8 ms·

65% of employees bypass cybersecurity measures, new study finds

66 points by botanicals6 2y ago

MyFedora 2y ago
Study finds that 65 % of employees bypass cybersecurity measures in companies with terrible cybersecurity practices? Shocking.
vrighter 2y ago
If your measures include stuff like the password manager, which I need to use constantly, being set up to log me out every two minutes "for security purposes", you're damn right I will try to find a way to circumvent it. Each time you log me out it takes me a full minute to log back in, because I need to take out my phone and do the whole 2fa dance all over again. The first step anyone does is to log in to the password manager, and copy all the passwords they'll be needing for a while into notepad.
daft_pink 2y ago
We literally have otp in a secure VM. If someone’s already in our secure VM, logging into a random software package is the least of our worries.
klooney 2y ago
My company runs servers in Alibaba Cloud and blocks access to the Alibaba Cloud API endpoints on the grounds that they're in a high risk country.
kelseyfrog 2y ago
Do IT/cybersecurity professionals really expect people to Work To Rule? This is a basic and effective corporate sabotage technique.
Elizabeth2223 2y ago
[flagged]
justahuman74 2y ago
> Employees often view security protocols as cumbersome. Long, complex passwords, frequent logins and multi-step authentication can feel like barriers to productivity. This resonates. Juggling Okta and 1P a few times a day is a drag
- bawolff 2y ago
  I think in the security industry, password complexity requirements and frequent re-logging in have been considered bad practises for a while now. Alas they are still seen in places.
  - masklinn 2y ago
    > frequent re-logging We recently had to add that for $bigco requirements at $dayjob, I was stunned: they asked to log people out after — IIRC — 1h inactivity.
    - zdragnar 2y ago
      That's a not-uncommon "security" feature $bigco will add as a requirement for buying software as well. Honestly, it's not a terrible policy if you're working with privileged information. A contact mine had with a big insurance company required a 30 minute inactivity logout I think. OTOH if your job is filling out spreadsheets and forms for a retailer and you don't even have access to customer info, it's way overkill. Nuance tends to be the first thing tossed out the window when dealing with $bigco though, too many people to manage smartly.
    - MattPalmer1086 2y ago
      Logging out when there is no activity is quite a common security control requirement in many places. I've seen 15 minute inactivity log out quite frequently. Drives users mad of course (particularly admins who are logged in to many machines).
      - masklinn 2y ago
totallykvothe 2y ago
Obviously. The processes for getting an official exception to cybersecurity practices for a legitimate reason are always slow and agonizing, and the people on the other end are incompetent and condescending.
- jknoepfler 2y ago
  Why would you make such a blanket generalization? The security team where I work is comprised of competent professionals and generally nice people to boot. Our CISO is a great guy to have a beer with. We've had our disagreements, but they've been of the "smart people championing conflicting business values having a reasonable discussion" variety.
  - necovek 2y ago
    And that still leaves someone not being able to do their job for a number of hours or a number of days while those "reasonable discussions" are ongoing. It is a hard problem, and the implied solution of "be even more restrictive" is only going to make matters worse.
    - n_plus_1_acc 2y ago
      Those discussions I consider part of the job educating users is very important.
      - necovek 2y ago
        If it's 35% successful as the OP claims, do you think it's working?
  - M95D 2y ago
    They're all great guys with each other. Do a test. Go to distant office and call IT pretending to be the person who works in that office, with his/her cooperation. See how fast the problem is solved and how you are treated.
ars 2y ago
This skipped the main reason employees do this: The cybersecurity measures are widely perceived as "security theater", rather than anything that actually enhances security. Logging me out of an application, where a re-login requires nothing more than a click, is a stupid thing to do. Blocking outgoing (not incoming) ssh is silly when I have outgoing http. Requiring MFA multiple times a day on a work computer that is already secure is overdoing it.
- jillesvangurp 2y ago
  Mostly corporate security is about ass coverage, not about prevention of problems. Though that can be a useful side effect. Ass coverage is about legal liability. If something bad happens, can I wash my hands in innocence and not suffer consequences (financial, legal, etc.)