3 ms·

I believe it's a sarcastic comment to make the point that just because something should be secure, doesn't mean you can go in a fiddle with it. Ianal but I don

I believe it's a sarcastic comment to make the point that just because something should be secure, doesn't mean you can go in a fiddle with it. Ianal but I don't think it's a valid defense to walk in to a bank, find an unlocked safe and take all the money to make a 'point'. Further, you're just normalising messing with other people's accounts which doesn't seem to be a good thing from a security pov.

I_Am_Nous 3y ago
The reason I asked for the documentation is because even your bank example falls short - my coworkers and I are trained in and expected to follow SOC2 requirements. Taking the job in the first place means explicitly agreeing that you will follow the SOC2 requirements that we adopted because our customers said "we won't host data with you unless you are secure and audited." I can see an argument that I shouldn't be a "vigilante" about making sure people follow security practices they agreed to when taking the job, but we are all responsible for the security of the business. A repeat offender coworker who doesn't care about the security consequences of leaving their PC unlocked is a security risk which needs addressed. This isn't just a case of messing with a friend. Further, the PC is company property and subject to acceptable use policies. It's not "my computer" so I have no reasonable expectation that it is a sacred object other people won't mess with. Assuming others won't mess with your things is a terrible reason not to lock your door at night. Getting angry at a burglar for entering because you failed basic security misses the point of your failure. My repeat offender coworker got over his indignation that I touched his computer and then started doing what he was required to do the entire time and locked his computer every time he got up. I stopped touching his computer. He didn't get written up or fired for repeat security failures, and all was well.

I_Am_Nous 3y ago

The reason I asked for the documentation is because even your bank example falls short - my coworkers and I are trained in and expected to follow SOC2 requirements. Taking the job in the first place means explicitly agreeing that you will follow the SOC2 requirements that we adopted because our customers said "we won't host data with you unless you are secure and audited." I can see an argument that I shouldn't be a "vigilante" about making sure people follow security practices they agreed to when taking the job, but we are all responsible for the security of the business. A repeat offender coworker who doesn't care about the security consequences of leaving their PC unlocked is a security risk which needs addressed. This isn't just a case of messing with a friend. Further, the PC is company property and subject to acceptable use policies. It's not "my computer" so I have no reasonable expectation that it is a sacred object other people won't mess with. Assuming others won't mess with your things is a terrible reason not to lock your door at night. Getting angry at a burglar for entering because you failed basic security misses the point of your failure. My repeat offender coworker got over his indignation that I touched his computer and then started doing what he was required to do the entire time and locked his computer every time he got up. I stopped touching his computer. He didn't get written up or fired for repeat security failures, and all was well.