One chestnut from my history in lottery game development:
While our security staff was incredibly tight and did a generally good job, oftentimes levels of paranoia were off the charts.
Once they went around hot gluing shut all of the “unnecessary” USB ports in our PCs under the premise of mitigating data theft via thumb drive, while ignoring that we were all Internet-connected and VPNs are a thing, also that every machine had a RW optical drive.
Banned open source software because of security concerns. For password management they require LastPass or that we write them down in a book that we keep on ourselves at all times. Worth noting that this policy change was a few months ago. After the giant breach.
And for extra absurdity: MFA via SMS only.
I wish I was making this up.
Care to elaborate “MFA via SMS only”? I’m not in tech and know MFA through text is widely used. Or do you mean alternatives like Microsoft Authenticator or YubiKey? Thanks!
Through a low tech social engineering attack referred to as SIM Jacking, an attacker can have your number moved to their SIM card, redirecting all SMS 2FA codes effectively making the whole thing useless as a security measure. Despite this, companies still implement it out of both laziness and to collect phone numbers (which is often why SMS MFA is forced)
To collect numbers, which they sell in bulk, to shadey organizations, that might SIM Jack you.
TIL! thanks for the explanation.
Sim swap is quite easy if you are convincing enough for support at an ISP doing phone plans.
Now imagine if I sim-swapped your 2FA codes :)Exactly this. Instead you should use a phone app like Aegis or proprietary solutions like MS Authenticator to MFA your access because it’s encrypted.
Thenks! I really don’t want to be forced into an app, but it’s good to know the reason why.
Do you work for a government?
I tried so hard to steer my last company away from SMS MFA. CTO basically flat out said, “As long as I’m here SMS MFA will always be an option.”
Alright, smarmy dumbass. I dream of the day when they get breached because of SMS.
If I remember it correctly, in GSM it’s perfectly possibly to spoof a phone number to receive the SMS using the roaming part of the protocol.
The thing was designed to be decently safe, not to be highly secure.
Banning open source because of security concerns is the opposite of what they should be doing if they care about security. You can’t vet proprietary software.
It’s not about security, it’s about liability. You can’t sue OSS to get shareholders off your back.
Worked a job where I had to be a Linux admin for a variety of VMs. To access them, I needed an VPN that only worked inside the company LAN, and blocked internet access. it was a 30 day trial license on day 700somthing, so it had a max 5 simultaneous connection limit. Access was from my heavily locked down laptop. Windows 7 with 5 minutes locking Screensaver. The ssh software was an unknown brand, “ssh.exe” which only allowed one connection at a time in a 80 x 24 console window with no ability to copy and paste. This went to a bastion host, an HPUx box on an old csh shell with no write access to your home directory due to a 1.4mb disk quota per user. Only one login per user, ten login max, and the bastion host was the only way to connect to the Linux VMs. Default 5 minute logout for inactivity. No ssh keys allowed. No scripting allowed, was like typing over 9600 baud.
I quit that job. When asked why, I told them I was a Linux administrator and the job was not allowing me to administrate. I was told “a poor carpenter always blames his tools.” Yeah, fuck you.
Set the automatic timeout for admin accounts to 15 minutes…meaning that process that may take an hour or so you have to wiggle the mouse or it logs out …not locks… logs out
From installs to copying log files, to moving data to reassigning owner of data to the service account.
And that’s why people use mouse jigglers and keep their computers unlocked 24/7.
deleted by creator
Mine was removed by Corporate IT, along with a bunch of other open source stuff that made my life bearable.
Also I spent 5 months with our cyber security guys to try and provide a simple file replication server for my team working in a remote office with shit internet connectivity. I gave up, the spooks put up a solid defense, push all the onerous IT security compliance checking onto my desk instead of taking control.
Not as bad as my previous company though, outsourced IT support to ATOS was a nightmare.
It’s reasonably easy to make a hardware mouse wiggler with an Arduino Micro (and I don’t mean something that physically moves a mouse, rather something that looks like a USB mouse to the computer and periodically sends mouse movement messages).
If you’re desperate enough, look it up as it’s quite simple so there should be step by step instructions out there.
Can also just buy one from Amazon if you’re lazy or not technically inclined.
