One chestnut from my history in lottery game development:
While our security staff was incredibly tight and did a generally good job, oftentimes levels of paranoia were off the charts.
Once they went around hot gluing shut all of the “unnecessary” USB ports in our PCs under the premise of mitigating data theft via thumb drive, while ignoring that we were all Internet-connected and VPNs are a thing, also that every machine had a RW optical drive.
Often times you’ll find that the crazy things IT does are forced on them from higher ups that don’t know shit.
A common case of this is requiring password changes every x days, which is a practice that is known to actively make passwords worse.
I’m in IT security and I’m fighting this battle. I want to lessen the burden of passwords and arbitrary rotation is terrible.
I’ve ran into a number of issues at my company that would give me the approval to reduce the frequency of expired passwords
-
the company gets asked this question by other customers “do you have a password policy for your staff?” (that somehow includes an expiration frequency).
-
on-prem AD password complexity has some nice parts built in vs some terrible parts with no granularity. It’s a single check box in gpo that does way too much stuff. I’m also not going to write a custom password policy because I don’t have the skill set to do it correctly when we’re talking about AD, that’s nightmare inducing. (Looking at specops to help and already using Azure AD password protection in passive mode)
-
I think management is worried that a phishing event happens on a person with a static password and then unfairly conflating that to my argument of “can we just do two things: increase password length by 2 and decrease expiration frequency by 30 days”
At the end of the day, some of us in IT security want to do the right things based in common sense but we get stymied by management decisions and precedence. Hell, I’ve brought NIST 800-63B documentation with me to check every reason why they wouldn’t budge. It’s just ingrained in them - meanwhile you look at the number of tickets for password help and password sharing violations that get reported … /Sigh
At the end of the day, some of us in IT security want to do the right things based in common sense but we get stymied by management decisions and precedence. Hell, I’ve brought NIST 800-63B documentation with me to check every reason why they wouldn’t budge. It’s just ingrained in them - meanwhile you look at the number of tickets for password help and password sharing violations that get reported …
Paint the picture for management:
At one time surgery was the purview of medieval barbers. Yes, the same barbers that cut your hair. At the time there were procedures to intentionally cause people to bleed excessively and cutting holes the body to let the one of the “4 humors” out to make the patient well again. All of this humanity arrived at with tens of thousands of years of existence on Earth. Today we look at this as uninformed and barbaric. Yet we’re doing the IT Security equivalent of those medieval barber still today. We’re bleeding our users unnecessarily with complex frequent password rotation and other bad methods because that’s what was the standard at one time. What’s the modern medicine version of IT Security? NIST 800-63B is a good start. I’m happy to explain whats in there. Now, do we want to keep harming our users and wasting the company’s money on poor efficiency or do we want to embrace the lesson learned from that bad past?
I feel this. I increased complexity and length, and reduced change frequency to 120d. It worked really well with the staggered rollout. Shared passwords went down significantly, password tickets went to almost none (there’s always that ‘one’). Everything points to this being the right thing and the fact that NIST supports this was a win… until the the IT audit. The auditor wrote “the password policy changed from 8-length, moderate complexity, 90-day change frequency to 12-length, high complexity, 120-day change frequency” and the board went apeshit. It wasn’t an infraction or a “ding”, it was only a note. The written policy was, of course, changed to match the GPO, so the note was for the next auditor to know of the change. The auditor even mentioned how he was impressed with the modernity of our policy and how it should lead to a better posture. I was forced to change it back, even though I got buyin from CTO for the change. BS.
Having been exposed to those kinds of audits before that’s really just bad handling by the CTO and other higher ups!
Oh, I agree. Just one reason I decided to move on to a different employer.
-
What I really love is mandatory length and character password policies so complex that together with such password change requirements that push people beyond what is humanly possible to memorize, so it all ends down written in post-its, the IT equivalent of having a spare key under a vase or the rug.
And in my company the password change policies are very different from one system to another. Some force a change monthly, some every 28 days, some every 90 days, and thwn there is rhat one legacy system that no longer has a functioning password change mechanism, so we can’t change passwords there if we wanted to.
