At my last employer, the security guy’s gig was “run Qualys”. He didn’t help us filter anything, he didn’t provide context, he didn’t provide guidance on how to correct or implement a compensating control. There was a business need to run Qualys, and so he was the human crontab. The rest of the time he spent vaping and complaining about compensation.

> human crontab

That's good. Scrum manager as a crontab:

Every week, scheduled per developer 1/2 hour: "[90%: How's your progress? Any blockers? I don't have any updates on any blockers you may or may not have previously mentioned. Your dog is good? You have a dog right? I thought so. See you., 10%: The [CEO;CTO;COO] is pissed. The velocity is not on target. I'm not saying this to anyone in particular but I am saying this to all of you. There's going to be a retrospective and I'm not sure what we are going to say. Look I got another meeting. See you.]"

Every Tuesday & Thursday: "[90%: Look I don't have much, you guys know what your working on I'm not gonna waste your time; 10%: The [CEO;CTO;COO] is pissed. The velocity is not on target. I'm not saying this to anyone in particular but I am saying this to all of you. There's going to be a retrospective and I'm not sure what we are going to say. Look I got another meeting, feel free to stay on if ya'll have anything to talk about.]

Every other week, meeting scheduled with all developers: "The [CEO;CTO;COO] is pissed. The velocity is not on target. I'm not saying this to anyone in particular but I am saying this to all of you. There's going to be a retrospective and I'm not sure what we are going to say. Look I got another meeting, feel free to stay on if ya'll have anything to talk about."

Qualys is one of the most useless pieces of software I've ever come across. It purely exists for ass-covering and box-ticking purposes, and requires so much access to run its scans (it runs random things as root and ssh's into your whole fleet) that it's one compromise away from taking down a significant chunk of the tech industry. It's one massive backdoor into everything.

And on top of that, if you use a cloud provider, the data you get back is next to useless because it still thinks hostnames/IPs are a remotely useful way to identify stuff, which they aren't. It looks like they might finally be providing some remotely useful identifying metadata, like instance tags, but only after years of begging for it.

The next iteration of that terrible idea is to have a security contractor do that role and report to someone else who decides whether to read the report or not.

DevSec is next, right?

Another example, files we upload to the corporate one drive would be auto scanned for export compliance after upload, sometimes triggering a security person to come down hard on you for making a mistake. After being hit with it once I asked if I could run that scanning tool before I upload, and was told no. I was pretty surprised they preferred to catch mistakes than prevent them. Wouldn't prevention be better than cure?

> prevention be better than cure

Not really. If you wanted to find a way to exfiltrate it would be in your favor to have the tool client side that you were trying to bypass.

My favorite was IT at a health insurance company enabling OneDrive on user desktop / personal folders without notice, then yelling at users that sensitive files were being "uploaded" to OneDrive instead of kept local.

If there are no incidents to respond to, we have to cut the secops team. Ohhhhhh.

What’s was your second factor if you didn’t use passwords? Webauth is relatively new and I have yet to see any company use it.

Webauthn is well supported by the top websites. Even if they didn't support Webauthn, security keys were supported long before Webauthn.