One chestnut from my history in lottery game development:
While our security staff was incredibly tight and did a generally good job, oftentimes levels of paranoia were off the charts.
Once they went around hot gluing shut all of the “unnecessary” USB ports in our PCs under the premise of mitigating data theft via thumb drive, while ignoring that we were all Internet-connected and VPNs are a thing, also that every machine had a RW optical drive.
Disabled “unnecessary” services on all member servers including netlogon. That was a fun couple of weeks.
The “we’ll just disable everything until somebody complains” strategy. Idiots!
Often times it’s the only strategy because most admins or system owners have no clue what services they actually need
deleted by creator
Are you twirling your mustache?
deleted by creator
I’m torn if I should be nodding and patting myself on the back for not doing any of this insanity or cackling and taking notes…
Taking notes?!? If you can’t make idiotic decisions on your own, you’re not much of an IT guy to begin with.
This is done to keep employees from sticking in unknown thumb drives that could install malware. Several critical systems on protected networks have been hacked in the past by leveraging human curiosity and placing a compromised thumb drive on the ground in the companies parking lot. Gluing shut the USB ports is a simple defense against that.
ZScaler. It’s supposedly a security tool meant to keep me from going to bad websites. The problem is that I’m a developer and the “bad website” definition is overly broad.
For example, they’ve been threatening to block PHP.Net for being malicious in some way. (They refuse to say how.) Now, I know a lot of people like to joke about PHP, but if you need to develop with it, PHP.Net is a great resource to see what function does what. They’re planning on blocking the reference part as well as the software downloads.
I’ve also been learning Spring Boot for development as it’s our standard tool. Except, I can’t build a new application. Why not? Doing so requires VSCode downloading some resources and - you guessed it - ZScaler blocks this!
They’ve “increased security” so much that I can’t do my job unless ZScaler is temporarily disabled.
deleted by creator
It’s been ages since I had to deal with the daily random road blocks of ZScaler, but I do think of it from time to time.
Then I play Since U Been Gone by Kelly Clarkson.
Also, zScaler breaks SSL. Every single piece of network traffic is open for them to read. Anyone who introduces zscaler should be fired and/or shot on sight. It’s garbage at best and extremely dangerous at worst.
Zscaler being the middleman is somewhat the point for security/IT teams using that feature.
And it’s a horrible point. You’re opening up your entire external network traffic to a third party, whose infrastructure isn’t even deployed or controllable in any form by you.
The idea being that it’s similar to using other enterprise solutions, many of which do the same things now.
Zscaler does have lesser settings too, at it’s most basic it can do split tunneling for internal services at an enterprise level and easy user management. Which is a huge plus.
I’d also like to point out that the entire Internet is a third party you have no control over which you open your external traffic to everyday.
The bigger deal would be the internal network, which is also a valid argument.
I’d also like to point out that the entire Internet is a third party you have no control over which you open your external traffic to everyday.
Not really. Proper TLS enables relatively secure E2E encryption, not perfect, but pretty good. Adding Zscaler means, that my entire outgoing traffic runs over one point. So one single incident in one single provider basically opens up all of my communication. And given that so many large orgs are customers of ZScaler, this company pretty much has a target on its back.
Additionally: I’m in Germany. My Company does a lot of contracting and communication with local, state and federal entities, a large part of that is not super secret, but definitely not public either. And now suddenly an Amercian company, that is legally required to hand over all data to NSA, CIA, FBI, etc. has access to (again) all of my external communication. That’s a disaster. And quite possibly pretty illegal.
Yeah. Zscaler was once blocking me from accessing the Cherwell ticket system, which made me unable to write a ticket that Zscaler blocked me access to Cherwell.
Took me a while to get an IT guy to fix it without a ticket.
Now that’s a Catch-22
Oh man our security team is trialing zscaler and netskope right now. I’ve been sitting in the meetings and it seems like it’s just cloud based global protect. GP was really solid so this worries me
It has the same problem as any kind of TLS interception/ traffic monitoring tool.
It just breaks everything and causes a lot of lost time and productivity firstly trying to configure everything to trust a new cert (plenty of apps refuse to use the system cert store) and secondly opening tickets with IT just to go to any useful site on the internet.
Thankfully, at least in my case, it’s trivial to disable so it’s the first thing I do when my computer restarts.
Security doesn’t seem to do any checks about what processes are actually running, so they think they’ve done a good job and I can continue to do my job
Admin access needed to change the clock, which was wrong. Missed a train because of that.
