3 ms·
Exactly. Anyone working in a moderately large company (500+ employees) or in a regulated industry is familiar with this issue. Just as no politician wants to be
by greedo 3y ago
Exactly. Anyone working in a moderately large company (500+ employees) or in a regulated industry is familiar with this issue. Just as no politician wants to be seen as soft on crime, no CISO want's to be blamed for a security breach. So more and more security gets piled on to every process and application. MFA everywhere, even though you're required to use MFA for the VPN. SSO everywhere, because why not. Session expiration after an hour. VPN limited to 8 hour sessions (great for people who work long periods or who have long running processes and don't want to use tmux/screen etc.
My team (20+ SREs/admins) spends roughly 40% of our time complying with either security requests, external audits, internal audits, internal queries from Risk/Security about servers etc. Figure the cost to our business of this (just from our team alone) is roughly $1M per annum. Add in the cost of all the "security" software, add another $2M per annum. Staffing of Risk/Security team is probably another $2M per annum. For all the other workers in IT (250 or so) probably another $3M. For non-IT workers, the added friction is easily 10% of their cost, so $15M. Add it up and you're around $25M.
And it's not even the out of pocket costs, but the opportunity cost. Thank god I work in a business that has regulative moats that prevent real competition.
Cancer is a perfect term for this IT culture.
- konschubert 3y agoThe reason why your business can "afford" this inefficiency is due to regulatory moats. Big companies are like governments, and when you remove outside market pressure, they become even more so.
- greedo 3y agoThe point I was trying to make about that is that most businesses don't have the financial resources to absorb the cost of "security" as it's being practiced now. Yet it's continually being foisted upon them as a necessity.
- konschubert 3y agoYea, we agree on this.
- seanp2k2 3y ago“We can’t afford to not do it”
- ndriscoll 3y agoWhat do you have against SSO everywhere? I see it as actually one of the things that makes obvious sense. It makes the user's life easier and improves security. It makes it easy to give a new employee access to a bunch of systems at once using RBAC. That and putting users' SSH public keys in LDAP and using that for auth everywhere instead of passwords are two obvious pure wins to me.
- greedo 3y agoSSO is great in a monoculture environment, but falls down in heterogenous systems. We have Azure SSO, Ping Federate, and a couple of others we're getting rid of. I think it adds unnecessary complexity, and fails too often. Our internal users don't like it because the failure modes are opaque to them compared to a userid/password.