4 ms·

> The buck is supposed to stop at security, not at each employee's personal hygiene … if your game plan depends on the latter, it's game over. I have to take s

> The buck is supposed to stop at security, not at each employee's personal hygiene … if your game plan depends on the latter, it's game over. I have to take security trainings twice a year that literally talk about the buck stopping at my digital hygiene and I better not fuck it up for The Company. Companies have to understand breaches will happen, but preparing employees on how to spot attacks or understand when they've been breached is a huge component of their ability to repel or minimize attacks.

NoPicklez 4y ago
Right, but for your average user. If your machine is infected with a keylogger that results in a stolen password because of a vulnerability not timely identified and corrected. That's not on you as an employee, that's on the security team for not implementing compensating controls/defence in depth. Yes you have a responsibility to detect phishing emails, not writing down passwords, inserting USB's etc. But if something happens to you completely behind the scenes during your normal business, it's not on the employee.
- rightbyte 4y ago
  > Yes you have a responsibility to [...] not writing down passwords Most places force you to rotate the password so I would not say it is a responsibility to not write it down. I do it. It is like there is a fixed number of passwords per life you can remember or something.
  - geoelectric 4y ago
    I'm sure they meant something analog like on a sticky note rather than in a password manager, where it should be stored.
    - ed_elliott_asc 4y ago
      My bank still won’t let me paste a password so at least that bank doesn’t mean use a password manager!
      - faeyanpiraat 4y ago
        If you start dragging a password from 1Password, the window disappears and you can release your mouse over a field elsewhere, and it will get typed in there (instead of pasting). This may or may not work for your case.
  - deleted 4y ago
    [deleted]
  - skissane 4y ago
    Almost 20 years ago, I worked with this (not particularly competent) sysadmin. Policy said the root password had to be rotated once a month. So, in July 2003, they set the root password to blah0307 (where blah was some random word, which I forget now but knew at the time.) I wasn’t actually supposed to know the root password, but one of my colleagues let me in on the secret, including the repetitive pattern. I think the security auditor ticked the box “root password changed every 30 days”, but never asked what the password actually was. I know some places have rules like “must have at least N characters different from previous passwords”. However, depending on the exact rule, people can come up with easy-to-remember workarounds: e.g. the “blah” bit is ”foo” in even months and “bar” in odd ones.
  - eru 4y ago
    Even more so, I think writing down passwords on paper is actually pretty good security: An attacker can only hack the paper with physical access to my office. But if they have that, they might as well install an physical keylogger. You can also combine a written down fragment of the password with a remembered one.
    - mschuster91 4y ago
      > An attacker can only hack the paper with physical access to my office. ... and there are lots of unrelated people with physical access to your office. Cleaning staff, building maintenance, HVAC technicians, printer service staff... and all of these may not have the same level of background checks as your company has. And even if you hire all of these yourself (which makes sense at a certain scale), that still doesn't protect you against marketing inviting a camera crew and walking around everywhere in one of these typical "life at the office" short films for Linkedin. IT staff offices seem to be very popular for such films since they're usually the most personalized rooms with lots of nerd stuff on the walls and desks. Besides: swiping a photo of a post-it leaves no evidence, whereas installing a physical keylogger certainly does.
      - nicky0 4y ago
        Nobody said the piece of paper has to be a post-it on your monitor. It could in a folder in a locked cabinet.
        eru 4y ago
        Yes. What I had in mind when I wrote my comment, was to stick the piece of paper in your wallet. But your suggestion also works.
        saalweachter 4y ago
        Just write it in your class syllabus; no one will ever find it there.
  - NoPicklez 4y ago
    You missed the point of what I said, I was just using examples that are the responsibility of the employee.
- schainks 4y ago
  I agree with this assessment. I am also required to run security scanning software by corporate that inspects a lot of activity on my machine.
blibble 4y ago
> I have to take security trainings twice a year that literally talk about the buck stopping at my digital hygiene and I better not fuck it up for The Company. this is mostly so they can pin it on you when it inevitably happens (rather than the management)
davewritescode 4y ago
Security is basically layering imperfect solutions on top of each other until the statistical probability of breaching ALL of them gets small enough to satisfy the requirements of the organization. In the case of LastPass, they're holding data (which they shouldn't have been to be fair) that's INCREDIBLY attractive to everyone from script kiddies to nation state actors. When it comes to keeping out nation states the threat model can get kind of wild and difficult to engineer for while building what's ultimately a consumer facing product. However, in this particular case it's fairly obvious that bad IT policies lead to an issue and LastPass got burned. I would be more forging of LastPass but letting employees do BYOD means you have to trust everyone that ever uses that computer including spouses and children. It's just really dumb.
- schainks 4y ago
  LastPass’ lackadaisical attitude internally for defense in depth is indeed embarrassing.

