4 ms·

I disagree with the concept of surveillance altogether. Computer users should be educated about security, given control of their devices, and trusted that they

by imiric 2y ago

I disagree with the concept of surveillance altogether. Computer users should be educated about security, given control of their devices, and trusted that they will do the right thing. If a company can't do that, that's a sign that they don't have good security practices to begin with, and don't do a good job at hiring and training. The only reason this kind of software is used is so that companies can tick a certification checkbox that gives the appearance of running a tight ship. I realize it's the easy way out, and possibly the only practical solution for a large corporation, but then this type of issues is unavoidable. Whether the product is free or proprietary makes no difference.

sooper 2y ago
Most people do not understand, or care to understand, what "security" means. You highlight training as a control. Training is expensive - to reduce cost and enhanced effectiveness, how do you focus training on those that need it without any method to identify those that do things in insecure ways? Additionally, I would say a major function of these systems is not surveillance at all - it is preventive controls to prevent compromise of your systems. Overall, your comment strikes me a naive and not based on operational experience.
- TeMPOraL 2y ago
  This type of software is notorious for severely degrading employees' ability to do their jobs, occasionally preventing it entirely. It's a main reason why "shadow IT" is a thing - bullshit IT restrictions and endpoint security malware can't reach third-party SaaS' servers. This is to say, there are costs and threats caused by deploying these systems too, and they should be considered when making security decisions.
  - jpc0 2y ago
    Explain exactly how any AV prevents a user from checking e-mails and opening word? The years I spent doing IT at that level, every time, every single time I got a request for admin privileges to be granted to a user or for software to be installed on an endpoint we already had a solution in place for exactly what the user wanted, installed and tested on their workstation that was taught in onboarding and they simply "forgot". Just like the users I had to reset their passwords for every monday because they forgot their passwords. It's an irritation but that doesn't mean they didn't do their job well. They met all performance expectations, they just needed to be handheld with technology . The real world isn't black and white and this isn't Reddit.
    - TeMPOraL 2y ago
      > Explain exactly how any AV prevents a user from checking e-mails and opening word? For example by doing continuous scans that consume so much CPU the machine stays thermally throttled at all times. (Yes, really. I've seen a colleague raising a ticket about AV making it near-impossible to do dev work, to which IT replied the company will reimburse them for a cooling pad for the laptop, and closed the issue as solved.) The problem is so bad that Microsoft, despite Defender being by far the lightest and least bullshit AV solution, created "dev drive", a designated drive that's excluded by design from Defender scanning, as a blatant workaround for corporate policies preventing users and admins from setting custom Defender exclusions. Before that, your only alternative was to run WSL2 or a regular VM, which are opaque to AVs, but that tends to be restricted by corporate too, because "sekhurity". And yes, people in these situations invent workarounds, such as VMs, unauthorized third-party SaaS, or using personal devices, because at the end of the day, the work still needs to be done. So all those security measures do is reduce actual security.
      - kchr 2y ago
        Most AV and EDR solutions support exceptions, either on specific assets or fleets of assets. You can make exceptions for some employees (for example developers or IT) while keeping (sane) defaults for everybody else. Exceptions are usually applied on file paths, executable image names, file hashes, signature certificates or the complete asset. It sounds like people are applying these solutions wrong, which of course has a negative outcome for everybody and builds distrust.
        TeMPOraL 2y ago
        In theory, those solutions could be used right. In practice, they never are. People making decisions about purchasing, deploying and configuring those systems are separated by many layers from rank-and-file employees. The impact on business downstream is diffuse and doesn't affect them directly, while the direct incentives they have are not aligned with the overall business operations. The top doesn't feel the damage this is doing, and the bottom has no way of communicating it in a way that will be heard. It does build distrust, but not necessarily in the sense that "company thinks I'm a potential criminal" - rather, just the mundane expectation that work will continue to get more difficult to perform with every new announcement from the security team.
chrisjj 2y ago
> Computer users should be educated about security, given control of their devices, and trusted that they will do the right thing. Imagine you are a bank. Imagine you have no way to ensure no employee is a crook. It does happen.
- matwood 2y ago
  > Imagine you have no way to ensure no employee is a crook. Wait, are you saying we have gotten rid of all the crooks in a bank/or those that handle money?

