Tech workers - what did your IT Security team do that made your life hell and had no practical benefit?

One chestnut from my history in lottery game development:

While our security staff was incredibly tight and did a generally good job, oftentimes levels of paranoia were off the charts.

Once they went around hot gluing shut all of the “unnecessary” USB ports in our PCs under the premise of mitigating data theft via thumb drive, while ignoring that we were all Internet-connected and VPNs are a thing, also that every machine had a RW optical drive.

Rin,

Mozilla products banned by IT because they had a vulnerability in a pervious version.

RantIt was so bullshit. I had Mozilla Firefox 115.1 installed, and Mozilla put out an advisory, like they do all the fucking time. Fujitsu made it out to be some huge huge unfixed bug the very next day in an email after the advisory was posted and the email chain basically said “yk, we should just remove all Firefox. It’s vulnerable so it must be removed.” I wouldn’t be mad if they decided that they didn’t want to have it be a managed app or that there was something (actually) wrong with it or literally anything else than the fact that they didn’t bother actually reading either fucking advisory and decided to nuke something I use daily.

Dicska,

Nah mate, they were completely right. What if you install an older version, and keep using it maliciously? Oh wait, now that you mention, I’m totally sure Edge had a similar problem at one point in the past. So refrain from using Edge, too. Or Explorer. And while we’re at it, it’s best to stay away from Chrome, as well. That had a similar vulnerability before, I’m sure. So let’s dish that, along with Opera, Safari, Maxthon and Netscape Navigator. Just use Lynx, it’s super lightweight!

EDIT: on another thought, you should just have stopped working for the above reason. Nothing is safe anymore.

Krudler,

Can’t use Lynx either.

www.cvedetails.com/cve/CVE-2010-2810/

All web pages must now be phoned in via a touch-tone system, and delivered on paper printouts via regular post.

PoolloverNathan,

Touch-tones had some sort of vulnerability too; you’re going to have to mail in your HTTP requests.

Canopyflyer,

Over 150 Major Incidents in a single month.

Formerly, I was on the Major Incident Response team for a national insurance company. IT Security has always been in their own ivory tower in every company I’ve worked for. But this company IT Security department was about the worst case I’ve ever seen up until that time and since.

They refused to file changes, or discuss any type of change control with the rest of IT. I get that Change Management is a bitch for the most of IT, but if you want to avoid major outages, file a fucking Change record and follow the approval process. The security directors would get some hair brained idea in a meeting in the morning and assign one of their barely competent techs to implement it that afternoon. They’d bring down what ever system they were fucking with. Then my team had to spend hours, usually after business hours, figuring out why a system, which had not seen a change control in two weeks, suddenly stopped working. Would security send someone to the MI meeting? Of course not. What would happen is, we would call the IT Security response team and ask if anything changed on their end. Suddenly 20 minutes later everything was back up and running. With the MI team not doing anything. We would try to talk to security and ask what they changed. They answered “nothing” every god damn time.

They got their asses handed to them when they brought down a billing system which brought in over $10 Billion (yes with a “B”) a year and people could not pay their bills. That outage went straight to the CIO and even the CEO sat in on that call. All of the sudden there was a hard change freeze for a month and security was required to file changes in the common IT record system, which was ServiceNow at the time.

We went from 150 major outages (defined as having financial, or reputation impact to the company) in a single month to 4 or 5.

Fuck IT Security. It’s a very important part of of every IT Department, but it is almost always filled with the most narcissistic incompetent asshats of the entire industry.

Seasm0ke,

Jesus Christ I never thought id be happy to have a change control process

Tar_alcaran,

Lots of safety measures really suck. But they generally get implemented because the alternative is far worse.

Machindo,

At my current company all changes have to happen via GitHub PR and commit because we use GitOps (ex: ArgoCD with Kubernetes). Any changes you do manually are immediately overwritten when ArgoCD notices the config drift.

This makes development more annoying sometimes but I’m so damn glad when I can immediately look at GitHub for an audit trail and source of truth.

It wasn’t InfoSec in this case but I had an annoying tech lead that would merge to main without telling people, so anytime something broke I had his GitHub activity bookmarked and could rule that out first.

shasta,

You can also lock down the repo to require approvals before merge into main branch to avoid this.

Machindo,

Since we were on the platform team we were all GitHub admins 😩. So it all relied on trust. Is there a way to block even admins?

shasta,

Hm can’t say. I’m using bitbucket and it does block admins, though they all have the ability to go into settings and remove the approval requirement. No one does though because then the bad devs would be able to get changes in without reviews.