The internal IT at that hellhole is a nightmare as well.
That’s why you buy a jiggler that you place your mouse onto. Not detectable by IT :)
I set my pocket knife on the ctrl key when I have to step away.
There is no compliance item I am aware of that has that requirement, some CISO needs to learn to read.
Misunderstood STIG from the sound of it. The STIG is only applicable to unprivileged users but tends to get applied to all workstations regardless of user privileges. Also I think the .mil STIG GPOs apply it to all workstations regardless of privileges.
The other thing that tends to get overlooked is that AC-12 let’s you set it to whatever the heck you want. Ao you could theoretically set it to 99999 year by policy if you wanted.
https://www.stigviewer.com/stig/application_security_and_development/2017-01-09/finding/V-69243
A long time ago in a galaxy far away (before the internet was a normal thing to have) I provided over-the-phone support for a large and complex piece of software.
So, people would call up and you had to describe how they could do the thing they needed to do, and if that failed they would have to wait a few days until you went to the site to sort it in person.
The software we supported was not on the approved list for the company I worked for, so you couldn’t use it within the building where the phones were being answered.
Here in Portugal the IT guys at the National Health Service recently blocked access to the Medical Doctor’s Union website from inside the national health service intranet.
The doctors are currently refusing to work any more overtime than the annual mandatory maximum of 150h so there are all sorts of problems in the national health service at the moment, mainly with hospitals having to close down emergency services to walk-in patients (this being AskLemmy, I’ll refrain from diving into the politics of it) so the whole things smells of something more than a mere mistake.
Anyways, this has got to be one of the dumbest abuses of firewalling “dangerous” websites I’ve seen in a long while.
Made me write SQL updates that had to be run by someone in a different state with pretty much no knowledge of SQL.
I used to work with a guy who glued the USB ports shut on his labs. I asked him why he didn’t just turn them off in BIOS and then lock BIOS behind a password and he just kinda shrugged. He wasn’t security, but it’s kinda related to your story.
¯\_(ツ)_/¯
Security where I work is pretty decent really, I don’t recall them ever doing any dumb crazy stuff. There were some things that were unpopular with some people but they had good reasons that far outweighed any complaints.
I just wrote a script that let me know if usb devices changed and emailed me. It was kinda funny the one time someone unplugged a USB hub to run a vacuum. I came running as like 20 messages popped up at once.
In high school they blocked dictionary.com for some reason.
Mozilla products banned by IT because they had a vulnerability in a pervious version.
Rant
It was so bullshit. I had Mozilla Firefox 115.1 installed, and Mozilla put out an advisory, like they do all the fucking time. Fujitsu made it out to be some huge huge unfixed bug the very next day in an email after the advisory was posted and the email chain basically said “yk, we should just remove all Firefox. It’s vulnerable so it must be removed.”
I wouldn’t be mad if they decided that they didn’t want to have it be a managed app or that there was something (actually) wrong with it or literally anything else than the fact that they didn’t bother actually reading either fucking advisory and decided to nuke something I use daily.
I had to run experiments that generate a lot of data (think hundreds of megabytes per minute). Our laptops had very little internal storage. I wasn’t allowed to use an external drive, or my own NAS, or the company share - instead they said “can’t you just delete the older experiments?”… Sure, why would I need the experiment data I’m generating? Might as well /dev/null it!
Oh hey I was living this a few months ago!
machine had a RW optical drive
Ah, the Private Manning protocol.
Access to change production systems was limited to a single team, which was tasked with doing all deploys by hand, for an engineering organisation of 50+ people. Quickly becoming overloaded, they limited deploy frequency to five deploys per day, organisation-wide.
Bit of a shit-show, that one.
Often times you’ll find that the crazy things IT does are forced on them from higher ups that don’t know shit.
A common case of this is requiring password changes every x days, which is a practice that is known to actively make passwords worse.
The DOD was like this. And it wasn’t just that you had to change passwords every so often but the requirements for those passwords were egregious but at the same time changing 1 number or letter was enough to pass the password requirements.
I’m in IT security and I’m fighting this battle. I want to lessen the burden of passwords and arbitrary rotation is terrible.
