Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

65% of employees bypass cybersecurity measures, new study finds

forbes.com

Post reply on HN
Print view View original

51–60 of 97 posts

Re: 65% of employees bypass cybersecurity measures, new study finds

#51

Post by cafeinux »

jongjong wrote: post #38
cafeinux wrote: post #35

Earlier quoted context omitted.

Why would you need to write your password on a post-it note if you use a password manager? Also, why would the note need to be specifically "on your desk"? If I really had no other choice than writing down a password, I would keep it in a more subtle/hidden place (my wallet, or my phone case, or in my locker). That's still not secure against a targeted attack, but I wouldn't be the lowest hanging fruit at least. Also…

I only use a password manager on my work computer because my boss forces me to. I find your question more surprising! Why would you use a password manager voluntarily? It's a torture device. I use it because my paycheck depends on it. What's your excuse? If I care about a service, I care enough to remember the password. Everything else might as well be a post-it-note on my desk... Though I prefer a simple one-word pa…

Most renown password managers are well integrated, making their use (usually) easier than just typing out a password. There's a good chance your company chose a outlier, or that the company or yourself don't use it correctly (and training employees to use the mandated tools is not always obvious to companies). This with the resettable password makes me think your company should really think again about which solution they chose.

I use a password manager in my daily life because I have 3 e-mail accounts, two domains, a cloud service not tied to any of my E-mail accounts, two banking accounts and the need to sometimes log into my wife's account (because she asks me to while she's at work), one PayPal account, and other services for which I wouldn't dare to write down the password to, nor would I dare to use the same password (or slight variations) for them. Using a password manager makes all of these easy to use at the click of a button, without me needing to remember any.

Post-it notes get lost, thrown away, burn, suffer water damage, and are bothersome to copy for backup purposes. Online password managers take care of backing up the DB for you, or if you don't trust them, offline solutions as pass or KeePass (and variations) let you backup the DB on offline drive and store them safely while you continue to use the main DB.

What's your excuse?

Re: 65% of employees bypass cybersecurity measures, new study finds

#52

Post by hulitu »

pembrook wrote: post #13

I’m amazed how we have widely available biometrics in the consumer space (anything Apple with TouchID or FaceID) but not in the realm of business where security is far more critical. A rational market observer would have assumed biometrics would have replaced antiquated passwords years ago. Feels like this is a solved problem but Microsoft having a monopoly over business computing and software and there being no agre…

> A rational market observer would have assumed biometrics would have replaced antiquated passwords years ago.

Why ? I don't want my picture stored on MS' servers every day.

Re: 65% of employees bypass cybersecurity measures, new study finds

#53

Post by GoblinSlayer »

bawolff wrote: post #7

> Password Reuse: 49% of respondents use the same login credentials for multiple work applications, and 36% use the same credentials for personal and professional accounts. If your company has multiple things you need to log in to, its doing something wrong. Having company-wide single login system is really critical for good security. > 30% of employees share their workplace passwords with colleagues, effectively nul…

>36% use the same credentials for personal and professional accounts

Does Big Tech even allow multiple accounts? When watsapp asks a phone number to register, what do you type?

Re: 65% of employees bypass cybersecurity measures, new study finds

#54

Post by epiecs »

tstrimple wrote: post #34
paxys wrote: post #29

I work at a large software company and recently documented the number of steps it takes me every morning to fully log into every system I need for work. I stopped at 37. And every year in response to all the breaches in the news the company spends more money to hire another security team who simply pile on another redundant layer on top. The industry has jumped the shark when it comes to IT security. It's the corpora…

I work for a large consulting company (300k+ employees globally) and 99% of our internal resources are all secured by Ping. One identity and MFA app. SSO between just about everything. The client I'm currently working for with that company has all of their auth handled by Entra. All their internal docs, their azure subscriptions, their gitub repos. All the same user identity. Shit IT isn't inevitable. It's a decision…

Same here. We had a very fragmented landscape (multiple idp tools, some tools using internal users,...). We consolidated everything to entra (450 apps and counting) and everybody couldn't be happier. Full sso on everything + scim where available.

We do offcourse have conditional access + PIM for admins but that is to be expected.

You just need a good strategy on how you are going to tackle IAM and then just stick to it.

