Tech workers - what did your IT Security team do that made your life hell and had no practical benefit?

One chestnut from my history in lottery game development:

While our security staff was incredibly tight and did a generally good job, oftentimes levels of paranoia were off the charts.

Once they went around hot gluing shut all of the “unnecessary” USB ports in our PCs under the premise of mitigating data theft via thumb drive, while ignoring that we were all Internet-connected and VPNs are a thing, also that every machine had a RW optical drive.

nobleshift,
@nobleshift@lemmy.world avatar

InfoSec guy here for the salty tears of the unwashed masses …

Fixbeat,

Are you twirling your mustache?

tty5,

I’m torn if I should be nodding and patting myself on the back for not doing any of this insanity or cackling and taking notes…

Krudler,

Taking notes?!? If you can’t make idiotic decisions on your own, you’re not much of an IT guy to begin with.

KISSmyOS,

This is done to keep employees from sticking in unknown thumb drives that could install malware. Several critical systems on protected networks have been hacked in the past by leveraging human curiosity and placing a compromised thumb drive on the ground in the companies parking lot. Gluing shut the USB ports is a simple defense against that.

Muscle_Meteor,

This is what i have to do to log into microsoft fuckin teams on my work laptop when i work from home…

  1. Unencrypt my laptop hardrive
  2. Log into my OS
  3. Log into the VPN
  4. Log into teams
  5. Use the authenticator app on my phone to enter the code that is on my screen
  6. Use my fingerprint on my phone to verify that i am the person using my phone…

Step 5 was introduced a few months ago because the other steps weren’t secure enough. This is why half my colleagues aren’t available when they work from home…

I suggested that we just use slack as our work chat and leave teams as a red herring to dissapoint extremely talented hackers.

jasondj,

Don’t reuse passwords!

But make them complicated!

Don’t write them down!

Change them every week!

Tischkante,

Everything only needed because it only helps to meet a security standard and to lower insurance. So much useless outdated stuff.

Rolive,

Some corporate BS screen lock application that replaces the built in Windows feature. It would take several minutes to log in because of that.

Fortunately you can kill the process with taskmanager and prevent the screen from locking entirely. Lol.

tslnox,

Our IT mandated 15 character long passwords. Many people in manufacturing (the guys who make the stuff we produce or setup and fix the machines) have the passwords in the format: “Somename123456…” You get the picture. When the passwords are forced to change? Yeah, just add “a,b,c,d…” at the end. Many have it written down on some post-it note on the notebook or desk. Security my ass.

I wouldn’t be surprised if I found that office guys have it too.

send_me_your_ink,

If you feel like poking a bear. NIST 800-63B is the US Federal guidance on passwords. In the past this guidance said to have long passwords and rotate them. Now they say 8 characters and never change (along with using MFA).

tslnox,

Don’t even start me on MFA. It routinely happens to me and all coworkers that it’s not enough to type in the code from the authenticator once, not twice, not even three times. You log in to windows, code prompt. You open Outlook, code prompt. You open SharePoint, another one. OneDrive? Another.

send_me_your_ink,

As someone who manages multiple identity systems - tell your IT to get their act together. Most of my environments we force reaith once a week (and that just a quick enter your password/TOTP code). Otherwise if you can log into your computer we trust you are who you say you are (note: we have some downright scary and invasive stuff on the network so we know if you start accessing stuff you should not). The sensitive/scary stuff is a lot faster (activity timers), but the teams involved know why it’s set this way (and where involved in setting the maximum durations).

Fosheze,

At a place I used to work one of my coworkers just had their password as a barcode taped to their desk. Now to be fair we worked in the extra high security room so even getting access to that desk would be a little tricky and we had about 20 unlabeled barcoded taped to each of our desks for various inventory locations and functions. So if someone wanted to get into their account they would still have to guess which barcode it was and get into a room only like 10 people had access to. It still felt pretty damn sketchy though.

aredditimmigrant,

Worked at a medium sized retail startup as a software engineer where we didn’t have root access to our local laptops, under the guise of “if you fuck it up we won’t be able to fix it” but we only started out with a basic MacBook setup. so every time I wanted to install a tool, ide, or VM I had to make a ticket to IT to come and log in with the password and explain what I was doing.

Eventually, the engineering dept bribed an IT guy to just give us the password and started using it. IT MGMT got pissed when the number of tickets dropped dramatically and realized what was going on.

