65% of employees bypass cybersecurity measures, new study finds

When I was at MS, I wrote a detailed guide how to trick the central IT system into thinking that your machine had the antivirus software running when it did not. It eventually, years later, got forwarded back to me as some sort of underground currency (with my authorship removed).

I’m amazed how we have widely available biometrics in the consumer space (anything Apple with TouchID or FaceID) but not in the realm of business where security is far more critical.

A rational market observer would have assumed biometrics would have replaced antiquated passwords years ago.

Feels like this is a solved problem but Microsoft having a monopoly over business computing and software and there being no agreed upon standards for biometrics hardware is holding us back.

Windows Hello exists. https://learn.microsoft.com/en-us/windows/security/identity-...

I don't understand why most password manager software that's being used in Enterprise and even targets that market specifically does not have the most basic features that people need.

Sharing passwords to external company accounts is essential for a marketing department, for example. Yet the proposed solution is to use an Android device for that. Good luck recovering that after an attack.

Password policies in Microsoft ADS systems are so broken that they have to change their password every 3 months for no reason whatsoever, effectively making all passwords predictable because the chance of someone using or as a password suffix is guaranteed.

Let alone the old messed up SAP systems everywhere that are abused as a login database. SAP doesn't even support special characters, and the max password length is 9 characters (10 if you count the # that is used as a hack to implement MFA). They are so crappy that the password always is set by an external rented plugin that updates all passwords in an interval with password#token. And yes, this also kind of nullifies the token's initial purpose as a secondary system.

Then there's stupid policies that logout a session every 5 minutes, while people need to use a program for hours on end. While also having a single button to relogin in an external window, in a program that is made in 90s Perl or Java.

And then you are wondering why employees reuse passwords if the state of systems is _that_ close to being pwned? Really?

Mostly corporate security is about ass coverage, not about prevention of problems. Though that can be a useful side effect. Ass coverage is about legal liability. If something bad happens, can I wash my hands in innocence and not suffer consequences (financial, legal, etc.)? If "no", take measures until you can because this could get very expensive.

Then the next question is "whose ass". Answer: literally anyone: service providers, your head of IT (who might get fired), your head of sales (who might have to explain to customer lawyers why their data leaked), the CEO, etc. They don't want to be on the spot for your mistakes. For public companies this is worse because now you have publicly traded shares in a very litigious environment with people looking for weaknesses that can be exploited to squeeze money out of any situation. And of course some of the tools in this space are made by publicly traded companies too.

The easiest way to deal with security is applying a shotgun approach of applying any kind of stuff that is vaguely understood to maybe work. The actual effectiveness of these things is besides the point and of course much of it is snake oil. The point is that there are policies and they are being enforced. The more visible and annoying this is, the more effective it is in case of trouble as a means to say "well it wasn't my fault because we did X, Y, and Z".

And of course a secondary effect of putting people on the job of securing a thing is that they will get busy doing their job to justify their existence. Which usually means a whole bunch of policy documents get written, tools get selected (preferably ones with big shiny reputations), and a lot of complexity gets introduced. There will be audits, consultants being consulted, chins being stroked, and a lot of money changing hands all for the assertion that "your ass is covered!" and by extension "theirs" as well. There are whole meta levels of ass coverage here.

That's why security theater is a thing. Because there is a large audience of people that all need to be re-assured about having suitable amounts of ass coverage.