? If "no", take measures until you can because this could get very expensive. Then the next question is "whose ass". Answer: literally anyone: service providers, your head of IT (who might get fired), your head of sales (who might have to explain to customer lawyers why their data leaked), the CEO, etc. They don't want to be on the spot for your mistakes. For public companies this is worse because now you have publicly traded shares in a very litigious environment with people looking for weaknesses that can be exploited to squeeze money out of any situation. And of course some of the tools in this space are made by publicly traded companies too. The easiest way to deal with security is applying a shotgun approach of applying any kind of stuff that is vaguely understood to maybe work. The actual effectiveness of these things is besides the point and of course much of it is snake oil. The point is that there are policies and they are being enforced. The more visible and annoying this is, the more effective it is in case of trouble as a means to say "well it wasn't my fault because we did X, Y, and Z". And of course a secondary effect of putting people on the job of securing a thing is that they will get busy doing their job to justify their existence. Which usually means a whole bunch of policy documents get written, tools get selected (preferably ones with big shiny reputations), and a lot of complexity gets introduced. There will be audits, consultants being consulted, chins being stroked, and a lot of money changing hands all for the assertion that "your ass is covered!" and by extension "theirs" as well. There are whole meta levels of ass coverage here. That's why security theater is a thing. Because there is a large audience of people that all need to be re-assured about having suitable amounts of ass coverage.
bawolff 2y ago
> Password Reuse: 49% of respondents use the same login credentials for multiple work applications, and 36% use the same credentials for personal and professional accounts. If your company has multiple things you need to log in to, its doing something wrong. Having company-wide single login system is really critical for good security. > 30% of employees share their workplace passwords with colleagues, effectively nullifying the protections offered by unique credentials or MFA. This also suggests something is setup wrong in the company (lack of giving people correct access?). Normally sharing passwords should be harder than not sharing, if you have to log out of a global account to log in as another one. Security is all about incentives. If employees are incentivized to act insecurely, they will. Its not the employees fault, its the people who setup the system in such a way that encourages people to act insecurely. Good security is all about aligning incentives to control risk.
- turbojet1321 2y ago
  > If your company has multiple things you need to log in to, its doing something wrong. How does that work for privileged accounts?
  - cmckn 2y ago
    Kind of like sudo. Your individual identity is allowed to assume the privileged identity after providing an additional factor/justification (and your access has a TTL).
    - turbojet1321 2y ago
      Sorry, I meant in an actual corporate (ie, Windows) environment, not conceptually.
      - kevindamm 2y ago
        My solution is: don't use AD for anything privileged in production, route all privileged operations through SSO auth and have the operation executed by servers in production. Separate corp and prod. Add a zero trust layer so that every single privileged operation involves an auth challenge (which can be assisted by an OTP dongle so that users aren't required to re-key their passwords multiple times per 20-ish hours).
phildini 2y ago
All the time I've worked in security I've seen that detection beats prevention because of this reality, nice to see some studies on it. (This is why we built https://crowdalert.com https://crowdalert.com, amusingly)
sitkack 2y ago
When I was at MS, I wrote a detailed guide how to trick the central IT system into thinking that your machine had the antivirus software running when it did not. It eventually, years later, got forwarded back to me as some sort of underground currency (with my authorship removed).
- tstrimple 2y ago
  I was reasonably impressed by MSFT IT when I worked there. I was primarily a BYOD Mac user and only had to deal with IT two to three times over the course of 8 years. I took it for granted at the time because I came from the startup work where you're basically your own IT person. But other large companies after Microsoft clearly demonstrated to me that Microsoft is on top of their shit and the average is fucking terrible.
  - sitkack 2y ago
    This was in the 90s, other than the AV issue, they got high marks from me. I even had a linux and freebsd machine running attached to the corp net with no issues, they did not touch MS infra. The average is indeed terrible.
m463 2y ago
It is always: security = 1/convenience And there are lots of confounding factors. Staying up-to-date with security updates might also mean you get breaking updates, or updates that have counterproductive changes, or downgrade your capabilities or privacy. and why do updates take so long to apply? also password re-use? sso can fix this. (but if you have to automate things, companies have a varied track record on credentials)
pembrook 2y ago
I’m amazed how we have widely available biometrics in the consumer space (anything Apple with TouchID or FaceID) but not in the realm of business where security is far more critical. A rational market observer would have assumed biometrics would have replaced antiquated passwords years ago. Feels like this is a solved problem but Microsoft having a monopoly over business computing and software and there being no agreed upon standards for biometrics hardware is holding us back.
- scarfaceneo 2y ago
  You still need to create a password. And since nearly always the biometric option doesn’t replace the password, it’s a moot point.
  - pembrook 2y ago