Re: 65% of employees bypass cybersecurity measures, new study finds

#55

Post by patmcc »

botanicals6 wrote: post #50
jerlam wrote: post #48

> Device Security Gaps: 36% delay installing security patches on personal devices used for work, exposing critical applications to exploitation. > Personal Devices: 80% of respondents access workplace applications from personal devices that lack security controls. I thought the BYOD fad was over. If cybersecurity is vital to your company, your users shouldn't be allowed to use personal devices for work.

100% agree, just that sometimes not every company has the resources or inclination to do that. The best middle ground is some kind of solution that allows the security team to "manage" personal devices in some way.

>>>The best middle ground is some kind of solution that allows the security team to "manage" personal devices in some way.

No thanks. I'm not compromising the security of my personal devices to save my employer a couple hundred bucks a year.

Re: 65% of employees bypass cybersecurity measures, new study finds

#56

Post by epiecs »

turbojet1321 wrote: post #28
cmckn wrote: post #20

Earlier quoted context omitted.

Kind of like sudo. Your individual identity is allowed to assume the privileged identity after providing an additional factor/justification (and your access has a TTL).

Sorry, I meant in an actual corporate (ie, Windows) environment, not conceptually.

You use PIM: https://learn.microsoft.com/en-us/entra/id-governance/privil...

Basically you are eligible for your admin roles but you have to activate them first. Usually there are additional checks + notifications to other admins. These permissions are also only available for a set amount of time and then you will need to re request them :)

Re: 65% of employees bypass cybersecurity measures, new study finds

#57

Post by awiesenhofer »

botanicals6 wrote: post #50
jerlam wrote: post #48

> Device Security Gaps: 36% delay installing security patches on personal devices used for work, exposing critical applications to exploitation. > Personal Devices: 80% of respondents access workplace applications from personal devices that lack security controls. I thought the BYOD fad was over. If cybersecurity is vital to your company, your users shouldn't be allowed to use personal devices for work.

100% agree, just that sometimes not every company has the resources or inclination to do that. The best middle ground is some kind of solution that allows the security team to "manage" personal devices in some way.

> The best middle ground is some kind of solution that allows the security team to "manage" personal devices in some way.

Oh that is the "best" "middle" ground, is it? Are you sure?

Why should anyone bring their personal device just because the company is to cheap to buy a few phones and then have them basically owned by their IT anyways? Do you realize how crazy that is?

You might want to think about that one again.

Every SMB can afford a few cheap phones for its employees, MFA apps dont need flagship hardware. If a company can't, maybe it shouldn't be in business anyway.

Re: 65% of employees bypass cybersecurity measures, new study finds

#58

Post by archi42 »

paxys wrote: post #29

I work at a large software company and recently documented the number of steps it takes me every morning to fully log into every system I need for work. I stopped at 37. And every year in response to all the breaches in the news the company spends more money to hire another security team who simply pile on another redundant layer on top. The industry has jumped the shark when it comes to IT security. It's the corpora…

That's security theater. Some decision makers want to "see" it's secure, so that's what some "security" people sell. If I was doing consultation for your employer, I'd tell them that's insane and that they will only push people to circumvent security instead of embracing it.

Others made good points, a decent SSO is the way to go.

(Ironically we also have an internal system that's equally degenerate and mostly a shitload of useless theater; it's secure of course, but there are a few pointless layers stacked on top of what makes it actually secure)

Re: 65% of employees bypass cybersecurity measures, new study finds

#59

Post by GoblinSlayer »

bawolff wrote: post #5
justahuman74 wrote: post #2

> Employees often view security protocols as cumbersome. Long, complex passwords, frequent logins and multi-step authentication can feel like barriers to productivity. This resonates. Juggling Okta and 1P a few times a day is a drag

I think in the security industry, password complexity requirements and frequent re-logging in have been considered bad practises for a while now. Alas they are still seen in places.

Famously, Jira.

Re: 65% of employees bypass cybersecurity measures, new study finds

#60

Post by pwdisswordfishz »

haaz wrote: post #39

When I worked at a large bank they blocked ChatGPT on the network. Unfortunately I was a new grad who didn’t know Java working in a Java team. I just turned off the vpn and copy pasted the code back and forth until it worked. Boss didn’t seem to mind. Left the job after 2 months anyway.

> I was a new grad who didn’t know Java working in a Java team

All the more reason not to use ChatGPT then.

Post reply on HN