Tech workers - what did your IT Security team do that made your life hell and had no practical benefit?

One chestnut from my history in lottery game development:

While our security staff was incredibly tight and did a generally good job, oftentimes levels of paranoia were off the charts.

Once they went around hot gluing shut all of the “unnecessary” USB ports in our PCs under the premise of mitigating data theft via thumb drive, while ignoring that we were all Internet-connected and VPNs are a thing, also that every machine had a RW optical drive.

TechyDad,
@TechyDad@lemmy.world avatar

ZScaler. It’s supposedly a security tool meant to keep me from going to bad websites. The problem is that I’m a developer and the “bad website” definition is overly broad.

For example, they’ve been threatening to block PHP.Net for being malicious in some way. (They refuse to say how.) Now, I know a lot of people like to joke about PHP, but if you need to develop with it, PHP.Net is a great resource to see what function does what. They’re planning on blocking the reference part as well as the software downloads.

I’ve also been learning Spring Boot for development as it’s our standard tool. Except, I can’t build a new application. Why not? Doing so requires VSCode downloading some resources and - you guessed it - ZScaler blocks this!

They’ve “increased security” so much that I can’t do my job unless ZScaler is temporarily disabled.

killeronthecorner,
@killeronthecorner@lemmy.world avatar

It’s been ages since I had to deal with the daily random road blocks of ZScaler, but I do think of it from time to time.

Then I play Since U Been Gone by Kelly Clarkson.

lightnegative,

It has the same problem as any kind of TLS interception/ traffic monitoring tool.

It just breaks everything and causes a lot of lost time and productivity firstly trying to configure everything to trust a new cert (plenty of apps refuse to use the system cert store) and secondly opening tickets with IT just to go to any useful site on the internet.

Thankfully, at least in my case, it’s trivial to disable so it’s the first thing I do when my computer restarts.

Security doesn’t seem to do any checks about what processes are actually running, so they think they’ve done a good job and I can continue to do my job

Yawnder,

Did they block “social sites” such as stackoverflow for you too?
Yup… they did that…

tslnox,

Yeah. Zscaler was once blocking me from accessing the Cherwell ticket system, which made me unable to write a ticket that Zscaler blocked me access to Cherwell.

Took me a while to get an IT guy to fix it without a ticket.

PainInTheAES,

Now that’s a Catch-22

Dkiscoo,

Oh man our security team is trialing zscaler and netskope right now. I’ve been sitting in the meetings and it seems like it’s just cloud based global protect. GP was really solid so this worries me

agressivelyPassive,

Also, zScaler breaks SSL. Every single piece of network traffic is open for them to read. Anyone who introduces zscaler should be fired and/or shot on sight. It’s garbage at best and extremely dangerous at worst.

G00d4y0u,

Zscaler being the middleman is somewhat the point for security/IT teams using that feature.

agressivelyPassive,

And it’s a horrible point. You’re opening up your entire external network traffic to a third party, whose infrastructure isn’t even deployed or controllable in any form by you.

G00d4y0u,

The idea being that it’s similar to using other enterprise solutions, many of which do the same things now.

Zscaler does have lesser settings too, at it’s most basic it can do split tunneling for internal services at an enterprise level and easy user management. Which is a huge plus.

I’d also like to point out that the entire Internet is a third party you have no control over which you open your external traffic to everyday.

The bigger deal would be the internal network, which is also a valid argument.

agressivelyPassive,

I’d also like to point out that the entire Internet is a third party you have no control over which you open your external traffic to everyday.

Not really. Proper TLS enables relatively secure E2E encryption, not perfect, but pretty good. Adding Zscaler means, that my entire outgoing traffic runs over one point. So one single incident in one single provider basically opens up all of my communication. And given that so many large orgs are customers of ZScaler, this company pretty much has a target on its back.

Additionally: I’m in Germany. My Company does a lot of contracting and communication with local, state and federal entities, a large part of that is not super secret, but definitely not public either. And now suddenly an Amercian company, that is legally required to hand over all data to NSA, CIA, FBI, etc. has access to (again) all of my external communication. That’s a disaster. And quite possibly pretty illegal.

Zeth0s,

They set zscaler so that if I don’t access an internal service for an unknown number of months, it means I don’t need it “for my daily work”, so they block it. If I want to access it again I need to open a ticket. There is no way to know what they closed and when they’ll close something.

In 1 months since this policy is active, I already have opened tickets to access test databases, k8s control plane, quality control dashboards, tableau server…

I really cannot comment how wrong it is.

