4 ms·

Yep. 0. Get your SSO + Webauthn 2FA everywhere. (Don't use Okta or Auth0! Do it yourself!) 1. Have service accounts that are owned by teams. (Every team shoul

Yep. 0. Get your SSO + Webauthn 2FA everywhere. (Don't use Okta or Auth0! Do it yourself!) 1. Have service accounts that are owned by teams. (Every team should have an "email" or group chat address, and use that as an identifier everywhere for who owns what.) 2. Have a proxy middleware that requires current good telemetry from regular client security checks. (Deploy some sort of firehouse structured data streaming service, say fluentbit on the managed hosts.) 3. Centralized intranet web platform that's effectively Istio pointing to micro-fullstack-ends. With a globally-routable, VPN-less domain. ("VPNs: Booo!" But if you need one, use managed Wireguard, not some ancient Cisco box no one wants to touch.) 4. Have an internal wiki. 5. Have a (de-)centralized search engine. 6. Roll machine & user (intranet & WiFi) certificates every week or 2. (Lock machines if they haven't checked in in 4 weeks.) 7. In offices, deploy 802.11x and POE+ every-frickn-where. 8. Don't do BYOD or personal apps on corp. Legal and support disaster areas. 9. Deploy Yubikey. 10. Get a password manager. Keeper scales well. 11. Throw away Zoom, iMessage, Telegram, and WhatsApp immediately. Use Session or Signal. (Solving mandatory min/max retention limits is an exercise for the reader.) 12. Disallow many cloud features clearly. 13. Have a 3rd-party approval process to run it by your legal, privacy, and client teams. 14. Retain the ability to remote insta-lockout and remote wipe machines. (And record any exceptions to legal holds.)

phrotoma 3y ago
I have an intuitive sense of each of these except 2, could you elaborate?
mschuster91 3y ago
> 0. Get your SSO + Webauthn 2FA everywhere. (Don't use Okta or Auth0! Do it yourself!) Maintaining that crap is a full-time job in itself and very hard to get right.
- tecleandor 3y ago
  I guess that, unless you have a small number of users, you could buy a whole authentication company for the price of your OKTA licenses...
  - mschuster91 3y ago
    The thing is, if you only have a small number of users, it's just not worth the effort to set up Keycloak or its alternatives. If you're large enough, then the effort of setting it up is smaller, but if it (inevitably) gets hacked, it's your head that's gonna roll and your company that has to pay out GDPR or whatever fines - with Okta, Auth0 or whatever it's them.
- 1letterunixname 3y ago
  It's not hard if your feature set is limited and you have proper testing. I maintain PKI and Yubikey-val at home. It's not rocket science and it's job security for those special folks who enjoy it. :)
ocdtrekkie 3y ago
There are some huge landmines of bad advice in here and I don't really understand why. Why do you want teams in an organization to use a chat app whose primary use (apparently) is to hide identity and allow easy transmission of CSAM with no accountability? In a business environment something like Session is a huge liability, not an asset. While you may want to keep internal communications private, it is still important for those communications to be attributable and loggable. Otherwise a lot of this is generally good, 802.1x, disabling cloud features, not BYOD, etc.
hparadiz 3y ago
Reading this list makes me dread working for orgs that are this locked down and frankly annoying.
- 1letterunixname 3y ago
  Legal requirements are there for N jurisdictions; it's just few companies implement compliance with them, and too often shift the critical thinking about their implementation to an unreliable or expensive third-party.
theamk 3y ago
Don't use Signal (or WhatApp or iMessage or Telegram) for your work stuff, unless your work is giving you a dedicated work phone. Your phone number is personal, but your work chats should be based on your work identity. You should be able to log out of corporate messenger, mute it, or skip installing it on your personal device altogether. If a workplace requires my personal number and expects it as a primary communication method it's a huge red flag to me.

phrotoma 3y ago

I have an intuitive sense of each of these except 2, could you elaborate?

mschuster91 3y ago

> 0. Get your SSO + Webauthn 2FA everywhere. (Don't use Okta or Auth0! Do it yourself!) Maintaining that crap is a full-time job in itself and very hard to get right.

tecleandor 3y ago
I guess that, unless you have a small number of users, you could buy a whole authentication company for the price of your OKTA licenses...
- mschuster91 3y ago
  The thing is, if you only have a small number of users, it's just not worth the effort to set up Keycloak or its alternatives. If you're large enough, then the effort of setting it up is smaller, but if it (inevitably) gets hacked, it's your head that's gonna roll and your company that has to pay out GDPR or whatever fines - with Okta, Auth0 or whatever it's them.
1letterunixname 3y ago
It's not hard if your feature set is limited and you have proper testing. I maintain PKI and Yubikey-val at home. It's not rocket science and it's job security for those special folks who enjoy it. :)

ocdtrekkie 3y ago

There are some huge landmines of bad advice in here and I don't really understand why. Why do you want teams in an organization to use a chat app whose primary use (apparently) is to hide identity and allow easy transmission of CSAM with no accountability? In a business environment something like Session is a huge liability, not an asset. While you may want to keep internal communications private, it is still important for those communications to be attributable and loggable. Otherwise a lot of this is generally good, 802.1x, disabling cloud features, not BYOD, etc.

hparadiz 3y ago

Reading this list makes me dread working for orgs that are this locked down and frankly annoying.

1letterunixname 3y ago
Legal requirements are there for N jurisdictions; it's just few companies implement compliance with them, and too often shift the critical thinking about their implementation to an unreliable or expensive third-party.

theamk 3y ago

Don't use Signal (or WhatApp or iMessage or Telegram) for your work stuff, unless your work is giving you a dedicated work phone. Your phone number is personal, but your work chats should be based on your work identity. You should be able to log out of corporate messenger, mute it, or skip installing it on your personal device altogether. If a workplace requires my personal number and expects it as a primary communication method it's a huge red flag to me.