And the different systems all want different password formats, have different re-use rules.
And, with all those uncoordinated passwords, they don’t allow password managers to be used on corporate machines, despite the training materials that the company makes us re-do every year recommending password managers…
For our org, we are required to do this for our cybersecurity insurance plan
Tell them NIST now recommends against it so the insurance company is increasing your risks
The guideline is abundantly clear too with little room for interpretation:
5.1.1.1 Memorized Secret Authenticators
Verifiers SHOULD NOT impose other composition rules (e.g., requiring mixtures of different character types or prohibiting consecutively repeated characters) for memorized secrets. Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically). However, verifiers SHALL force a change if there is evidence of compromise of the authenticator.
So glad we opted for a longer password length, with fewer arbitrary limits, and expiry only after 2 years or a suspected breach.
The DOD was like this. And it wasn’t just that you had to change passwords every so often but the requirements for those passwords were egregious but at the same time changing 1 number or letter was enough to pass the password requirements.
Even better is forcing changes every 30 or 60 days, and not allowing changes more than every week. Our users complain daily between those rules and the password requirements that they are too dumb to understand.
Set the automatic timeout for admin accounts to 15 minutes…meaning that process that may take an hour or so you have to wiggle the mouse or it logs out …not locks… logs out
From installs to copying log files, to moving data to reassigning owner of data to the service account.
And that’s why people use mouse jigglers and keep their computers unlocked 24/7.
Mine was removed by Corporate IT, along with a bunch of other open source stuff that made my life bearable.
Also I spent 5 months with our cyber security guys to try and provide a simple file replication server for my team working in a remote office with shit internet connectivity. I gave up, the spooks put up a solid defense, push all the onerous IT security compliance checking onto my desk instead of taking control.
Not as bad as my previous company though, outsourced IT support to ATOS was a nightmare.
That’s why you buy a jiggler that you place your mouse onto. Not detectable by IT :)
I set my pocket knife on the ctrl key when I have to step away.
Does that keep your status in Teams as “online”? That’s what I use the jiggler for - if I’m waiting for CI tests which take 30+ minutes and I sit in front of the laptop, I don’t want to have to manually jiggle my mouse every couple of minutes just to keep my status.
Yep
I had to run experiments that generate a lot of data (think hundreds of megabytes per minute). Our laptops had very little internal storage. I wasn’t allowed to use an external drive, or my own NAS, or the company share - instead they said “can’t you just delete the older experiments?”… Sure, why would I need the experiment data I’m generating? Might as well /dev/null it!
Oh hey I was living this a few months ago!
deleted by creator
Nah mate, they were completely right. What if you install an older version, and keep using it maliciously? Oh wait, now that you mention, I’m totally sure Edge had a similar problem at one point in the past. So refrain from using Edge, too. Or Explorer. And while we’re at it, it’s best to stay away from Chrome, as well. That had a similar vulnerability before, I’m sure. So let’s dish that, along with Opera, Safari, Maxthon and Netscape Navigator. Just use Lynx, it’s super lightweight!
EDIT: on another thought, you should just have stopped working for the above reason. Nothing is safe anymore.
Can’t use Lynx either.
https://www.cvedetails.com/cve/CVE-2010-2810/
All web pages must now be phoned in via a touch-tone system, and delivered on paper printouts via regular post.
Touch-tones had some sort of vulnerability too; you’re going to have to mail in your HTTP requests.
Admin access needed to change the clock, which was wrong. Missed a train because of that.
We cant run scripts on our work laptop because of domain policy. Thing is, I am a software developer. They also do not allow docker without some heavy approval process, nor VMs. So im just sitting here remoting into a machine for development…which is fine but the machine is super slow. Also their VPN keeps going down, so all the software developers have to reconnect periodically all at the same time.
At my prior jobs, it was all open so it was very easy to install the tools we needed or get approval fairly quickly. Its more frustrating than anything. At least they give us software development work marked months out.
