3 ms·

Only tangentially related but my wife used to work at a private institute research lab which was affiliated with a large university, and therefore used computin

by ssss11 3y ago

Only tangentially related but my wife used to work at a private institute research lab which was affiliated with a large university, and therefore used computing resources. The University IT security staff did a great job enabling 2FA across the entire network.. big job, well done. They didn’t do the slightest bit of requirements analysis of those people using the network such as affiliated research labs. One day my wife went to use the computer _in the PC3 lab_ and couldn’t without 2FA. Even logistically getting a computer in - that computer can then never leave the lab. PC3 labs don’t allow you to bring in a phone or anything really.. you’re double gowned, double gloved, goggles etc… hilarious. Took them about a week to explain themselves sufficiently for IT security to fix it.

Semaphor 3y ago
> PC3 Physical Containment Level 3 = Biosafety Level 3. I think. https://en.wikipedia.org/wiki/Biosafety_level#Biosafety_level_3 https://en.wikipedia.org/wiki/Biosafety_level#Biosafety_leve...
jalapenos 3y ago
Great case in point. In a well run org, that would've been elevated to a "security incident" just the same as a hack, with their jobs potentially on the line, rather than a week of pleading to them to have mercy.
- noahjk 3y ago
  a company may very well consider this a “security incident” or other high-priority issue, but at least in my experience, the method of reporting something like this can be vague. While the right answer should be a place to submit a ticket, even internal systems nowadays seem to not let the users set the priority on tickets and instead let L1s try to resolve everything, who may not have the experience to recognize something needs to be elevated. At that point, it seems the only good option is to run the issue up the chain and back down through the right department (which is probably more effective, at the end of the day).
  - ssss11 3y ago
    Yeah she was on the L1 helpdesk ticket merry-go-round for a couple of days before I told her what she needed to say to them to have a security team member look at it
- aiisjustanif 3y ago
  > with their jobs potentially on the line That would be a bit much and not accomplish improvements.

by ssss11 3y ago

Semaphor 3y ago

> PC3 Physical Containment Level 3 = Biosafety Level 3. I think. https://en.wikipedia.org/wiki/Biosafety_level#Biosafety_level_3 https://en.wikipedia.org/wiki/Biosafety_level#Biosafety_leve...

jalapenos 3y ago

Great case in point. In a well run org, that would've been elevated to a "security incident" just the same as a hack, with their jobs potentially on the line, rather than a week of pleading to them to have mercy.

noahjk 3y ago
a company may very well consider this a “security incident” or other high-priority issue, but at least in my experience, the method of reporting something like this can be vague. While the right answer should be a place to submit a ticket, even internal systems nowadays seem to not let the users set the priority on tickets and instead let L1s try to resolve everything, who may not have the experience to recognize something needs to be elevated. At that point, it seems the only good option is to run the issue up the chain and back down through the right department (which is probably more effective, at the end of the day).
- ssss11 3y ago
  Yeah she was on the L1 helpdesk ticket merry-go-round for a couple of days before I told her what she needed to say to them to have a security team member look at it
aiisjustanif 3y ago
> with their jobs potentially on the line That would be a bit much and not accomplish improvements.