Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

65% of employees bypass cybersecurity measures, new study finds

forbes.com

Post reply on HN
Print view View original

91–97 of 97 posts

Re: 65% of employees bypass cybersecurity measures, new study finds

#91

Post by MattPalmer1086 »

ars wrote: post #43
aulin wrote: post #26

Earlier quoted context omitted.

Always assumed they block everything they cannot spy, it's not for security. Https they inject their certificates, ssh you can have your key and they'll be blind. And they spy to prevent exfiltration they say. I cannot ssh into my home network but I can drop tons of company code into an LLM prompt. Everything else, MFA, password rotations, approved software, stupid training videos... is all there to tick some boxes i…

You can just encrypt your stuff and upload it via http. You can even run ssh over http if you work at it. Encryption is as easy as using zip. And if you uploaded a very large file, they can't realistically log it - so you could even upload it in the clear and it won't be caught unless they are specifically looking.

We scan all file uploads and block encrypted files. Your move.

Re: 65% of employees bypass cybersecurity measures, new study finds

#92

Post by Helmut10001 »

moooo99 wrote: post #79
methou wrote: post #71

Earlier quoted context omitted.

FreeIPA and Authentik works pretty well for me, I did some of this for my self with terraform for fun. Personally I don’t think it’s viable SMB who can’t hire a couple of sysadmins. But the documentation for FreeIPA is especially good. Personally wouldn’t use samba as windows DC, but one legacy windows server license seems reasonable if you are having a few hundreds of employees. In a previous job we’ve done Windows…

Oh absolutely, I am not talking about the provider side. Sure, it is not trivial, it is doable to set up a central directory and maintain it for relatively affordable. The problem is with the software you are using. A lot of SaaS software has the connection to an SSO provider locked behind an enterprise tier. Take Figma as an example. Their Pro tier is 15€/mo, their Organization tier is 45€/mo. A 3x markup for the lo…

That is why (e.g.) we chose grist over nocodb.

Re: 65% of employees bypass cybersecurity measures, new study finds

#93

Post by M95D »

jknoepfler wrote: post #86
M95D wrote: post #47

Earlier quoted context omitted.

They're all great guys with each other. Do a test. Go to distant office and call IT pretending to be the person who works in that office, with his/her cooperation. See how fast the problem is solved and how you are treated.

I mean, we're a remote company. I work in software, not IT. YMMV I guess. I don't think demonizing an entire department on the basis of a job title is a very intelligent or humane thing to do, and it doesn't resonate with my lived experience.

I work in medical labs. So far I worked for 4 companies and IT support was the same everywhere. It's usually like this:

-ME: I found a problem. The patients get wrong test results in some cases. [explanation]

-IT: No, you don't know how to use the system. [brief instructions for 4y old children, only vaguely related to the issue]

- Look, I did that, it still happens. [attach more instructions to reproduce the problem]

- (1 week later) There could be a problem, but we can't replicate it with your instructions.

- [send video demo]

- Yeah... it could be a small problem, but it's not that serious.

- It's very serious! We send wrong test results to patients! [add more argumentes, examples]

- (1 week later) Yeah... it doesn't seem that serious, it's probably very rare anyway, but here's a workaround [40 clicks procedure]

- I can't do that every time it happens! And it's not rare, it's [x] times a day just the occurences that I know about!

- (1 month no reply)

- Did you read my message? Are you still working on this?

- (1 week later) We sent a support request to [external company]. We're closing this issue until we hear back from them. [closes issue with "invalid"]

- (1 year later, the problem is still there.) Are you still working on this?

- (no reply)

I quit after 7 years and the problem was still there.

Re: 65% of employees bypass cybersecurity measures, new study finds

#95

Post by necovek »

MattPalmer1086 wrote: post #90
necovek wrote: post #88

Earlier quoted context omitted.

So, as the OP claims, it is working for the 35% of the employees, right? And it likely inconveniences a full 100%. Does that sound like a smart trade-off?

What is the alternative? I have actually worked in places that prevented all personal electronic devices in the building, had security guards and bag searches on every floor and no internet access on your desktop. You don't know what inconvenience looks like!

I am sure it can be even worse than what you describe. I, however, do not aspire to taste it.

The question is not what "inconvenience looks like", but rather, what is "enough security with the least inconvenience?"

The alternative is in the answer to that question: if your "measure" is likely to be "bypassed", it is worse than not having it in the first place (because bypassing usually puts sensitive data on even worse medium like flash devices, public cloud, external servers etc).

If your security policy was simply "Do not keep sensitive work data on unencrypted storage" and had informed your employees they are legally liable to adhere to this, they would either choose to not use personal devices or understand the risks if they do.

So like always, getting to that point requires "simply" being reasonable and smart ("common sense" which is, unfortunately, "not that common").

Re: 65% of employees bypass cybersecurity measures, new study finds

#96

Post by ars »

MattPalmer1086 wrote: post #91
ars wrote: post #43

Earlier quoted context omitted.

You can just encrypt your stuff and upload it via http. You can even run ssh over http if you work at it. Encryption is as easy as using zip. And if you uploaded a very large file, they can't realistically log it - so you could even upload it in the clear and it won't be caught unless they are specifically looking.

We scan all file uploads and block encrypted files. Your move.

I challenge you to automatically tell the difference between an encrypted file with a fake header and a jpeg.

A human could see it's not a real image, a tool would not. And that's not even getting into steganography - just literally add a jpeg header to the encrypted file and it will fool most things.

Or any kind of streaming upload. The thing about media compression is that the compression process leads to a file that looks 100% random, an encrypted file also looks that way.

Re: 65% of employees bypass cybersecurity measures, new study finds

#97

Post by MattPalmer1086 »

ars wrote: post #96
MattPalmer1086 wrote: post #91

Earlier quoted context omitted.

We scan all file uploads and block encrypted files. Your move.

I challenge you to automatically tell the difference between an encrypted file with a fake header and a jpeg. A human could see it's not a real image, a tool would not. And that's not even getting into steganography - just literally add a jpeg header to the encrypted file and it will fool most things. Or any kind of streaming upload. The thing about media compression is that the compression process leads to a file th…

Yeah, you would probably get past it like that, good one. Steganography could also be used to exfiltrate data.

The point of these systems though isn't to stop a determined attacker on the inside. It's to prevent people foolishly, accidentally, or intentionally (because they're lazy) from sending potentially sensitive data out. This happens all the time.

Post reply on HN