Tech workers - what did your IT Security team do that made your life hell and had no practical benefit?

One chestnut from my history in lottery game development:

While our security staff was incredibly tight and did a generally good job, oftentimes levels of paranoia were off the charts.

Once they went around hot gluing shut all of the “unnecessary” USB ports in our PCs under the premise of mitigating data theft via thumb drive, while ignoring that we were all Internet-connected and VPNs are a thing, also that every machine had a RW optical drive.

Rolive,

Some corporate BS screen lock application that replaces the built in Windows feature. It would take several minutes to log in because of that.

Fortunately you can kill the process with taskmanager and prevent the screen from locking entirely. Lol.

punkwalrus,
@punkwalrus@lemmy.world avatar

Worked a job where I had to be a Linux admin for a variety of VMs. To access them, I needed an VPN that only worked inside the company LAN, and blocked internet access. it was a 30 day trial license on day 700somthing, so it had a max 5 simultaneous connection limit. Access was from my heavily locked down laptop. Windows 7 with 5 minutes locking Screensaver. The ssh software was an unknown brand, “ssh.exe” which only allowed one connection at a time in a 80 x 24 console window with no ability to copy and paste. This went to a bastion host, an HPUx box on an old csh shell with no write access to your home directory due to a 1.4mb disk quota per user. Only one login per user, ten login max, and the bastion host was the only way to connect to the Linux VMs. Default 5 minute logout for inactivity. No ssh keys allowed. No scripting allowed, was like typing over 9600 baud.

I quit that job. When asked why, I told them I was a Linux administrator and the job was not allowing me to administrate. I was told “a poor carpenter always blames his tools.” Yeah, fuck you.

AceFuzzLord,

That sounds like the equivalent of asking a carpenter to build a wooden boat large enough to carry 30 people, but only giving them Fisherprice tools and foam blocks.

AceFuzzLord,

That sounds like the equivalent of asking a carpenter to build a wooden boat large enough to carry 30 people, but only giving them Fisherprice tools and foam blocks.

FitzNuggly,

A carpenter isn’t expected to use his tools with garbage grabbers (reachy claw things) either.

AceFuzzLord,

That sounds like the equivalent of asking a carpenter to build a wooden boat large enough to carry 30 people, but only giving them Fisherprice tools and foam blocks.

aredditimmigrant,

Worked at a medium sized retail startup as a software engineer where we didn’t have root access to our local laptops, under the guise of “if you fuck it up we won’t be able to fix it” but we only started out with a basic MacBook setup. so every time I wanted to install a tool, ide, or VM I had to make a ticket to IT to come and log in with the password and explain what I was doing.

Eventually, the engineering dept bribed an IT guy to just give us the password and started using it. IT MGMT got pissed when the number of tickets dropped dramatically and realized what was going on.

We eventually came to the compromise that they gave us sudo access with the warning “we’re not backing anything up. If you mess up we’ll have to factory reset the whole machine”. Nobody ever had to factory reboot their machine because we weren’t children… And if there was an issue we just fixed it ourselves

AceFuzzLord,

Imagine that. IT knowing how to fix the issues they caused. What a revolutionary thought! /s

coffee_poops,

Password rotation.

Taringano,

Also complex and random requirements for passwords

BradleyUffner,

“your password may not start with a special character” (rage)

Nicadimos,

As a security guy - as soon as I can get federal auditors to agree, I’m getting rid of password expiration.

The main problem is they don’t audit with logic. It’s a script and a feeling. No password expiration FEELS less secure. Nevermind the literal years of data and research. Drives me nuts.

coffee_poops,

It’s counterintuitive. Drives people to use less secure passwords that they’re likely to reuse or to just increment; Password1, Password2, etc.

commandar,

Cite NIST SP 800-63B.

Verifiers SHOULD NOT impose other composition rules (e.g., requiring mixtures of different character types or prohibiting consecutively repeated characters) for memorized secrets. Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically). However, verifiers SHALL force a change if there is evidence of compromise of the authenticator.

pages.nist.gov/800-63-3/sp800-63b.html

I’ve successfully used it to tell auditors to fuck off about password rotation in the healthcare space.

Now, to be in compliance with NIST guidelines, you do also need to require MFA. This document is what federal guidelines are based on, which is why you’re starting to see Federal gov websites require MFA for access.

