4 ms·
> or write a cron job that resets a managed setting to a more palatable one every time the corporate security team enforces a value. You write as if those are
by tgma 2y ago
> or write a cron job that resets a managed setting to a more palatable one every time the corporate security team enforces a value.
You write as if those are things one should feel guilty for. I proudly admit that I have done such things.
In my experience, whenever this happens, whenever the user goes above and beyond to do such things, the security team should revisit their values rather than the other way around.
Never ever it happens. Feedback is given. Stupid policies remain. At best you get some acknowledgement that they also realize it is stupid but it is what it is. As the tone of your post shows, the security guy thinks they are bestowed a divine power to restrict without fully understanding the trade-offs. That puts the user in an adversarial position with the security team. Stallman's philosophy ultimately sides with the user.
- throw0101b 2y ago> In my experience, whenever this happens, whenever the user goes above and beyond to do such things, the security team should revisit their values rather than the other way around. It may not be the value of the security team, but the values that are part of a cyber-insurance policy, or regulatory regime, and thus outside of what the security team are able to change. Perhaps the user, at times, does not understand the larger context, and the risks that he is exposing the organization to.
- tgma 2y agoIf some security policy is only required for compliance and the security team agrees, the security team should do the bare minimum and look the other way smiling when the users circumvent that policy. Same with a good legal team.