We eventually came to the compromise that they gave us sudo access with the warning “we’re not backing anything up. If you mess up we’ll have to factory reset the whole machine”. Nobody ever had to factory reboot their machine because we weren’t children… And if there was an issue we just fixed it ourselves

AceFuzzLord,

Imagine that. IT knowing how to fix the issues they caused. What a revolutionary thought! /s

AtHeartEngineer,
@AtHeartEngineer@lemmy.world avatar

SSL proxy, in a company full of developers, so they could sniff traffic. It broke everything. It’s one of the reasons I left that company.

vivadanang,

I dunno, gluing usb’s in a super sensitive environment like that is actually logical; on the disc drives - they could disable autoplay as well though removing or gluing them closed would be preferable. USB is just such an easy attack vector where the individual plugging it in may not have skills themselves - it might be easier to bribe cleaning folks for example - or inject a person into a cleaning team. Ideally they would attack multiple nodes of your target’s network via as many avenues as possible; which makes the network and vpn thing just silly indeed; perhaps they were waiting for someone to try something with excellent infosec / firewalls / traffic shaping. yeeeeah lol.

SendMePhotos,

So like… Unplug the mouse and plug in the thumb drive… Bam!

Hobo,

That’s obvious when a mouse or keyboard doesn’t work. OP, and clealy other people in here, don’t really understand the actual attack vector in play. They aren’t using the USB as data storage, they are using as a cellular connected RAT and/or a tool to deploy a RAT to a workstation.

I think gluing usbs is dumb in just about any environment (disable them on the BIOS is the right answer), but attackers aren’t using it to drag and drop files and then physically take the usb with them. They are plugging them into a workstation, or just leaving them in the parking lot and letting other people plug them in, leveraging them to get initial access, and then essentially abandoning them.

For example see stuxnet: en.m.wikipedia.org/wiki/Stuxnet

MrMcGasion,

Pretty easy to make a hub device that you can plug the keyboard into and make it transparent to the user. Could even build in a keylogger to capture direct from the keyboard. The attacker would likely need physical access for that, so it wouldn’t be as convenient as the thumb drive in the parking lot attack vector, but unless you’re using PS/2 peripherals (or gluing those USB devices in too somehow), there’s still a fairly open attack vector there, even if you are disabling unused ports in BIOS.

Hobo,

Yep you’re right, but at least that adds another layer of complexity to their attack. A lot of security controls are at least somewhat situational, and most non-draconian companies have a process to put further mitigations around those exceptions either from increased monitoring or adding additional supplemental controls.

There’s no such thing at perfect security, just better risk mitigation. Slipping in a usb hub between the computer and keyboard while someone isn’t looking is a bit trickier then just plugging in a usb stick. If you disable unused usbs in the bios, instead of trying to do silly stuff like glue them shut, then the attacker has at least been temporarily thwarted if they slot it into a dead port. Aside from the high traffic areas, disabling ALL usb ports in places like datacenters and especially colocated datacenters, can thwart the attack outright as well.

Really from looking through this thread a lot of people seem to be under the misconception that security that isn’t perfect is pointless. It’s like claiming that locking your doors is pointless because lockpicks exists. The point isn’t to keep a sophisticated attack at bay, but rather to keep script kiddies and drive-by attacks from hitting your network. To defend against sophisticated attacks you really have to go a bit crazy, and even then very small slip ups can be disastrous. Ask Microsoft about their root cert getting leaked via a core dump!

I fully acknowledge that many people also work for places with dumbass security controls. Gluing usbs is WAYYYY up there on that list in my opinion. It also looks like a lot of people work at places that have really shitty security teams that haven’t quite figured out that controls are situational and require more thought then, “see checkbox, execute checkbox.”

mystik,

If it’s a secure enough environment, I imagine that there will be monitoring on the device, and the moment a hub shows up that’s not supposed to be there, or any other USB device tree that doesn’t match the approved list, , alarm bells ought to go off. If it’s valuable enough; the attack would be to use a passive device picking up leaky signals on the wire, or even hidden camera watching screen/keyboard.

LucyLastic,

A long time ago in a galaxy far away (before the internet was a normal thing to have) I provided over-the-phone support for a large and complex piece of software.

So, people would call up and you had to describe how they could do the thing they needed to do, and if that failed they would have to wait a few days until you went to the site to sort it in person.

The software we supported was not on the approved list for the company I worked for, so you couldn’t use it within the building where the phones were being answered.

Hobo,

I’m absolutely shocked that a company had a software whitelist before the widespread adoption of the internet. Ahead of their time in implementing, and fucking up, software whitelisting!