I’ve ran into a number of issues at my company that would give me the approval to reduce the frequency of expired passwords
-
the company gets asked this question by other customers “do you have a password policy for your staff?” (that somehow includes an expiration frequency).
-
on-prem AD password complexity has some nice parts built in vs some terrible parts with no granularity. It’s a single check box in gpo that does way too much stuff. I’m also not going to write a custom password policy because I don’t have the skill set to do it correctly when we’re talking about AD, that’s nightmare inducing. (Looking at specops to help and already using Azure AD password protection in passive mode)
-
I think management is worried that a phishing event happens on a person with a static password and then unfairly conflating that to my argument of “can we just do two things: increase password length by 2 and decrease expiration frequency by 30 days”
At the end of the day, some of us in IT security want to do the right things based in common sense but we get stymied by management decisions and precedence. Hell, I’ve brought NIST 800-63B documentation with me to check every reason why they wouldn’t budge. It’s just ingrained in them - meanwhile you look at the number of tickets for password help and password sharing violations that get reported … /Sigh
I feel this. I increased complexity and length, and reduced change frequency to 120d. It worked really well with the staggered rollout. Shared passwords went down significantly, password tickets went to almost none (there’s always that ‘one’). Everything points to this being the right thing and the fact that NIST supports this was a win… until the the IT audit. The auditor wrote “the password policy changed from 8-length, moderate complexity, 90-day change frequency to 12-length, high complexity, 120-day change frequency” and the board went apeshit. It wasn’t an infraction or a “ding”, it was only a note. The written policy was, of course, changed to match the GPO, so the note was for the next auditor to know of the change. The auditor even mentioned how he was impressed with the modernity of our policy and how it should lead to a better posture. I was forced to change it back, even though I got buyin from CTO for the change. BS.
Having been exposed to those kinds of audits before that’s really just bad handling by the CTO and other higher ups!
-
For our org, we are required to do this for our cybersecurity insurance plan
Tell them NIST now recommends against it so the insurance company is increasing your risks
What I really love is mandatory length and character password policies so complex that together with such password change requirements that push people beyond what is humanly possible to memorize, so it all ends down written in post-its, the IT equivalent of having a spare key under a vase or the rug.
And in my company the password change policies are very different from one system to another. Some force a change monthly, some every 28 days, some every 90 days, and thwn there is rhat one legacy system that no longer has a functioning password change mechanism, so we can’t change passwords there if we wanted to.
And the different systems all want different password formats, have different re-use rules.
And, with all those uncoordinated passwords, they don’t allow password managers to be used on corporate machines, despite the training materials that the company makes us re-do every year recommending password managers…
Even better is forcing changes every 30 or 60 days, and not allowing changes more than every week. Our users complain daily between those rules and the password requirements that they are too dumb to understand.
Password changes that frequent are shown to be ineffective, especially for the hassle. Complexity is a better protection method.
I’m aware. Apparently everyone who read my post has misread it. I’m saying that the requirements above are terrible, and they make my users complain constantly. Our security team constantly comes up with ways to increase security theater at the detriment of actual security.
So glad we opted for a longer password length, with fewer arbitrary limits, and expiry only after 2 years or a suspected breach.
Forcing password expiration does cause people to make shittier passwords. But when their passwords are breached programitically or through social engineering They don’t just sit around valid for years on the dark web waiting for someone to buy them up.
This requirement forces people who can’t otherwise remember passwords to fall into patterns like (kid’s name)(season)(year), this is a very common password pattern for people who have to change passwords every 90 days or so. Breaching the password would expose the pattern and make it easy enough to guess based off of.
99% of password theft currently comes from phishing. Most of the people that get fished don’t have a freaking clue they got fished oh look the Microsoft site link didn’t work.
Complex passwords that never change don’t mean s*** when your users are willing to put them into a website.
It’s still not in a freaking list that they can run a programmatic attack against. People that give this answer sound like a f****** broken record I swear.
Secops has been against this method of protection for many years now, I’d say you’re the outdated one here
Years ago phishing and 2fa breaches werent as pervasive. Since we can’t all go to pass key right now, nobody’s doing a damn thing about the phishing campaigns. Secops current method of protection is to pay companies that scan the dark web by the lists and offer up if your password’s been owned for a fee.
