Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

65% of employees bypass cybersecurity measures, new study finds

forbes.com

Post reply on HN
Print view View original

31–40 of 97 posts

Re: 65% of employees bypass cybersecurity measures, new study finds

#31

Post by strken »

sandworm101 wrote: post #30
bawolff wrote: post #7

> Password Reuse: 49% of respondents use the same login credentials for multiple work applications, and 36% use the same credentials for personal and professional accounts. If your company has multiple things you need to log in to, its doing something wrong. Having company-wide single login system is really critical for good security. > 30% of employees share their workplace passwords with colleagues, effectively nul…

Maybe if you work at a unitary company with a narrow scope of work. If you have to login to external systems belonging to other organizations, or have terminals for external systems in your facility, unitary identity is not an option.

Having a centrally administered password manager is usually an option, unless there are regulatory reasons not to.

Re: 65% of employees bypass cybersecurity measures, new study finds

#32

Post by rustcleaner »

pembrook wrote: post #13

I’m amazed how we have widely available biometrics in the consumer space (anything Apple with TouchID or FaceID) but not in the realm of business where security is far more critical. A rational market observer would have assumed biometrics would have replaced antiquated passwords years ago. Feels like this is a solved problem but Microsoft having a monopoly over business computing and software and there being no agre…

Can we not just make a password prompt which is two 8 digit TOTP codes concatenated together (each having different shared secrets)? Why must we use biometrics, SMS, and proprietary lock-in solutions?

Also, the recent Salt Typhoon revelations need to be screaming at you: Chinese intel (and probably others) can likely access SMS codes without hijacking the number, and that it's probably not far out of reach from criminal gangs considering foreign policy jockeying lately.

Phone verification is dead. Also, everyone should be adopting something like SimpleX (plus Orbot/Tor) and get away from unencrypted normie networks. If before it was just to reduce metadata footprint because data sells, now it's because you could be vulnerable to international criminal organizations which have access just as intimate as Salt Typhoon to US public comms infrastructure.

F***! Odds CISA gets funding cut under new admin? I could use a new job...

Re: 65% of employees bypass cybersecurity measures, new study finds

#33

Post by kevindamm »

turbojet1321 wrote: post #28
cmckn wrote: post #20

Earlier quoted context omitted.

Kind of like sudo. Your individual identity is allowed to assume the privileged identity after providing an additional factor/justification (and your access has a TTL).

Sorry, I meant in an actual corporate (ie, Windows) environment, not conceptually.

My solution is: don't use AD for anything privileged in production, route all privileged operations through SSO auth and have the operation executed by servers in production. Separate corp and prod. Add a zero trust layer so that every single privileged operation involves an auth challenge (which can be assisted by an OTP dongle so that users aren't required to re-key their passwords multiple times per 20-ish hours).

Re: 65% of employees bypass cybersecurity measures, new study finds

#34

Post by tstrimple »

paxys wrote: post #29

I work at a large software company and recently documented the number of steps it takes me every morning to fully log into every system I need for work. I stopped at 37. And every year in response to all the breaches in the news the company spends more money to hire another security team who simply pile on another redundant layer on top. The industry has jumped the shark when it comes to IT security. It's the corpora…

I work for a large consulting company (300k+ employees globally) and 99% of our internal resources are all secured by Ping. One identity and MFA app. SSO between just about everything. The client I'm currently working for with that company has all of their auth handled by Entra. All their internal docs, their azure subscriptions, their gitub repos. All the same user identity. Shit IT isn't inevitable. It's a decision, or often lack of a decision and result of "organic" growth.

Re: 65% of employees bypass cybersecurity measures, new study finds

#35

Post by cafeinux »

jongjong wrote: post #18

My biggest pet peeve is when the platform forces me to add certain special characters to my password, then I need to write down my altered password and put it on a post-it note on my desk to remember it. My other pet peeve, with a password manager, is when I forgot my master password and I need to reset it, but then my password manager sends the reset link to my email inbox; which I cannot access since its password i…

Why would you need to write your password on a post-it note if you use a password manager? Also, why would the note need to be specifically "on your desk"? If I really had no other choice than writing down a password, I would keep it in a more subtle/hidden place (my wallet, or my phone case, or in my locker). That's still not secure against a targeted attack, but I wouldn't be the lowest hanging fruit at least.

Also, if you are able to reset the master password of your password manager, then something is seriously wrong with the solution your company uses.

Advice for a good and rememberable master password: use a passphrase. 6 random words are easier to recall than lots of characters. Throw in one number and one capital letter in two random places (replacing o with 0 or i with 1 is not random, neither are start and end of words), use a special character as words separator, and you got an easy to remember password that checks all the security requirements.