    But that’s my point. Why use passwords at all. If we’re okay using our face to auth into all mobile apps (business, personal or otherwise) and also to auth into the country every time we fly into it, why not just move towards making it standard.
    - rustcleaner 2y ago
      >If we’re okay using our face to auth I'm not! If this sort of thing becomes standard, I will become digitally amish.
    - n_plus_1_acc 2y ago
      Until you get into an accident and your face is covered in bandages or something and the computer wont let you in.
- wmf 2y ago
  Windows Hello exists. https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/how-it-works https://learn.microsoft.com/en-us/windows/security/identity-...
- 2y ago
h4ck_th3_pl4n3t 2y ago
I don't understand why most password manager software that's being used in Enterprise and even targets that market specifically does not have the most basic features that people need. Sharing passwords to external company accounts is essential for a marketing department, for example. Yet the proposed solution is to use an Android device for that. Good luck recovering that after an attack. Password policies in Microsoft ADS systems are so broken that they have to change their password every 3 months for no reason whatsoever, effectively making all passwords predictable because the chance of someone using <year/month> or <month> as a password suffix is guaranteed. Let alone the old messed up SAP systems everywhere that are abused as a login database. SAP doesn't even support special characters, and the max password length is 9 characters (10 if you count the # that is used as a hack to implement MFA). They are so crappy that the password always is set by an external rented plugin that updates all passwords in an interval with password#token. And yes, this also kind of nullifies the token's initial purpose as a secondary system. Then there's stupid policies that logout a session every 5 minutes, while people need to use a program for hours on end. While also having a single button to relogin in an external window, in a program that is made in 90s Perl or Java. And then you are wondering why employees reuse passwords if the state of systems is _that_ close to being pwned? Really?
- tstrimple 2y ago
  > I don't understand why most password manager software that's being used in Enterprise and even targets that market specifically does not have the most basic features that people need. > Sharing passwords to external company accounts is essential for a marketing department, for example. Yet the proposed solution is to use an Android device for that. Good luck recovering that after an attack. Not really. We likely wouldn't allow a marketing tool that couldn't integrate with auth standards. Which is why we have dozens of systems integrated together with one identity and SSO between everything. It's the companies that make dozens of exceptions from their auth standards that have to deal with this password sharing nonsense and security nightmare. Password sharing is a Bad Idea even if sometimes it's the most expedient.
jongjong 2y ago
My biggest pet peeve is when the platform forces me to add certain special characters to my password, then I need to write down my altered password and put it on a post-it note on my desk to remember it. My other pet peeve, with a password manager, is when I forgot my master password and I need to reset it, but then my password manager sends the reset link to my email inbox; which I cannot access since its password is itself inside my password manager (true story). Thankfully, in that second case, I eventually managed to guess my email's password. I couldn't guess my master password because it required too many weird characters which I couldn't recall. Good thing I didn't let the password manager generate the password for me! It reminds me of another topic regarding how most software tends to assume that you are a billionaire and everyone is trying to hack you or spam you... Also, like how Gmail hides my newly received emails underneath some weird accordion menu as if my inbox is so full of emails that I couldn't see all of this month's emails in a single view.
- cafeinux 2y ago
  Why would you need to write your password on a post-it note if you use a password manager? Also, why would the note need to be specifically "on your desk"? If I really had no other choice than writing down a password, I would keep it in a more subtle/hidden place (my wallet, or my phone case, or in my locker). That's still not secure against a targeted attack, but I wouldn't be the lowest hanging fruit at least. Also, if you are able to reset the master password of your password manager, then something is seriously wrong with the solution your company uses. Advice for a good and rememberable master password: use a passphrase. 6 random words are easier to recall than lots of characters. Throw in one number and one capital letter in two random places (replacing o with 0 or i with 1 is not random, neither are start and end of words), use a special character as words separator, and you got an easy to remember password that checks all the security requirements. Heck, even using a line or two from the lyrics of a song you know (but obviously not your favorite or the one you sing every morning) is easier and better than most passwords. Some time ago I used the first line of "Toxicity" by System of a Down, when I didn't have the time to craft a good passphrase. Checks all the marks (special chars and numbers included), and was not anymore guessable than a random passphrase during the short time I used it.
