Tech workers - what did your IT Security team do that made your life hell and had no practical benefit?

One chestnut from my history in lottery game development:

While our security staff was incredibly tight and did a generally good job, oftentimes levels of paranoia were off the charts.

Once they went around hot gluing shut all of the “unnecessary” USB ports in our PCs under the premise of mitigating data theft via thumb drive, while ignoring that we were all Internet-connected and VPNs are a thing, also that every machine had a RW optical drive.

Treczoks,

The network has been subnetted into departments. Problem: I, from development, get calls from service about devices that have issues. Before the subnetting, they simply told me the serial number, and I let my army of diagnosis tools hit the unsuspecting device to get an idea what’s up with it. Now they have to bring it over and set up all the attached devices here so I can run my tests.

shasta,

Surely IT can make an exception for you or create a VM with multiple NICs for you.

Rand0mA,

Or configure a local port on the dev vlan… Sounds like a corporate environment where the many IT teams dont talk to each other, or network team are hiding out in a comms cupboard.

argentcorvid,
@argentcorvid@midwest.social avatar

Oh my… no.

Canopyflyer,

Over 150 Major Incidents in a single month.

Formerly, I was on the Major Incident Response team for a national insurance company. IT Security has always been in their own ivory tower in every company I’ve worked for. But this company IT Security department was about the worst case I’ve ever seen up until that time and since.

They refused to file changes, or discuss any type of change control with the rest of IT. I get that Change Management is a bitch for the most of IT, but if you want to avoid major outages, file a fucking Change record and follow the approval process. The security directors would get some hair brained idea in a meeting in the morning and assign one of their barely competent techs to implement it that afternoon. They’d bring down what ever system they were fucking with. Then my team had to spend hours, usually after business hours, figuring out why a system, which had not seen a change control in two weeks, suddenly stopped working. Would security send someone to the MI meeting? Of course not. What would happen is, we would call the IT Security response team and ask if anything changed on their end. Suddenly 20 minutes later everything was back up and running. With the MI team not doing anything. We would try to talk to security and ask what they changed. They answered “nothing” every god damn time.

They got their asses handed to them when they brought down a billing system which brought in over $10 Billion (yes with a “B”) a year and people could not pay their bills. That outage went straight to the CIO and even the CEO sat in on that call. All of the sudden there was a hard change freeze for a month and security was required to file changes in the common IT record system, which was ServiceNow at the time.

We went from 150 major outages (defined as having financial, or reputation impact to the company) in a single month to 4 or 5.

Fuck IT Security. It’s a very important part of of every IT Department, but it is almost always filled with the most narcissistic incompetent asshats of the entire industry.

Seasm0ke,

Jesus Christ I never thought id be happy to have a change control process

Tar_alcaran,

Lots of safety measures really suck. But they generally get implemented because the alternative is far worse.

Machindo,

At my current company all changes have to happen via GitHub PR and commit because we use GitOps (ex: ArgoCD with Kubernetes). Any changes you do manually are immediately overwritten when ArgoCD notices the config drift.

This makes development more annoying sometimes but I’m so damn glad when I can immediately look at GitHub for an audit trail and source of truth.

It wasn’t InfoSec in this case but I had an annoying tech lead that would merge to main without telling people, so anytime something broke I had his GitHub activity bookmarked and could rule that out first.

shasta,

You can also lock down the repo to require approvals before merge into main branch to avoid this.

Machindo,

Since we were on the platform team we were all GitHub admins 😩. So it all relied on trust. Is there a way to block even admins?

shasta,

Hm can’t say. I’m using bitbucket and it does block admins, though they all have the ability to go into settings and remove the approval requirement. No one does though because then the bad devs would be able to get changes in without reviews.

Machindo,

That sounds like a good idea. I’ll take another look at GitHub settings. Thanks!

Canopyflyer,

The past several years I have been working more as a process engineer than a technical one. I’ve worked in Problem Management, Change Management, and currently in Incident for a major defense contractor (yes, you’ve heard of it). So I’ve been on both sides. Documenting an incident is a PITA. File a Change record to restart a server that is in an otherwise healthy cluster? You’re kidding, right? What the hell is a “Problem” record and why do I need to mess with it?

All things I’ve heard and even thought over the years. What it comes down to, the difference between a Mom and Pop operation, that has limited scalability and a full Enterprise Environment that can support a multi-billion dollar business… Is documentation. That’s what those numb nuts in that Insurance Company were too stupid to understand.

Krudler,

You poor man. I’ve worked with those exact fukkin’ bozos.