Heck, even using a line or two from the lyrics of a song you know (but obviously not your favorite or the one you sing every morning) is easier and better than most passwords. Some time ago I used the first line of "Toxicity" by System of a Down, when I didn't have the time to craft a good passphrase. Checks all the marks (special chars and numbers included), and was not anymore guessable than a random passphrase during the short time I used it.

Re: 65% of employees bypass cybersecurity measures, new study finds

#36

Post by rustcleaner »

pembrook wrote: post #22
scarfaceneo wrote: post #14

Earlier quoted context omitted.

You still need to create a password. And since nearly always the biometric option doesn’t replace the password, it’s a moot point.

But that’s my point. Why use passwords at all. If we’re okay using our face to auth into all mobile apps (business, personal or otherwise) and also to auth into the country every time we fly into it, why not just move towards making it standard.

>If we’re okay using our face to auth

I'm not! If this sort of thing becomes standard, I will become digitally amish.

Re: 65% of employees bypass cybersecurity measures, new study finds

#37

Post by tstrimple »

sitkack wrote: post #11

When I was at MS, I wrote a detailed guide how to trick the central IT system into thinking that your machine had the antivirus software running when it did not. It eventually, years later, got forwarded back to me as some sort of underground currency (with my authorship removed).

I was reasonably impressed by MSFT IT when I worked there. I was primarily a BYOD Mac user and only had to deal with IT two to three times over the course of 8 years. I took it for granted at the time because I came from the startup work where you're basically your own IT person. But other large companies after Microsoft clearly demonstrated to me that Microsoft is on top of their shit and the average is fucking terrible.

Re: 65% of employees bypass cybersecurity measures, new study finds

#38

Post by jongjong »

cafeinux wrote: post #35
jongjong wrote: post #18

My biggest pet peeve is when the platform forces me to add certain special characters to my password, then I need to write down my altered password and put it on a post-it note on my desk to remember it. My other pet peeve, with a password manager, is when I forgot my master password and I need to reset it, but then my password manager sends the reset link to my email inbox; which I cannot access since its password i…

Why would you need to write your password on a post-it note if you use a password manager? Also, why would the note need to be specifically "on your desk"? If I really had no other choice than writing down a password, I would keep it in a more subtle/hidden place (my wallet, or my phone case, or in my locker). That's still not secure against a targeted attack, but I wouldn't be the lowest hanging fruit at least. Also…

I only use a password manager on my work computer because my boss forces me to.

I find your question more surprising! Why would you use a password manager voluntarily? It's a torture device. I use it because my paycheck depends on it. What's your excuse?

If I care about a service, I care enough to remember the password. Everything else might as well be a post-it-note on my desk... Though I prefer a simple one-word password that I can easily remember.

Re: 65% of employees bypass cybersecurity measures, new study finds

#39

Post by haaz »

When I worked at a large bank they blocked ChatGPT on the network. Unfortunately I was a new grad who didn’t know Java working in a Java team. I just turned off the vpn and copy pasted the code back and forth until it worked. Boss didn’t seem to mind. Left the job after 2 months anyway.

Re: 65% of employees bypass cybersecurity measures, new study finds

#40

Post by necovek »

aulin wrote: post #26
ars wrote: post #4

This skipped the main reason employees do this: The cybersecurity measures are widely perceived as "security theater", rather than anything that actually enhances security. Logging me out of an application, where a re-login requires nothing more than a click, is a stupid thing to do. Blocking outgoing (not incoming) ssh is silly when I have outgoing http. Requiring MFA multiple times a day on a work computer that is…

Always assumed they block everything they cannot spy, it's not for security. Https they inject their certificates, ssh you can have your key and they'll be blind. And they spy to prevent exfiltration they say. I cannot ssh into my home network but I can drop tons of company code into an LLM prompt. Everything else, MFA, password rotations, approved software, stupid training videos... is all there to tick some boxes i…

Because of MITM-ing TLS with their own certificates, they could also stop you from dumping tons of code into an LLM prompt by blocking all public LLMs (or even all sites not on an allowlist).

The reason it's silly is really that you can always take "secrets" with you, be it by taking photos with your phone ("lets ban phones") or memorizing or writing on paper. Security is useful when it prevents accidental, inadvertent leakage of information ("stop me from shooting myself in the foot"). Anything else, and the inconvenience will make people figure out ways around it.

And the real reason people won't leak information is either ethics and morality, or legal liability.

Post reply on HN