18 ms·

> I disagree with other posts here, it is partially a balance between security and usability. And economics. Many people here are blaming incompetent security

• Wowfunhappy 1y ago
  Maybe it wouldn't make a difference, but if I was the IT person telling users they have to change their passwords every 90 days, I would 100% include a line in the email blaming the insurance company.
  • foobarchu 1y ago
    I'm not in an IT dept (developer instead), but I'd bet money that would get you a thorough dressing down by an executive involved with the insurance. That sort of blaming goes over well with those at the bottom of the hierarchy, and poorly with those at the top.
    • Wowfunhappy 1y ago
      The insurance people are not a part of the company, so I'm not sure who would be offended. I wouldn't be mean about it. I'm imagining adding a line to the email such as: > (Yes, I know this is annoying, but it's required by our insurance company.) What is the insurance company going to do, jack up our rates because we accurately stated what their policy was?
      • int_19h 1y ago
        The problem is that this particular insurance company was picked by someone who does work in yours.
        • Wowfunhappy 1y ago
          This seems like a pretty awful place to work if my bosses have such fragile egos they can't handle me saying "our insurance requires us to do X". I'm not even really passing judgement on whether X is good or bad. I'm not saying you're wrong, I've never worked in a company this large (except for a brief internship), or in IT specifically. But also, like, come on people, grow up.
  • bigfatkitten 1y ago
    You would probably have no idea what the requirement actually said or where it ultimately came from. It would've gone from the insurer to the legal team, to the GRC team, to the enterprise security team, to the IT engineering team, to the IT support team, and then to the user. Steps #1 to #4 can (and do) introduce their own requirements, or interpret other requirements in novel ways, and you'd be #5 in the chain.
• swiftcoder 1y ago
  Not just economics, audit processes also really encourage adopting large rulesets wholesale. We're SOC2 + HIPAA compliant, which either means convincing the auditor that our in-house security rules cover 100% of the cases they care about... or we buy an off-the-shelf WAF that has already completed the compliance process, and call it a day. The CTO is going to pick the second option every time.
  • mjr00 1y ago
    Yeah. SOC2 reminds me that I didn't mention sales as well, another security-as-economics feature. I've seen a lot of enterprise RFPs that mandate certain security protocols, some of which are perfectly sensible and others... not so much. Usually this is less problematic than insurance because the buyer is more flexible, but sometimes they (specifically, the buyer's company's security team, who has no interest besides covering their own ass) refuse to budge. If your startup is on the verge of getting a 6 figure MRR deal with a company, but the company's security team mandates you put in a WAF to "protect their data"... guess you're putting in a WAF, like it or not.
    • meindnoch 1y ago
      >guess you're putting in a WAF, like it or not. Install the WAF crap, and then feed every request through rot13(). Everyone is happy!
      • throwup238 1y ago
        Up until you need to exercise the insurance policy and the court room "experts" come down on you like a ton of bricks.
      • benaubin 1y ago
        now you've banned several different arbitrary strings!
        • connicpu 1y ago
• lucianbr 1y ago
  There should be some limits and some consequences to the insurer as well. I don't think the insurer is god and should be able to request anything no matter if it makes sense or not and have people and companies comply. If anything, I think this attitude is part of the problem. Management, IT security, insurers, governing bodies, they all just impose rules with (sometimes, too often) zero regard for consequences to anyone else. If no pushback mechanism exists against insurer requirements, something is broken.
  • mjr00 1y ago
    > There should be some limits and some consequences to the insurer as well. I don't think the insurer is god and should be able to request anything no matter if it makes sense or not and have people and companies comply. If the insurer requested something unreasonable, you'd go to a different insurer. It's a competitive market after all. But most of the complaints about incompetent security practices boil down to minor nuisances in the grand scheme of things. Forced password changes once every 90 days is dumb and slightly annoying but doesn't significantly impact business operations. Having to run some "enterprise security tool" and go through every false positive result (of which there will be many) and provide an explanation as to why it's a false positive is incredibly annoying and doesn't help your security, but it's also something you could have a $50k/year security intern do. Turning on a WAF that happens to reject the 0.0001% of Substack articles which talk about /etc/hosts isn't going to materially change Substack's revenue this year.
    • vladvasiliu 1y ago
      The issue is that the Finance dept will show up and ask why you chose the more expensive insurance. Sure, if you're able to show how much the annoyances of the cheaper company would cost you, they'd probably shut it. But I'd argue it's not that easy. Plus, all these annoyances aren't borne by the security team, so they don't care that much in the end.
