One chestnut from my history in lottery game development:

While our security staff was incredibly tight and did a generally good job, oftentimes levels of paranoia were off the charts.

Once they went around hot gluing shut all of the “unnecessary” USB ports in our PCs under the premise of mitigating data theft via thumb drive, while ignoring that we were all Internet-connected and VPNs are a thing, also that every machine had a RW optical drive.

  • @[email protected]
    link
    fedilink
    462 years ago

    I had to run experiments that generate a lot of data (think hundreds of megabytes per minute). Our laptops had very little internal storage. I wasn’t allowed to use an external drive, or my own NAS, or the company share - instead they said “can’t you just delete the older experiments?”… Sure, why would I need the experiment data I’m generating? Might as well /dev/null it!

    • @[email protected]
      link
      fedilink
      142 years ago

      I’m torn if I should be nodding and patting myself on the back for not doing any of this insanity or cackling and taking notes…

      • KrudlerOP
        link
        fedilink
        English
        11
        edit-2
        2 years ago

        Taking notes?!? If you can’t make idiotic decisions on your own, you’re not much of an IT guy to begin with.

  • @[email protected]
    link
    fedilink
    12 years ago

    This is done to keep employees from sticking in unknown thumb drives that could install malware. Several critical systems on protected networks have been hacked in the past by leveraging human curiosity and placing a compromised thumb drive on the ground in the companies parking lot. Gluing shut the USB ports is a simple defense against that.

  • @[email protected]
    link
    fedilink
    242 years ago

    Endless approval processes are a good one. They don’t even have to be nonsensical. Just unnecessarily manual, tedious, applied to the simplest changes, with long wait times and multiple steps. Add time zone differences and pile up many different ones, and life becomes hell.

    • @[email protected]
      link
      fedilink
      92 years ago

      It took them three weeks to have my super secure voicemail PIN reset, only for me to set it to whatever I wanted.

  • body_by_make
    link
    fedilink
    2552 years ago

    Often times you’ll find that the crazy things IT does are forced on them from higher ups that don’t know shit.

    A common case of this is requiring password changes every x days, which is a practice that is known to actively make passwords worse.

    • dual_sport_dork 🐧🗡️
      link
      fedilink
      1022 years ago

      Or it prompts people to just stick their “super secure password” with byzantine special character, numeral, and capital letter requirements to their monitor or under their keyboard, because they can’t be arsed to remember what nonsensical piece of shit they had to come up with this month just to make the damn machine happy and allow them to do their jobs.

      • @[email protected]
        link
        fedilink
        45
        edit-2
        2 years ago

        I do this in protest of asinine password change rules.

        Nobody’s gonna see it since my monitor is at home, but it’s the principle of the thing.

        • @[email protected]
          link
          fedilink
          English
          92 years ago

          A truly dedicated enough attacker can and will look in your window! Or do fancier things like enable cameras on devices you put near your monitor

          Not saying it’s likely, but writing passwords down is super unsafe

          • KrudlerOP
            link
            fedilink
            English
            582 years ago

            What you are describing is the equivalent of somebody breaking into your house so they can steal your house key.

            • @[email protected]
              link
              fedilink
              202 years ago

              No, they’re breaking into your house to steal your work key. The LastPass breach was accomplished by hitting an employee’s personal, out of date, Plex server and then using it to compromise their work from home computer. Targeting a highly privileged employees personal technology is absolutely something threat actors do.

              • KrudlerOP
                link
                fedilink
                English
                142 years ago

                The point is if they’re going to get access to your PC it’s not going to be to turn on a webcam to see a sticky note on your monitor bezel. They’re gonna do other nefarious shit or keylog, etc.

                • @[email protected]
                  link
                  fedilink
                  English
                  62 years ago

                  Why keylog and pick up 10k random characters to sift through when the password they want is written down for them?

      • @[email protected]
        link
        fedilink
        22 years ago

        Your coworkers put their password under the keyboard ? Mine just leave a post it on the side of the monitor.

    • @[email protected]
      link
      fedilink
      English
      242 years ago

      I’m in IT security and I’m fighting this battle. I want to lessen the burden of passwords and arbitrary rotation is terrible.

