Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

65% of employees bypass cybersecurity measures, new study finds

forbes.com

Post reply on HN
Print view View original

21–30 of 97 posts

Re: 65% of employees bypass cybersecurity measures, new study finds

#21

Post by Izkata »

thaumasiotes wrote: post #16
pembrook wrote: post #13

I’m amazed how we have widely available biometrics in the consumer space (anything Apple with TouchID or FaceID) but not in the realm of business where security is far more critical. A rational market observer would have assumed biometrics would have replaced antiquated passwords years ago. Feels like this is a solved problem but Microsoft having a monopoly over business computing and software and there being no agre…

> A rational market observer would have assumed biometrics would have replaced antiquated passwords years ago. Some people prefer that their passwords not be public information.

In the US, passwords are protected by the 5th Amendment. Face and fingerprint are not. Police can make you unlock with those methods with no repercussions.

Re: 65% of employees bypass cybersecurity measures, new study finds

#22

Post by pembrook »

scarfaceneo wrote: post #14
pembrook wrote: post #13

I’m amazed how we have widely available biometrics in the consumer space (anything Apple with TouchID or FaceID) but not in the realm of business where security is far more critical. A rational market observer would have assumed biometrics would have replaced antiquated passwords years ago. Feels like this is a solved problem but Microsoft having a monopoly over business computing and software and there being no agre…

You still need to create a password. And since nearly always the biometric option doesn’t replace the password, it’s a moot point.

But that’s my point. Why use passwords at all.

If we’re okay using our face to auth into all mobile apps (business, personal or otherwise) and also to auth into the country every time we fly into it, why not just move towards making it standard.

Re: 65% of employees bypass cybersecurity measures, new study finds

#23

Post by necovek »

jknoepfler wrote: post #8
totallykvothe wrote: post #3

Obviously. The processes for getting an official exception to cybersecurity practices for a legitimate reason are always slow and agonizing, and the people on the other end are incompetent and condescending.

Why would you make such a blanket generalization? The security team where I work is comprised of competent professionals and generally nice people to boot. Our CISO is a great guy to have a beer with. We've had our disagreements, but they've been of the "smart people championing conflicting business values having a reasonable discussion" variety.

And that still leaves someone not being able to do their job for a number of hours or a number of days while those "reasonable discussions" are ongoing.

It is a hard problem, and the implied solution of "be even more restrictive" is only going to make matters worse.

Re: 65% of employees bypass cybersecurity measures, new study finds

#24

Post by masklinn »

bawolff wrote: post #5
justahuman74 wrote: post #2

> Employees often view security protocols as cumbersome. Long, complex passwords, frequent logins and multi-step authentication can feel like barriers to productivity. This resonates. Juggling Okta and 1P a few times a day is a drag

I think in the security industry, password complexity requirements and frequent re-logging in have been considered bad practises for a while now. Alas they are still seen in places.

> frequent re-logging

We recently had to add that for $bigco requirements at $dayjob, I was stunned: they asked to log people out after — IIRC — 1h inactivity.

Re: 65% of employees bypass cybersecurity measures, new study finds

#25

Post by pembrook »

Izkata wrote: post #21
thaumasiotes wrote: post #16

Earlier quoted context omitted.

> A rational market observer would have assumed biometrics would have replaced antiquated passwords years ago. Some people prefer that their passwords not be public information.

In the US, passwords are protected by the 5th Amendment. Face and fingerprint are not. Police can make you unlock with those methods with no repercussions.

Seems like we should update that.

Re: 65% of employees bypass cybersecurity measures, new study finds

#26

Post by aulin »

ars wrote: post #4

This skipped the main reason employees do this: The cybersecurity measures are widely perceived as "security theater", rather than anything that actually enhances security. Logging me out of an application, where a re-login requires nothing more than a click, is a stupid thing to do. Blocking outgoing (not incoming) ssh is silly when I have outgoing http. Requiring MFA multiple times a day on a work computer that is…

Always assumed they block everything they cannot spy, it's not for security. Https they inject their certificates, ssh you can have your key and they'll be blind. And they spy to prevent exfiltration they say. I cannot ssh into my home network but I can drop tons of company code into an LLM prompt.

Everything else, MFA, password rotations, approved software, stupid training videos... is all there to tick some boxes in a certification process or to easily shift the blame when something bad happens.

Re: 65% of employees bypass cybersecurity measures, new study finds

#27

Post by zdragnar »

masklinn wrote: post #24
bawolff wrote: post #5

Earlier quoted context omitted.

I think in the security industry, password complexity requirements and frequent re-logging in have been considered bad practises for a while now. Alas they are still seen in places.

> frequent re-logging We recently had to add that for $bigco requirements at $dayjob, I was stunned: they asked to log people out after — IIRC — 1h inactivity.

That's a not-uncommon "security" feature $bigco will add as a requirement for buying software as well.

Honestly, it's not a terrible policy if you're working with privileged information. A contact mine had with a big insurance company required a 30 minute inactivity logout I think.

OTOH if your job is filling out spreadsheets and forms for a retailer and you don't even have access to customer info, it's way overkill.

Nuance tends to be the first thing tossed out the window when dealing with $bigco though, too many people to manage smartly.

Re: 65% of employees bypass cybersecurity measures, new study finds

#28

Post by turbojet1321 »

cmckn wrote: post #20
turbojet1321 wrote: post #10

Earlier quoted context omitted.

> If your company has multiple things you need to log in to, its doing something wrong. How does that work for privileged accounts?

Kind of like sudo. Your individual identity is allowed to assume the privileged identity after providing an additional factor/justification (and your access has a TTL).

Sorry, I meant in an actual corporate (ie, Windows) environment, not conceptually.

Re: 65% of employees bypass cybersecurity measures, new study finds

#29

Post by paxys »

I work at a large software company and recently documented the number of steps it takes me every morning to fully log into every system I need for work. I stopped at 37.

And every year in response to all the breaches in the news the company spends more money to hire another security team who simply pile on another redundant layer on top.

The industry has jumped the shark when it comes to IT security. It's the corporate equivalent of spending tens of billions of dollars on the TSA and making everyone take their shoes off at the airport. Meanwhile someone with intent can stroll into JFK, casually bypass all security checkpoints and get on a plane to Paris without a boarding pass.

Re: 65% of employees bypass cybersecurity measures, new study finds

#30

Post by sandworm101 »

bawolff wrote: post #7

> Password Reuse: 49% of respondents use the same login credentials for multiple work applications, and 36% use the same credentials for personal and professional accounts. If your company has multiple things you need to log in to, its doing something wrong. Having company-wide single login system is really critical for good security. > 30% of employees share their workplace passwords with colleagues, effectively nul…

Maybe if you work at a unitary company with a narrow scope of work. If you have to login to external systems belonging to other organizations, or have terminals for external systems in your facility, unitary identity is not an option.
Post reply on HN