4 ms·

It’s a trade-off. Most people are never going to check the links no matter how much you ask them to, and even if they did they wouldn’t know what to check for.

It’s a trade-off. Most people are never going to check the links no matter how much you ask them to, and even if they did they wouldn’t know what to check for. But the tool Microsoft give you to check a link before opening it is that awful URL rewriter, which prevents the small minority who would check from being able to. Similarly those flashing cmd windows are usually automatic update processes that Windows has no way to hide. Even some drivers that MS distribute through Windows Update do it. We could turn automatic updates off, but then nobody would update their software. IT is rough because you’re often stuck between a rock and a hard place. On the one side you have users who don’t want to change their behaviour, on the other side you have industry leading vendors, that the SLT insist on using, that make it impossible to do the right thing or put the right thing on an Enterprise plan that the budget won’t permit. Then to top it off, there are usually compliance and insurance breathing down your neck forcing you to implement questionable best practices from the 90s, so you just have to do your best to limit the damage.

mobiuscog 1y ago
There is an easy answer. Give employees two computers. One is the 'business' one. Mostly locked down, with checks in place. The other is on a different network, isolated from all business functions, and they can do what they want but must never use it for work data, just like their phones (that everyone knows they use for social media etc. in the day). Sure, you still have to deal with copying from one to the other (but there are solutions for that if critical, and much easier to secure). It sounds crazy, but air-gaps are largely proven and it also means that employees feel less oppressed. Now I realise, even ignoring the cost, businesses won't want this, as perish the thought their employees may do anything other than work. But I suspect it would actually stop more attacks and issues than otherwise and maybe... just maybe.. employees feel as if they're actually human.
- sigwinch 1y ago
  Just call one business internal and the other one LLM inference. You don’t want AI crafting packets on business internal.
- dweekly 1y ago
  Your "crazy" proposition is exactly the reality at many companies: the work computer is increasingly isolated from the Internet. At my last employer their game plan for employees was to move the whole web to a whitelist approach - if you want to browse the web freely, use your personal computer or personal phone. So most of us carted around a work laptop (connected to corp WiFi) a personal laptop (on guest WiFi or tethered) a work phone and a personal phone. In other news, you should never ever MDM enroll your personal phone with a work BYOD policy.
- cameronh90 1y ago
  It's not really an easy answer as (1) it doesn't stop phishing attacks hitting work emails so isn't really relevant anyway, (2) most people, executives especially, don't want to cart multiple devices around, which is why we now have to deal with the security nightmare that is supporting work stuff on BYOD phones, (3) I don't work for a SV company with the budget to buy everyone two laptops, and if we did, honestly I think most people would prefer a better single laptop than two mediocre ones. Besides, most people just treat their phone as their personal portable device now. The odd person brings their own laptop. Developers are the exception here, where usually they'd prefer to develop on a machine with minimal BS running, even if it means carrying around an ultraportable in addition to their development workstation laptop.
arghwhat 1y ago
I do not believe this is a trade-off, I believe this behavior from corporate IT is a primary cause of the problem. I do agree that dealing with users is awful, but that doesn't justify solutions that only make things worse. The flashing cmd.exe windows are not drivers from Windows Update - this could have been the case as drivers shipped with Windows Update is a total security nightmare running arbitrary code with administrative privileges upon hotplug - but in this context of managed devices, commonly from HP or Lenovo's corporate portfolio, it's usually additional products and changes pushed by group policy or random management software. The often changing user prompts, looking like they were from some early 2000's hello world example, come from obscure and overlapping management software they remotely deploy which they change at will. You don't need a proprietary solution to remotely upgrade Google Chrome, just specify an enterprise policy with auto-update. You don't need a proprietary solution to prompt users and manage Windows Update, because you have... Windows Update. The URL checker has no valid benefit, and makes it so people can never learn how to do it themselves. The browser performs the exact same checks with the exact same capabilities through its safe browsing stuff, and corporate IT often has network-level solutions too. Corporate IT uses emails services that spoof domains and look suspicious, reversing all the phishing training they paid for. Not to mention that Corporate IT might deploy network-wide solutions like Cisco Umbrella, which is a TLS Man-in-the-Middle attack where you install their root CA on all machines and let them control DNS to randomly redirect all traffic to their servers, effectively undermining the basis of all modern web security for the entire organization. In general there's a fetish for buying products that has significant negative impact to security, user experience and possibility of training users, usually for the purpose of feigning progress and meeting some targets. Say, they had a ransomware incident, and now they're buying every ransomware product for a few years. Stuff with such buggy kernel code that it deadlocks and makes it impossible to create new processes until you hard reboot. I'm sure that's not a security problem!
- lcnPylGDnU4H9OF 1y ago
  > Cisco Umbrella My current employer was somewhat recently purchased by a large, publicly-traded company and I had this installed on my work machine. Suddenly DoH was forced off by administrator policy and I had to use some specific internal IP for DNS. Which isn't strictly less secure but let's just say I would, even for my large, publicly-traded business, trust Mullvad more than Cisco.
Den_VR 1y ago
I sure do miss the days before browser makers conspired to make it near impossible to check the certs when there’s a certificate related error. “Most people are never going to check properly” is a poor excuse.