Machindo,

That sounds like a good idea. I’ll take another look at GitHub settings. Thanks!

Canopyflyer,

The past several years I have been working more as a process engineer than a technical one. I’ve worked in Problem Management, Change Management, and currently in Incident for a major defense contractor (yes, you’ve heard of it). So I’ve been on both sides. Documenting an incident is a PITA. File a Change record to restart a server that is in an otherwise healthy cluster? You’re kidding, right? What the hell is a “Problem” record and why do I need to mess with it?

All things I’ve heard and even thought over the years. What it comes down to, the difference between a Mom and Pop operation, that has limited scalability and a full Enterprise Environment that can support a multi-billion dollar business… Is documentation. That’s what those numb nuts in that Insurance Company were too stupid to understand.

Krudler,

You poor man. I’ve worked with those exact fukkin’ bozos.

RaoulDook,

Lack of a Change Control process has nothing to do with IT Security except within the domain of Availability. Part of Security is ensuring IT systems are available and working.

You simply experienced working at an organization with poor enforcement of Change Control policies. That was a mistake of oversight, because with competent oversight anyone causing outages by making unapproved changes that cause an outage would be reprimanded and instructed to follow policy properly.

KISSmyOS,

This is done to keep employees from sticking in unknown thumb drives that could install malware. Several critical systems on protected networks have been hacked in the past by leveraging human curiosity and placing a compromised thumb drive on the ground in the companies parking lot. Gluing shut the USB ports is a simple defense against that.

tslnox,

Our IT mandated 15 character long passwords. Many people in manufacturing (the guys who make the stuff we produce or setup and fix the machines) have the passwords in the format: “Somename123456…” You get the picture. When the passwords are forced to change? Yeah, just add “a,b,c,d…” at the end. Many have it written down on some post-it note on the notebook or desk. Security my ass.

I wouldn’t be surprised if I found that office guys have it too.

Fosheze,

At a place I used to work one of my coworkers just had their password as a barcode taped to their desk. Now to be fair we worked in the extra high security room so even getting access to that desk would be a little tricky and we had about 20 unlabeled barcoded taped to each of our desks for various inventory locations and functions. So if someone wanted to get into their account they would still have to guess which barcode it was and get into a room only like 10 people had access to. It still felt pretty damn sketchy though.

send_me_your_ink,

If you feel like poking a bear. NIST 800-63B is the US Federal guidance on passwords. In the past this guidance said to have long passwords and rotate them. Now they say 8 characters and never change (along with using MFA).

tslnox,

Don’t even start me on MFA. It routinely happens to me and all coworkers that it’s not enough to type in the code from the authenticator once, not twice, not even three times. You log in to windows, code prompt. You open Outlook, code prompt. You open SharePoint, another one. OneDrive? Another.

send_me_your_ink,

As someone who manages multiple identity systems - tell your IT to get their act together. Most of my environments we force reaith once a week (and that just a quick enter your password/TOTP code). Otherwise if you can log into your computer we trust you are who you say you are (note: we have some downright scary and invasive stuff on the network so we know if you start accessing stuff you should not). The sensitive/scary stuff is a lot faster (activity timers), but the teams involved know why it’s set this way (and where involved in setting the maximum durations).

Herrmens,

Took away Admin rights, so everytime you wanted to install something or do something in general that requires higher privileges, we had to file a ticket in the helpdesk to get 10 minutes of Admin rights.

The review of your request took sometimes up 3 days. Fun times for a software developer.

Fixbeat,

Fighting similar shit right now. I need admin rights frequently.

Krudler,

Oh shit, you just reminded me of the time that I had to PHONE Macromedia to manually activate software because of the firewalling. This was after waiting days to get administrative permission to install it in the first place.

“Thank you” for helping resurface those horrible memories!

I don’t miss those days.

XEAL,

We used Intune Portal for a list of approved desktop apps

argentcorvid,
@argentcorvid@midwest.social avatar

Let me guess, the list is about 6 items long with no provision for getting any added

XEAL,

No, it was quite extensive (20-30?) and we (I) kept expanding it. I even added icons for each app so it looked nice.

All published software was approved by Cybersecurity. We allowed people to request apps and evaluated each case.