paxys 2y ago
I work at a large software company and recently documented the number of steps it takes me every morning to fully log into every system I need for work. I stopped at 37. And every year in response to all the breaches in the news the company spends more money to hire another security team who simply pile on another redundant layer on top. The industry has jumped the shark when it comes to IT security. It's the corporate equivalent of spending tens of billions of dollars on the TSA and making everyone take their shoes off at the airport. Meanwhile someone with intent can stroll into JFK, casually bypass all security checkpoints and get on a plane to Paris without a boarding pass.
- tstrimple 2y ago
  I work for a large consulting company (300k+ employees globally) and 99% of our internal resources are all secured by Ping. One identity and MFA app. SSO between just about everything. The client I'm currently working for with that company has all of their auth handled by Entra. All their internal docs, their azure subscriptions, their gitub repos. All the same user identity. Shit IT isn't inevitable. It's a decision, or often lack of a decision and result of "organic" growth.
  - epiecs 2y ago
    Same here. We had a very fragmented landscape (multiple idp tools, some tools using internal users,...). We consolidated everything to entra (450 apps and counting) and everybody couldn't be happier. Full sso on everything + scim where available. We do offcourse have conditional access + PIM for admins but that is to be expected. You just need a good strategy on how you are going to tackle IAM and then just stick to it.
- hedora 2y ago
  Security is usually defined as confidentiality, integrity and availability. (Not in order of importance, just to spell “CIA”). If it takes that long to log in, the system is not available, and therefore insecure. Full stop. The security team responsible for that setup should be fired. In related news, I’ve been watching old murder mysteries from the ‘60s. Typical plot points include the fact that you can decide to fly from Los Angeles and arrive anywhere on the west coast with in 2-3 hours because the planes leave every 30 minutes. Why wouldn’t you just walk up to the gate and buy a ticket? Why do we put up with this TSA bullshit?
haaz 2y ago
When I worked at a large bank they blocked ChatGPT on the network. Unfortunately I was a new grad who didn’t know Java working in a Java team. I just turned off the vpn and copy pasted the code back and forth until it worked. Boss didn’t seem to mind. Left the job after 2 months anyway.
- pwdisswordfishz 2y ago
  > I was a new grad who didn’t know Java working in a Java team All the more reason not to use ChatGPT then.
deleted 2y ago
[deleted]
botanicals6 2y ago
AviD's Rule of Usability: "Security at the expense of usability, comes at the expense of security." Security companies should have more focus on the usability aspect of their product. Some of the enterprise products you see today are just plain bad in terms of UX/UI, and funnily enough, they aren't getting called out since they're only used in the workplace/closed groups.
- cybercatgurrl 2y ago
  this is why i have a problem with flatpacks. i’ve tried using an immutable distro with flatpacks and it’s made me want to disable every flatpack security measure because it’s even harsher and less usable than macos’s sandboxing. i don’t know what their goal is but it’s definitely not usable if i can’t connect 1password to my browser or i struggle to get steam to access another drive
- blablabla123 2y ago
  Yeah there's a certain amount of effort most people are willing to put in to do something. If it's too high, it won't happen. Yet at the same time a certain baseline is needed to not end up being low hanging fruit for attackers. I've also seen this, especially in security tools. The usability is often straight out of the 90s which keeps me wondering, who uses this voluntarily?
jerlam 2y ago
> Device Security Gaps: 36% delay installing security patches on personal devices used for work, exposing critical applications to exploitation. > Personal Devices: 80% of respondents access workplace applications from personal devices that lack security controls. I thought the BYOD fad was over. If cybersecurity is vital to your company, your users shouldn't be allowed to use personal devices for work.
- botanicals6 2y ago
  100% agree, just that sometimes not every company has the resources or inclination to do that. The best middle ground is some kind of solution that allows the security team to "manage" personal devices in some way.
  - patmcc 2y ago
    >>>The best middle ground is some kind of solution that allows the security team to "manage" personal devices in some way. No thanks. I'm not compromising the security of my personal devices to save my employer a couple hundred bucks a year.
  - awiesenhofer 2y ago
    > The best middle ground is some kind of solution that allows the security team to "manage" personal devices in some way. Oh that is the "best" "middle" ground, is it? Are you sure? Why should anyone bring their personal device just because the company is to cheap to buy a few phones and then have them basically owned by their IT anyways? Do you realize how crazy that is? You might want to think about that one again. Every SMB can afford a few cheap phones for its employees, MFA apps dont need flagship hardware. If a company can't, maybe it shouldn't be in business anyway.

