5 ms·

> So... going back to the point: If expiring sessions is terrible UX (and it is) and it's not stopping attackers (and it's not), why are you doing it? Everytim

• marcosdumay 3y ago
  As the GP said, the attitude is cancer, and spreading is what it does. It really doesn't help that "security expert" is a job title. That means this person is expected to deal with security, not business objectives, and will be blamed for security incidents, not business goals satisfied. If the OP's attitude is cancer, this is what causes it, and it's completely toxic.
  • greedo 3y ago
    Exactly. Anyone working in a moderately large company (500+ employees) or in a regulated industry is familiar with this issue. Just as no politician wants to be seen as soft on crime, no CISO want's to be blamed for a security breach. So more and more security gets piled on to every process and application. MFA everywhere, even though you're required to use MFA for the VPN. SSO everywhere, because why not. Session expiration after an hour. VPN limited to 8 hour sessions (great for people who work long periods or who have long running processes and don't want to use tmux/screen etc. My team (20+ SREs/admins) spends roughly 40% of our time complying with either security requests, external audits, internal audits, internal queries from Risk/Security about servers etc. Figure the cost to our business of this (just from our team alone) is roughly $1M per annum. Add in the cost of all the "security" software, add another $2M per annum. Staffing of Risk/Security team is probably another $2M per annum. For all the other workers in IT (250 or so) probably another $3M. For non-IT workers, the added friction is easily 10% of their cost, so $15M. Add it up and you're around $25M. And it's not even the out of pocket costs, but the opportunity cost. Thank god I work in a business that has regulative moats that prevent real competition. Cancer is a perfect term for this IT culture.
    • konschubert 3y ago
      The reason why your business can "afford" this inefficiency is due to regulatory moats. Big companies are like governments, and when you remove outside market pressure, they become even more so.
      • greedo 3y ago
        The point I was trying to make about that is that most businesses don't have the financial resources to absorb the cost of "security" as it's being practiced now. Yet it's continually being foisted upon them as a necessity.
        • konschubert 3y ago
          Yea, we agree on this.
    • seanp2k2 3y ago
      “We can’t afford to not do it”
    • ndriscoll 3y ago
      What do you have against SSO everywhere? I see it as actually one of the things that makes obvious sense. It makes the user's life easier and improves security. It makes it easy to give a new employee access to a bunch of systems at once using RBAC. That and putting users' SSH public keys in LDAP and using that for auth everywhere instead of passwords are two obvious pure wins to me.
      • greedo 3y ago
        SSO is great in a monoculture environment, but falls down in heterogenous systems. We have Azure SSO, Ping Federate, and a couple of others we're getting rid of. I think it adds unnecessary complexity, and fails too often. Our internal users don't like it because the failure modes are opaque to them compared to a userid/password.
• mcdonje 3y ago
  Sometimes the answer is "so our sales team can tell people our security is better than our competitors."
  • horsawlarway 3y ago
    Hah, I worked for a software security company. This is literally the entire industry. Check these boxes to be compliant to make that enterprise sale. Is it actually more secure? Who cares, insurance will cover us now and the enterprise paid us.
    • seanp2k2 3y ago
      I still have PTSD from dealing with HIPAA and SOX stuff. Don’t run your own credit card processing if at all possible.
    • saynay 3y ago
      Same thing with selling software to the government. "Is the software secure" is far less important to those customers than "does it pass the scan".