Either way, I’d highly encourage everyone to give the full document a read through. Not enough people are aware of it and this revision was shockingly reasonable when it came out a year or two ago.

AtHeartEngineer,
@AtHeartEngineer@lemmy.world avatar

SSL proxy, in a company full of developers, so they could sniff traffic. It broke everything. It’s one of the reasons I left that company.

jj4211,

We have a largeish number of systems that IT declared catheorically could not connect directly to the Internet for any reason.

So guess what systems weren’t getting updates. Also guess what systems got overwhelmed by ransomware that hit what would have been a patched vulnerability, that came through someone’s laptop that was allowed to connect to the Internet.

My department was fine, because we broke the rules to get updates.

So did network team admit the flaw in their strategy? No, they declared a USB key must have been the culprit and they literally went into every room and confiscated all USB keys and threw them away, with quarterly audits to make sure no USB keys appear. The systems are still not being updated and laptops with Internet connection are still indirectly bridging them.

jj4211,

Also, I keep a “rogue” laptop to self administrate along with my official it laptop to show I am in compliance. Updates are disabled and are only allowed to be fine y by IT. I just checked and they haven’t pushed any updates for about 8 months.

irotsoma,
@irotsoma@lemmy.world avatar

Wait, why don’t they use patch management software? If they allow computers with Internet access to connect to them, why not a patch management server?

jj4211,

They do. In fact they mandate IT assets to have three competing patch management software on them. They mandate disabling any auto updates because they have to vet them first. My official laptop hasn’t been pushed an update in 8 months.

PutangInaMo,

Do y’all need a consultant? That is so bad it’s a non starter.

jj4211,

Ironically, we actually have a Segment of our business that provides IT for other companies, and they do a decent job, but they aren’t allowed to manage our own IT. Best guess is that they are too expensive to waste on our own IT needs. If an IT staffember accidentally shows competence, they are probably moved to the billable group.

PutangInaMo,

The irony…

neveraskedforthis,

Banned open source software because of security concerns. For password management they require LastPass or that we write them down in a book that we keep on ourselves at all times. Worth noting that this policy change was a few months ago. After the giant breach.

And for extra absurdity: MFA via SMS only.

I wish I was making this up.

JigglySackles,

I tried so hard to steer my last company away from SMS MFA. CTO basically flat out said, “As long as I’m here SMS MFA will always be an option.”

Alright, smarmy dumbass. I dream of the day when they get breached because of SMS.

Aceticon,

If I remember it correctly, in GSM it’s perfectly possibly to spoof a phone number to receive the SMS using the roaming part of the protocol.

The thing was designed to be decently safe, not to be highly secure.

slazer2au,

Do you work for a government?

Hobart_the_GoKart,

Care to elaborate “MFA via SMS only”? I’m not in tech and know MFA through text is widely used. Or do you mean alternatives like Microsoft Authenticator or YubiKey? Thanks!

Appoxo,
@Appoxo@lemmy.dbzer0.com avatar

Sim swap is quite easy if you are convincing enough for support at an ISP doing phone plans.
Now imagine if I sim-swapped your 2FA codes :)

Exactly this. Instead you should use a phone app like Aegis or proprietary solutions like MS Authenticator to MFA your access because it’s encrypted.

Hobart_the_GoKart,

Thenks! I really don’t want to be forced into an app, but it’s good to know the reason why.

Funwayguy,
@Funwayguy@lemmy.world avatar

Through a low tech social engineering attack referred to as SIM Jacking, an attacker can have your number moved to their SIM card, redirecting all SMS 2FA codes effectively making the whole thing useless as a security measure. Despite this, companies still implement it out of both laziness and to collect phone numbers (which is often why SMS MFA is forced)

Hobart_the_GoKart,

TIL! thanks for the explanation.

jaybone,

To collect numbers, which they sell in bulk, to shadey organizations, that might SIM Jack you.

JackGreenEarth,

Banning open source because of security concerns is the opposite of what they should be doing if they care about security. You can’t vet proprietary software.

CCDKP,

It’s not about security, it’s about liability. You can’t sue OSS to get shareholders off your back.

csm10495,
@csm10495@sh.itjust.works avatar

In high school they blocked dictionary.com for some reason.

SgtAStrawberry,

I’m going to guess either because it starts with dic or because you can look up dirty words on it.

willis936,

You wouldn’t want high school boys running around with enlarged dictions.