NOT_RICK,
@NOT_RICK@lemmy.world avatar

I too know this pain

ShunkW,

We worked around this at my old job by getting VirtualBox installed on our PCs and just running CentOS or Ubuntu VMs to develop in. Developing on windows sucks unless you’re doing .NET imo.

lightnegative,

Developing on VMs also sucks, neverending network issues on platforms like Windows which have a shitty networking stack (try forwarding ports or using VPN connections).

In fact, Windows is just a shitty dev platform in general for non-Microsoft technologies but I get that you needed to go for the least shit option

ShunkW,

Yeah fortunately we didn’t need to do any port forwarding or anything complex for networking for developing locally. It was definitely much easier for us. I don’t like Apple, but I didn’t mind my other old job that gave us MacBooks honestly.

SHamblingSHapes,

3 days? That’s downright speedy!

I submitted a ticket that fell into a black hole. I have long since found an alternate solution, but am now keeping the ticket open for the sick fascination of seeing how long it takes to get a response. 47 days and counting…

raynethackery,

Nobody wants to take it because it will mess up their KPIs.

Natanael,

Any ticketing system set up like that is just begging for abuse. If they don’t have queue managers then the team should share the hit if they just leave the ticket untouched

PoolloverNathan,

During those 10 minutes of admin rights:


<span style="color:#323232;">net user secretlocaladmin * /add
</span><span style="color:#323232;">net localgroup administrators secretlocaladmin /add
</span>
CriticalMiss,

There’s likely a GPO cycling and removing all the admins.

lightnegative,

This was my experience too. Shitty group policies messing with my local changes

Cqrd,

Often times you’ll find that the crazy things IT does are forced on them from higher ups that don’t know shit.

A common case of this is requiring password changes every x days, which is a practice that is known to actively make passwords worse.

dditty,

For our org, we are required to do this for our cybersecurity insurance plan

Natanael,

Tell them NIST now recommends against it so the insurance company is increasing your risks

Hobo,

The guideline is abundantly clear too with little room for interpretation:

5.1.1.1 Memorized Secret Authenticators

Verifiers SHOULD NOT impose other composition rules (e.g., requiring mixtures of different character types or prohibiting consecutively repeated characters) for memorized secrets. Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically). However, verifiers SHALL force a change if there is evidence of compromise of the authenticator.

pages.nist.gov/800-63-3/sp800-63b.html

Krudler,

That’s super true, so many times to stay ISO compliant (I’m thinking about the lottery industry here), security policies need to align with other recommendations and best practices that are often insane.

But then there’s a difference between those things which at least we can rationalize WHY they exist… and then there’s gluing USB plugs shut because they read about it on slashdot and had a big paranoia. Lol

Ookami38,

So glad we opted for a longer password length, with fewer arbitrary limits, and expiry only after 2 years or a suspected breach.

xkforce,

The DOD was like this. And it wasn’t just that you had to change passwords every so often but the requirements for those passwords were egregious but at the same time changing 1 number or letter was enough to pass the password requirements.

dual_sport_dork,
@dual_sport_dork@lemmy.world avatar

Or it prompts people to just stick their “super secure password” with byzantine special character, numeral, and capital letter requirements to their monitor or under their keyboard, because they can’t be arsed to remember what nonsensical piece of shit they had to come up with this month just to make the damn machine happy and allow them to do their jobs.

BastingChemina,

Your coworkers put their password under the keyboard ? Mine just leave a post it on the side of the monitor.

SpaceNoodle, (edited )

I do this in protest of asinine password change rules.

Nobody’s gonna see it since my monitor is at home, but it’s the principle of the thing.

residentmarchant,

A truly dedicated enough attacker can and will look in your window! Or do fancier things like enable cameras on devices you put near your monitor

Not saying it’s likely, but writing passwords down is super unsafe

Krudler,

What you are describing is the equivalent of somebody breaking into your house so they can steal your house key.

curve_empty_buzz,

No, they’re breaking into your house to steal your work key. The LastPass breach was accomplished by hitting an employee’s personal, out of date, Plex server and then using it to compromise their work from home computer. Targeting a highly privileged employees personal technology is absolutely something threat actors do.

Krudler,

The point is if they’re going to get access to your PC it’s not going to be to turn on a webcam to see a sticky note on your monitor bezel. They’re gonna do other nefarious shit or keylog, etc.

residentmarchant,

Why keylog and pick up 10k random characters to sift through when the password they want is written down for them?