LucyLastic,

It was for government owned computers, they didn’t want any pirated or virus-infected stuff, and at that point there was no way to lock down such a mish-mash of systems.

The software company (who also do things like run prisons these days) had given permission for us to run the software and given a set of fake data so we could go through the motions when talking people through things, but apparently that wasn’t enough to get it on the list.

coffee_poops,

Password rotation.

Taringano,

Also complex and random requirements for passwords

BradleyUffner,

“your password may not start with a special character” (rage)

Nicadimos,

As a security guy - as soon as I can get federal auditors to agree, I’m getting rid of password expiration.

The main problem is they don’t audit with logic. It’s a script and a feeling. No password expiration FEELS less secure. Nevermind the literal years of data and research. Drives me nuts.

coffee_poops,

It’s counterintuitive. Drives people to use less secure passwords that they’re likely to reuse or to just increment; Password1, Password2, etc.

commandar,

Cite NIST SP 800-63B.

Verifiers SHOULD NOT impose other composition rules (e.g., requiring mixtures of different character types or prohibiting consecutively repeated characters) for memorized secrets. Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically). However, verifiers SHALL force a change if there is evidence of compromise of the authenticator.

pages.nist.gov/800-63-3/sp800-63b.html

I’ve successfully used it to tell auditors to fuck off about password rotation in the healthcare space.

Now, to be in compliance with NIST guidelines, you do also need to require MFA. This document is what federal guidelines are based on, which is why you’re starting to see Federal gov websites require MFA for access.

Either way, I’d highly encourage everyone to give the full document a read through. Not enough people are aware of it and this revision was shockingly reasonable when it came out a year or two ago.

TechyDad,
@TechyDad@lemmy.world avatar

ZScaler. It’s supposedly a security tool meant to keep me from going to bad websites. The problem is that I’m a developer and the “bad website” definition is overly broad.

For example, they’ve been threatening to block PHP.Net for being malicious in some way. (They refuse to say how.) Now, I know a lot of people like to joke about PHP, but if you need to develop with it, PHP.Net is a great resource to see what function does what. They’re planning on blocking the reference part as well as the software downloads.

I’ve also been learning Spring Boot for development as it’s our standard tool. Except, I can’t build a new application. Why not? Doing so requires VSCode downloading some resources and - you guessed it - ZScaler blocks this!

They’ve “increased security” so much that I can’t do my job unless ZScaler is temporarily disabled.

tslnox,

Yeah. Zscaler was once blocking me from accessing the Cherwell ticket system, which made me unable to write a ticket that Zscaler blocked me access to Cherwell.

Took me a while to get an IT guy to fix it without a ticket.

PainInTheAES,

Now that’s a Catch-22

Yawnder,

Did they block “social sites” such as stackoverflow for you too?
Yup… they did that…

killeronthecorner,
@killeronthecorner@lemmy.world avatar

It’s been ages since I had to deal with the daily random road blocks of ZScaler, but I do think of it from time to time.

Then I play Since U Been Gone by Kelly Clarkson.

agressivelyPassive,

Also, zScaler breaks SSL. Every single piece of network traffic is open for them to read. Anyone who introduces zscaler should be fired and/or shot on sight. It’s garbage at best and extremely dangerous at worst.

G00d4y0u,

Zscaler being the middleman is somewhat the point for security/IT teams using that feature.

agressivelyPassive,

And it’s a horrible point. You’re opening up your entire external network traffic to a third party, whose infrastructure isn’t even deployed or controllable in any form by you.

G00d4y0u,

The idea being that it’s similar to using other enterprise solutions, many of which do the same things now.

Zscaler does have lesser settings too, at it’s most basic it can do split tunneling for internal services at an enterprise level and easy user management. Which is a huge plus.

I’d also like to point out that the entire Internet is a third party you have no control over which you open your external traffic to everyday.

The bigger deal would be the internal network, which is also a valid argument.

agressivelyPassive,

I’d also like to point out that the entire Internet is a third party you have no control over which you open your external traffic to everyday.

Not really. Proper TLS enables relatively secure E2E encryption, not perfect, but pretty good. Adding Zscaler means, that my entire outgoing traffic runs over one point. So one single incident in one single provider basically opens up all of my communication. And given that so many large orgs are customers of ZScaler, this company pretty much has a target on its back.