ElderWendigo,

Worse yet, the girls might become cunning linguists.

glue_snorter,

Think of the lexiconsequences

Hogger85b,

Set the automatic timeout for admin accounts to 15 minutes....meaning that process that may take an hour or so you have to wiggle the mouse or it logs out ..not locks.... logs out

From installs to copying log files, to moving data to reassigning owner of data to the service account.

netburnr,
@netburnr@lemmy.world avatar

There is no compliance item I am aware of that has that requirement, some CISO needs to learn to read.

Hobo,

Misunderstood STIG from the sound of it. The STIG is only applicable to unprivileged users but tends to get applied to all workstations regardless of user privileges. Also I think the .mil STIG GPOs apply it to all workstations regardless of privileges.

The other thing that tends to get overlooked is that AC-12 let’s you set it to whatever the heck you want. Ao you could theoretically set it to 99999 year by policy if you wanted.

www.stigviewer.com/stig/…/V-69243

chiliedogg,

And that’s why people use mouse jigglers and keep their computers unlocked 24/7.

fat_stig,

Mine was removed by Corporate IT, along with a bunch of other open source stuff that made my life bearable.

Also I spent 5 months with our cyber security guys to try and provide a simple file replication server for my team working in a remote office with shit internet connectivity. I gave up, the spooks put up a solid defense, push all the onerous IT security compliance checking onto my desk instead of taking control.

Not as bad as my previous company though, outsourced IT support to ATOS was a nightmare.

0xD,

The internal IT at that hellhole is a nightmare as well.

FooBarrington,

That’s why you buy a jiggler that you place your mouse onto. Not detectable by IT :)

lightnsfw,

I set my pocket knife on the ctrl key when I have to step away.

lazylion_ca,

That works?

lightnsfw,

Idk about every application but it keeps windows from timing out which serves most purposes for me.

FooBarrington,

Does that keep your status in Teams as “online”? That’s what I use the jiggler for - if I’m waiting for CI tests which take 30+ minutes and I sit in front of the laptop, I don’t want to have to manually jiggle my mouse every couple of minutes just to keep my status.

lightnsfw,

Yep

FooBarrington,

Awesome, thank you!

Krudler,

Ahhh the old “level up an RPG Skill by jamming a pen cap into a key and going to watch Night Court reruns” method.

Thanks, I actually didn’t know holding CTRL would keep the system awake!

fat_stig,

After mine was disabled, I found that if I run videos of old meetings or training onscreen, it keeps the system alive…

Works nicely when I’m WFH.

Aceticon,

It’s reasonably easy to make a hardware mouse wiggler with an Arduino Micro (and I don’t mean something that physically moves a mouse, rather something that looks like a USB mouse to the computer and periodically sends mouse movement messages).

If you’re desperate enough, look it up as it’s quite simple so there should be step by step instructions out there.

drudoo,

Absolutely love my Uno keyboard for this keyhive.xyz/shop/uno-single-key-keyboard

Got like 6 commands on a single key and one of them is to press shift every 30seconds so my computer doesn’t lock. Lifesaver.

glue_snorter,

I used a Sidewinder keyboard for years with programmable macros.

Yeah, I had my password as a macro.

Dick move on my part as the macro, I’m fairly sure, is stored in plaintext on the PC. But the convenience was great. I don’t do that any more.

Aceticon,

Yeah, it’s surprisingly simple to get these microcontrollers to become essentially programmable keyboard/mouse emulators, by which point if you’re familiar with the stuff to program them (Arduino being the simplest and most widespread framework) it really just becomes a coding task and you can get it to do crazy stuff.

I suggested an Arduino Micro board because it bypasses the whole hardware side of the problem, but something like what you mention is even simpler.

steal_your_face,
@steal_your_face@lemmy.ml avatar

Can also just buy one from Amazon if you’re lazy or not technically inclined.

Aceticon,

Well, my off the cuff suggestion was what seems simple to me in this domain ;)

That said I get what you mean and agree.

mesamunefire,

We cant run scripts on our work laptop because of domain policy. Thing is, I am a software developer. They also do not allow docker without some heavy approval process, nor VMs. So im just sitting here remoting into a machine for development…which is fine but the machine is super slow. Also their VPN keeps going down, so all the software developers have to reconnect periodically all at the same time.