Rooty,

Again, how is the attacker going to see a piece of paper that is stuck to the side of the screen? This rule makes sense in high traffic areas, but in a private persons home? The attacker would also need to be a burglar.

Krudler,

It seems that some people are having trouble following the conversation and a basic stream of topical logic.

The initial premise was that somebody could see your passwords by pwning your machine… And using that to… Turn on webcam so they could steal your password so they could… pwn your machine?

Lol

Hobo,

Nope. The premise is they pwn ANOTHER, less secure, personal device and use the camera from the DIFFERENT device to pwn your work computer. For example, by silently installing Pegasus on some cocky “security is dumb lol” employee’s 5 year out-of-date iphone via text message while they’re sleeping, and use the camera from that phone to recon the password.

They probably wouldn’t want the $3.50 that person has in their bank account, but ransoming corporate data pays bank, and wire transfering from a corporate account pays even better! If you’re in a highly privileged position, or have access to execute financial transactions at a larger company, pwning a personal device isn’t outside of the threat model.

Most likely that threat model doesn’t apply to you, but perhaps at least put it under the keyboard out of plain sight?

Krudler,

Would you just stop.

Hobo,

I made one comment to you clarifying the other person’s point because you clearly didn’t understand what they were saying. Personally seen a couple of small companies fold because they were ransomed from a password on a post it. But you do you.

linearchaos,
@linearchaos@lemmy.world avatar

Forcing password expiration does cause people to make shittier passwords. But when their passwords are breached programitically or through social engineering They don’t just sit around valid for years on the dark web waiting for someone to buy them up.

Natanael,

NIST now recommends watching for suspicious activity and only force rotation when there’s risk of compromise

linearchaos,
@linearchaos@lemmy.world avatar

Tell me, can your users identify suspicious activity cuz mine sure as hell can’t.

Natanael,

That’s why password leak detection services exists

(And a rare few of them yes)

Cqrd,

This requirement forces people who can’t otherwise remember passwords to fall into patterns like (kid’s name)(season)(year), this is a very common password pattern for people who have to change passwords every 90 days or so. Breaching the password would expose the pattern and make it easy enough to guess based off of.

linearchaos,
@linearchaos@lemmy.world avatar

99% of password theft currently comes from phishing. Most of the people that get fished don’t have a freaking clue they got fished oh look the Microsoft site link didn’t work.

Complex passwords that never change don’t mean s*** when your users are willing to put them into a website.

linearchaos,
@linearchaos@lemmy.world avatar

It’s still not in a freaking list that they can run a programmatic attack against. People that give this answer sound like a f****** broken record I swear.

Cqrd,

Secops has been against this method of protection for many years now, I’d say you’re the outdated one here

linearchaos,
@linearchaos@lemmy.world avatar

Years ago phishing and 2fa breaches werent as pervasive. Since we can’t all go to pass key right now, nobody’s doing a damn thing about the phishing campaigns. Secops current method of protection is to pay companies that scan the dark web by the lists and offer up if your password’s been owned for a fee.

That’s a pretty s***** tactic to try to protect your users.

Cqrd, (edited )

We’re on the internet, you can say shit.

If your user is just using johnsmithfall2022 as their password and they update the season and year every time, it’s pretty easy for hackers to identify that pattern and correct it. This is not the solution and it actively makes life worse for everyone involved.

Natanael,

Password crackers says you’re wrong

linearchaos,
@linearchaos@lemmy.world avatar

No never minded people that think that all passwords are being cracked tell me I’m wrong. Lists emails and passwords grabbed from fishing attacks tell me the people that are too lazy to change their passwords and once in awhile don’t deserve the security.

glue_snorter,

I’m a native English speaker. I can’t understand your comment. I sense that you have a useful perspective, could you rephrase it so it’s understandable?

vagrantprodigy,

Even better is forcing changes every 30 or 60 days, and not allowing changes more than every week. Our users complain daily between those rules and the password requirements that they are too dumb to understand.

JigglySackles,

Password changes that frequent are shown to be ineffective, especially for the hassle. Complexity is a better protection method.

vagrantprodigy,

I’m aware. Apparently everyone who read my post has misread it. I’m saying that the requirements above are terrible, and they make my users complain constantly. Our security team constantly comes up with ways to increase security theater at the detriment of actual security.

