3 ms·

Obviously. The processes for getting an official exception to cybersecurity practices for a legitimate reason are always slow and agonizing, and the people on t

Obviously. The processes for getting an official exception to cybersecurity practices for a legitimate reason are always slow and agonizing, and the people on the other end are incompetent and condescending.

jknoepfler 2y ago
Why would you make such a blanket generalization? The security team where I work is comprised of competent professionals and generally nice people to boot. Our CISO is a great guy to have a beer with. We've had our disagreements, but they've been of the "smart people championing conflicting business values having a reasonable discussion" variety.
- necovek 2y ago
  And that still leaves someone not being able to do their job for a number of hours or a number of days while those "reasonable discussions" are ongoing. It is a hard problem, and the implied solution of "be even more restrictive" is only going to make matters worse.
  - n_plus_1_acc 2y ago
    Those discussions I consider part of the job educating users is very important.
    - necovek 2y ago
      If it's 35% successful as the OP claims, do you think it's working?
- M95D 2y ago
  They're all great guys with each other. Do a test. Go to distant office and call IT pretending to be the person who works in that office, with his/her cooperation. See how fast the problem is solved and how you are treated.
  - jknoepfler 2y ago
    I mean, we're a remote company. I work in software, not IT. YMMV I guess. I don't think demonizing an entire department on the basis of a job title is a very intelligent or humane thing to do, and it doesn't resonate with my lived experience.
    - M95D 2y ago
      I work in medical labs. So far I worked for 4 companies and IT support was the same everywhere. It's usually like this: -ME: I found a problem. The patients get wrong test results in some cases. [explanation] -IT: No, you don't know how to use the system. [brief instructions for 4y old children, only vaguely related to the issue] - Look, I did that, it still happens. [attach more instructions to reproduce the problem] - (1 week later) There could be a problem, but we can't replicate it with your instructions. - [send video demo] - Yeah... it could be a small problem, but it's not that serious. - It's very serious! We send wrong test results to patients! [add more argumentes, examples] - (1 week later) Yeah... it doesn't seem that serious, it's probably very rare anyway, but here's a workaround [40 clicks procedure] - I can't do that every time it happens! And it's not rare, it's [x] times a day just the occurences that I know about! - (1 month no reply) - Did you read my message? Are you still working on this? - (1 week later) We sent a support request to [external company]. We're closing this issue until we hear back from them. [closes issue with "invalid"] - (1 year later, the problem is still there.) Are you still working on this? - (no reply) I quit after 7 years and the problem was still there.

jknoepfler 2y ago

Why would you make such a blanket generalization? The security team where I work is comprised of competent professionals and generally nice people to boot. Our CISO is a great guy to have a beer with. We've had our disagreements, but they've been of the "smart people championing conflicting business values having a reasonable discussion" variety.

necovek 2y ago
And that still leaves someone not being able to do their job for a number of hours or a number of days while those "reasonable discussions" are ongoing. It is a hard problem, and the implied solution of "be even more restrictive" is only going to make matters worse.
- n_plus_1_acc 2y ago
  Those discussions I consider part of the job educating users is very important.
  - necovek 2y ago
    If it's 35% successful as the OP claims, do you think it's working?
M95D 2y ago
They're all great guys with each other. Do a test. Go to distant office and call IT pretending to be the person who works in that office, with his/her cooperation. See how fast the problem is solved and how you are treated.
- jknoepfler 2y ago
  I mean, we're a remote company. I work in software, not IT. YMMV I guess. I don't think demonizing an entire department on the basis of a job title is a very intelligent or humane thing to do, and it doesn't resonate with my lived experience.
  - M95D 2y ago
    I work in medical labs. So far I worked for 4 companies and IT support was the same everywhere. It's usually like this: -ME: I found a problem. The patients get wrong test results in some cases. [explanation] -IT: No, you don't know how to use the system. [brief instructions for 4y old children, only vaguely related to the issue] - Look, I did that, it still happens. [attach more instructions to reproduce the problem] - (1 week later) There could be a problem, but we can't replicate it with your instructions. - [send video demo] - Yeah... it could be a small problem, but it's not that serious. - It's very serious! We send wrong test results to patients! [add more argumentes, examples] - (1 week later) Yeah... it doesn't seem that serious, it's probably very rare anyway, but here's a workaround [40 clicks procedure] - I can't do that every time it happens! And it's not rare, it's [x] times a day just the occurences that I know about! - (1 month no reply) - Did you read my message? Are you still working on this? - (1 week later) We sent a support request to [external company]. We're closing this issue until we hear back from them. [closes issue with "invalid"] - (1 year later, the problem is still there.) Are you still working on this? - (no reply) I quit after 7 years and the problem was still there.