66 points by botanicals6 2y ago

Study finds that 65 % of employees bypass cybersecurity measures in companies with terrible cybersecurity practices? Shocking.

vrighter 2y ago

If your measures include stuff like the password manager, which I need to use constantly, being set up to log me out every two minutes "for security purposes", you're damn right I will try to find a way to circumvent it. Each time you log me out it takes me a full minute to log back in, because I need to take out my phone and do the whole 2fa dance all over again. The first step anyone does is to log in to the password manager, and copy all the passwords they'll be needing for a while into notepad.

daft_pink 2y ago

We literally have otp in a secure VM. If someone’s already in our secure VM, logging into a random software package is the least of our worries.

klooney 2y ago

My company runs servers in Alibaba Cloud and blocks access to the Alibaba Cloud API endpoints on the grounds that they're in a high risk country.

kelseyfrog 2y ago

Do IT/cybersecurity professionals really expect people to Work To Rule? This is a basic and effective corporate sabotage technique.

Elizabeth2223 2y ago

[flagged]

justahuman74 2y ago

> Employees often view security protocols as cumbersome. Long, complex passwords, frequent logins and multi-step authentication can feel like barriers to productivity. This resonates. Juggling Okta and 1P a few times a day is a drag

bawolff 2y ago
I think in the security industry, password complexity requirements and frequent re-logging in have been considered bad practises for a while now. Alas they are still seen in places.
- masklinn 2y ago
  > frequent re-logging We recently had to add that for $bigco requirements at $dayjob, I was stunned: they asked to log people out after — IIRC — 1h inactivity.
  - zdragnar 2y ago
    That's a not-uncommon "security" feature $bigco will add as a requirement for buying software as well. Honestly, it's not a terrible policy if you're working with privileged information. A contact mine had with a big insurance company required a 30 minute inactivity logout I think. OTOH if your job is filling out spreadsheets and forms for a retailer and you don't even have access to customer info, it's way overkill. Nuance tends to be the first thing tossed out the window when dealing with $bigco though, too many people to manage smartly.
  - MattPalmer1086 2y ago
    Logging out when there is no activity is quite a common security control requirement in many places. I've seen 15 minute inactivity log out quite frequently. Drives users mad of course (particularly admins who are logged in to many machines).
    - masklinn 2y ago

totallykvothe 2y ago

Obviously. The processes for getting an official exception to cybersecurity practices for a legitimate reason are always slow and agonizing, and the people on the other end are incompetent and condescending.

jknoepfler 2y ago
Why would you make such a blanket generalization? The security team where I work is comprised of competent professionals and generally nice people to boot. Our CISO is a great guy to have a beer with. We've had our disagreements, but they've been of the "smart people championing conflicting business values having a reasonable discussion" variety.
- necovek 2y ago
  And that still leaves someone not being able to do their job for a number of hours or a number of days while those "reasonable discussions" are ongoing. It is a hard problem, and the implied solution of "be even more restrictive" is only going to make matters worse.
  - n_plus_1_acc 2y ago
    Those discussions I consider part of the job educating users is very important.
    - necovek 2y ago
      If it's 35% successful as the OP claims, do you think it's working?
- M95D 2y ago
  They're all great guys with each other. Do a test. Go to distant office and call IT pretending to be the person who works in that office, with his/her cooperation. See how fast the problem is solved and how you are treated.

ars 2y ago

This skipped the main reason employees do this: The cybersecurity measures are widely perceived as "security theater", rather than anything that actually enhances security. Logging me out of an application, where a re-login requires nothing more than a click, is a stupid thing to do. Blocking outgoing (not incoming) ssh is silly when I have outgoing http. Requiring MFA multiple times a day on a work computer that is already secure is overdoing it.