JigglySackles,

Ahh my bad. That sounds like a sec team that needs a reality check.

kent_eh,

And in my company the password change policies are very different from one system to another. Some force a change monthly, some every 28 days, some every 90 days, and thwn there is rhat one legacy system that no longer has a functioning password change mechanism, so we can’t change passwords there if we wanted to.

And the different systems all want different password formats, have different re-use rules.

And, with all those uncoordinated passwords, they don’t allow password managers to be used on corporate machines, despite the training materials that the company makes us re-do every year recommending password managers…

Aceticon,

What I really love is mandatory length and character password policies so complex that together with such password change requirements that push people beyond what is humanly possible to memorize, so it all ends down written in post-its, the IT equivalent of having a spare key under a vase or the rug.

xubu,

I’m in IT security and I’m fighting this battle. I want to lessen the burden of passwords and arbitrary rotation is terrible.

I’ve ran into a number of issues at my company that would give me the approval to reduce the frequency of expired passwords

  • the company gets asked this question by other customers “do you have a password policy for your staff?” (that somehow includes an expiration frequency).
  • on-prem AD password complexity has some nice parts built in vs some terrible parts with no granularity. It’s a single check box in gpo that does way too much stuff. I’m also not going to write a custom password policy because I don’t have the skill set to do it correctly when we’re talking about AD, that’s nightmare inducing. (Looking at specops to help and already using Azure AD password protection in passive mode)
  • I think management is worried that a phishing event happens on a person with a static password and then unfairly conflating that to my argument of “can we just do two things: increase password length by 2 and decrease expiration frequency by 30 days”

At the end of the day, some of us in IT security want to do the right things based in common sense but we get stymied by management decisions and precedence. Hell, I’ve brought NIST 800-63B documentation with me to check every reason why they wouldn’t budge. It’s just ingrained in them - meanwhile you look at the number of tickets for password help and password sharing violations that get reported … /Sigh

01189998819991197253,
@01189998819991197253@infosec.pub avatar

I feel this. I increased complexity and length, and reduced change frequency to 120d. It worked really well with the staggered rollout. Shared passwords went down significantly, password tickets went to almost none (there’s always that ‘one’). Everything points to this being the right thing and the fact that NIST supports this was a win… until the the IT audit. The auditor wrote “the password policy changed from 8-length, moderate complexity, 90-day change frequency to 12-length, high complexity, 120-day change frequency” and the board went apeshit. It wasn’t an infraction or a “ding”, it was only a note. The written policy was, of course, changed to match the GPO, so the note was for the next auditor to know of the change. The auditor even mentioned how he was impressed with the modernity of our policy and how it should lead to a better posture. I was forced to change it back, even though I got buyin from CTO for the change. BS.

Trainguyrom,

Having been exposed to those kinds of audits before that’s really just bad handling by the CTO and other higher ups!

01189998819991197253,
@01189998819991197253@infosec.pub avatar

Oh, I agree. Just one reason I decided to move on to a different employer.

partial_accumen,

At the end of the day, some of us in IT security want to do the right things based in common sense but we get stymied by management decisions and precedence. Hell, I’ve brought NIST 800-63B documentation with me to check every reason why they wouldn’t budge. It’s just ingrained in them - meanwhile you look at the number of tickets for password help and password sharing violations that get reported …

Paint the picture for management:

At one time surgery was the purview of medieval barbers. Yes, the same barbers that cut your hair. At the time there were procedures to intentionally cause people to bleed excessively and cutting holes the body to let the one of the “4 humors” out to make the patient well again. All of this humanity arrived at with tens of thousands of years of existence on Earth. Today we look at this as uninformed and barbaric. Yet we’re doing the IT Security equivalent of those medieval barber still today. We’re bleeding our users unnecessarily with complex frequent password rotation and other bad methods because that’s what was the standard at one time. What’s the modern medicine version of IT Security? NIST 800-63B is a good start. I’m happy to explain whats in there. Now, do we want to keep harming our users and wasting the company’s money on poor efficiency or do we want to embrace the lesson learned from that bad past?

Muscle_Meteor,

This is what i have to do to log into microsoft fuckin teams on my work laptop when i work from home…

  1. Unencrypt my laptop hardrive
  2. Log into my OS
  3. Log into the VPN
  4. Log into teams
  5. Use the authenticator app on my phone to enter the code that is on my screen
  6. Use my fingerprint on my phone to verify that i am the person using my phone…

Step 5 was introduced a few months ago because the other steps weren’t secure enough. This is why half my colleagues aren’t available when they work from home…

I suggested that we just use slack as our work chat and leave teams as a red herring to dissapoint extremely talented hackers.

jasondj,

Don’t reuse passwords!

