Re:SaaS CTO Security Checklist
by bigiain on Friday May 31, 2019 @02:14AM
(#20058623)
So much this.
If you make your security policies into a problem for your people trying to do their work, they'll find ways to work around it.
That either means 1) your policies are misplaced and you need to relax then, or 2) you need to fire everybody who creatively works around them.
If your adversary is Mossad, the option 2 is the right one. If your adversary is not-Mossad, you can almost certainly have a security policy that people won't feel the need to work around.
There are, of course, shades of grey below "Mossad adversaries", but in my opinion at the upper end of that you have policies that include providing every employee with a good password manager, TOTP apps/devices, and/or USB 2FA keys - and choosing services which integrate properly with them.
"Change your password every X days" is an admission that you're going to leak passwords somehow, and that you only care about your data/systems enough to close the attack window down to X days. Which means you're screwed before you start, and may as well just turn everything off now.
If you make your security policies into a problem for your people trying to do their work, they'll find ways to work around it.
That either means 1) your policies are misplaced and you need to relax then, or 2) you need to fire everybody who creatively works around them.
If your adversary is Mossad, the option 2 is the right one. If your adversary is not-Mossad, you can almost certainly have a security policy that people won't feel the need to work around.
There are, of course, shades of grey below "Mossad adversaries", but in my opinion at the upper end of that you have policies that include providing every employee with a good password manager, TOTP apps/devices, and/or USB 2FA keys - and choosing services which integrate properly with them.
"Change your password every X days" is an admission that you're going to leak passwords somehow, and that you only care about your data/systems enough to close the attack window down to X days. Which means you're screwed before you start, and may as well just turn everything off now.