[deleted]
We installed a single turnstile to feel secure
71–80 of 203 posts
Re: We installed a single turnstile to feel secure
#72Earlier quoted context omitted.
If forced partition of a building were the primary goal, that goal could be achieved without badges. Or, at least, without having to badge into every door. Just have locks on every door that are normally disengaged, but which can be locked remotely and promptly. (While at it, I once worked on an access control system. It was aeons ago; the system ran under OS/2. We installed it on a factory. It worked well, until we…
This actually exposes how this type of system is just security theater usually. A shooter can get a badge. Most partitions aren't bulletproof (and probably don't have security film), and a shooter doesn't fear getting a cut on some tempered glass. The thing that would be effective is 24/7 security monitoring with a building lockdown and reinforced entrances/partitions. Of course, the victims whose badges were disable…
[deleted]
Re: We installed a single turnstile to feel secure
#73I worked at a company that had effectively no physical security during work hours until the second time someone came in during lunch and stole an armload of laptops. Then we got card readers and a staffed front desk, and discovered our snack budget was too high because people from other companies on other floors were coming to ours for snacks too. I never felt the office was insecure, except in retrospect once it was…
I once lived in Singapore for a while and we were all sure that nobody would steal anything anyway, so we just never bothered to lock the doors. (That was also very helpful if you wanted to stop for a quick coffee with a date in the middle of the night.) You could see the MacBooks from the street, but nothing ever went missing. I don’t know what exactly it was, but Singapore felt incredibly safe and crime-free.
Re: We installed a single turnstile to feel secure
#74Earlier quoted context omitted.
"I'd slip in suspiciously" means the "slipping in" was suspicious.
You sure? I wasn’t. “John regarded Mary suspiciously” “Sharon suspected her husband of cheating. She looked through his emails suspiciously.”
It can mean either. "Suspicious behavior" doesn't mean that the behavior thinks that you've done something wrong.
"She's suspicious" can mean either that I suspect her intentions or that she suspects someone else's intentions.
Re: We installed a single turnstile to feel secure
#75Author here. I posted this on Sunday for a light read, but I guess it got traction today. Based on the comments I see here, I think the focus is going on the turnstiles just as it did when I worked there. While the cookie credentials are pushed aside. I think that's the security theater. We are worried about supposed active shooters, different physical threats while a backdoor to the company is left wide open. The tu…
The majority of commenters don't actually read the article, or at least not the whole thing.
Re: We installed a single turnstile to feel secure
#76As others have mentioned, it comes down to the threat model, but sometimes the threat model itself is uncomfortable to talk about. It’s sad to think about, but in my recollection a lot of intra-building badge readers went up in response to the 2018 active shooter situation at the YouTube HQ[1]. In cases like this, the threat model is “confine a hostile person to a specific part of the building once they’ve gotten in…
If an active shooter is the anticipated threat, how does a turnstile effectively stop that? Many of these turnstiles are specifically meant to allow people through in emergencies, and aren't strong enough to withstand bullets or even a sturdy kick. The elevator restrictions would be a better chokepoint, but as the article noted they didn't turn those back on.
It doesn't effectively stop it, but it forces them to give up some element of surprise. They have to either start the attack or start a trespassing action that will initiate contact with police.
Re: We installed a single turnstile to feel secure
#77I worked at a company that had effectively no physical security during work hours until the second time someone came in during lunch and stole an armload of laptops. Then we got card readers and a staffed front desk, and discovered our snack budget was too high because people from other companies on other floors were coming to ours for snacks too. I never felt the office was insecure, except in retrospect once it was…
How the fuck nobody notices some randoms coming to steal snacks in the first place ?
There's a huge difference between a company with its own building, and a company that shares a building in some way with other companies.
Many I've seen have it setup so that if you get past the security guard at the lobby, you effectively had full reign of the entire building, including many companies that wouldn't lock the doors or common areas.
Re: We installed a single turnstile to feel secure
#78As others have mentioned, it comes down to the threat model, but sometimes the threat model itself is uncomfortable to talk about. It’s sad to think about, but in my recollection a lot of intra-building badge readers went up in response to the 2018 active shooter situation at the YouTube HQ[1]. In cases like this, the threat model is “confine a hostile person to a specific part of the building once they’ve gotten in…
No, the model there is something bad happened, we must do something. This is something, so we will do it. I’m not saying that to diminish the value of the actual solution, but what the people want is literally something to make them feel better about a situation that is mostly out of their control. Someone showed up to their workplace with a fucking gun. And now they have to go there every day, and hope it doesn’t ha…
This is exactly it - most "security" isn't really built around actual threat models, nor is it ever verified. IT security is perhaps the weirdest in the world in that the security of your web server will be constantly probed, whilst your front door could go your entire lifetime and never be probed once.
Where people actually care about physical security, they develop things that do actually work; and often are so unobtrusive you never realize they're there.
Security theater necessitates that it be showy and in your face.
Re: We installed a single turnstile to feel secure
#79Author here. I posted this on Sunday for a light read, but I guess it got traction today. Based on the comments I see here, I think the focus is going on the turnstiles just as it did when I worked there. While the cookie credentials are pushed aside. I think that's the security theater. We are worried about supposed active shooters, different physical threats while a backdoor to the company is left wide open. The tu…
I don't think you could take over the company with a jira token. Another factor for consideration with turnstiles is disability access and fire egress. Those are covered by building code but since this is a parable, it's worth noting that physical security has often caused tragic stampedes that have killed many.
Re: We installed a single turnstile to feel secure
#80As others have mentioned, it comes down to the threat model, but sometimes the threat model itself is uncomfortable to talk about. It’s sad to think about, but in my recollection a lot of intra-building badge readers went up in response to the 2018 active shooter situation at the YouTube HQ[1]. In cases like this, the threat model is “confine a hostile person to a specific part of the building once they’ve gotten in…
Hand out weapons to the workers?
Places that really do care about security do exactly that. Military bases routinely prohibit on-duty soldiers from carrying arms - except the guards at the gate and the military police.