Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

65% of employees bypass cybersecurity measures, new study finds

forbes.com

Post reply on HN
Print view View original

41–50 of 97 posts

Re: 65% of employees bypass cybersecurity measures, new study finds

#41

Post by tstrimple »

h4ck_th3_pl4n3t wrote: post #17

I don't understand why most password manager software that's being used in Enterprise and even targets that market specifically does not have the most basic features that people need. Sharing passwords to external company accounts is essential for a marketing department, for example. Yet the proposed solution is to use an Android device for that. Good luck recovering that after an attack. Password policies in Microso…

> I don't understand why most password manager software that's being used in Enterprise and even targets that market specifically does not have the most basic features that people need.

> Sharing passwords to external company accounts is essential for a marketing department, for example. Yet the proposed solution is to use an Android device for that. Good luck recovering that after an attack.

Not really. We likely wouldn't allow a marketing tool that couldn't integrate with auth standards. Which is why we have dozens of systems integrated together with one identity and SSO between everything. It's the companies that make dozens of exceptions from their auth standards that have to deal with this password sharing nonsense and security nightmare. Password sharing is a Bad Idea even if sometimes it's the most expedient.

Re: 65% of employees bypass cybersecurity measures, new study finds

#42

Post by imtringued »

jongjong wrote: post #38
cafeinux wrote: post #35

Earlier quoted context omitted.

Why would you need to write your password on a post-it note if you use a password manager? Also, why would the note need to be specifically "on your desk"? If I really had no other choice than writing down a password, I would keep it in a more subtle/hidden place (my wallet, or my phone case, or in my locker). That's still not secure against a targeted attack, but I wouldn't be the lowest hanging fruit at least. Also…

I only use a password manager on my work computer because my boss forces me to. I find your question more surprising! Why would you use a password manager voluntarily? It's a torture device. I use it because my paycheck depends on it. What's your excuse? If I care about a service, I care enough to remember the password. Everything else might as well be a post-it-note on my desk... Though I prefer a simple one-word pa…

Why would a password manager be a torture device? The effort needed to remember hundreds to thousands of passwords sounds way worse.

That last paragraph sounds like you're the type of person that has caused security problems in the past.

Re: 65% of employees bypass cybersecurity measures, new study finds

#43

Post by ars »

aulin wrote: post #26
ars wrote: post #4

This skipped the main reason employees do this: The cybersecurity measures are widely perceived as "security theater", rather than anything that actually enhances security. Logging me out of an application, where a re-login requires nothing more than a click, is a stupid thing to do. Blocking outgoing (not incoming) ssh is silly when I have outgoing http. Requiring MFA multiple times a day on a work computer that is…

Always assumed they block everything they cannot spy, it's not for security. Https they inject their certificates, ssh you can have your key and they'll be blind. And they spy to prevent exfiltration they say. I cannot ssh into my home network but I can drop tons of company code into an LLM prompt. Everything else, MFA, password rotations, approved software, stupid training videos... is all there to tick some boxes i…

You can just encrypt your stuff and upload it via http. You can even run ssh over http if you work at it.

Encryption is as easy as using zip. And if you uploaded a very large file, they can't realistically log it - so you could even upload it in the clear and it won't be caught unless they are specifically looking.

Re: 65% of employees bypass cybersecurity measures, new study finds

#45

Post by moooo99 »

bawolff wrote: post #7

> Password Reuse: 49% of respondents use the same login credentials for multiple work applications, and 36% use the same credentials for personal and professional accounts. If your company has multiple things you need to log in to, its doing something wrong. Having company-wide single login system is really critical for good security. > 30% of employees share their workplace passwords with colleagues, effectively nul…

> If your company has multiple things you need to log in to, its doing something wrong. Having company-wide single login system is really critical for good security.

It absolutely is, but it is only applicable to large corporations and won’t help any SMBs. The issue is that this functionality via LDAP/SAML/OODS is frequently locked behind enterprise subscription tiers that usually represent an extremely high markup over other paid tiers.

Even in larger corporations, it often not possible to have SSO everywhere. We have multiple „shadow IT“ subscriptions for services that only our team uses. Most of them don’t offer SSO functionality, even for those who do a user base of 5 people is not going to be sufficient to have someone from the responsible departments deal with it. So we have passwords

Re: 65% of employees bypass cybersecurity measures, new study finds

#46

Post by botanicals6 »

AviD's Rule of Usability: "Security at the expense of usability, comes at the expense of security."

Security companies should have more focus on the usability aspect of their product. Some of the enterprise products you see today are just plain bad in terms of UX/UI, and funnily enough, they aren't getting called out since they're only used in the workplace/closed groups.

Re: 65% of employees bypass cybersecurity measures, new study finds

#47

Post by M95D »

jknoepfler wrote: post #8
totallykvothe wrote: post #3

Obviously. The processes for getting an official exception to cybersecurity practices for a legitimate reason are always slow and agonizing, and the people on the other end are incompetent and condescending.

Why would you make such a blanket generalization? The security team where I work is comprised of competent professionals and generally nice people to boot. Our CISO is a great guy to have a beer with. We've had our disagreements, but they've been of the "smart people championing conflicting business values having a reasonable discussion" variety.

They're all great guys with each other.

Do a test. Go to distant office and call IT pretending to be the person who works in that office, with his/her cooperation. See how fast the problem is solved and how you are treated.

Re: 65% of employees bypass cybersecurity measures, new study finds

#48

Post by jerlam »

> Device Security Gaps: 36% delay installing security patches on personal devices used for work, exposing critical applications to exploitation.

> Personal Devices: 80% of respondents access workplace applications from personal devices that lack security controls.

I thought the BYOD fad was over. If cybersecurity is vital to your company, your users shouldn't be allowed to use personal devices for work.

Re: 65% of employees bypass cybersecurity measures, new study finds

#49

Post by hedora »

paxys wrote: post #29

I work at a large software company and recently documented the number of steps it takes me every morning to fully log into every system I need for work. I stopped at 37. And every year in response to all the breaches in the news the company spends more money to hire another security team who simply pile on another redundant layer on top. The industry has jumped the shark when it comes to IT security. It's the corpora…

Security is usually defined as confidentiality, integrity and availability. (Not in order of importance, just to spell “CIA”).

If it takes that long to log in, the system is not available, and therefore insecure. Full stop. The security team responsible for that setup should be fired.

In related news, I’ve been watching old murder mysteries from the ‘60s.

Typical plot points include the fact that you can decide to fly from Los Angeles and arrive anywhere on the west coast with in 2-3 hours because the planes leave every 30 minutes.

Why wouldn’t you just walk up to the gate and buy a ticket?

Why do we put up with this TSA bullshit?

Re: 65% of employees bypass cybersecurity measures, new study finds

#50

Post by botanicals6 »

jerlam wrote: post #48

> Device Security Gaps: 36% delay installing security patches on personal devices used for work, exposing critical applications to exploitation. > Personal Devices: 80% of respondents access workplace applications from personal devices that lack security controls. I thought the BYOD fad was over. If cybersecurity is vital to your company, your users shouldn't be allowed to use personal devices for work.

100% agree, just that sometimes not every company has the resources or inclination to do that. The best middle ground is some kind of solution that allows the security team to "manage" personal devices in some way.
Post reply on HN