mobiuscog 1y ago

There is an easy answer. Give employees two computers. One is the 'business' one. Mostly locked down, with checks in place. The other is on a different network, isolated from all business functions, and they can do what they want but must never use it for work data, just like their phones (that everyone knows they use for social media etc. in the day). Sure, you still have to deal with copying from one to the other (but there are solutions for that if critical, and much easier to secure). It sounds crazy, but air-gaps are largely proven and it also means that employees feel less oppressed. Now I realise, even ignoring the cost, businesses won't want this, as perish the thought their employees may do anything other than work. But I suspect it would actually stop more attacks and issues than otherwise and maybe... just maybe.. employees feel as if they're actually human.

sigwinch 1y ago
Just call one business internal and the other one LLM inference. You don’t want AI crafting packets on business internal.
dweekly 1y ago
Your "crazy" proposition is exactly the reality at many companies: the work computer is increasingly isolated from the Internet. At my last employer their game plan for employees was to move the whole web to a whitelist approach - if you want to browse the web freely, use your personal computer or personal phone. So most of us carted around a work laptop (connected to corp WiFi) a personal laptop (on guest WiFi or tethered) a work phone and a personal phone. In other news, you should never ever MDM enroll your personal phone with a work BYOD policy.
cameronh90 1y ago
It's not really an easy answer as (1) it doesn't stop phishing attacks hitting work emails so isn't really relevant anyway, (2) most people, executives especially, don't want to cart multiple devices around, which is why we now have to deal with the security nightmare that is supporting work stuff on BYOD phones, (3) I don't work for a SV company with the budget to buy everyone two laptops, and if we did, honestly I think most people would prefer a better single laptop than two mediocre ones. Besides, most people just treat their phone as their personal portable device now. The odd person brings their own laptop. Developers are the exception here, where usually they'd prefer to develop on a machine with minimal BS running, even if it means carrying around an ultraportable in addition to their development workstation laptop.

arghwhat 1y ago

I do not believe this is a trade-off, I believe this behavior from corporate IT is a primary cause of the problem. I do agree that dealing with users is awful, but that doesn't justify solutions that only make things worse. The flashing cmd.exe windows are not drivers from Windows Update - this could have been the case as drivers shipped with Windows Update is a total security nightmare running arbitrary code with administrative privileges upon hotplug - but in this context of managed devices, commonly from HP or Lenovo's corporate portfolio, it's usually additional products and changes pushed by group policy or random management software. The often changing user prompts, looking like they were from some early 2000's hello world example, come from obscure and overlapping management software they remotely deploy which they change at will. You don't need a proprietary solution to remotely upgrade Google Chrome, just specify an enterprise policy with auto-update. You don't need a proprietary solution to prompt users and manage Windows Update, because you have... Windows Update. The URL checker has no valid benefit, and makes it so people can never learn how to do it themselves. The browser performs the exact same checks with the exact same capabilities through its safe browsing stuff, and corporate IT often has network-level solutions too. Corporate IT uses emails services that spoof domains and look suspicious, reversing all the phishing training they paid for. Not to mention that Corporate IT might deploy network-wide solutions like Cisco Umbrella, which is a TLS Man-in-the-Middle attack where you install their root CA on all machines and let them control DNS to randomly redirect all traffic to their servers, effectively undermining the basis of all modern web security for the entire organization. In general there's a fetish for buying products that has significant negative impact to security, user experience and possibility of training users, usually for the purpose of feigning progress and meeting some targets. Say, they had a ransomware incident, and now they're buying every ransomware product for a few years. Stuff with such buggy kernel code that it deadlocks and makes it impossible to create new processes until you hard reboot. I'm sure that's not a security problem!

lcnPylGDnU4H9OF 1y ago
> Cisco Umbrella My current employer was somewhat recently purchased by a large, publicly-traded company and I had this installed on my work machine. Suddenly DoH was forced off by administrator policy and I had to use some specific internal IP for DNS. Which isn't strictly less secure but let's just say I would, even for my large, publicly-traded business, trust Mullvad more than Cisco.

Den_VR 1y ago

I sure do miss the days before browser makers conspired to make it near impossible to check the certs when there’s a certificate related error. “Most people are never going to check properly” is a poor excuse.