jillesvangurp 2y ago
Mostly corporate security is about ass coverage, not about prevention of problems. Though that can be a useful side effect. Ass coverage is about legal liability. If something bad happens, can I wash my hands in innocence and not suffer consequences (financial, legal, etc.)? If "no", take measures until you can because this could get very expensive. Then the next question is "whose ass". Answer: literally anyone: service providers, your head of IT (who might get fired), your head of sales (who might have to explain to customer lawyers why their data leaked), the CEO, etc. They don't want to be on the spot for your mistakes. For public companies this is worse because now you have publicly traded shares in a very litigious environment with people looking for weaknesses that can be exploited to squeeze money out of any situation. And of course some of the tools in this space are made by publicly traded companies too. The easiest way to deal with security is applying a shotgun approach of applying any kind of stuff that is vaguely understood to maybe work. The actual effectiveness of these things is besides the point and of course much of it is snake oil. The point is that there are policies and they are being enforced. The more visible and annoying this is, the more effective it is in case of trouble as a means to say "well it wasn't my fault because we did X, Y, and Z". And of course a secondary effect of putting people on the job of securing a thing is that they will get busy doing their job to justify their existence. Which usually means a whole bunch of policy documents get written, tools get selected (preferably ones with big shiny reputations), and a lot of complexity gets introduced. There will be audits, consultants being consulted, chins being stroked, and a lot of money changing hands all for the assertion that "your ass is covered!" and by extension "theirs" as well. There are whole meta levels of ass coverage here. That's why security theater is a thing. Because there is a large audience of people that all need to be re-assured about having suitable amounts of ass coverage.

bawolff 2y ago

> Password Reuse: 49% of respondents use the same login credentials for multiple work applications, and 36% use the same credentials for personal and professional accounts. If your company has multiple things you need to log in to, its doing something wrong. Having company-wide single login system is really critical for good security. > 30% of employees share their workplace passwords with colleagues, effectively nullifying the protections offered by unique credentials or MFA. This also suggests something is setup wrong in the company (lack of giving people correct access?). Normally sharing passwords should be harder than not sharing, if you have to log out of a global account to log in as another one. Security is all about incentives. If employees are incentivized to act insecurely, they will. Its not the employees fault, its the people who setup the system in such a way that encourages people to act insecurely. Good security is all about aligning incentives to control risk.

turbojet1321 2y ago
> If your company has multiple things you need to log in to, its doing something wrong. How does that work for privileged accounts?
- cmckn 2y ago
  Kind of like sudo. Your individual identity is allowed to assume the privileged identity after providing an additional factor/justification (and your access has a TTL).
  - turbojet1321 2y ago
    Sorry, I meant in an actual corporate (ie, Windows) environment, not conceptually.
    - kevindamm 2y ago
      My solution is: don't use AD for anything privileged in production, route all privileged operations through SSO auth and have the operation executed by servers in production. Separate corp and prod. Add a zero trust layer so that every single privileged operation involves an auth challenge (which can be assisted by an OTP dongle so that users aren't required to re-key their passwords multiple times per 20-ish hours).

phildini 2y ago

All the time I've worked in security I've seen that detection beats prevention because of this reality, nice to see some studies on it. (This is why we built https://crowdalert.com https://crowdalert.com, amusingly)

sitkack 2y ago

When I was at MS, I wrote a detailed guide how to trick the central IT system into thinking that your machine had the antivirus software running when it did not. It eventually, years later, got forwarded back to me as some sort of underground currency (with my authorship removed).

tstrimple 2y ago
I was reasonably impressed by MSFT IT when I worked there. I was primarily a BYOD Mac user and only had to deal with IT two to three times over the course of 8 years. I took it for granted at the time because I came from the startup work where you're basically your own IT person. But other large companies after Microsoft clearly demonstrated to me that Microsoft is on top of their shit and the average is fucking terrible.
- sitkack 2y ago
  This was in the 90s, other than the AV issue, they got high marks from me. I even had a linux and freebsd machine running attached to the corp net with no issues, they did not touch MS infra. The average is indeed terrible.

m463 2y ago

It is always: security = 1/convenience And there are lots of confounding factors. Staying up-to-date with security updates might also mean you get breaking updates, or updates that have counterproductive changes, or downgrade your capabilities or privacy. and why do updates take so long to apply? also password re-use? sso can fix this. (but if you have to automate things, companies have a varied track record on credentials)

pembrook 2y ago

I’m amazed how we have widely available biometrics in the consumer space (anything Apple with TouchID or FaceID) but not in the realm of business where security is far more critical. A rational market observer would have assumed biometrics would have replaced antiquated passwords years ago. Feels like this is a solved problem but Microsoft having a monopoly over business computing and software and there being no agreed upon standards for biometrics hardware is holding us back.