RaoulDook,

Lack of a Change Control process has nothing to do with IT Security except within the domain of Availability. Part of Security is ensuring IT systems are available and working.

You simply experienced working at an organization with poor enforcement of Change Control policies. That was a mistake of oversight, because with competent oversight anyone causing outages by making unapproved changes that cause an outage would be reprimanded and instructed to follow policy properly.

tsz,

Mine refuses to use ipmi. Also all switches use the same password.

thisbenzingring,

I was a network administrator at a site, which just made me a glorified system admin with responsibility for the network and switches.

Everyone in the IT Dept had the password for the switches. After one person gave a 3rd party vendor the password, I had to change the passwords and exclude him from having it… but then everyone else got the password.

That place was nuts, between that and a few other stupid boss actions, I just moved on. Found a much better job and it was for the best.

d00phy,

The IT company I work for purchased me, along with some number of my coworkers and our product line from my former employer. Leading up to the cut over, we’re told that on midnight of the change, our company email will stop working. No forwarders or anything. BUT, we will get a new email that consists of gibberish@stupidsubdomain.company.com. When the password on this new account expires, because we can’t change it because we’re no longer employees, we have to go to a website to request a password change. This emails us a link to our new company email address, but we can’t use that link. We have to manually change part of the URL for it to work. I had them manually change my password twice before I gave up on the whole process. Figured I didn’t work for them anymore. What would they do if I stopped using this bogus account/email address, fire me?

RogueBanana,

Is it actually gibberish? I have never seen a company use anything other than parts of first name last name at company.

d00phy,

I’m sure it meant something to someone, but it was just letters and numbers to me.

Hogger85b,

Set the automatic timeout for admin accounts to 15 minutes....meaning that process that may take an hour or so you have to wiggle the mouse or it logs out ..not locks.... logs out

From installs to copying log files, to moving data to reassigning owner of data to the service account.

netburnr,
@netburnr@lemmy.world avatar

There is no compliance item I am aware of that has that requirement, some CISO needs to learn to read.

Hobo,

Misunderstood STIG from the sound of it. The STIG is only applicable to unprivileged users but tends to get applied to all workstations regardless of user privileges. Also I think the .mil STIG GPOs apply it to all workstations regardless of privileges.

The other thing that tends to get overlooked is that AC-12 let’s you set it to whatever the heck you want. Ao you could theoretically set it to 99999 year by policy if you wanted.

www.stigviewer.com/stig/…/V-69243

chiliedogg,

And that’s why people use mouse jigglers and keep their computers unlocked 24/7.

fat_stig,

Mine was removed by Corporate IT, along with a bunch of other open source stuff that made my life bearable.

Also I spent 5 months with our cyber security guys to try and provide a simple file replication server for my team working in a remote office with shit internet connectivity. I gave up, the spooks put up a solid defense, push all the onerous IT security compliance checking onto my desk instead of taking control.

Not as bad as my previous company though, outsourced IT support to ATOS was a nightmare.

0xD,

The internal IT at that hellhole is a nightmare as well.

FooBarrington,

That’s why you buy a jiggler that you place your mouse onto. Not detectable by IT :)

lightnsfw,

I set my pocket knife on the ctrl key when I have to step away.

lazylion_ca,

That works?

lightnsfw,

Idk about every application but it keeps windows from timing out which serves most purposes for me.

FooBarrington,

Does that keep your status in Teams as “online”? That’s what I use the jiggler for - if I’m waiting for CI tests which take 30+ minutes and I sit in front of the laptop, I don’t want to have to manually jiggle my mouse every couple of minutes just to keep my status.

lightnsfw,

Yep

FooBarrington,

Awesome, thank you!

Krudler,

Ahhh the old “level up an RPG Skill by jamming a pen cap into a key and going to watch Night Court reruns” method.

Thanks, I actually didn’t know holding CTRL would keep the system awake!

fat_stig,

After mine was disabled, I found that if I run videos of old meetings or training onscreen, it keeps the system alive…

Works nicely when I’m WFH.

Aceticon,

It’s reasonably easy to make a hardware mouse wiggler with an Arduino Micro (and I don’t mean something that physically moves a mouse, rather something that looks like a USB mouse to the computer and periodically sends mouse movement messages).

If you’re desperate enough, look it up as it’s quite simple so there should be step by step instructions out there.

drudoo,

Absolutely love my Uno keyboard for this keyhive.xyz/shop/uno-single-key-keyboard

Got like 6 commands on a single key and one of them is to press shift every 30seconds so my computer doesn’t lock. Lifesaver.

glue_snorter,

I used a Sidewinder keyboard for years with programmable macros.

Yeah, I had my password as a macro.