      • HappMacDonald 1y ago
        My first thought might be to put together a report showing the cost that the cheaper insurance would impose upon the organization which the more expensive up-front option is saving you. Perhaps even serve that up as a cost-savings the finance department is free to then take credit for, I'unno. :P
• josephcsible 1y ago
  Why wouldn't the IT people just tell the grumbling employees that exact explanation?
  • the8472 1y ago
    In small orgs that might happen, in large orgs it's some game of telephone where the insurance requirements are forwarded to the security team which makes the policies which are enforced by several layers of compliance which come down on the local IT department. The underlying purpose of the rules and agency to apply the spirt rather than the letter gets lost early in the chain and trying to unwind it can be tedious.
  • derektank 1y ago
    IT doesn't always hear the grumbles, hidden away as they frequently are behind a ticketing system; the help desk technicians who do hear the grumbles aren't always informed of the "why" behind certain policies, and don't have the time or inclination to go look them up if they're even documented; and it's a very unsatisfying answer even if one receives a detailed explanation. Information loss is an inherent property of large organizations.
    • decasia 1y ago
      > Information loss is an inherent property of large organizations. That's such an interesting axiom, I'm curious if you would want to say more about it? It feels right intuitively - complexity doesn't travel easily across contexts and reaching a common understanding is harder the more people you're talking to.
      • resonious 1y ago
        On a more micro level, I find it very hard to write good documentation. I always forget something that once pointed out seems obvious. Or worse, the reader is missing some important context that many other readers are already privy to. Not to mention, some people don't even seek out docs before acting. I imagine this gets amplified in a large org. The docs are lacking, people might not read them anyway, and you get an explosion of people who don't understand very much but still have a job to do.
• betaby 1y ago
  > but a lot of seemingly dumb security policies are due to insurers. I keep hearing that often on HN, however I've personally never seen seen such demands from insurers. I would greatly appreciate if one share such insurance policy. Insurance policies are not trade secrets and OK to be public. I can google plenty of commercial cars insurance policies for example.
  • manwe150 1y ago
    You can buy insurance for just about anything, not just cars. Companies frequently buy insurance against various low-probability incidents such as loss of use, fraud, lawsuit, etc.
  • simonw 1y ago
    I found an example! https://retail.direct.zurich.ch/resources/definition/product/CyberSme/it/ch/Cyber%20KMU_Richiesta%20d%20offerta_IT__1582810100000.pdf https://retail.direct.zurich.ch/resources/definition/product... Questionnaire Zurich Cyber Insurance Question 4.2: "Do you have a technically enforced password policy that ensures use of strong passwords and that passwords are changed at least quarterly?" Since this is an insurance questionnaire, presumably your answers to that question affect the rates you get charged? (Found that with the help of o4-mini https://chatgpt.com/share/680bc054-77d8-8006-88a1-a6928ab99a25 https://chatgpt.com/share/680bc054-77d8-8006-88a1-a6928ab99a...)
    • kiitos 1y ago
      Directly following is question 4.3: "Are users always prevented from installing programs on end-user devices?" Totally bonkers stuff.
      • 9x39 1y ago
        A trend for corporate workstations is moving closer to a phone with a locked-down app store, with all programs from a company software repo. Eliminating everything but a business's industry specific apps, MS Office, and some well-known productivity tools slashes support calls (no customization!) and frustrates cyberattacks to some degree when you can't deploy custom executables.
• smeg_it 1y ago
  I'm no expert, but I did take a CISSP course a while ago. One thing I actually remember ;P, is that it recommended long passwords in in lieu of the number, special character, upper, lower ... I don't remember the exact wording of course and maybe it did recommend some of that, but it talked about having a sentence rather than all that mess in 6-8 characters, but many sites still want the short mess that I never will actually remember
  • mcoliver 1y ago
    entropy is stronger than complexity. https://xkcd.com/936/ https://xkcd.com/936/
    • joseda-hg 1y ago
      I wonder how many people have used Correct Horse Battery Staple as a password thanks to this comic
      • D-Coder 1y ago
        Ah, just mix them up randomly: Staple Battery Correct Horse!