      I’ve ran into a number of issues at my company that would give me the approval to reduce the frequency of expired passwords

      • the company gets asked this question by other customers “do you have a password policy for your staff?” (that somehow includes an expiration frequency).

      • on-prem AD password complexity has some nice parts built in vs some terrible parts with no granularity. It’s a single check box in gpo that does way too much stuff. I’m also not going to write a custom password policy because I don’t have the skill set to do it correctly when we’re talking about AD, that’s nightmare inducing. (Looking at specops to help and already using Azure AD password protection in passive mode)

      • I think management is worried that a phishing event happens on a person with a static password and then unfairly conflating that to my argument of “can we just do two things: increase password length by 2 and decrease expiration frequency by 30 days”

      At the end of the day, some of us in IT security want to do the right things based in common sense but we get stymied by management decisions and precedence. Hell, I’ve brought NIST 800-63B documentation with me to check every reason why they wouldn’t budge. It’s just ingrained in them - meanwhile you look at the number of tickets for password help and password sharing violations that get reported … /Sigh

      • 𝕸𝖔𝖘𝖘
        link
        fedilink
        English
        92 years ago

        I feel this. I increased complexity and length, and reduced change frequency to 120d. It worked really well with the staggered rollout. Shared passwords went down significantly, password tickets went to almost none (there’s always that ‘one’). Everything points to this being the right thing and the fact that NIST supports this was a win… until the the IT audit. The auditor wrote “the password policy changed from 8-length, moderate complexity, 90-day change frequency to 12-length, high complexity, 120-day change frequency” and the board went apeshit. It wasn’t an infraction or a “ding”, it was only a note. The written policy was, of course, changed to match the GPO, so the note was for the next auditor to know of the change. The auditor even mentioned how he was impressed with the modernity of our policy and how it should lead to a better posture. I was forced to change it back, even though I got buyin from CTO for the change. BS.

        • @[email protected]
          link
          fedilink
          English
          42 years ago

          Having been exposed to those kinds of audits before that’s really just bad handling by the CTO and other higher ups!

      • partial_accumen
        link
        fedilink
        122 years ago

        At the end of the day, some of us in IT security want to do the right things based in common sense but we get stymied by management decisions and precedence. Hell, I’ve brought NIST 800-63B documentation with me to check every reason why they wouldn’t budge. It’s just ingrained in them - meanwhile you look at the number of tickets for password help and password sharing violations that get reported …

        Paint the picture for management:

        At one time surgery was the purview of medieval barbers. Yes, the same barbers that cut your hair. At the time there were procedures to intentionally cause people to bleed excessively and cutting holes the body to let the one of the “4 humors” out to make the patient well again. All of this humanity arrived at with tens of thousands of years of existence on Earth. Today we look at this as uninformed and barbaric. Yet we’re doing the IT Security equivalent of those medieval barber still today. We’re bleeding our users unnecessarily with complex frequent password rotation and other bad methods because that’s what was the standard at one time. What’s the modern medicine version of IT Security? NIST 800-63B is a good start. I’m happy to explain whats in there. Now, do we want to keep harming our users and wasting the company’s money on poor efficiency or do we want to embrace the lesson learned from that bad past?

    • @[email protected]
      link
      fedilink
      English
      122 years ago

      Forcing password expiration does cause people to make shittier passwords. But when their passwords are breached programitically or through social engineering They don’t just sit around valid for years on the dark web waiting for someone to buy them up.

      • body_by_make
        link
        fedilink
        162 years ago

        This requirement forces people who can’t otherwise remember passwords to fall into patterns like (kid’s name)(season)(year), this is a very common password pattern for people who have to change passwords every 90 days or so. Breaching the password would expose the pattern and make it easy enough to guess based off of.

        • @[email protected]
          link
          fedilink
          English
          42 years ago

          It’s still not in a freaking list that they can run a programmatic attack against. People that give this answer sound like a f****** broken record I swear.

            • @[email protected]
              link
              fedilink
              English
              12 years ago

              No never minded people that think that all passwords are being cracked tell me I’m wrong. Lists emails and passwords grabbed from fishing attacks tell me the people that are too lazy to change their passwords and once in awhile don’t deserve the security.