scarfaceneo 2y ago
You still need to create a password. And since nearly always the biometric option doesn’t replace the password, it’s a moot point.
- pembrook 2y ago
  But that’s my point. Why use passwords at all. If we’re okay using our face to auth into all mobile apps (business, personal or otherwise) and also to auth into the country every time we fly into it, why not just move towards making it standard.
  - rustcleaner 2y ago
    >If we’re okay using our face to auth I'm not! If this sort of thing becomes standard, I will become digitally amish.
  - n_plus_1_acc 2y ago
    Until you get into an accident and your face is covered in bandages or something and the computer wont let you in.
wmf 2y ago
Windows Hello exists. https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/how-it-works https://learn.microsoft.com/en-us/windows/security/identity-...
2y ago

h4ck_th3_pl4n3t 2y ago

I don't understand why most password manager software that's being used in Enterprise and even targets that market specifically does not have the most basic features that people need. Sharing passwords to external company accounts is essential for a marketing department, for example. Yet the proposed solution is to use an Android device for that. Good luck recovering that after an attack. Password policies in Microsoft ADS systems are so broken that they have to change their password every 3 months for no reason whatsoever, effectively making all passwords predictable because the chance of someone using <year/month> or <month> as a password suffix is guaranteed. Let alone the old messed up SAP systems everywhere that are abused as a login database. SAP doesn't even support special characters, and the max password length is 9 characters (10 if you count the # that is used as a hack to implement MFA). They are so crappy that the password always is set by an external rented plugin that updates all passwords in an interval with password#token. And yes, this also kind of nullifies the token's initial purpose as a secondary system. Then there's stupid policies that logout a session every 5 minutes, while people need to use a program for hours on end. While also having a single button to relogin in an external window, in a program that is made in 90s Perl or Java. And then you are wondering why employees reuse passwords if the state of systems is _that_ close to being pwned? Really?

tstrimple 2y ago
> I don't understand why most password manager software that's being used in Enterprise and even targets that market specifically does not have the most basic features that people need. > Sharing passwords to external company accounts is essential for a marketing department, for example. Yet the proposed solution is to use an Android device for that. Good luck recovering that after an attack. Not really. We likely wouldn't allow a marketing tool that couldn't integrate with auth standards. Which is why we have dozens of systems integrated together with one identity and SSO between everything. It's the companies that make dozens of exceptions from their auth standards that have to deal with this password sharing nonsense and security nightmare. Password sharing is a Bad Idea even if sometimes it's the most expedient.

jongjong 2y ago

My biggest pet peeve is when the platform forces me to add certain special characters to my password, then I need to write down my altered password and put it on a post-it note on my desk to remember it. My other pet peeve, with a password manager, is when I forgot my master password and I need to reset it, but then my password manager sends the reset link to my email inbox; which I cannot access since its password is itself inside my password manager (true story). Thankfully, in that second case, I eventually managed to guess my email's password. I couldn't guess my master password because it required too many weird characters which I couldn't recall. Good thing I didn't let the password manager generate the password for me! It reminds me of another topic regarding how most software tends to assume that you are a billionaire and everyone is trying to hack you or spam you... Also, like how Gmail hides my newly received emails underneath some weird accordion menu as if my inbox is so full of emails that I couldn't see all of this month's emails in a single view.

cafeinux 2y ago
Why would you need to write your password on a post-it note if you use a password manager? Also, why would the note need to be specifically "on your desk"? If I really had no other choice than writing down a password, I would keep it in a more subtle/hidden place (my wallet, or my phone case, or in my locker). That's still not secure against a targeted attack, but I wouldn't be the lowest hanging fruit at least. Also, if you are able to reset the master password of your password manager, then something is seriously wrong with the solution your company uses. Advice for a good and rememberable master password: use a passphrase. 6 random words are easier to recall than lots of characters. Throw in one number and one capital letter in two random places (replacing o with 0 or i with 1 is not random, neither are start and end of words), use a special character as words separator, and you got an easy to remember password that checks all the security requirements. Heck, even using a line or two from the lyrics of a song you know (but obviously not your favorite or the one you sing every morning) is easier and better than most passwords. Some time ago I used the first line of "Toxicity" by System of a Down, when I didn't have the time to craft a good passphrase. Checks all the marks (special chars and numbers included), and was not anymore guessable than a random passphrase during the short time I used it.