      • smj-edison 1y ago
        > Makes password "xkcd.com/936"
  • vlovich123 1y ago
    While the password recommendation stuff is changing (the US government updating it guidelines last year), it’s generally best practice to not share passwords which itself implies using a password manager anyway which makes the whole “long passphrase” vs “complex” password moot - just generate 32 lowercase random characters to make it easier to type or use the autogenerated password your password manager recommends. The long passphrase is more for the key that unlocks your password manager rather than the random passwords you use day to day.
• simonw 1y ago
  I wish IT teams would say "sorry about the password requirement, it's required by our insurance policy". I'd feel a lot less angry about stupid password expiration rules if they told me that.
  • cratermoon 1y ago
    Sometime in the past few years I saw a new wrinkle: password must be changed every 90 days unless it is above a minimum length (12 or so as best I recall) in which case you only need to change it yearly. Since the industry has realized length trumps dumb "complexity" checks, it's a welcome change to see that encoded into policy.
    • manwe150 1y ago
      I think I like this idea that the rotation interval could be made proportional to length, for example doubling the interval with each additional character. Security standards already now acknowledge that forced yearly rotation is a net decrease in security, so this would incentivize users to pick the longest password for which they would tolerate the rotation interval. Is yearly rotation too annoying for you? For merely the effort of going from 12 -> 14 characters, you could make it 4 years instead, or 8 years, 16, and so on.
      • connicpu 1y ago
        Can confirm when I found out I'd be required to regularly change my password the security of it went down significantly. At my current job when I was a new employee I generated a secure random password and spent a week memorizing it. 6 months later when I found out I was required to change it, I reverted to a variation of the password I used to use for everything years ago with some extra characters at the end that I'll be rotating with each forced change...
        • byproxy 1y ago
          Why not make use of a password manager?
• afiori 1y ago
  I believe that these kind of decisions are mostly downstream of security audits/consultants with varying level of up to date slideshows. I believe that this is overall a reasonable approach for companies that are bigger than "the CEO knows everyone and trusted executives are also senior IT/Devs/tech experts" and smaller than "we can spin an internal security audit using in-house resources"
• II2II 1y ago
  > If an insurer says "we're going to jack up premiums by 20% unless you force employees to change their password once every 90 days", you can argue till you're blue in the face that it's bad practice, NIST changed its policy to recommend not regularly rotating passwords over a decade ago, etc., and be totally correct... but they're still going to jack up premiums if you don't do it. I would argue that password policies are very context dependent. As much as I detest changing my password every 90 days, I've worked in places where the culture encouraged password sharing. That sharing creates a whole slew of problems. On top of that, removing the requirement to change passwords every 90 days would encourage very few people to select secure passwords, mostly because they prefer convenience and do not understand the risks. If you are dealing with an externally facing service where people are willing to choose secure passwords and unwilling to share them, I would agree that regularly changing passwords creates more problems than it solves.
  • Aeolun 1y ago
    > removing the requirement to change passwords every 90 days would encourage very few people to select secure passwords When you don’t require them to change it, you can just assign them a random 16 character string and tell them it’s their job to memorize it.
    • phito 1y ago
      There's no way I will ever remember it. I will write it down. Let me choose my own password (passphrase if I need to remember it)
• patrakov 1y ago
  Worse. If you are not in the USA, i.e., if NIST is not the correct authority, that insurer might actually be enforcing what the "correct" authority believes to be right, i.e., password expiration.
• 620gelato 1y ago
  > jack up premiums by 20% unless you force employees to change their password once every 90 days" Always made me judge my company's security teams as to why they enable this stupidity. Thankfully they got rid of this gradually, nearly 2 years ago now (90 days to 365 days to never). New passwords were just one key l/r/u/d on the keyboard. Now I'm thinking maybe this is why the app for a govt savings scheme in my country won't allow password autofill at all. Imagine expecting a new password every 90 days and not allowing auto fill - that just makes passwords worse.
• wvh 1y ago
  Having worked with PCI-DSS, some rules seem to only exist to appease insurance. When criticising decisions, you are told that passing audits to be able to claim insurance is the whole game, even when you can demonstrate how you can bypass certain rules in reality. High-level security has more to do with politics (my definition) than purely technical ability. I wouldn't go as far as to call it security theatre, there's too much good stuff there that many don't think about without having a handy list, but the game is certainly a lot bigger than just technical skills and hacker vs anti-hacker. I still have a nervous tick from having a screen lock timeout "smaller than or equal to 30 seconds".