That’s a pretty s***** tactic to try to protect your users.
We’re on the internet, you can say shit.
If your user is just using johnsmithfall2022 as their password and they update the season and year every day, it’s pretty easy for hackers to identify that pattern and correct it. This is not the solution and it actively makes life worse for everyone involved.
Password crackers says you’re wrong
No never minded people that think that all passwords are being cracked tell me I’m wrong. Lists emails and passwords grabbed from fishing attacks tell me the people that are too lazy to change their passwords and once in awhile don’t deserve the security.
I’m a native English speaker. I can’t understand your comment. I sense that you have a useful perspective, could you rephrase it so it’s understandable?
NIST now recommends watching for suspicious activity and only force rotation when there’s risk of compromise
Tell me, can your users identify suspicious activity cuz mine sure as hell can’t.
That’s why password leak detection services exists
(And a rare few of them yes)
That’s super true, so many times to stay ISO compliant (I’m thinking about the lottery industry here), security policies need to align with other recommendations and best practices that are often insane.
But then there’s a difference between those things which at least we can rationalize WHY they exist… and then there’s gluing USB plugs shut because they read about it on slashdot and had a big paranoia. Lol
Or it prompts people to just stick their “super secure password” with byzantine special character, numeral, and capital letter requirements to their monitor or under their keyboard, because they can’t be arsed to remember what nonsensical piece of shit they had to come up with this month just to make the damn machine happy and allow them to do their jobs.
I do this in protest of asinine password change rules.
Nobody’s gonna see it since my monitor is at home, but it’s the principle of the thing.
A truly dedicated enough attacker can and will look in your window! Or do fancier things like enable cameras on devices you put near your monitor
Not saying it’s likely, but writing passwords down is super unsafe
What you are describing is the equivalent of somebody breaking into your house so they can steal your house key.
No, they’re breaking into your house to steal your work key. The LastPass breach was accomplished by hitting an employee’s personal, out of date, Plex server and then using it to compromise their work from home computer. Targeting a highly privileged employees personal technology is absolutely something threat actors do.
The point is if they’re going to get access to your PC it’s not going to be to turn on a webcam to see a sticky note on your monitor bezel. They’re gonna do other nefarious shit or keylog, etc.
Why keylog and pick up 10k random characters to sift through when the password they want is written down for them?
Your coworkers put their password under the keyboard ? Mine just leave a post it on the side of the monitor.
Took away Admin rights, so everytime you wanted to install something or do something in general that requires higher privileges, we had to file a ticket in the helpdesk to get 10 minutes of Admin rights.
The review of your request took sometimes up 3 days. Fun times for a software developer.
I too know this pain
We used Intune Portal for a list of approved desktop apps
3 days? That’s downright speedy!
I submitted a ticket that fell into a black hole. I have long since found an alternate solution, but am now keeping the ticket open for the sick fascination of seeing how long it takes to get a response. 47 days and counting…
Nobody wants to take it because it will mess up their KPIs.
Any ticketing system set up like that is just begging for abuse. If they don’t have queue managers then the team should share the hit if they just leave the ticket untouched
We worked around this at my old job by getting VirtualBox installed on our PCs and just running CentOS or Ubuntu VMs to develop in. Developing on windows sucks unless you’re doing .NET imo.
During those 10 minutes of admin rights:
net user secretlocaladmin * /add net localgroup administrators secretlocaladmin /addOh shit, you just reminded me of the time that I had to PHONE Macromedia to manually activate software because of the firewalling. This was after waiting days to get administrative permission to install it in the first place.
“Thank you” for helping resurface those horrible memories!
I don’t miss those days.
Fighting similar shit right now. I need admin rights frequently.
I dunno, gluing usb’s in a super sensitive environment like that is actually logical; on the disc drives - they could disable autoplay as well though removing or gluing them closed would be preferable. USB is just such an easy attack vector where the individual plugging it in may not have skills themselves - it might be easier to bribe cleaning folks for example - or inject a person into a cleaning team. Ideally they would attack multiple nodes of your target’s network via as many avenues as possible; which makes the network and vpn thing just silly indeed; perhaps they were waiting for someone to try something with excellent infosec / firewalls / traffic shaping. yeeeeah lol.