              • @[email protected]
                link
                fedilink
                English
                22 years ago

                I’m a native English speaker. I can’t understand your comment. I sense that you have a useful perspective, could you rephrase it so it’s understandable?

          • body_by_make
            link
            fedilink
            102 years ago

            Secops has been against this method of protection for many years now, I’d say you’re the outdated one here

            • @[email protected]
              link
              fedilink
              English
              12 years ago

              Years ago phishing and 2fa breaches werent as pervasive. Since we can’t all go to pass key right now, nobody’s doing a damn thing about the phishing campaigns. Secops current method of protection is to pay companies that scan the dark web by the lists and offer up if your password’s been owned for a fee.

              That’s a pretty s***** tactic to try to protect your users.

              • body_by_make
                link
                fedilink
                3
                edit-2
                2 years ago

                We’re on the internet, you can say shit.

                If your user is just using johnsmithfall2022 as their password and they update the season and year every time, it’s pretty easy for hackers to identify that pattern and correct it. This is not the solution and it actively makes life worse for everyone involved.

        • @[email protected]
          link
          fedilink
          English
          22 years ago

          99% of password theft currently comes from phishing. Most of the people that get fished don’t have a freaking clue they got fished oh look the Microsoft site link didn’t work.

          Complex passwords that never change don’t mean s*** when your users are willing to put them into a website.

      • Natanael
        link
        fedilink
        52 years ago

        NIST now recommends watching for suspicious activity and only force rotation when there’s risk of compromise

          • Natanael
            link
            fedilink
            42 years ago

            That’s why password leak detection services exists

            (And a rare few of them yes)

    • @[email protected]
      link
      fedilink
      English
      32 years ago

      Even better is forcing changes every 30 or 60 days, and not allowing changes more than every week. Our users complain daily between those rules and the password requirements that they are too dumb to understand.

      • @[email protected]
        link
        fedilink
        152 years ago

        Password changes that frequent are shown to be ineffective, especially for the hassle. Complexity is a better protection method.

        • @[email protected]
          link
          fedilink
          English
          32 years ago

          I’m aware. Apparently everyone who read my post has misread it. I’m saying that the requirements above are terrible, and they make my users complain constantly. Our security team constantly comes up with ways to increase security theater at the detriment of actual security.

    • @[email protected]
      link
      fedilink
      92 years ago

      So glad we opted for a longer password length, with fewer arbitrary limits, and expiry only after 2 years or a suspected breach.

    • dditty
      link
      fedilink
      142 years ago

      For our org, we are required to do this for our cybersecurity insurance plan

      • Natanael
        link
        fedilink
        72 years ago

        Tell them NIST now recommends against it so the insurance company is increasing your risks

        • @[email protected]
          link
          fedilink
          52 years ago

          The guideline is abundantly clear too with little room for interpretation:

          5.1.1.1 Memorized Secret Authenticators

          Verifiers SHOULD NOT impose other composition rules (e.g., requiring mixtures of different character types or prohibiting consecutively repeated characters) for memorized secrets. Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically). However, verifiers SHALL force a change if there is evidence of compromise of the authenticator.

          https://pages.nist.gov/800-63-3/sp800-63b.html

    • @[email protected]
      link
      fedilink
      15
      edit-2
      2 years ago

      What I really love is mandatory length and character password policies so complex that together with such password change requirements that push people beyond what is humanly possible to memorize, so it all ends down written in post-its, the IT equivalent of having a spare key under a vase or the rug.

    • @[email protected]
      link
      fedilink
      English
      102 years ago

      And in my company the password change policies are very different from one system to another. Some force a change monthly, some every 28 days, some every 90 days, and thwn there is rhat one legacy system that no longer has a functioning password change mechanism, so we can’t change passwords there if we wanted to.

      And the different systems all want different password formats, have different re-use rules.

      And, with all those uncoordinated passwords, they don’t allow password managers to be used on corporate machines, despite the training materials that the company makes us re-do every year recommending password managers…

    • @[email protected]
      link
      fedilink
      382 years ago

      The DOD was like this. And it wasn’t just that you had to change passwords every so often but the requirements for those passwords were egregious but at the same time changing 1 number or letter was enough to pass the password requirements.