Worked a job where I had to be a Linux admin for a variety of VMs. To access them, I needed an VPN that only worked inside the company LAN, and blocked internet access. it was a 30 day trial license on day 700somthing, so it had a max 5 simultaneous connection limit. Access was from my heavily locked down laptop. Windows 7 with 5 minutes locking Screensaver. The ssh software was an unknown brand, “ssh.exe” which only allowed one connection at a time in a 80 x 24 console window with no ability to copy and paste. This went to a bastion host, an HPUx box on an old csh shell with no write access to your home directory due to a 1.4mb disk quota per user. Only one login per user, ten login max, and the bastion host was the only way to connect to the Linux VMs. Default 5 minute logout for inactivity. No ssh keys allowed. No scripting allowed, was like typing over 9600 baud.
I quit that job. When asked why, I told them I was a Linux administrator and the job was not allowing me to administrate. I was told “a poor carpenter always blames his tools.” Yeah, fuck you.
A carpenter isn’t expected to use his tools with garbage grabbers (reachy claw things) either.
removed by mod
That sounds like the equivalent of asking a carpenter to build a wooden boat large enough to carry 30 people, but only giving them Fisherprice tools and foam blocks.
removed by mod
One IT security team insisted we have separate source code repositories for production and development environments.
I’m honestly not sure how they thought that would work.
I’m honestly not sure how they thought that would work.
Just manually copy-paste everything. That never goes wrong, right?
I mean, it’s what the Security guys do, right? Just copy+paste everything, mandate that everyone else does it too, Management won’t argue because it’s for “security” reasons.
Then the Security guys will sit around jerking each other off about how much more secure they made the system
Could work if dev was upstream from prod. But honestly there would be no difference between that and branches.
Maybe it is a rights issue. Preventing a prod build agent of sorts to access develop code.
Yeah…assuming that the policy was written “from blood” (meaning someone did something stupid).
But even then you can put other checks and balances in place to make sure that kind of thing doesn’t happen.
This is such an extreme reaction though. Or the policy was made from someone dumb
That’s fucking bananas.
In my job, the only difference between prod/dev is a single environmental file. Two repositories would literally serve no purpose and if anything, double the chances of having the source code be stolen.
That was the only difference for us as well. The CI/CD process built container images. Only difference between dev, test, and prod was the environment variables passed to the container.
At first I asked the clueless security analyst to explain how that improves security, which he couldn’t. Then I asked him how testing against one repository and deploying from another wouldn’t invalidate the results of the testing done by the QA team, but he kept insisting we needed it to check some box. I asked about the source of the policy and still no explanation, at least not one that made any sense.
Security analyst escalated it to his (thankfully not clueless) boss who promptly gave our process a pass and pointed out to Mr security analyst that literally nobody does that.
Mozilla products banned by IT because they had a vulnerability in a pervious version.
Rant
It was so bullshit. I had Mozilla Firefox 115.1 installed, and Mozilla put out an advisory, like they do all the fucking time. Fujitsu made it out to be some huge huge unfixed bug the very next day in an email after the advisory was posted and the email chain basically said “yk, we should just remove all Firefox. It’s vulnerable so it must be removed.”
I wouldn’t be mad if they decided that they didn’t want to have it be a managed app or that there was something (actually) wrong with it or literally anything else than the fact that they didn’t bother actually reading either fucking advisory and decided to nuke something I use daily.
Nah mate, they were completely right. What if you install an older version, and keep using it maliciously? Oh wait, now that you mention, I’m totally sure Edge had a similar problem at one point in the past. So refrain from using Edge, too. Or Explorer. And while we’re at it, it’s best to stay away from Chrome, as well. That had a similar vulnerability before, I’m sure. So let’s dish that, along with Opera, Safari, Maxthon and Netscape Navigator. Just use Lynx, it’s super lightweight!
EDIT: on another thought, you should just have stopped working for the above reason. Nothing is safe anymore.
Can’t use Lynx either.
https://www.cvedetails.com/cve/CVE-2010-2810/
All web pages must now be phoned in via a touch-tone system, and delivered on paper printouts via regular post.
Touch-tones had some sort of vulnerability too; you’re going to have to mail in your HTTP requests.
Misunderstood STIG from the sound of it. The STIG is only applicable to unprivileged users but tends to get applied to all workstations regardless of user privileges. Also I think the .mil STIG GPOs apply it to all workstations regardless of privileges.
The other thing that tends to get overlooked is that AC-12 let’s you set it to whatever the heck you want. Ao you could theoretically set it to 99999 year by policy if you wanted.
https://www.stigviewer.com/stig/application_security_and_development/2017-01-09/finding/V-69243
And that’s why people use mouse jigglers and keep their computers unlocked 24/7.
deleted by creator
Mine was removed by Corporate IT, along with a bunch of other open source stuff that made my life bearable.
Also I spent 5 months with our cyber security guys to try and provide a simple file replication server for my team working in a remote office with shit internet connectivity. I gave up, the spooks put up a solid defense, push all the onerous IT security compliance checking onto my desk instead of taking control.