Dick move on my part as the macro, I’m fairly sure, is stored in plaintext on the PC. But the convenience was great. I don’t do that any more.

Aceticon,

Yeah, it’s surprisingly simple to get these microcontrollers to become essentially programmable keyboard/mouse emulators, by which point if you’re familiar with the stuff to program them (Arduino being the simplest and most widespread framework) it really just becomes a coding task and you can get it to do crazy stuff.

I suggested an Arduino Micro board because it bypasses the whole hardware side of the problem, but something like what you mention is even simpler.

steal_your_face,
@steal_your_face@lemmy.ml avatar

Can also just buy one from Amazon if you’re lazy or not technically inclined.

Aceticon,

Well, my off the cuff suggestion was what seems simple to me in this domain ;)

That said I get what you mean and agree.

dgmib,

One IT security team insisted we have separate source code repositories for production and development environments.

I’m honestly not sure how they thought that would work.

CosmicTurtle,

Could work if dev was upstream from prod. But honestly there would be no difference between that and branches.

Rednax,

Maybe it is a rights issue. Preventing a prod build agent of sorts to access develop code.

CosmicTurtle,

Yeah…assuming that the policy was written “from blood” (meaning someone did something stupid).

But even then you can put other checks and balances in place to make sure that kind of thing doesn’t happen.

This is such an extreme reaction though. Or the policy was made from someone dumb

Potatos_are_not_friends, (edited )

That’s fucking bananas.

In my job, the only difference between prod/dev is a single environmental file. Two repositories would literally serve no purpose and if anything, double the chances of having the source code be stolen.

dgmib,

That was the only difference for us as well. The CI/CD process built container images. Only difference between dev, test, and prod was the environment variables passed to the container.

At first I asked the clueless security analyst to explain how that improves security, which he couldn’t. Then I asked him how testing against one repository and deploying from another wouldn’t invalidate the results of the testing done by the QA team, but he kept insisting we needed it to check some box. I asked about the source of the policy and still no explanation, at least not one that made any sense.

Security analyst escalated it to his (thankfully not clueless) boss who promptly gave our process a pass and pointed out to Mr security analyst that literally nobody does that.

Tar_alcaran,

I’m honestly not sure how they thought that would work.

Just manually copy-paste everything. That never goes wrong, right?

lightnegative,

I mean, it’s what the Security guys do, right? Just copy+paste everything, mandate that everyone else does it too, Management won’t argue because it’s for “security” reasons.

Then the Security guys will sit around jerking each other off about how much more secure they made the system

mesamunefire,

Yep doing that now. Not sustainable in the slightest. Im glad im not in charge of that system.

countflacula,

Removed admin access for all developers without warning and without a means for us to install software. We got access back in the form of a secondary admin account a few days later, it was just annoying until then.

Brkdncr,

Local admin of your interactive account is just. Ad though.

glad_cat,

I had the same problem once. Every time I needed to be an admin, I had to send an email to an outsourced guy in another country, and wait one hour for an answer with a temporary password.

With WSL and Linux, I needed to be admin 3 or 4 times per day. I CCed my boss for every request. When he saw that I was waiting and doing nothing for 4 hours every day, he sent them an angry email and I got my admin account back.

The stupid restriction was meant for managers and sales people who didn’t need an admin account. It was annoying for developers.

mesamunefire,

I worked at a big name health insurance company that did the same. You would have to give them an email, wait a week, then give them a call to get them to do anything. You could not install anything yourself, it was always a person that remote into your computer. After a month, I still didn’t have visual studio installed when they wanted me to work on some .Net. Then they installed the wrong version of Visual Studio. So the whole process had to be restarted.

I got a new job within 3 months and just noped out.

Lexam,

Locked down our USB ports. We work on network equipment that we have to use the USB port to log in to locally.

mesamunefire,

One place I worked at did this but had bluetooth on no issues. People brought all kinds of things to the office.

al177,

Oh man. Huge company I used to work for had:

  • two separate Okta instances. It was a coin toss as to which one you’d need for any given service
  • oh, and a third internally developed federated login service for other stuff
  • 90 day expiry for all of the above passwords
  • two different corporate IM systems, again coin toss depending on what team you’re working with
  • nannyware everywhere. Open Performance Monitor and watch network activity spike anytime you move your mouse or hit a key
  • an internally developed secure document system used by an international division that we were instructed to never ever use. We were told by IT that it “does something to the PC at a hardware level if you install the reader and open a document” which would cause a PC to be banned from the network until we get it replaced. Sounds hyperbolic, but plausible given the rest of the mess.
  • required a mobile authenticator app for some of the above services, yet the company expected that us grunts use our personal devices for this purpose.
  • all of the above and more, yet we were encouraged to use any cloud hosted password manager of our choosing.
Hogger85b,