I cannot remember the specifics because it’s going back almost 15 years now but at one point…crontab (edit and other various vital tools) was disabled by policy.
To get necessary processes/cleanup done at night, I used a scheduled task on a Windows PC to run a BAT that opened a macro program which opened a remote shell and “typed” the commands.
Fuuuuuuck.
I hate this stuff. When I had a more devops role I would just VM everything. Developers need their tools, here is a VM with root. Do what you want and backups run on Friday.
My dev pc isn’t allowed to be connected to the internet :D
Yep you have it the worst. Shut down the thread.
Wait, I haven’t even started talking about the fact it’s a huge unstructured legacy project using SharePoint 2016 and…
Where did everyone go?
Thought my work was bad. We at least can use VMs. I literally can’t do my job without one, Rockwell being what it is. Companies don’t like upgrading PLC software so I need to use old versions of windows occasionally to run old Rockwell stuff.
There was also a bug for a bit that would brick win11 PCs when trying to update PLC firmware, fun stuff.
Same boat. I use dedicated laptops. This is for my old Rockwell stuff, this is for my old Siemens stuff, this is my normal laptop with AD stuff, this one for Idec, and the last one for Schneider. Pretty much every laptop at the company gets retired it becomes mine.
Also works for on site access. Customer needs support? Mail them a laptop. I got one laptop that has been in Canada, both coastlines in America, Australia, and Vietnam.
I had a software developer job where they expected me to write code in Microsoft notepad, put it on a USB, and then plug it into airgapped computers to test it. Wasn’t allowed to even use notepad++.
Oh it felt so freaken good leaving that job after 6 weeks. It felt even better when I used my old manager’s personal phone number on a fake grinder profile I made. She kept a tally of my bathroom breaks.
Jump systems are a good practice but they gotta have the resources you need… I hate to say it but it sounds like y’all need to just move to a cloud platform…
ZScaler. It’s supposedly a security tool meant to keep me from going to bad websites. The problem is that I’m a developer and the “bad website” definition is overly broad.
For example, they’ve been threatening to block PHP.Net for being malicious in some way. (They refuse to say how.) Now, I know a lot of people like to joke about PHP, but if you need to develop with it, PHP.Net is a great resource to see what function does what. They’re planning on blocking the reference part as well as the software downloads.
I’ve also been learning Spring Boot for development as it’s our standard tool. Except, I can’t build a new application. Why not? Doing so requires VSCode downloading some resources and - you guessed it - ZScaler blocks this!
They’ve “increased security” so much that I can’t do my job unless ZScaler is temporarily disabled.
Also, zScaler breaks SSL. Every single piece of network traffic is open for them to read. Anyone who introduces zscaler should be fired and/or shot on sight. It’s garbage at best and extremely dangerous at worst.
Zscaler being the middleman is somewhat the point for security/IT teams using that feature.
And it’s a horrible point. You’re opening up your entire external network traffic to a third party, whose infrastructure isn’t even deployed or controllable in any form by you.
The idea being that it’s similar to using other enterprise solutions, many of which do the same things now.
Zscaler does have lesser settings too, at it’s most basic it can do split tunneling for internal services at an enterprise level and easy user management. Which is a huge plus.
I’d also like to point out that the entire Internet is a third party you have no control over which you open your external traffic to everyday.
The bigger deal would be the internal network, which is also a valid argument.
I’d also like to point out that the entire Internet is a third party you have no control over which you open your external traffic to everyday.
Not really. Proper TLS enables relatively secure E2E encryption, not perfect, but pretty good. Adding Zscaler means, that my entire outgoing traffic runs over one point. So one single incident in one single provider basically opens up all of my communication. And given that so many large orgs are customers of ZScaler, this company pretty much has a target on its back.
Additionally: I’m in Germany. My Company does a lot of contracting and communication with local, state and federal entities, a large part of that is not super secret, but definitely not public either. And now suddenly an Amercian company, that is legally required to hand over all data to NSA, CIA, FBI, etc. has access to (again) all of my external communication. That’s a disaster. And quite possibly pretty illegal.
deleted by creator
Yeah. Zscaler was once blocking me from accessing the Cherwell ticket system, which made me unable to write a ticket that Zscaler blocked me access to Cherwell.
