111–120 of 202 posts
Earlier quoted context omitted.
> How can they prevent migration of talented people, given China's infinite war chest ? The Renminbi is very difficult to convert.
I've never had a problem converting modest amounts of CNY USD at any bank in China or in the USA. Are you referring to capital export controls (~100k CNY/year)?
Yes.
Earlier quoted context omitted.
First, using USB drives was never against security policy at my work - so your personal attacks are unjustified. But secondly my powerpoint presentation isn't exactly top secret classified material. If we were talking about handling the private signing keys I would agree with you. Different types of data have different levels of security needed. Over classifying trivial data just makes it harder to get things done.
I am sorry if it came across as a personal attack, I didnt want to imply that you are personally negligent or unqualified to make that call. For all I know it is your job to make those policies at your place off work. The problem is a User with this attitude whos job isnt to make that call. Strictly speaking, If a user in a workplace where this behavior is against the security policy acts like this or expresses this…
The vast majority of people in an organization don't work with sensitive material. It makes much more sense to do this on a per department basis.
Policies like this that ignore on the ground reality and make it hard to get work done encourage abuse of the rules. When the rules are too draconian people will work around them and it encourages disrespect for other rules - especially the ones that actually do improve security.
$1 says they give out IBM branded USB keys at trade shows ;-)
Earlier quoted context omitted.
You're not wrong on their poor employee experience, but there's very little theater involved - there's good reason to protect their IP. Any firm that invests multi-millions in original design will want to protect their property from theft. Semiconductors were mentioned, but also think about someone like Pixar.
The thing is, what's stopping employees from uploading files to a server? The physical devices are a fraction of a fraction of IP theft. Hence the term "theatre".
Earlier quoted context omitted.
An implementation I’ve seen had all ports locked down on the laptop itself and physically locked with a plastic plug that can’t be removed without leaving evidence. The keyboard and mouse were connected to a dock. On the OS level only HID devices were allowed via USB you could bypass this if you had admin rights but it would leave a trail. The idea behind these like most other security controls is to prevent accident…
> you could bypass this if you had admin rights but it would leave a trail A move I've seen being put in place at several locations, is removing local admin rights from all users. Those with advanced needs, like developers, gets a VM which is limited to a specific VLAN, with no access to the production environments. The principle is sound, implementation is ... difficult, to say the least.
Earlier quoted context omitted.
An implementation I’ve seen had all ports locked down on the laptop itself and physically locked with a plastic plug that can’t be removed without leaving evidence. The keyboard and mouse were connected to a dock. On the OS level only HID devices were allowed via USB you could bypass this if you had admin rights but it would leave a trail. The idea behind these like most other security controls is to prevent accident…
> you could bypass this if you had admin rights but it would leave a trail A move I've seen being put in place at several locations, is removing local admin rights from all users. Those with advanced needs, like developers, gets a VM which is limited to a specific VLAN, with no access to the production environments. The principle is sound, implementation is ... difficult, to say the least.
In a restricted environment you will have several monitoring agents that track and enforce system integrity.
Earlier quoted context omitted.
> you could bypass this if you had admin rights but it would leave a trail A move I've seen being put in place at several locations, is removing local admin rights from all users. Those with advanced needs, like developers, gets a VM which is limited to a specific VLAN, with no access to the production environments. The principle is sound, implementation is ... difficult, to say the least.
And if you're willing to run a lot of screencaps or re-type the stuff you see on another computer you can still get the data out. Before modems were common in the hands of unwashed masses my friend and I would transfer files on the phone by spelling out blocks in hex. Slow but with a checksum every 16 bytes it was good enough to get some work done. If the data is high value enough it would probably be worth it.
Earlier quoted context omitted.
You're not wrong on their poor employee experience, but there's very little theater involved - there's good reason to protect their IP. Any firm that invests multi-millions in original design will want to protect their property from theft. Semiconductors were mentioned, but also think about someone like Pixar.
The thing is, what's stopping employees from uploading files to a server? The physical devices are a fraction of a fraction of IP theft. Hence the term "theatre".
Earlier quoted context omitted.
> you could bypass this if you had admin rights but it would leave a trail A move I've seen being put in place at several locations, is removing local admin rights from all users. Those with advanced needs, like developers, gets a VM which is limited to a specific VLAN, with no access to the production environments. The principle is sound, implementation is ... difficult, to say the least.
I’ve not seen this approach, but it’s definitely an interesting one. What do you do about the people who actually need production access?
https://docs.microsoft.com/en-us/windows-server/identity/sec...
Example of an actual implementation in the wild: https://uit.stanford.edu/service/paw