ShunkW,

Zscaler is one of the worst products I’ve had the displeasure to interact with. They implemented it at my old job and it said that my home Internet connection was insecure to connect to the VPN. Cyber Sec guys couldn’t figure out the issue because the logs were SO helpful.

Took working with their support to find that it has somehow identified my nonstandard address spacing on my LAN to be insecure for some reason.

I kept my work laptop on a separate vlan for obvious reasons.

Natanael,

Pretty sure it’s some misapplied heuristics for previously identified bad clients, but that should only trigger an alert (with details!) in most cases and not block you if it’s not also paired with any known malicious activity

ShunkW,

I’m going off memory from early 2021. But it was my private IP on the laptop using a Class B private address according to their support team. I was flabbergasted. Maybe they just expected every remote worker to use Class C or something. Who knows?

punkwalrus,
@punkwalrus@lemmy.world avatar

Worked a job where I had to be a Linux admin for a variety of VMs. To access them, I needed an VPN that only worked inside the company LAN, and blocked internet access. it was a 30 day trial license on day 700somthing, so it had a max 5 simultaneous connection limit. Access was from my heavily locked down laptop. Windows 7 with 5 minutes locking Screensaver. The ssh software was an unknown brand, “ssh.exe” which only allowed one connection at a time in a 80 x 24 console window with no ability to copy and paste. This went to a bastion host, an HPUx box on an old csh shell with no write access to your home directory due to a 1.4mb disk quota per user. Only one login per user, ten login max, and the bastion host was the only way to connect to the Linux VMs. Default 5 minute logout for inactivity. No ssh keys allowed. No scripting allowed, was like typing over 9600 baud.

I quit that job. When asked why, I told them I was a Linux administrator and the job was not allowing me to administrate. I was told “a poor carpenter always blames his tools.” Yeah, fuck you.

AceFuzzLord,

That sounds like the equivalent of asking a carpenter to build a wooden boat large enough to carry 30 people, but only giving them Fisherprice tools and foam blocks.

AceFuzzLord,

That sounds like the equivalent of asking a carpenter to build a wooden boat large enough to carry 30 people, but only giving them Fisherprice tools and foam blocks.

FitzNuggly,

A carpenter isn’t expected to use his tools with garbage grabbers (reachy claw things) either.

AceFuzzLord,

That sounds like the equivalent of asking a carpenter to build a wooden boat large enough to carry 30 people, but only giving them Fisherprice tools and foam blocks.

willis936,

I am not allowed to change my wallpaper.

waterbogan,

Even worse here - we cant change the screensaver or screen lockout timeout settings!

I have a workaround by running a little looping script that keep the screen active. Its not that I particularly object to the screensaver, but once it activates I have to Ctrl Alt Delete 3-4 times and enter my password to get my desktop open again. Also it is an active screensaver that sometimes mucks up my desktop layout (I have a multiple monitor setup)

sizzling,

That is so annoying… when I’m working from home I just start a meeting with myself in Teams to keep the pc from autolocking.

lightnegative,

That’s actually genius. Here’s me writing a script to just move the mouse randomly lol, starting a Teams meeting would’ve been way simpler

feddylemmy,

This came from your security team? I usually see it from HR / management selling it as a branding issue or “professional” thing.

Aceticon,

Here in Portugal the IT guys at the National Health Service recently blocked access to the Medical Doctor’s Union website from inside the national health service intranet.

The doctors are currently refusing to work any more overtime than the annual mandatory maximum of 150h so there are all sorts of problems in the national health service at the moment, mainly with hospitals having to close down emergency services to walk-in patients (this being AskLemmy, I’ll refrain from diving into the politics of it) so the whole things smells of something more than a mere mistake.

Anyways, this has got to be one of the dumbest abuses of firewalling “dangerous” websites I’ve seen in a long while.

al177,

Oh man. Huge company I used to work for had:

  • two separate Okta instances. It was a coin toss as to which one you’d need for any given service
  • oh, and a third internally developed federated login service for other stuff
  • 90 day expiry for all of the above passwords
  • two different corporate IM systems, again coin toss depending on what team you’re working with
  • nannyware everywhere. Open Performance Monitor and watch network activity spike anytime you move your mouse or hit a key
  • an internally developed secure document system used by an international division that we were instructed to never ever use. We were told by IT that it “does something to the PC at a hardware level if you install the reader and open a document” which would cause a PC to be banned from the network until we get it replaced. Sounds hyperbolic, but plausible given the rest of the mess.
  • required a mobile authenticator app for some of the above services, yet the company expected that us grunts use our personal devices for this purpose.
  • all of the above and more, yet we were encouraged to use any cloud hosted password manager of our choosing.
Hogger85b,

I'll.go one further with authenticator. Mobile phones were banned in the data center and other certain locations (financial services). Had to set up landline phone....but to do that needed to request it...approve it on my phone then enter data center security door run and answer the phone line with 60s like something in the matrix.

coffee_poops,

Password rotation.