But make them complicated!

Don’t write them down!

Change them every week!

dgmib,

One IT security team insisted we have separate source code repositories for production and development environments.

I’m honestly not sure how they thought that would work.

CosmicTurtle,

Could work if dev was upstream from prod. But honestly there would be no difference between that and branches.

Rednax,

Maybe it is a rights issue. Preventing a prod build agent of sorts to access develop code.

CosmicTurtle,

Yeah…assuming that the policy was written “from blood” (meaning someone did something stupid).

But even then you can put other checks and balances in place to make sure that kind of thing doesn’t happen.

This is such an extreme reaction though. Or the policy was made from someone dumb

Potatos_are_not_friends, (edited )

That’s fucking bananas.

In my job, the only difference between prod/dev is a single environmental file. Two repositories would literally serve no purpose and if anything, double the chances of having the source code be stolen.

dgmib,

That was the only difference for us as well. The CI/CD process built container images. Only difference between dev, test, and prod was the environment variables passed to the container.

At first I asked the clueless security analyst to explain how that improves security, which he couldn’t. Then I asked him how testing against one repository and deploying from another wouldn’t invalidate the results of the testing done by the QA team, but he kept insisting we needed it to check some box. I asked about the source of the policy and still no explanation, at least not one that made any sense.

Security analyst escalated it to his (thankfully not clueless) boss who promptly gave our process a pass and pointed out to Mr security analyst that literally nobody does that.

Tar_alcaran,

I’m honestly not sure how they thought that would work.

Just manually copy-paste everything. That never goes wrong, right?

lightnegative,

I mean, it’s what the Security guys do, right? Just copy+paste everything, mandate that everyone else does it too, Management won’t argue because it’s for “security” reasons.

Then the Security guys will sit around jerking each other off about how much more secure they made the system

mesamunefire,

Yep doing that now. Not sustainable in the slightest. Im glad im not in charge of that system.

LucyLastic,

A long time ago in a galaxy far away (before the internet was a normal thing to have) I provided over-the-phone support for a large and complex piece of software.

So, people would call up and you had to describe how they could do the thing they needed to do, and if that failed they would have to wait a few days until you went to the site to sort it in person.

The software we supported was not on the approved list for the company I worked for, so you couldn’t use it within the building where the phones were being answered.

Hobo,

I’m absolutely shocked that a company had a software whitelist before the widespread adoption of the internet. Ahead of their time in implementing, and fucking up, software whitelisting!

LucyLastic,

It was for government owned computers, they didn’t want any pirated or virus-infected stuff, and at that point there was no way to lock down such a mish-mash of systems.

The software company (who also do things like run prisons these days) had given permission for us to run the software and given a set of fake data so we could go through the motions when talking people through things, but apparently that wasn’t enough to get it on the list.

jeena,
@jeena@jemmy.jeena.net avatar

There was a server I inherited from colleagues who resigned, mostly static HTML serving. I would occasionally do a apt update &amp;&amp; apt ugrade to keep nginx and so updated and installed certbot because IT told me that this static HTML site should be served via HTTPS, fair enough.

Then I went on parental leave and someone blocked all outgoing internet access from the server. Now certbot can’t renew the certificate and I can’t run apt. Then I got a ticket to update nginx and they told me to use SSH to copy the files needed.

Hobo,

They are sort of right but have implemented it terribly. Serving out a static webpage is pretty low on the “things that are exploitable” but it’s still an entry point into the network (unless this is all internal then this gets a bit silly). What you need to do is get IT to set up a proxy and run apt/certbot through that proxy. It defends against some basic reverse shell techniques and gives you better control over the webhosts traffic. Even better would be to put a WAP and a basic load balancer in front of the webhost, AND proxy external communications.

Blocking updates/security services is dogshit though and usually is done by people that are a bit slow on the uptake. Basically they have completely missed the point of blocking external comms and created a way more massive risk in the process… They either need to politely corrected or shamed mercilessly if that doesn’t work.

