3 ms·

I work at a large software company and recently documented the number of steps it takes me every morning to fully log into every system I need for work. I stopp

by paxys 2y ago

I work at a large software company and recently documented the number of steps it takes me every morning to fully log into every system I need for work. I stopped at 37. And every year in response to all the breaches in the news the company spends more money to hire another security team who simply pile on another redundant layer on top. The industry has jumped the shark when it comes to IT security. It's the corporate equivalent of spending tens of billions of dollars on the TSA and making everyone take their shoes off at the airport. Meanwhile someone with intent can stroll into JFK, casually bypass all security checkpoints and get on a plane to Paris without a boarding pass.

tstrimple 2y ago
I work for a large consulting company (300k+ employees globally) and 99% of our internal resources are all secured by Ping. One identity and MFA app. SSO between just about everything. The client I'm currently working for with that company has all of their auth handled by Entra. All their internal docs, their azure subscriptions, their gitub repos. All the same user identity. Shit IT isn't inevitable. It's a decision, or often lack of a decision and result of "organic" growth.
- epiecs 2y ago
  Same here. We had a very fragmented landscape (multiple idp tools, some tools using internal users,...). We consolidated everything to entra (450 apps and counting) and everybody couldn't be happier. Full sso on everything + scim where available. We do offcourse have conditional access + PIM for admins but that is to be expected. You just need a good strategy on how you are going to tackle IAM and then just stick to it.
hedora 2y ago
Security is usually defined as confidentiality, integrity and availability. (Not in order of importance, just to spell “CIA”). If it takes that long to log in, the system is not available, and therefore insecure. Full stop. The security team responsible for that setup should be fired. In related news, I’ve been watching old murder mysteries from the ‘60s. Typical plot points include the fact that you can decide to fly from Los Angeles and arrive anywhere on the west coast with in 2-3 hours because the planes leave every 30 minutes. Why wouldn’t you just walk up to the gate and buy a ticket? Why do we put up with this TSA bullshit?
archi42 2y ago
That's security theater. Some decision makers want to "see" it's secure, so that's what some "security" people sell. If I was doing consultation for your employer, I'd tell them that's insane and that they will only push people to circumvent security instead of embracing it. Others made good points, a decent SSO is the way to go. (Ironically we also have an internal system that's equally degenerate and mostly a shitload of useless theater; it's secure of course, but there are a few pointless layers stacked on top of what makes it actually secure)
MattPalmer1086 2y ago
Why is the company hiring a new security team each year? Where the ownership and strategic thinking? Sounds like your organisation is extremely dysfunctional, and the ridiculous security you have is a symptom of that. None of that is inevitable.
- mikeyouse 2y ago
  Nor is it uncommon though.. That description sounds very familiar.

by paxys 2y ago

tstrimple 2y ago

I work for a large consulting company (300k+ employees globally) and 99% of our internal resources are all secured by Ping. One identity and MFA app. SSO between just about everything. The client I'm currently working for with that company has all of their auth handled by Entra. All their internal docs, their azure subscriptions, their gitub repos. All the same user identity. Shit IT isn't inevitable. It's a decision, or often lack of a decision and result of "organic" growth.

epiecs 2y ago
Same here. We had a very fragmented landscape (multiple idp tools, some tools using internal users,...). We consolidated everything to entra (450 apps and counting) and everybody couldn't be happier. Full sso on everything + scim where available. We do offcourse have conditional access + PIM for admins but that is to be expected. You just need a good strategy on how you are going to tackle IAM and then just stick to it.

hedora 2y ago

Security is usually defined as confidentiality, integrity and availability. (Not in order of importance, just to spell “CIA”). If it takes that long to log in, the system is not available, and therefore insecure. Full stop. The security team responsible for that setup should be fired. In related news, I’ve been watching old murder mysteries from the ‘60s. Typical plot points include the fact that you can decide to fly from Los Angeles and arrive anywhere on the west coast with in 2-3 hours because the planes leave every 30 minutes. Why wouldn’t you just walk up to the gate and buy a ticket? Why do we put up with this TSA bullshit?

archi42 2y ago

That's security theater. Some decision makers want to "see" it's secure, so that's what some "security" people sell. If I was doing consultation for your employer, I'd tell them that's insane and that they will only push people to circumvent security instead of embracing it. Others made good points, a decent SSO is the way to go. (Ironically we also have an internal system that's equally degenerate and mostly a shitload of useless theater; it's secure of course, but there are a few pointless layers stacked on top of what makes it actually secure)

MattPalmer1086 2y ago

Why is the company hiring a new security team each year? Where the ownership and strategic thinking? Sounds like your organisation is extremely dysfunctional, and the ridiculous security you have is a symptom of that. None of that is inevitable.

mikeyouse 2y ago
Nor is it uncommon though.. That description sounds very familiar.