Taringano,

Also complex and random requirements for passwords

BradleyUffner,

“your password may not start with a special character” (rage)

Nicadimos,

As a security guy - as soon as I can get federal auditors to agree, I’m getting rid of password expiration.

The main problem is they don’t audit with logic. It’s a script and a feeling. No password expiration FEELS less secure. Nevermind the literal years of data and research. Drives me nuts.

coffee_poops,

It’s counterintuitive. Drives people to use less secure passwords that they’re likely to reuse or to just increment; Password1, Password2, etc.

commandar,

Cite NIST SP 800-63B.

Verifiers SHOULD NOT impose other composition rules (e.g., requiring mixtures of different character types or prohibiting consecutively repeated characters) for memorized secrets. Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically). However, verifiers SHALL force a change if there is evidence of compromise of the authenticator.

pages.nist.gov/800-63-3/sp800-63b.html

I’ve successfully used it to tell auditors to fuck off about password rotation in the healthcare space.

Now, to be in compliance with NIST guidelines, you do also need to require MFA. This document is what federal guidelines are based on, which is why you’re starting to see Federal gov websites require MFA for access.

Either way, I’d highly encourage everyone to give the full document a read through. Not enough people are aware of it and this revision was shockingly reasonable when it came out a year or two ago.

serial_crusher,
@serial_crusher@lemmy.basedcount.com avatar

Blocked the OWASP web site because it was categorized as “hacking materials”.

banneryear1868,

My favorite filter was “distasteful,” for a sysadmin forum page or reddit thread that had what I hoped would be relevant information.

Amends1782,

That is so retarded

jj4211,

We have a largeish number of systems that IT declared catheorically could not connect directly to the Internet for any reason.

So guess what systems weren’t getting updates. Also guess what systems got overwhelmed by ransomware that hit what would have been a patched vulnerability, that came through someone’s laptop that was allowed to connect to the Internet.

My department was fine, because we broke the rules to get updates.

So did network team admit the flaw in their strategy? No, they declared a USB key must have been the culprit and they literally went into every room and confiscated all USB keys and threw them away, with quarterly audits to make sure no USB keys appear. The systems are still not being updated and laptops with Internet connection are still indirectly bridging them.

jj4211,

Also, I keep a “rogue” laptop to self administrate along with my official it laptop to show I am in compliance. Updates are disabled and are only allowed to be fine y by IT. I just checked and they haven’t pushed any updates for about 8 months.

irotsoma,
@irotsoma@lemmy.world avatar

Wait, why don’t they use patch management software? If they allow computers with Internet access to connect to them, why not a patch management server?

jj4211,

They do. In fact they mandate IT assets to have three competing patch management software on them. They mandate disabling any auto updates because they have to vet them first. My official laptop hasn’t been pushed an update in 8 months.

PutangInaMo,

Do y’all need a consultant? That is so bad it’s a non starter.

jj4211,

Ironically, we actually have a Segment of our business that provides IT for other companies, and they do a decent job, but they aren’t allowed to manage our own IT. Best guess is that they are too expensive to waste on our own IT needs. If an IT staffember accidentally shows competence, they are probably moved to the billable group.

PutangInaMo,

The irony…

Treczoks,

The network has been subnetted into departments. Problem: I, from development, get calls from service about devices that have issues. Before the subnetting, they simply told me the serial number, and I let my army of diagnosis tools hit the unsuspecting device to get an idea what’s up with it. Now they have to bring it over and set up all the attached devices here so I can run my tests.

shasta,

Surely IT can make an exception for you or create a VM with multiple NICs for you.

Rand0mA,

Or configure a local port on the dev vlan… Sounds like a corporate environment where the many IT teams dont talk to each other, or network team are hiding out in a comms cupboard.

argentcorvid,
@argentcorvid@midwest.social avatar

Oh my… no.

aredditimmigrant,

Worked at a medium sized retail startup as a software engineer where we didn’t have root access to our local laptops, under the guise of “if you fuck it up we won’t be able to fix it” but we only started out with a basic MacBook setup. so every time I wanted to install a tool, ide, or VM I had to make a ticket to IT to come and log in with the password and explain what I was doing.

