Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

65% of employees bypass cybersecurity measures, new study finds

forbes.com

Post reply on HN
Print view View original

61–70 of 97 posts

Re: 65% of employees bypass cybersecurity measures, new study finds

#61

Post by n_plus_1_acc »

necovek wrote: post #23
jknoepfler wrote: post #8

Earlier quoted context omitted.

Why would you make such a blanket generalization? The security team where I work is comprised of competent professionals and generally nice people to boot. Our CISO is a great guy to have a beer with. We've had our disagreements, but they've been of the "smart people championing conflicting business values having a reasonable discussion" variety.

And that still leaves someone not being able to do their job for a number of hours or a number of days while those "reasonable discussions" are ongoing. It is a hard problem, and the implied solution of "be even more restrictive" is only going to make matters worse.

Those discussions I consider part of the job educating users is very important.

Re: 65% of employees bypass cybersecurity measures, new study finds

#62

Post by throwawayian »

bawolff wrote: post #7

> Password Reuse: 49% of respondents use the same login credentials for multiple work applications, and 36% use the same credentials for personal and professional accounts. If your company has multiple things you need to log in to, its doing something wrong. Having company-wide single login system is really critical for good security. > 30% of employees share their workplace passwords with colleagues, effectively nul…

You don’t work in IT.

Unless you’re paying for Okta and Office365 and Workspace, you’re only getting maybe 70% of systems _you know about_.

And don’t get me started on automated provisioning or deprovisioning.

Re: 65% of employees bypass cybersecurity measures, new study finds

#63

Post by n_plus_1_acc »

pembrook wrote: post #22
scarfaceneo wrote: post #14

Earlier quoted context omitted.

You still need to create a password. And since nearly always the biometric option doesn’t replace the password, it’s a moot point.

But that’s my point. Why use passwords at all. If we’re okay using our face to auth into all mobile apps (business, personal or otherwise) and also to auth into the country every time we fly into it, why not just move towards making it standard.

Until you get into an accident and your face is covered in bandages or something and the computer wont let you in.

Re: 65% of employees bypass cybersecurity measures, new study finds

#64

Post by tame3902 »

turbojet1321 wrote: post #28
cmckn wrote: post #20

Earlier quoted context omitted.

Kind of like sudo. Your individual identity is allowed to assume the privileged identity after providing an additional factor/justification (and your access has a TTL).

Sorry, I meant in an actual corporate (ie, Windows) environment, not conceptually.

In my company the official policy is that nobody but the admins gets administrator privileges. If you need them the workflow is that you go to IT and they do what is necessary. Or they just might say no. People had to complain that makes work impossible for them and will cost the company a lot of money so that they got exceptions -- but only after escalation to upper management.

I think this was a security directive that came from the top.

Re: 65% of employees bypass cybersecurity measures, new study finds

#65

Post by MattPalmer1086 »

paxys wrote: post #29

I work at a large software company and recently documented the number of steps it takes me every morning to fully log into every system I need for work. I stopped at 37. And every year in response to all the breaches in the news the company spends more money to hire another security team who simply pile on another redundant layer on top. The industry has jumped the shark when it comes to IT security. It's the corpora…

Why is the company hiring a new security team each year? Where the ownership and strategic thinking?

Sounds like your organisation is extremely dysfunctional, and the ridiculous security you have is a symptom of that. None of that is inevitable.

Re: 65% of employees bypass cybersecurity measures, new study finds

#66

Post by MattPalmer1086 »

masklinn wrote: post #24
bawolff wrote: post #5

Earlier quoted context omitted.

I think in the security industry, password complexity requirements and frequent re-logging in have been considered bad practises for a while now. Alas they are still seen in places.

> frequent re-logging We recently had to add that for $bigco requirements at $dayjob, I was stunned: they asked to log people out after — IIRC — 1h inactivity.

Logging out when there is no activity is quite a common security control requirement in many places.

I've seen 15 minute inactivity log out quite frequently.

Drives users mad of course (particularly admins who are logged in to many machines).

Re: 65% of employees bypass cybersecurity measures, new study finds

#67

Post by MattPalmer1086 »

necovek wrote: post #40
aulin wrote: post #26

Earlier quoted context omitted.

Always assumed they block everything they cannot spy, it's not for security. Https they inject their certificates, ssh you can have your key and they'll be blind. And they spy to prevent exfiltration they say. I cannot ssh into my home network but I can drop tons of company code into an LLM prompt. Everything else, MFA, password rotations, approved software, stupid training videos... is all there to tick some boxes i…

Because of MITM-ing TLS with their own certificates, they could also stop you from dumping tons of code into an LLM prompt by blocking all public LLMs (or even all sites not on an allowlist). The reason it's silly is really that you can always take "secrets" with you, be it by taking photos with your phone ("lets ban phones") or memorizing or writing on paper. Security is useful when it prevents accidental, inadverte…

You overestimate the intelligence of a lot of people. We have caught attempts at exfiltration over channels we can easily monitor.

Is it perfect? No. Can reasonably intelligent people find a way around them? Sure. But we are still going to control that information flow where we can.

Re: 65% of employees bypass cybersecurity measures, new study finds

#68

Post by sfn42 »

epiecs wrote: post #56
turbojet1321 wrote: post #28

Earlier quoted context omitted.

Sorry, I meant in an actual corporate (ie, Windows) environment, not conceptually.

You use PIM: https://learn.microsoft.com/en-us/entra/id-governance/privil... Basically you are eligible for your admin roles but you have to activate them first. Usually there are additional checks + notifications to other admins. These permissions are also only available for a set amount of time and then you will need to re request them :)

I don't understand the point of PIM. If some malicious actor has my token or controls my PC then what's stopping them from PIMing?

Seems to me like it wastes my time more than anything else.

Re: 65% of employees bypass cybersecurity measures, new study finds

#69

Post by masklinn »

MattPalmer1086 wrote: post #66
masklinn wrote: post #24

Earlier quoted context omitted.

> frequent re-logging We recently had to add that for $bigco requirements at $dayjob, I was stunned: they asked to log people out after — IIRC — 1h inactivity.

Logging out when there is no activity is quite a common security control requirement in many places. I've seen 15 minute inactivity log out quite frequently. Drives users mad of course (particularly admins who are logged in to many machines).

Device logout makes perfect sense, but this is software logout, so would be in addition to the device one, in every piece of software.

I hope and assume it goes along SSO making it less painful but still…

Re: 65% of employees bypass cybersecurity measures, new study finds

#70

Post by cybercatgurrl »

botanicals6 wrote: post #46

AviD's Rule of Usability: "Security at the expense of usability, comes at the expense of security." Security companies should have more focus on the usability aspect of their product. Some of the enterprise products you see today are just plain bad in terms of UX/UI, and funnily enough, they aren't getting called out since they're only used in the workplace/closed groups.

this is why i have a problem with flatpacks. i’ve tried using an immutable distro with flatpacks and it’s made me want to disable every flatpack security measure because it’s even harsher and less usable than macos’s sandboxing. i don’t know what their goal is but it’s definitely not usable if i can’t connect 1password to my browser or i struggle to get steam to access another drive
Post reply on HN