Took me a while to get an IT guy to fix it without a ticket.
Now that’s a Catch-22
Oh man our security team is trialing zscaler and netskope right now. I’ve been sitting in the meetings and it seems like it’s just cloud based global protect. GP was really solid so this worries me
It has the same problem as any kind of TLS interception/ traffic monitoring tool.
It just breaks everything and causes a lot of lost time and productivity firstly trying to configure everything to trust a new cert (plenty of apps refuse to use the system cert store) and secondly opening tickets with IT just to go to any useful site on the internet.
Thankfully, at least in my case, it’s trivial to disable so it’s the first thing I do when my computer restarts.
Security doesn’t seem to do any checks about what processes are actually running, so they think they’ve done a good job and I can continue to do my job
It’s been ages since I had to deal with the daily random road blocks of ZScaler, but I do think of it from time to time.
Then I play Since U Been Gone by Kelly Clarkson.
Worked a job where I had to be a Linux admin for a variety of VMs. To access them, I needed an VPN that only worked inside the company LAN, and blocked internet access. it was a 30 day trial license on day 700somthing, so it had a max 5 simultaneous connection limit. Access was from my heavily locked down laptop. Windows 7 with 5 minutes locking Screensaver. The ssh software was an unknown brand, “ssh.exe” which only allowed one connection at a time in a 80 x 24 console window with no ability to copy and paste. This went to a bastion host, an HPUx box on an old csh shell with no write access to your home directory due to a 1.4mb disk quota per user. Only one login per user, ten login max, and the bastion host was the only way to connect to the Linux VMs. Default 5 minute logout for inactivity. No ssh keys allowed. No scripting allowed, was like typing over 9600 baud.
I quit that job. When asked why, I told them I was a Linux administrator and the job was not allowing me to administrate. I was told “a poor carpenter always blames his tools.” Yeah, fuck you.
A carpenter isn’t expected to use his tools with garbage grabbers (reachy claw things) either.
That sounds like the equivalent of asking a carpenter to build a wooden boat large enough to carry 30 people, but only giving them Fisherprice tools and foam blocks.
Removed by mod
Removed by mod
Here in Portugal the IT guys at the National Health Service recently blocked access to the Medical Doctor’s Union website from inside the national health service intranet.
The doctors are currently refusing to work any more overtime than the annual mandatory maximum of 150h so there are all sorts of problems in the national health service at the moment, mainly with hospitals having to close down emergency services to walk-in patients (this being AskLemmy, I’ll refrain from diving into the politics of it) so the whole things smells of something more than a mere mistake.
Anyways, this has got to be one of the dumbest abuses of firewalling “dangerous” websites I’ve seen in a long while.
I am not allowed to change my wallpaper.
This came from your security team? I usually see it from HR / management selling it as a branding issue or “professional” thing.
Even worse here - we cant change the screensaver or screen lockout timeout settings!
I have a workaround by running a little looping script that keep the screen active. Its not that I particularly object to the screensaver, but once it activates I have to Ctrl Alt Delete 3-4 times and enter my password to get my desktop open again. Also it is an active screensaver that sometimes mucks up my desktop layout (I have a multiple monitor setup)
That is so annoying… when I’m working from home I just start a meeting with myself in Teams to keep the pc from autolocking.
That’s actually genius. Here’s me writing a script to just move the mouse randomly lol, starting a Teams meeting would’ve been way simpler
deleted by creator
deleted by creator
deleted by creator
Blocked the OWASP web site because it was categorized as “hacking materials”.
My favorite filter was “distasteful,” for a sysadmin forum page or reddit thread that had what I hoped would be relevant information.
That is so retarded
We have a largeish number of systems that IT declared catheorically could not connect directly to the Internet for any reason.