    • KrudlerOP
      link
      fedilink
      English
      20
      edit-2
      2 years ago

      That’s super true, so many times to stay ISO compliant (I’m thinking about the lottery industry here), security policies need to align with other recommendations and best practices that are often insane.

      But then there’s a difference between those things which at least we can rationalize WHY they exist… and then there’s gluing USB plugs shut because they read about it on slashdot and had a big paranoia. Lol

  • Illecors
    link
    fedilink
    English
    502 years ago

    Hasn’t made life hell, but the general dumb following of compliance has left me baffled:

    • users must not be able to have a crontab. Crontab for users disabled.
    • compliance says nothing about systemd timers, so these work just fine 🤦

    I’ve raised it with security and they just shrugged it off. Wankers.

    • mesa
      link
      fedilink
      52 years ago

      Thats really funny. Made my day thanks.

      Are they super old school and not know about systemd? Or are they doing something out of compliance that they may hate too? I have so many questions.

      • Illecors
        link
        fedilink
        English
        72 years ago

        I actually think they’re new school enough where Linux to them means a lot less than it does to us. And so they don’t feel at home on a Linux machine and, unfortunately, don’t care to learn.

        I could totally be wrong, though. Maybe I’m the moron.

        • mesa
          link
          fedilink
          32 years ago

          I dont think your the moron. Thats super strange. I can only think it might be some sort of standard that they had to comply with…or whatever.

  • @[email protected]
    link
    fedilink
    1322 years ago

    Took away Admin rights, so everytime you wanted to install something or do something in general that requires higher privileges, we had to file a ticket in the helpdesk to get 10 minutes of Admin rights.

    The review of your request took sometimes up 3 days. Fun times for a software developer.

    • Shambling Shapes
      link
      fedilink
      English
      312 years ago

      3 days? That’s downright speedy!

      I submitted a ticket that fell into a black hole. I have long since found an alternate solution, but am now keeping the ticket open for the sick fascination of seeing how long it takes to get a response. 47 days and counting…

        • Natanael
          link
          fedilink
          102 years ago

          Any ticketing system set up like that is just begging for abuse. If they don’t have queue managers then the team should share the hit if they just leave the ticket untouched

        • @[email protected]
          link
          fedilink
          1
          edit-2
          2 years ago

          No, it was quite extensive (20-30?) and we (I) kept expanding it. I even added icons for each app so it looked nice.

          All published software was approved by Cybersecurity. We allowed people to request apps and evaluated each case.

    • @[email protected]
      link
      fedilink
      English
      7
      edit-2
      2 years ago

      During those 10 minutes of admin rights:

      net user secretlocaladmin * /add
      net localgroup administrators secretlocaladmin /add
      
    • @[email protected]
      link
      fedilink
      532 years ago

      We worked around this at my old job by getting VirtualBox installed on our PCs and just running CentOS or Ubuntu VMs to develop in. Developing on windows sucks unless you’re doing .NET imo.

      • @[email protected]
        link
        fedilink
        22 years ago

        Developing on VMs also sucks, neverending network issues on platforms like Windows which have a shitty networking stack (try forwarding ports or using VPN connections).

        In fact, Windows is just a shitty dev platform in general for non-Microsoft technologies but I get that you needed to go for the least shit option

        • @[email protected]
          link
          fedilink
          22 years ago

          Yeah fortunately we didn’t need to do any port forwarding or anything complex for networking for developing locally. It was definitely much easier for us. I don’t like Apple, but I didn’t mind my other old job that gave us MacBooks honestly.

    • KrudlerOP
      link
      fedilink
      English
      432 years ago

      Oh shit, you just reminded me of the time that I had to PHONE Macromedia to manually activate software because of the firewalling. This was after waiting days to get administrative permission to install it in the first place.

      “Thank you” for helping resurface those horrible memories!

      I don’t miss those days.

  • @[email protected]
    link
    fedilink
    1492 years ago

    Banned open source software because of security concerns. For password management they require LastPass or that we write them down in a book that we keep on ourselves at all times. Worth noting that this policy change was a few months ago. After the giant breach.