Good luck though! I’m just glad I’m not the one that has to deal with it.

vivadanang,

I dunno, gluing usb’s in a super sensitive environment like that is actually logical; on the disc drives - they could disable autoplay as well though removing or gluing them closed would be preferable. USB is just such an easy attack vector where the individual plugging it in may not have skills themselves - it might be easier to bribe cleaning folks for example - or inject a person into a cleaning team. Ideally they would attack multiple nodes of your target’s network via as many avenues as possible; which makes the network and vpn thing just silly indeed; perhaps they were waiting for someone to try something with excellent infosec / firewalls / traffic shaping. yeeeeah lol.

SendMePhotos,

So like… Unplug the mouse and plug in the thumb drive… Bam!

Hobo,

That’s obvious when a mouse or keyboard doesn’t work. OP, and clealy other people in here, don’t really understand the actual attack vector in play. They aren’t using the USB as data storage, they are using as a cellular connected RAT and/or a tool to deploy a RAT to a workstation.

I think gluing usbs is dumb in just about any environment (disable them on the BIOS is the right answer), but attackers aren’t using it to drag and drop files and then physically take the usb with them. They are plugging them into a workstation, or just leaving them in the parking lot and letting other people plug them in, leveraging them to get initial access, and then essentially abandoning them.

For example see stuxnet: en.m.wikipedia.org/wiki/Stuxnet

MrMcGasion,

Pretty easy to make a hub device that you can plug the keyboard into and make it transparent to the user. Could even build in a keylogger to capture direct from the keyboard. The attacker would likely need physical access for that, so it wouldn’t be as convenient as the thumb drive in the parking lot attack vector, but unless you’re using PS/2 peripherals (or gluing those USB devices in too somehow), there’s still a fairly open attack vector there, even if you are disabling unused ports in BIOS.

mystik,

If it’s a secure enough environment, I imagine that there will be monitoring on the device, and the moment a hub shows up that’s not supposed to be there, or any other USB device tree that doesn’t match the approved list, , alarm bells ought to go off. If it’s valuable enough; the attack would be to use a passive device picking up leaky signals on the wire, or even hidden camera watching screen/keyboard.

Hobo,

Yep you’re right, but at least that adds another layer of complexity to their attack. A lot of security controls are at least somewhat situational, and most non-draconian companies have a process to put further mitigations around those exceptions either from increased monitoring or adding additional supplemental controls.

There’s no such thing at perfect security, just better risk mitigation. Slipping in a usb hub between the computer and keyboard while someone isn’t looking is a bit trickier then just plugging in a usb stick. If you disable unused usbs in the bios, instead of trying to do silly stuff like glue them shut, then the attacker has at least been temporarily thwarted if they slot it into a dead port. Aside from the high traffic areas, disabling ALL usb ports in places like datacenters and especially colocated datacenters, can thwart the attack outright as well.

Really from looking through this thread a lot of people seem to be under the misconception that security that isn’t perfect is pointless. It’s like claiming that locking your doors is pointless because lockpicks exists. The point isn’t to keep a sophisticated attack at bay, but rather to keep script kiddies and drive-by attacks from hitting your network. To defend against sophisticated attacks you really have to go a bit crazy, and even then very small slip ups can be disastrous. Ask Microsoft about their root cert getting leaked via a core dump!

I fully acknowledge that many people also work for places with dumbass security controls. Gluing usbs is WAYYYY up there on that list in my opinion. It also looks like a lot of people work at places that have really shitty security teams that haven’t quite figured out that controls are situational and require more thought then, “see checkbox, execute checkbox.”

willis936,

I am not allowed to change my wallpaper.

waterbogan,

Even worse here - we cant change the screensaver or screen lockout timeout settings!

I have a workaround by running a little looping script that keep the screen active. Its not that I particularly object to the screensaver, but once it activates I have to Ctrl Alt Delete 3-4 times and enter my password to get my desktop open again. Also it is an active screensaver that sometimes mucks up my desktop layout (I have a multiple monitor setup)

sizzling,

That is so annoying… when I’m working from home I just start a meeting with myself in Teams to keep the pc from autolocking.

lightnegative,

That’s actually genius. Here’s me writing a script to just move the mouse randomly lol, starting a Teams meeting would’ve been way simpler

feddylemmy,

This came from your security team? I usually see it from HR / management selling it as a branding issue or “professional” thing.

TechyDad,
@TechyDad@lemmy.world avatar

ZScaler. It’s supposedly a security tool meant to keep me from going to bad websites. The problem is that I’m a developer and the “bad website” definition is overly broad.

