a camera or police officer. Additionally, my work requires the ability to pivot quick with software and requires root access, hardware control, etc. I've regularly worked with coworkers in other areas of the company who spend a week setting up a workaround to the managed machine. My colleagues and I all run personalized linux configurations and a typical managed machine would greatly hamper that. The company is large enough that the IT dept would not have time to manage all our exceptions so they just let us be.

acdha 4y ago

It helps to look at it from the other direction as well: if you install the wrong NPM/PyPI package and something exfiltrates your corporate credentials, data, etc. how are you going to look if the managed device configuration would have stopped it? It's a change in how we think about computing but the old styles are not very secure and attackers have considerable experience exploiting those all or nothing security models. Having something which monitors unknown binaries being launched is the right choice for most people, and even developers really need some careful sandboxing (e.g. unless a new binary is in ~/Projects it's probably malware). The other thing to consider: why should you care about what you work on being monitored? The most obvious reason is using work equipment for personal things, which is just a bad idea for a number of reasons starting with liability and data loss (e.g. if you get laid off, does anything get lost when your now-former employer does a remote wipe?). The other reason is if you don't have a good relationship with the security people, which is a social problem which needs to be addressed at a higher level since it'll show up in other areas, too. Rather than looking like you're being difficult or non-compliant, it's probably better to try to figure out what rules make sense - e.g. having some relationship with the endpoint monitoring people to get policy updates on a non-geologic time scale, having an official policy for who in IT security has access to data and how that's logged, etc. It's good to get that kind of thing nailed down before, say, the company gets hit with a lawsuit because one of the ITSec analysts thought it was okay to stalk that hot intern & spy on their personal web activity.

account42 4y ago
You can justify arbitrary security theater by only looking at the worst case scenario. Do you justify constant GPSs surveilance because your work keys/cards might get stolen if you visit a bad neighbourhood? I hope not. It's always a tradeoff of security vs. actually being able to do your job. Sure, a breach will cost a company but if you only have access to (mostly worthless) company "secrets" and no customer data then you really need to consider the likelyhood of having your data/credentials stolen, the cost that would have as well as the cost of the proposed security measures to your daily operation.
- acdha 4y ago
  Something isn't security theater because you don't personally have the same threat model or exposure. Attackers can easily avoid traditional antivirus software so people with more aggressive security postures have switched to investigating or blocking any unknown executable following pretty standard advice in the field that it's not sustainable to try to enumerate all of the bad things in the world. Someone running random JavaScript out of a downloaded ZIP file matches the signature of a lot of attacks, and almost no legitimate activity: that's a super common technique to use something built-in like JScript rather than their own binary which might be blocked, and even web developers never do that intentionally since their code is running in a browser or something else like Node. > Sure, a breach will cost a company but if you only have access to (mostly worthless) company "secrets" and no customer data then you really need to consider the likelyhood of having your data/credentials stolen, the cost that would have as well as the cost of the proposed security measures to your daily operation. Some other costs to think about: 1. If you have any sort of cloud credential on your system, how quickly can you spend money before someone revokes it? 2. Can your system be used to attack any internal infrastructure? Deploy something in the cloud for further attacks? 3. Can your system be used to phish other people at your company by, say, sending realistic messages? What about customers? Now, it's true that you have to consider the impact on daily work but in this case it's pretty low unless your job actually is to run random downloads and at any organization over a certain size the majority of times that alert trips it's probably going to be something where the cost of the malware which people routinely try to run would be non-trivial, too, even if you just measured it in the time it takes to investigate and cleanup.