by imiric 2y ago

sooper 2y ago

Most people do not understand, or care to understand, what "security" means. You highlight training as a control. Training is expensive - to reduce cost and enhanced effectiveness, how do you focus training on those that need it without any method to identify those that do things in insecure ways? Additionally, I would say a major function of these systems is not surveillance at all - it is preventive controls to prevent compromise of your systems. Overall, your comment strikes me a naive and not based on operational experience.

TeMPOraL 2y ago
This type of software is notorious for severely degrading employees' ability to do their jobs, occasionally preventing it entirely. It's a main reason why "shadow IT" is a thing - bullshit IT restrictions and endpoint security malware can't reach third-party SaaS' servers. This is to say, there are costs and threats caused by deploying these systems too, and they should be considered when making security decisions.
- jpc0 2y ago
  Explain exactly how any AV prevents a user from checking e-mails and opening word? The years I spent doing IT at that level, every time, every single time I got a request for admin privileges to be granted to a user or for software to be installed on an endpoint we already had a solution in place for exactly what the user wanted, installed and tested on their workstation that was taught in onboarding and they simply "forgot". Just like the users I had to reset their passwords for every monday because they forgot their passwords. It's an irritation but that doesn't mean they didn't do their job well. They met all performance expectations, they just needed to be handheld with technology . The real world isn't black and white and this isn't Reddit.
  - TeMPOraL 2y ago
    > Explain exactly how any AV prevents a user from checking e-mails and opening word? For example by doing continuous scans that consume so much CPU the machine stays thermally throttled at all times. (Yes, really. I've seen a colleague raising a ticket about AV making it near-impossible to do dev work, to which IT replied the company will reimburse them for a cooling pad for the laptop, and closed the issue as solved.) The problem is so bad that Microsoft, despite Defender being by far the lightest and least bullshit AV solution, created "dev drive", a designated drive that's excluded by design from Defender scanning, as a blatant workaround for corporate policies preventing users and admins from setting custom Defender exclusions. Before that, your only alternative was to run WSL2 or a regular VM, which are opaque to AVs, but that tends to be restricted by corporate too, because "sekhurity". And yes, people in these situations invent workarounds, such as VMs, unauthorized third-party SaaS, or using personal devices, because at the end of the day, the work still needs to be done. So all those security measures do is reduce actual security.
    - kchr 2y ago
      Most AV and EDR solutions support exceptions, either on specific assets or fleets of assets. You can make exceptions for some employees (for example developers or IT) while keeping (sane) defaults for everybody else. Exceptions are usually applied on file paths, executable image names, file hashes, signature certificates or the complete asset. It sounds like people are applying these solutions wrong, which of course has a negative outcome for everybody and builds distrust.
      - TeMPOraL 2y ago
        In theory, those solutions could be used right. In practice, they never are. People making decisions about purchasing, deploying and configuring those systems are separated by many layers from rank-and-file employees. The impact on business downstream is diffuse and doesn't affect them directly, while the direct incentives they have are not aligned with the overall business operations. The top doesn't feel the damage this is doing, and the bottom has no way of communicating it in a way that will be heard. It does build distrust, but not necessarily in the sense that "company thinks I'm a potential criminal" - rather, just the mundane expectation that work will continue to get more difficult to perform with every new announcement from the security team.

chrisjj 2y ago

> Computer users should be educated about security, given control of their devices, and trusted that they will do the right thing. Imagine you are a bank. Imagine you have no way to ensure no employee is a crook. It does happen.

matwood 2y ago
> Imagine you have no way to ensure no employee is a crook. Wait, are you saying we have gotten rid of all the crooks in a bank/or those that handle money?