For example, they’ve been threatening to block PHP.Net for being malicious in some way. (They refuse to say how.) Now, I know a lot of people like to joke about PHP, but if you need to develop with it, PHP.Net is a great resource to see what function does what. They’re planning on blocking the reference part as well as the software downloads.

I’ve also been learning Spring Boot for development as it’s our standard tool. Except, I can’t build a new application. Why not? Doing so requires VSCode downloading some resources and - you guessed it - ZScaler blocks this!

They’ve “increased security” so much that I can’t do my job unless ZScaler is temporarily disabled.

killeronthecorner,
@killeronthecorner@lemmy.world avatar

It’s been ages since I had to deal with the daily random road blocks of ZScaler, but I do think of it from time to time.

Then I play Since U Been Gone by Kelly Clarkson.

lightnegative,

It has the same problem as any kind of TLS interception/ traffic monitoring tool.

It just breaks everything and causes a lot of lost time and productivity firstly trying to configure everything to trust a new cert (plenty of apps refuse to use the system cert store) and secondly opening tickets with IT just to go to any useful site on the internet.

Thankfully, at least in my case, it’s trivial to disable so it’s the first thing I do when my computer restarts.

Security doesn’t seem to do any checks about what processes are actually running, so they think they’ve done a good job and I can continue to do my job

Yawnder,

Did they block “social sites” such as stackoverflow for you too?
Yup… they did that…

tslnox,

Yeah. Zscaler was once blocking me from accessing the Cherwell ticket system, which made me unable to write a ticket that Zscaler blocked me access to Cherwell.

Took me a while to get an IT guy to fix it without a ticket.

PainInTheAES,

Now that’s a Catch-22

Dkiscoo,

Oh man our security team is trialing zscaler and netskope right now. I’ve been sitting in the meetings and it seems like it’s just cloud based global protect. GP was really solid so this worries me

agressivelyPassive,

Also, zScaler breaks SSL. Every single piece of network traffic is open for them to read. Anyone who introduces zscaler should be fired and/or shot on sight. It’s garbage at best and extremely dangerous at worst.

G00d4y0u,

Zscaler being the middleman is somewhat the point for security/IT teams using that feature.

agressivelyPassive,

And it’s a horrible point. You’re opening up your entire external network traffic to a third party, whose infrastructure isn’t even deployed or controllable in any form by you.

G00d4y0u,

The idea being that it’s similar to using other enterprise solutions, many of which do the same things now.

Zscaler does have lesser settings too, at it’s most basic it can do split tunneling for internal services at an enterprise level and easy user management. Which is a huge plus.

I’d also like to point out that the entire Internet is a third party you have no control over which you open your external traffic to everyday.

The bigger deal would be the internal network, which is also a valid argument.

agressivelyPassive,

I’d also like to point out that the entire Internet is a third party you have no control over which you open your external traffic to everyday.

Not really. Proper TLS enables relatively secure E2E encryption, not perfect, but pretty good. Adding Zscaler means, that my entire outgoing traffic runs over one point. So one single incident in one single provider basically opens up all of my communication. And given that so many large orgs are customers of ZScaler, this company pretty much has a target on its back.

Additionally: I’m in Germany. My Company does a lot of contracting and communication with local, state and federal entities, a large part of that is not super secret, but definitely not public either. And now suddenly an Amercian company, that is legally required to hand over all data to NSA, CIA, FBI, etc. has access to (again) all of my external communication. That’s a disaster. And quite possibly pretty illegal.

Tischkante,

Everything only needed because it only helps to meet a security standard and to lower insurance. So much useless outdated stuff.

Merwyn,

They forbid us to add our ssh keys in some server machines, and force us to log in these servers with the non-personal admin account, with a password that is super easy to guess and haven’t been changed in 5 years.

PoolloverNathan,

VPN to another country and pretend to crack it. Repeat this until IT changes their mind.

Rolive,

Chaotic good.

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • asklemmy@lemmy.world
  • localhost
  • All magazines
    •
    Loading…
    Loading the web debug toolbar…
    Attempt #

    Fatal error: Allowed memory size of 134217728 bytes exhausted (tried to allocate 327680 bytes) in /var/www/kbin/kbin/vendor/symfony/var-dumper/Cloner/VarCloner.php on line 205

    Fatal error: Allowed memory size of 134217728 bytes exhausted (tried to allocate 32768 bytes) in /var/www/kbin/kbin/vendor/symfony/error-handler/ErrorRenderer/HtmlErrorRenderer.php on line 249