I'll.go one further with authenticator. Mobile phones were banned in the data center and other certain locations (financial services). Had to set up landline phone....but to do that needed to request it...approve it on my phone then enter data center security door run and answer the phone line with 60s like something in the matrix.

tractus,

I’m sure there are more elegant ways they could have disabled the USB ports, but this might have been partially to avoid users being able to accidentally compromise their device by sticking a thumb drive they found in the parking lot in to see what was on it. For exfiltration and VPN usage over the network there are other controls they can/likely had put in place that you may just not have known about

AtariDump,

Users would just unplug the keyboard and plug in the USB stick.

Krudler,

They were just paranoid dopes.

I would hear them talking about IT security the way 10 year old boys talk about defending their fort from zombies.

totallynotarobot,

So… what was the zombie situation tho? Were they at least on top of that?

Krudler,

Well if we’re following the metaphor, yes they were completely on top of preventing imaginary threats that wouldn’t realistically ever materialize lol

Merwyn,

They forbid us to add our ssh keys in some server machines, and force us to log in these servers with the non-personal admin account, with a password that is super easy to guess and haven’t been changed in 5 years.

PoolloverNathan,

VPN to another country and pretend to crack it. Repeat this until IT changes their mind.

Rolive,

Chaotic good.

thantik,

Haha, I never thought of this but…I WAS the IT department in a previous life. I never really thought about how none of this shit really affected me. Granted, I’d have everyone using Yubikeys+Password for logins if I were in charge now.

pirrrrrrrr,

Yubikey enforcement is ass in AD.

We’ve moved to SilverFort. That way I can keep using the YKs but actually enforce them correctly. It allows WAAAY more visibility and control over the things that matter, and it’s diagnostics and easy policy generation from lookups is great.

Zeth0s,

They set zscaler so that if I don’t access an internal service for an unknown number of months, it means I don’t need it “for my daily work”, so they block it. If I want to access it again I need to open a ticket. There is no way to know what they closed and when they’ll close something.

In 1 months since this policy is active, I already have opened tickets to access test databases, k8s control plane, quality control dashboards, tableau server…

I really cannot comment how wrong it is.

ShunkW,

Zscaler is one of the worst products I’ve had the displeasure to interact with. They implemented it at my old job and it said that my home Internet connection was insecure to connect to the VPN. Cyber Sec guys couldn’t figure out the issue because the logs were SO helpful.

Took working with their support to find that it has somehow identified my nonstandard address spacing on my LAN to be insecure for some reason.

I kept my work laptop on a separate vlan for obvious reasons.

Natanael,

Pretty sure it’s some misapplied heuristics for previously identified bad clients, but that should only trigger an alert (with details!) in most cases and not block you if it’s not also paired with any known malicious activity

ShunkW,

I’m going off memory from early 2021. But it was my private IP on the laptop using a Class B private address according to their support team. I was flabbergasted. Maybe they just expected every remote worker to use Class C or something. Who knows?

nobleshift,
@nobleshift@lemmy.world avatar

InfoSec guy here for the salty tears of the unwashed masses …

tty5,

I’m torn if I should be nodding and patting myself on the back for not doing any of this insanity or cackling and taking notes…

Krudler,

Taking notes?!? If you can’t make idiotic decisions on your own, you’re not much of an IT guy to begin with.

Fixbeat,

Are you twirling your mustache?

SHITPOSTING_ACCOUNT,

Endless approval processes are a good one. They don’t even have to be nonsensical. Just unnecessarily manual, tedious, applied to the simplest changes, with long wait times and multiple steps. Add time zone differences and pile up many different ones, and life becomes hell.

RozhkiNozhki,
@RozhkiNozhki@lemmy.world avatar

It took them three weeks to have my super secure voicemail PIN reset, only for me to set it to whatever I wanted.

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • asklemmy@lemmy.world
  • localhost
  • All magazines
    •
    Loading…
    Loading the web debug toolbar…
    Attempt #

    Fatal error: Allowed memory size of 134217728 bytes exhausted (tried to allocate 25131672 bytes) in /var/www/kbin/kbin/vendor/symfony/http-kernel/Profiler/FileProfilerStorage.php on line 174

    Fatal error: Allowed memory size of 134217728 bytes exhausted (tried to allocate 4210688 bytes) in /var/www/kbin/kbin/vendor/symfony/error-handler/Resources/views/logs.html.php on line 27