paxys 2y ago

I work at a large software company and recently documented the number of steps it takes me every morning to fully log into every system I need for work. I stopped at 37. And every year in response to all the breaches in the news the company spends more money to hire another security team who simply pile on another redundant layer on top. The industry has jumped the shark when it comes to IT security. It's the corporate equivalent of spending tens of billions of dollars on the TSA and making everyone take their shoes off at the airport. Meanwhile someone with intent can stroll into JFK, casually bypass all security checkpoints and get on a plane to Paris without a boarding pass.

tstrimple 2y ago
I work for a large consulting company (300k+ employees globally) and 99% of our internal resources are all secured by Ping. One identity and MFA app. SSO between just about everything. The client I'm currently working for with that company has all of their auth handled by Entra. All their internal docs, their azure subscriptions, their gitub repos. All the same user identity. Shit IT isn't inevitable. It's a decision, or often lack of a decision and result of "organic" growth.
- epiecs 2y ago
  Same here. We had a very fragmented landscape (multiple idp tools, some tools using internal users,...). We consolidated everything to entra (450 apps and counting) and everybody couldn't be happier. Full sso on everything + scim where available. We do offcourse have conditional access + PIM for admins but that is to be expected. You just need a good strategy on how you are going to tackle IAM and then just stick to it.
hedora 2y ago
Security is usually defined as confidentiality, integrity and availability. (Not in order of importance, just to spell “CIA”). If it takes that long to log in, the system is not available, and therefore insecure. Full stop. The security team responsible for that setup should be fired. In related news, I’ve been watching old murder mysteries from the ‘60s. Typical plot points include the fact that you can decide to fly from Los Angeles and arrive anywhere on the west coast with in 2-3 hours because the planes leave every 30 minutes. Why wouldn’t you just walk up to the gate and buy a ticket? Why do we put up with this TSA bullshit?

haaz 2y ago

When I worked at a large bank they blocked ChatGPT on the network. Unfortunately I was a new grad who didn’t know Java working in a Java team. I just turned off the vpn and copy pasted the code back and forth until it worked. Boss didn’t seem to mind. Left the job after 2 months anyway.

pwdisswordfishz 2y ago
> I was a new grad who didn’t know Java working in a Java team All the more reason not to use ChatGPT then.

deleted 2y ago

[deleted]

botanicals6 2y ago

AviD's Rule of Usability: "Security at the expense of usability, comes at the expense of security." Security companies should have more focus on the usability aspect of their product. Some of the enterprise products you see today are just plain bad in terms of UX/UI, and funnily enough, they aren't getting called out since they're only used in the workplace/closed groups.

cybercatgurrl 2y ago
this is why i have a problem with flatpacks. i’ve tried using an immutable distro with flatpacks and it’s made me want to disable every flatpack security measure because it’s even harsher and less usable than macos’s sandboxing. i don’t know what their goal is but it’s definitely not usable if i can’t connect 1password to my browser or i struggle to get steam to access another drive
blablabla123 2y ago
Yeah there's a certain amount of effort most people are willing to put in to do something. If it's too high, it won't happen. Yet at the same time a certain baseline is needed to not end up being low hanging fruit for attackers. I've also seen this, especially in security tools. The usability is often straight out of the 90s which keeps me wondering, who uses this voluntarily?

jerlam 2y ago

> Device Security Gaps: 36% delay installing security patches on personal devices used for work, exposing critical applications to exploitation. > Personal Devices: 80% of respondents access workplace applications from personal devices that lack security controls. I thought the BYOD fad was over. If cybersecurity is vital to your company, your users shouldn't be allowed to use personal devices for work.

botanicals6 2y ago
100% agree, just that sometimes not every company has the resources or inclination to do that. The best middle ground is some kind of solution that allows the security team to "manage" personal devices in some way.
- patmcc 2y ago
  >>>The best middle ground is some kind of solution that allows the security team to "manage" personal devices in some way. No thanks. I'm not compromising the security of my personal devices to save my employer a couple hundred bucks a year.
- awiesenhofer 2y ago
  > The best middle ground is some kind of solution that allows the security team to "manage" personal devices in some way. Oh that is the "best" "middle" ground, is it? Are you sure? Why should anyone bring their personal device just because the company is to cheap to buy a few phones and then have them basically owned by their IT anyways? Do you realize how crazy that is? You might want to think about that one again. Every SMB can afford a few cheap phones for its employees, MFA apps dont need flagship hardware. If a company can't, maybe it shouldn't be in business anyway.