Eventually, the engineering dept bribed an IT guy to just give us the password and started using it. IT MGMT got pissed when the number of tickets dropped dramatically and realized what was going on.

We eventually came to the compromise that they gave us sudo access with the warning “we’re not backing anything up. If you mess up we’ll have to factory reset the whole machine”. Nobody ever had to factory reboot their machine because we weren’t children… And if there was an issue we just fixed it ourselves

AceFuzzLord,

Imagine that. IT knowing how to fix the issues they caused. What a revolutionary thought! /s

LucyLastic,

A long time ago in a galaxy far away (before the internet was a normal thing to have) I provided over-the-phone support for a large and complex piece of software.

So, people would call up and you had to describe how they could do the thing they needed to do, and if that failed they would have to wait a few days until you went to the site to sort it in person.

The software we supported was not on the approved list for the company I worked for, so you couldn’t use it within the building where the phones were being answered.

Hobo,

I’m absolutely shocked that a company had a software whitelist before the widespread adoption of the internet. Ahead of their time in implementing, and fucking up, software whitelisting!

LucyLastic,

It was for government owned computers, they didn’t want any pirated or virus-infected stuff, and at that point there was no way to lock down such a mish-mash of systems.

The software company (who also do things like run prisons these days) had given permission for us to run the software and given a set of fake data so we could go through the motions when talking people through things, but apparently that wasn’t enough to get it on the list.

jeena,
@jeena@jemmy.jeena.net avatar

There was a server I inherited from colleagues who resigned, mostly static HTML serving. I would occasionally do a apt update && apt ugrade to keep nginx and so updated and installed certbot because IT told me that this static HTML site should be served via HTTPS, fair enough.

Then I went on parental leave and someone blocked all outgoing internet access from the server. Now certbot can’t renew the certificate and I can’t run apt. Then I got a ticket to update nginx and they told me to use SSH to copy the files needed.

Hobo,

They are sort of right but have implemented it terribly. Serving out a static webpage is pretty low on the “things that are exploitable” but it’s still an entry point into the network (unless this is all internal then this gets a bit silly). What you need to do is get IT to set up a proxy and run apt/certbot through that proxy. It defends against some basic reverse shell techniques and gives you better control over the webhosts traffic. Even better would be to put a WAP and a basic load balancer in front of the webhost, AND proxy external communications.

Blocking updates/security services is dogshit though and usually is done by people that are a bit slow on the uptake. Basically they have completely missed the point of blocking external comms and created a way more massive risk in the process… They either need to politely corrected or shamed mercilessly if that doesn’t work.

Good luck though! I’m just glad I’m not the one that has to deal with it.

sturmblast,

I got to say after reading a couple stories here I can understand the frustrations and some very legitimate stories here make a lot of sense in the context of it teams fucking up. but I also think there’s a lot of ignorance about what people are actually trying to accomplish in some of these stories as somebody that does it security and a lot of compliance work sometimes we’re doing these things because we have to not so much that we want to.

shasta,

Doesn’t matter to the end user whose fault it is. The spirit of this discussion is what was done to make your life harder. If you want to, go ahead and read it as “IT workers, what stupid things were you mandated to do that made your workers jobs harder?” The end user doesn’t know why a thing happens, just that IT did it. They’ll complain to IT and if it’s not their fault, it’s their responsibility to push back on whoever is calling these shots. The idiot in charge won’t know any better unless he’s called out on his bullshit.

sturmblast,

I understand, I often have to explain to large groups of people why we make the choices we make as a security team and it’s not always a very popular thing I make a lot of people upset because security and convenience don’t really work well together.

flop_leash_973,

Ours is terrible for making security policy that will impact technical solution options in a vacuum with a few select higher level IT folks and no one sorts out the process to using the new “secure” way first. Ending up in finding out something you thought would be a day or 2 task ends up being a weeks long odyssey to define new processes and technical approaches. Or sometimes just out right abandoning the work because the headache isn’t worth it.

lightnsfw,

Ours does this too. Except they stick to their guns and we end up having to just work around the new impediment they’ve created for months until it happens to inconvenience someone with enough pull to make them change it.

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • asklemmy@lemmy.world
  • localhost
  • All magazines
    •
    Loading…
    Loading the web debug toolbar…
    Attempt #