4 ms·

Our organization contracts out our IT, I can cannot stress enough how bad/lazy their cyber security guys are. It feels like the owner told his directionless son

Our organization contracts out our IT, I can cannot stress enough how bad/lazy their cyber security guys are. It feels like the owner told his directionless son "Hey boy, if you manage to pass this cert class I'll make you head of cyber security!" Every few months we need to change our password. It cannot be a previously used password. It needs uppercase, lowercase, number, special character and minimum 12 characters. We have 2FA that is easily bypassed by going offline then back online once through login. We have 4 different active security suites running on our machines, and mandatory biweekly virus scans, at 10am (which cannot be changed). Every standard 16GB machine runs on it's knees all day long. But at least you can skip 2fa by turning off wifi real fast.

formerly_proven 2y ago
We made IT security a checklist compliance exercise and call it cybersecurity, and then we are shocked and surprised the main deliverable turns out to be checked checklists, not security.
- nonrandomstring 2y ago
  Don't stop there. You can make some even greater efficiencies. By having cyber-insurance you can do nothing and just have someone pay you out money when you fuck up. There's no end of ways security theatre and half-arsed "compliance" can help lower standards,
  - quacksilver 2y ago
    To be fair, if using insurance and risking being hacked anyway has a higher expected net payoff than implementing a given set of security measures, then you may be financially incentivized (or legally beholden to your shareholders) to take the risk, get hacked and pay any fines if it gets discovered. The security literature refers to it as "risk transference". Chances are your company ultimately exists to optimize for shareholder value
SketchySeaBeast 2y ago
I personally can't imagine trying to be a cybersecurity person. I'd be going out of my mind, concerned with all the things I can't keep up with. As a full stack dev, if I don't know what's new in React 19 it doesn't really hurt anybody, but if the cybersecurity people aren't up to date, that could very well be the end of the company. Either you're hot shit, just think you're hot shit, or you simply don't care, and that blend really scares me.

formerly_proven 2y ago

We made IT security a checklist compliance exercise and call it cybersecurity, and then we are shocked and surprised the main deliverable turns out to be checked checklists, not security.

nonrandomstring 2y ago
Don't stop there. You can make some even greater efficiencies. By having cyber-insurance you can do nothing and just have someone pay you out money when you fuck up. There's no end of ways security theatre and half-arsed "compliance" can help lower standards,
- quacksilver 2y ago
  To be fair, if using insurance and risking being hacked anyway has a higher expected net payoff than implementing a given set of security measures, then you may be financially incentivized (or legally beholden to your shareholders) to take the risk, get hacked and pay any fines if it gets discovered. The security literature refers to it as "risk transference". Chances are your company ultimately exists to optimize for shareholder value

SketchySeaBeast 2y ago

I personally can't imagine trying to be a cybersecurity person. I'd be going out of my mind, concerned with all the things I can't keep up with. As a full stack dev, if I don't know what's new in React 19 it doesn't really hurt anybody, but if the cybersecurity people aren't up to date, that could very well be the end of the company. Either you're hot shit, just think you're hot shit, or you simply don't care, and that blend really scares me.