So guess what systems weren’t getting updates. Also guess what systems got overwhelmed by ransomware that hit what would have been a patched vulnerability, that came through someone’s laptop that was allowed to connect to the Internet.
My department was fine, because we broke the rules to get updates.
So did network team admit the flaw in their strategy? No, they declared a USB key must have been the culprit and they literally went into every room and confiscated all USB keys and threw them away, with quarterly audits to make sure no USB keys appear. The systems are still not being updated and laptops with Internet connection are still indirectly bridging them.
Wait, why don’t they use patch management software? If they allow computers with Internet access to connect to them, why not a patch management server?
They do. In fact they mandate IT assets to have three competing patch management software on them. They mandate disabling any auto updates because they have to vet them first. My official laptop hasn’t been pushed an update in 8 months.
Do y’all need a consultant? That is so bad it’s a non starter.
Ironically, we actually have a Segment of our business that provides IT for other companies, and they do a decent job, but they aren’t allowed to manage our own IT. Best guess is that they are too expensive to waste on our own IT needs. If an IT staffember accidentally shows competence, they are probably moved to the billable group.
The irony…
Also, I keep a “rogue” laptop to self administrate along with my official it laptop to show I am in compliance. Updates are disabled and are only allowed to be fine y by IT. I just checked and they haven’t pushed any updates for about 8 months.
deleted by creator
Password rotation.
As a security guy - as soon as I can get federal auditors to agree, I’m getting rid of password expiration.
The main problem is they don’t audit with logic. It’s a script and a feeling. No password expiration FEELS less secure. Nevermind the literal years of data and research. Drives me nuts.
Cite NIST SP 800-63B.
Verifiers SHOULD NOT impose other composition rules (e.g., requiring mixtures of different character types or prohibiting consecutively repeated characters) for memorized secrets. Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically). However, verifiers SHALL force a change if there is evidence of compromise of the authenticator.
https://pages.nist.gov/800-63-3/sp800-63b.html
I’ve successfully used it to tell auditors to fuck off about password rotation in the healthcare space.
Now, to be in compliance with NIST guidelines, you do also need to require MFA. This document is what federal guidelines are based on, which is why you’re starting to see Federal gov websites require MFA for access.
Either way, I’d highly encourage everyone to give the full document a read through. Not enough people are aware of it and this revision was shockingly reasonable when it came out a year or two ago.
It’s counterintuitive. Drives people to use less secure passwords that they’re likely to reuse or to just increment; Password1, Password2, etc.
Also complex and random requirements for passwords
“your password may not start with a special character” (rage)
The network has been subnetted into departments. Problem: I, from development, get calls from service about devices that have issues. Before the subnetting, they simply told me the serial number, and I let my army of diagnosis tools hit the unsuspecting device to get an idea what’s up with it. Now they have to bring it over and set up all the attached devices here so I can run my tests.
Surely IT can make an exception for you or create a VM with multiple NICs for you.
Or configure a local port on the dev vlan… Sounds like a corporate environment where the many IT teams dont talk to each other, or network team are hiding out in a comms cupboard.
Oh my… no.
Removed admin access for all developers without warning and without a means for us to install software. We got access back in the form of a secondary admin account a few days later, it was just annoying until then.
I had the same problem once. Every time I needed to be an admin, I had to send an email to an outsourced guy in another country, and wait one hour for an answer with a temporary password.
With WSL and Linux, I needed to be admin 3 or 4 times per day. I CCed my boss for every request. When he saw that I was waiting and doing nothing for 4 hours every day, he sent them an angry email and I got my admin account back.
The stupid restriction was meant for managers and sales people who didn’t need an admin account. It was annoying for developers.
I worked at a big name health insurance company that did the same. You would have to give them an email, wait a week, then give them a call to get them to do anything. You could not install anything yourself, it was always a person that remote into your computer. After a month, I still didn’t have visual studio installed when they wanted me to work on some .Net. Then they installed the wrong version of Visual Studio. So the whole process had to be restarted.
I got a new job within 3 months and just noped out.
Local admin of your interactive account is just. Ad though.