    And for extra absurdity: MFA via SMS only.

    I wish I was making this up.

    • JackGreenEarth
      link
      fedilink
      882 years ago

      Banning open source because of security concerns is the opposite of what they should be doing if they care about security. You can’t vet proprietary software.

      • DKP
        link
        fedilink
        English
        372 years ago

        It’s not about security, it’s about liability. You can’t sue OSS to get shareholders off your back.

    • @[email protected]
      link
      fedilink
      152 years ago

      Care to elaborate “MFA via SMS only”? I’m not in tech and know MFA through text is widely used. Or do you mean alternatives like Microsoft Authenticator or YubiKey? Thanks!

      • Funwayguy
        link
        fedilink
        362 years ago

        Through a low tech social engineering attack referred to as SIM Jacking, an attacker can have your number moved to their SIM card, redirecting all SMS 2FA codes effectively making the whole thing useless as a security measure. Despite this, companies still implement it out of both laziness and to collect phone numbers (which is often why SMS MFA is forced)

      • @[email protected]
        link
        fedilink
        122 years ago

        Sim swap is quite easy if you are convincing enough for support at an ISP doing phone plans.
        Now imagine if I sim-swapped your 2FA codes :)

        Exactly this. Instead you should use a phone app like Aegis or proprietary solutions like MS Authenticator to MFA your access because it’s encrypted.

    • @[email protected]
      link
      fedilink
      152 years ago

      I tried so hard to steer my last company away from SMS MFA. CTO basically flat out said, “As long as I’m here SMS MFA will always be an option.”

      Alright, smarmy dumbass. I dream of the day when they get breached because of SMS.

      • @[email protected]
        link
        fedilink
        32 years ago

        If I remember it correctly, in GSM it’s perfectly possibly to spoof a phone number to receive the SMS using the roaming part of the protocol.

        The thing was designed to be decently safe, not to be highly secure.

  • dual_sport_dork 🐧🗡️
    link
    fedilink
    53
    edit-2
    2 years ago

    Not my IT department (I am my IT department): One of the manufacturers for a brand of equipment we sell has a “Dealer Resource Center,” which consists solely of a web page where you can download the official product photography and user’s manuals, etc. for their products. This is to enable you to list their products on your e-commerce web site, or whatever.

    Apparently whoever they subcontracted this to got their hands on a copy of Front End Dev For Dummies, and in order to use this you must create a mandatory account with minimum password complexity requirements, and solve a CAPTCHA every time you log in. They also require you to change your password every 60 days, and if you don’t they lock your account and you have to call their tech support.

    Three major problems with this:

    1. There is no verification check that you are actually an authorized dealer of this brand of product, so any fool who finds this on Google and comes up with an email address can just create an account and away you go downloading whatever you want. If you’ve been locked out of your account and don’t feel like picking up the telephone – no problem! Just create a new one.

    2. There is no personalized content on this service. Everyone sees the same content, and it’s not like there’s a way to purchase anything on here or anyway, and your “account” stores no identifying information about you or your dealership that you feel like giving it other than your email address. You are free to fill it out with a fake name if you like; no one checks. You could create an account using [email protected] and no one would notice.

    3. Every single scrap of content on this site is identical to the images and .pdf downloads already available on the manufacturer’s public web site. There is no privileged or secure content hosted in this “Resource Center” whatsoever. The pictures aren’t higher res or anything. Even the file names are the same. It’s obviously hooked up to the same backend as the manufacturer’s public web site. So if there were such a thing as a “bad actor” who wanted to obtain a complete library of glamor shots of durable goods, for some reason, there’s nothing stopping them from scraping the public web site and coming up with literally exactly the same thing.

    It’s baffling.

  • @[email protected]
    link
    fedilink
    43
    edit-2
    2 years ago

    They set zscaler so that if I don’t access an internal service for an unknown number of months, it means I don’t need it “for my daily work”, so they block it. If I want to access it again I need to open a ticket. There is no way to know what they closed and when they’ll close something.

    In 1 months since this policy is active, I already have opened tickets to access test databases, k8s control plane, quality control dashboards, tableau server…

    I really cannot comment how wrong it is.