NoPicklez 4y ago

Right, but for your average user. If your machine is infected with a keylogger that results in a stolen password because of a vulnerability not timely identified and corrected. That's not on you as an employee, that's on the security team for not implementing compensating controls/defence in depth. Yes you have a responsibility to detect phishing emails, not writing down passwords, inserting USB's etc. But if something happens to you completely behind the scenes during your normal business, it's not on the employee.

rightbyte 4y ago
> Yes you have a responsibility to [...] not writing down passwords Most places force you to rotate the password so I would not say it is a responsibility to not write it down. I do it. It is like there is a fixed number of passwords per life you can remember or something.
- geoelectric 4y ago
  I'm sure they meant something analog like on a sticky note rather than in a password manager, where it should be stored.
  - ed_elliott_asc 4y ago
    My bank still won’t let me paste a password so at least that bank doesn’t mean use a password manager!
    - faeyanpiraat 4y ago
      If you start dragging a password from 1Password, the window disappears and you can release your mouse over a field elsewhere, and it will get typed in there (instead of pasting). This may or may not work for your case.
- deleted 4y ago
  [deleted]
- skissane 4y ago
  Almost 20 years ago, I worked with this (not particularly competent) sysadmin. Policy said the root password had to be rotated once a month. So, in July 2003, they set the root password to blah0307 (where blah was some random word, which I forget now but knew at the time.) I wasn’t actually supposed to know the root password, but one of my colleagues let me in on the secret, including the repetitive pattern. I think the security auditor ticked the box “root password changed every 30 days”, but never asked what the password actually was. I know some places have rules like “must have at least N characters different from previous passwords”. However, depending on the exact rule, people can come up with easy-to-remember workarounds: e.g. the “blah” bit is ”foo” in even months and “bar” in odd ones.
- eru 4y ago
  Even more so, I think writing down passwords on paper is actually pretty good security: An attacker can only hack the paper with physical access to my office. But if they have that, they might as well install an physical keylogger. You can also combine a written down fragment of the password with a remembered one.
  - mschuster91 4y ago
    > An attacker can only hack the paper with physical access to my office. ... and there are lots of unrelated people with physical access to your office. Cleaning staff, building maintenance, HVAC technicians, printer service staff... and all of these may not have the same level of background checks as your company has. And even if you hire all of these yourself (which makes sense at a certain scale), that still doesn't protect you against marketing inviting a camera crew and walking around everywhere in one of these typical "life at the office" short films for Linkedin. IT staff offices seem to be very popular for such films since they're usually the most personalized rooms with lots of nerd stuff on the walls and desks. Besides: swiping a photo of a post-it leaves no evidence, whereas installing a physical keylogger certainly does.
    - nicky0 4y ago
      Nobody said the piece of paper has to be a post-it on your monitor. It could in a folder in a locked cabinet.
      - eru 4y ago
        Yes. What I had in mind when I wrote my comment, was to stick the piece of paper in your wallet. But your suggestion also works.
      - saalweachter 4y ago
        Just write it in your class syllabus; no one will ever find it there.
- NoPicklez 4y ago
  You missed the point of what I said, I was just using examples that are the responsibility of the employee.
schainks 4y ago
I agree with this assessment. I am also required to run security scanning software by corporate that inspects a lot of activity on my machine.

blibble 4y ago

> I have to take security trainings twice a year that literally talk about the buck stopping at my digital hygiene and I better not fuck it up for The Company. this is mostly so they can pin it on you when it inevitably happens (rather than the management)

davewritescode 4y ago

Security is basically layering imperfect solutions on top of each other until the statistical probability of breaching ALL of them gets small enough to satisfy the requirements of the organization. In the case of LastPass, they're holding data (which they shouldn't have been to be fair) that's INCREDIBLY attractive to everyone from script kiddies to nation state actors. When it comes to keeping out nation states the threat model can get kind of wild and difficult to engineer for while building what's ultimately a consumer facing product. However, in this particular case it's fairly obvious that bad IT policies lead to an issue and LastPass got burned. I would be more forging of LastPass but letting employees do BYOD means you have to trust everyone that ever uses that computer including spouses and children. It's just really dumb.

schainks 4y ago
LastPass’ lackadaisical attitude internally for defense in depth is indeed embarrassing.