When Employees Use Software That IT Hasn’t Approved

Re:When Employees Use Software That IT Hasn’t Approved by scarface74 on Wednesday June 12, 2019 @08:36AM (#20163881)

I find most “IT security policies” that hamper developers to be mostly security theatre. No matter how many policies they put in place, since they aren’t developers, one junior developer can write:

  var sql = “select * from Customer where firstname = ‘“ + firstname + “‘“;

And thwart all of your security “best practices.”

I was the lead dev at a medium size non tech company, and the hoops I had to go through to get anything done dealing with the “security team” was ridiculous and of course I didn’t have access to production to troubleshoot for awhile.

I had ultimate control of all the code that did go through the process. If I were to do something stupid or purposefully malicious, while I didn’t have access to the environment - my code did.

As far as someone mistakingly installing a “crypto wall”, if a user can download a program that doesn’t require admin access, that program has access to the user’s files. The system can be restored much easier than the user’s data.

[ Parent | on HN ]

Re:When Employees Use Software That IT Hasn’t Approved by alistairSH on Wednesday June 12, 2019 @11:08AM (#20165368)

IT policies at large corporations aren't implemented for developers (only). They're implemented for everybody. For every developer, there is a salesperson, admin, manager, or HRBP who will do things they might not fully understand to be "bad".

I came into the industry in the late-90s and still remember the chaos that the ILOVEYOU and Anna Kournikova style viruses caused in corporate offices. Non-technical users didn't know that Windows hid file extensions by default. They didn't think that opening a picture could start a shitstorm the brought the corporate network to its knees. Fun times.

[ Parent | on HN ]

Re:When Employees Use Software That IT Hasn’t Approved by scarface74 on Wednesday June 12, 2019 @11:21AM (#20165519)

Yes. I remember ILOVEYOU too. It also confirms my point.

- It spread by reading the person’s contact information which doesn’t require administrator access.

- It also corrupted the user’s files and didn’t require administrator access for that either.

[ Parent | on HN ]

Re:When Employees Use Software That IT Hasn’t Approved by thisisnico on Wednesday June 12, 2019 @09:58AM (#20164664)

I agree that the current systems and policy for security is in-efficient. It seems that Security policies are mostly roadblocks to production, roadblocks for developers. It's a sad state at the moment and that I absolutely agree with. In this case IT isn't as worried about the users data on that machine. We're worried about the state of that machine taking everything else down with it. Users data should be stored on the network, some data may be local. A user with local admin access and installing malicious software has a higher risk of propagating everywhere. This is what I notice where a divide is between developers and IT. You must change you perspective. It's not a single user we're talking about, it's everything, the integrity of the system and the integrity of the network is based upon the integrity of every node on the network. A vast majority of the threats faced are user based. Somebody clicked on a link, somebody was spear-phished. The biggest threat to IT Security is ourselves.

[ Parent | on HN ]

Re:When Employees Use Software That IT Hasn’t Approved by scarface74 on Wednesday June 12, 2019 @03:44PM (#20168512)

Users data should be stored on the network, some data may be local.

If the user has read/write access to the network, so does anything the user run.

A user with local admin access and installing malicious software has a higher risk of propagating everywhere.

A sibling post just use an old example of the ILOVEYOU virus that didn’t require admin access to run or spread.

Somebody clicked on a link, somebody was spear-phished.

And if that happens, and if the user gave up their username and password. The perpetrator has access to everything the user has access to. The perpetrator will probably target a user with the access they desire. You say enforce two factor authentication? That’s also easy to scam out of user - get then to tell you the 2FA code. It was happening to Uber drivers.

If you can’t trust the user not to do something stupid, you can’t trust anything that the user runs not to do something malicious or be tricked into giving up confidential information.

[ Parent | on HN ]