    • @[email protected]
      link
      fedilink
      302 years ago

      Zscaler is one of the worst products I’ve had the displeasure to interact with. They implemented it at my old job and it said that my home Internet connection was insecure to connect to the VPN. Cyber Sec guys couldn’t figure out the issue because the logs were SO helpful.

      Took working with their support to find that it has somehow identified my nonstandard address spacing on my LAN to be insecure for some reason.

      I kept my work laptop on a separate vlan for obvious reasons.

      • Natanael
        link
        fedilink
        92 years ago

        Pretty sure it’s some misapplied heuristics for previously identified bad clients, but that should only trigger an alert (with details!) in most cases and not block you if it’s not also paired with any known malicious activity

        • @[email protected]
          link
          fedilink
          72 years ago

          I’m going off memory from early 2021. But it was my private IP on the laptop using a Class B private address according to their support team. I was flabbergasted. Maybe they just expected every remote worker to use Class C or something. Who knows?

  • @[email protected]
    link
    fedilink
    English
    22 years ago

    Haha, I never thought of this but…I WAS the IT department in a previous life. I never really thought about how none of this shit really affected me. Granted, I’d have everyone using Yubikeys+Password for logins if I were in charge now.

    • @[email protected]
      link
      fedilink
      1
      edit-2
      2 years ago

      Yubikey enforcement is ass in AD.

      We’ve moved to SilverFort. That way I can keep using the YKs but actually enforce them correctly. It allows WAAAY more visibility and control over the things that matter, and it’s diagnostics and easy policy generation from lookups is great.

  • @[email protected]
    link
    fedilink
    82 years ago

    I’m sure there are more elegant ways they could have disabled the USB ports, but this might have been partially to avoid users being able to accidentally compromise their device by sticking a thumb drive they found in the parking lot in to see what was on it. For exfiltration and VPN usage over the network there are other controls they can/likely had put in place that you may just not have known about

    • KrudlerOP
      link
      fedilink
      English
      122 years ago

      They were just paranoid dopes.

      I would hear them talking about IT security the way 10 year old boys talk about defending their fort from zombies.

        • KrudlerOP
          link
          fedilink
          English
          12
          edit-2
          2 years ago

          Well if we’re following the metaphor, yes they were completely on top of preventing imaginary threats that wouldn’t realistically ever materialize lol

  • @[email protected]
    link
    fedilink
    212 years ago

    They forbid us to add our ssh keys in some server machines, and force us to log in these servers with the non-personal admin account, with a password that is super easy to guess and haven’t been changed in 5 years.

  • @[email protected]
    link
    fedilink
    392 years ago

    Oh man. Huge company I used to work for had:

    • two separate Okta instances. It was a coin toss as to which one you’d need for any given service

    • oh, and a third internally developed federated login service for other stuff

    • 90 day expiry for all of the above passwords

    • two different corporate IM systems, again coin toss depending on what team you’re working with

    • nannyware everywhere. Open Performance Monitor and watch network activity spike anytime you move your mouse or hit a key

    • an internally developed secure document system used by an international division that we were instructed to never ever use. We were told by IT that it “does something to the PC at a hardware level if you install the reader and open a document” which would cause a PC to be banned from the network until we get it replaced. Sounds hyperbolic, but plausible given the rest of the mess.

    • required a mobile authenticator app for some of the above services, yet the company expected that us grunts use our personal devices for this purpose.

    • all of the above and more, yet we were encouraged to use any cloud hosted password manager of our choosing.

    • Hogger85b
      link
      fedilink
      20
      edit-2
      2 years ago

      I’ll.go one further with authenticator. Mobile phones were banned in the data center and other certain locations (financial services). Had to set up landline phone…but to do that needed to request it…approve it on my phone then enter data center security door run and answer the phone line with 60s like something in the matrix.

  • @[email protected]
    link
    fedilink
    English
    452 years ago

    Locked down our USB ports. We work on network equipment that we have to use the USB port to log in to locally.

    • mesa
      link
      fedilink
      52 years ago

      One place I worked at did this but had bluetooth on no issues. People brought all kinds of things to the office.