At my prior jobs, it was all open so it was very easy to install the tools we needed or get approval fairly quickly. Its more frustrating than anything. At least they give us software development work marked months out.

pahlimur,

Thought my work was bad. We at least can use VMs. I literally can’t do my job without one, Rockwell being what it is. Companies don’t like upgrading PLC software so I need to use old versions of windows occasionally to run old Rockwell stuff.

There was also a bug for a bit that would brick win11 PCs when trying to update PLC firmware, fun stuff.

afraid_of_zombies,

Same boat. I use dedicated laptops. This is for my old Rockwell stuff, this is for my old Siemens stuff, this is my normal laptop with AD stuff, this one for Idec, and the last one for Schneider. Pretty much every laptop at the company gets retired it becomes mine.

Also works for on site access. Customer needs support? Mail them a laptop. I got one laptop that has been in Canada, both coastlines in America, Australia, and Vietnam.

Krudler,

I cannot remember the specifics because it’s going back almost 15 years now but at one point…crontab (edit and other various vital tools) was disabled by policy.

To get necessary processes/cleanup done at night, I used a scheduled task on a Windows PC to run a BAT that opened a macro program which opened a remote shell and “typed” the commands.

Fuuuuuuck.

afraid_of_zombies,

I hate this stuff. When I had a more devops role I would just VM everything. Developers need their tools, here is a VM with root. Do what you want and backups run on Friday.

SpookySnek,

My dev pc isn’t allowed to be connected to the internet :D

mesamunefire,

Yep you have it the worst. Shut down the thread.

SpookySnek,

Wait, I haven’t even started talking about the fact it’s a huge unstructured legacy project using SharePoint 2016 and…

Where did everyone go?

afraid_of_zombies,

I had a software developer job where they expected me to write code in Microsoft notepad, put it on a USB, and then plug it into airgapped computers to test it. Wasn’t allowed to even use notepad++.

Oh it felt so freaken good leaving that job after 6 weeks. It felt even better when I used my old manager’s personal phone number on a fake grinder profile I made. She kept a tally of my bathroom breaks.

PutangInaMo,

Jump systems are a good practice but they gotta have the resources you need… I hate to say it but it sounds like y’all need to just move to a cloud platform…

FooBarrington,

I had to run experiments that generate a lot of data (think hundreds of megabytes per minute). Our laptops had very little internal storage. I wasn’t allowed to use an external drive, or my own NAS, or the company share - instead they said “can’t you just delete the older experiments?”… Sure, why would I need the experiment data I’m generating? Might as well /dev/null it!

Taringano,

Oh hey I was living this a few months ago!

thantik,

Haha, I never thought of this but…I WAS the IT department in a previous life. I never really thought about how none of this shit really affected me. Granted, I’d have everyone using Yubikeys+Password for logins if I were in charge now.

pirrrrrrrr,

Yubikey enforcement is ass in AD.

We’ve moved to SilverFort. That way I can keep using the YKs but actually enforce them correctly. It allows WAAAY more visibility and control over the things that matter, and it’s diagnostics and easy policy generation from lookups is great.

DaneGerous,

Disabled “unnecessary” services on all member servers including netlogon. That was a fun couple of weeks.

Krudler,

The “we’ll just disable everything until somebody complains” strategy. Idiots!

teichflamme,

Often times it’s the only strategy because most admins or system owners have no clue what services they actually need

disconnectikacio,

Very short screensaver timeouts, useless proxy, short timeouts from intranet pages, disabled browser extensions, to make impossible to automatize our very repetitive work, daily DB access requests for work, etc.

AstralWeekends,

Screensaver?

AstralWeekends,

Made me write SQL updates that had to be run by someone in a different state with pretty much no knowledge of SQL.

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • asklemmy@lemmy.world
  • localhost
  • All magazines
    •
    Loading…
    Loading the web debug toolbar…
    Attempt #

    Fatal error: Allowed memory size of 134217728 bytes exhausted (tried to allocate 18878464 bytes) in /var/www/kbin/kbin/vendor/symfony/http-kernel/Profiler/FileProfilerStorage.php on line 171

    Fatal error: Allowed memory size of 134217728 bytes exhausted (tried to allocate 10502144 bytes) in /var/www/kbin/kbin/vendor/symfony/error-handler/Resources/views/logs.html.php on line 31