4 ms·

This skipped the main reason employees do this: The cybersecurity measures are widely perceived as "security theater", rather than anything that actually enhanc

by ars 2y ago

This skipped the main reason employees do this: The cybersecurity measures are widely perceived as "security theater", rather than anything that actually enhances security. Logging me out of an application, where a re-login requires nothing more than a click, is a stupid thing to do. Blocking outgoing (not incoming) ssh is silly when I have outgoing http. Requiring MFA multiple times a day on a work computer that is already secure is overdoing it.

jillesvangurp 2y ago
Mostly corporate security is about ass coverage, not about prevention of problems. Though that can be a useful side effect. Ass coverage is about legal liability. If something bad happens, can I wash my hands in innocence and not suffer consequences (financial, legal, etc.)? If "no", take measures until you can because this could get very expensive. Then the next question is "whose ass". Answer: literally anyone: service providers, your head of IT (who might get fired), your head of sales (who might have to explain to customer lawyers why their data leaked), the CEO, etc. They don't want to be on the spot for your mistakes. For public companies this is worse because now you have publicly traded shares in a very litigious environment with people looking for weaknesses that can be exploited to squeeze money out of any situation. And of course some of the tools in this space are made by publicly traded companies too. The easiest way to deal with security is applying a shotgun approach of applying any kind of stuff that is vaguely understood to maybe work. The actual effectiveness of these things is besides the point and of course much of it is snake oil. The point is that there are policies and they are being enforced. The more visible and annoying this is, the more effective it is in case of trouble as a means to say "well it wasn't my fault because we did X, Y, and Z". And of course a secondary effect of putting people on the job of securing a thing is that they will get busy doing their job to justify their existence. Which usually means a whole bunch of policy documents get written, tools get selected (preferably ones with big shiny reputations), and a lot of complexity gets introduced. There will be audits, consultants being consulted, chins being stroked, and a lot of money changing hands all for the assertion that "your ass is covered!" and by extension "theirs" as well. There are whole meta levels of ass coverage here. That's why security theater is a thing. Because there is a large audience of people that all need to be re-assured about having suitable amounts of ass coverage.
aulin 2y ago
Always assumed they block everything they cannot spy, it's not for security. Https they inject their certificates, ssh you can have your key and they'll be blind. And they spy to prevent exfiltration they say. I cannot ssh into my home network but I can drop tons of company code into an LLM prompt. Everything else, MFA, password rotations, approved software, stupid training videos... is all there to tick some boxes in a certification process or to easily shift the blame when something bad happens.
- necovek 2y ago
  Because of MITM-ing TLS with their own certificates, they could also stop you from dumping tons of code into an LLM prompt by blocking all public LLMs (or even all sites not on an allowlist). The reason it's silly is really that you can always take "secrets" with you, be it by taking photos with your phone ("lets ban phones") or memorizing or writing on paper. Security is useful when it prevents accidental, inadvertent leakage of information ("stop me from shooting myself in the foot"). Anything else, and the inconvenience will make people figure out ways around it. And the real reason people won't leak information is either ethics and morality, or legal liability.
  - MattPalmer1086 2y ago
    You overestimate the intelligence of a lot of people. We have caught attempts at exfiltration over channels we can easily monitor. Is it perfect? No. Can reasonably intelligent people find a way around them? Sure. But we are still going to control that information flow where we can.
    - necovek 2y ago
      So, as the OP claims, it is working for the 35% of the employees, right? And it likely inconveniences a full 100%. Does that sound like a smart trade-off?
      - MattPalmer1086 2y ago
        What is the alternative? I have actually worked in places that prevented all personal electronic devices in the building, had security guards and bag searches on every floor and no internet access on your desktop. You don't know what inconvenience looks like!

by ars 2y ago

jillesvangurp 2y ago

Mostly corporate security is about ass coverage, not about prevention of problems. Though that can be a useful side effect. Ass coverage is about legal liability. If something bad happens, can I wash my hands in innocence and not suffer consequences (financial, legal, etc.)? If "no", take measures until you can because this could get very expensive. Then the next question is "whose ass". Answer: literally anyone: service providers, your head of IT (who might get fired), your head of sales (who might have to explain to customer lawyers why their data leaked), the CEO, etc. They don't want to be on the spot for your mistakes. For public companies this is worse because now you have publicly traded shares in a very litigious environment with people looking for weaknesses that can be exploited to squeeze money out of any situation. And of course some of the tools in this space are made by publicly traded companies too. The easiest way to deal with security is applying a shotgun approach of applying any kind of stuff that is vaguely understood to maybe work. The actual effectiveness of these things is besides the point and of course much of it is snake oil. The point is that there are policies and they are being enforced. The more visible and annoying this is, the more effective it is in case of trouble as a means to say "well it wasn't my fault because we did X, Y, and Z". And of course a secondary effect of putting people on the job of securing a thing is that they will get busy doing their job to justify their existence. Which usually means a whole bunch of policy documents get written, tools get selected (preferably ones with big shiny reputations), and a lot of complexity gets introduced. There will be audits, consultants being consulted, chins being stroked, and a lot of money changing hands all for the assertion that "your ass is covered!" and by extension "theirs" as well. There are whole meta levels of ass coverage here. That's why security theater is a thing. Because there is a large audience of people that all need to be re-assured about having suitable amounts of ass coverage.

aulin 2y ago

Always assumed they block everything they cannot spy, it's not for security. Https they inject their certificates, ssh you can have your key and they'll be blind. And they spy to prevent exfiltration they say. I cannot ssh into my home network but I can drop tons of company code into an LLM prompt. Everything else, MFA, password rotations, approved software, stupid training videos... is all there to tick some boxes in a certification process or to easily shift the blame when something bad happens.

necovek 2y ago
Because of MITM-ing TLS with their own certificates, they could also stop you from dumping tons of code into an LLM prompt by blocking all public LLMs (or even all sites not on an allowlist). The reason it's silly is really that you can always take "secrets" with you, be it by taking photos with your phone ("lets ban phones") or memorizing or writing on paper. Security is useful when it prevents accidental, inadvertent leakage of information ("stop me from shooting myself in the foot"). Anything else, and the inconvenience will make people figure out ways around it. And the real reason people won't leak information is either ethics and morality, or legal liability.
- MattPalmer1086 2y ago
  You overestimate the intelligence of a lot of people. We have caught attempts at exfiltration over channels we can easily monitor. Is it perfect? No. Can reasonably intelligent people find a way around them? Sure. But we are still going to control that information flow where we can.
  - necovek 2y ago
    So, as the OP claims, it is working for the 35% of the employees, right? And it likely inconveniences a full 100%. Does that sound like a smart trade-off?
    - MattPalmer1086 2y ago
      What is the alternative? I have actually worked in places that prevented all personal electronic devices in the building, had security guards and bag searches on every floor and no internet access on your desktop. You don't know what inconvenience looks like!