Additionally: I’m in Germany. My Company does a lot of contracting and communication with local, state and federal entities, a large part of that is not super secret, but definitely not public either. And now suddenly an Amercian company, that is legally required to hand over all data to NSA, CIA, FBI, etc. has access to (again) all of my external communication. That’s a disaster. And quite possibly pretty illegal.

Dkiscoo,

Oh man our security team is trialing zscaler and netskope right now. I’ve been sitting in the meetings and it seems like it’s just cloud based global protect. GP was really solid so this worries me

lightnegative,

It has the same problem as any kind of TLS interception/ traffic monitoring tool.

It just breaks everything and causes a lot of lost time and productivity firstly trying to configure everything to trust a new cert (plenty of apps refuse to use the system cert store) and secondly opening tickets with IT just to go to any useful site on the internet.

Thankfully, at least in my case, it’s trivial to disable so it’s the first thing I do when my computer restarts.

Security doesn’t seem to do any checks about what processes are actually running, so they think they’ve done a good job and I can continue to do my job

punkwalrus,
@punkwalrus@lemmy.world avatar

Worked a job where I had to be a Linux admin for a variety of VMs. To access them, I needed an VPN that only worked inside the company LAN, and blocked internet access. it was a 30 day trial license on day 700somthing, so it had a max 5 simultaneous connection limit. Access was from my heavily locked down laptop. Windows 7 with 5 minutes locking Screensaver. The ssh software was an unknown brand, “ssh.exe” which only allowed one connection at a time in a 80 x 24 console window with no ability to copy and paste. This went to a bastion host, an HPUx box on an old csh shell with no write access to your home directory due to a 1.4mb disk quota per user. Only one login per user, ten login max, and the bastion host was the only way to connect to the Linux VMs. Default 5 minute logout for inactivity. No ssh keys allowed. No scripting allowed, was like typing over 9600 baud.

I quit that job. When asked why, I told them I was a Linux administrator and the job was not allowing me to administrate. I was told “a poor carpenter always blames his tools.” Yeah, fuck you.

AceFuzzLord,

That sounds like the equivalent of asking a carpenter to build a wooden boat large enough to carry 30 people, but only giving them Fisherprice tools and foam blocks.

FitzNuggly,

A carpenter isn’t expected to use his tools with garbage grabbers (reachy claw things) either.

AceFuzzLord,

That sounds like the equivalent of asking a carpenter to build a wooden boat large enough to carry 30 people, but only giving them Fisherprice tools and foam blocks.

AceFuzzLord,

That sounds like the equivalent of asking a carpenter to build a wooden boat large enough to carry 30 people, but only giving them Fisherprice tools and foam blocks.

AstralWeekends,

Made me write SQL updates that had to be run by someone in a different state with pretty much no knowledge of SQL.

jeena,
@jeena@jemmy.jeena.net avatar

There was a server I inherited from colleagues who resigned, mostly static HTML serving. I would occasionally do a apt update && apt ugrade to keep nginx and so updated and installed certbot because IT told me that this static HTML site should be served via HTTPS, fair enough.

Then I went on parental leave and someone blocked all outgoing internet access from the server. Now certbot can’t renew the certificate and I can’t run apt. Then I got a ticket to update nginx and they told me to use SSH to copy the files needed.

Hobo,

They are sort of right but have implemented it terribly. Serving out a static webpage is pretty low on the “things that are exploitable” but it’s still an entry point into the network (unless this is all internal then this gets a bit silly). What you need to do is get IT to set up a proxy and run apt/certbot through that proxy. It defends against some basic reverse shell techniques and gives you better control over the webhosts traffic. Even better would be to put a WAP and a basic load balancer in front of the webhost, AND proxy external communications.

Blocking updates/security services is dogshit though and usually is done by people that are a bit slow on the uptake. Basically they have completely missed the point of blocking external comms and created a way more massive risk in the process… They either need to politely corrected or shamed mercilessly if that doesn’t work.

Good luck though! I’m just glad I’m not the one that has to deal with it.

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • asklemmy@lemmy.world
  • DreamBathrooms
  • magazineikmin
  • ethstaker
  • khanakhh
  • rosin
  • Youngstown
  • everett
  • slotface
  • ngwrru68w68
  • mdbf
  • GTA5RPClips
  • kavyap
  • thenastyranch
  • cisconetworking
  • JUstTest
  • cubers
  • Leos
  • InstantRegret
  • Durango
  • tacticalgear
  • tester
  • osvaldo12
  • normalnudes
  • anitta
  • modclub
  • megavids
  • provamag3
  • lostlight
  • All magazines
    •