Not as bad as my previous company though, outsourced IT support to ATOS was a nightmare.
The internal IT at that hellhole is a nightmare as well.
That’s why you buy a jiggler that you place your mouse onto. Not detectable by IT :)
I set my pocket knife on the ctrl key when I have to step away.
That works?
Idk about every application but it keeps windows from timing out which serves most purposes for me.
Ahhh the old “level up an RPG Skill by jamming a pen cap into a key and going to watch Night Court reruns” method.
Thanks, I actually didn’t know holding CTRL would keep the system awake!
Does that keep your status in Teams as “online”? That’s what I use the jiggler for - if I’m waiting for CI tests which take 30+ minutes and I sit in front of the laptop, I don’t want to have to manually jiggle my mouse every couple of minutes just to keep my status.
Yep
Awesome, thank you!
After mine was disabled, I found that if I run videos of old meetings or training onscreen, it keeps the system alive…
Works nicely when I’m WFH.
It’s reasonably easy to make a hardware mouse wiggler with an Arduino Micro (and I don’t mean something that physically moves a mouse, rather something that looks like a USB mouse to the computer and periodically sends mouse movement messages).
If you’re desperate enough, look it up as it’s quite simple so there should be step by step instructions out there.
Can also just buy one from Amazon if you’re lazy or not technically inclined.
Well, my off the cuff suggestion was what seems simple to me in this domain ;)
That said I get what you mean and agree.
Absolutely love my Uno keyboard for this https://keyhive.xyz/shop/uno-single-key-keyboard
Got like 6 commands on a single key and one of them is to press shift every 30seconds so my computer doesn’t lock. Lifesaver.
Yeah, it’s surprisingly simple to get these microcontrollers to become essentially programmable keyboard/mouse emulators, by which point if you’re familiar with the stuff to program them (Arduino being the simplest and most widespread framework) it really just becomes a coding task and you can get it to do crazy stuff.
I suggested an Arduino Micro board because it bypasses the whole hardware side of the problem, but something like what you mention is even simpler.
I used a Sidewinder keyboard for years with programmable macros.
Yeah, I had my password as a macro.
Dick move on my part as the macro, I’m fairly sure, is stored in plaintext on the PC. But the convenience was great. I don’t do that any more.
Made me write SQL updates that had to be run by someone in a different state with pretty much no knowledge of SQL.
We cant run scripts on our work laptop because of domain policy. Thing is, I am a software developer. They also do not allow docker without some heavy approval process, nor VMs. So im just sitting here remoting into a machine for development…which is fine but the machine is super slow. Also their VPN keeps going down, so all the software developers have to reconnect periodically all at the same time.
At my prior jobs, it was all open so it was very easy to install the tools we needed or get approval fairly quickly. Its more frustrating than anything. At least they give us software development work marked months out.
I had a software developer job where they expected me to write code in Microsoft notepad, put it on a USB, and then plug it into airgapped computers to test it. Wasn’t allowed to even use notepad++.
Oh it felt so freaken good leaving that job after 6 weeks. It felt even better when I used my old manager’s personal phone number on a fake grinder profile I made. She kept a tally of my bathroom breaks.
Jump systems are a good practice but they gotta have the resources you need… I hate to say it but it sounds like y’all need to just move to a cloud platform…
My dev pc isn’t allowed to be connected to the internet :D
Wait, I haven’t even started talking about the fact it’s a huge unstructured legacy project using SharePoint 2016 and…
Where did everyone go?
I cannot remember the specifics because it’s going back almost 15 years now but at one point…crontab (edit and other various vital tools) was disabled by policy.
To get necessary processes/cleanup done at night, I used a scheduled task on a Windows PC to run a BAT that opened a macro program which opened a remote shell and “typed” the commands.
Fuuuuuuck.
I hate this stuff. When I had a more devops role I would just VM everything. Developers need their tools, here is a VM with root. Do what you want and backups run on Friday.
Thought my work was bad. We at least can use VMs. I literally can’t do my job without one, Rockwell being what it is. Companies don’t like upgrading PLC software so I need to use old versions of windows occasionally to run old Rockwell stuff.
There was also a bug for a bit that would brick win11 PCs when trying to update PLC firmware, fun stuff.
Same boat. I use dedicated laptops. This is for my old Rockwell stuff, this is for my old Siemens stuff, this is my normal laptop with AD stuff, this one for Idec, and the last one for Schneider. Pretty much every laptop at the company gets retired it becomes mine.
Also works for on site access. Customer needs support? Mail them a laptop. I got one laptop that has been in Canada, both coastlines in America, Australia, and Vietnam.
machine had a RW optical drive
Ah, the Private Manning protocol.
Less the Lady Gaga obfuscation.
We had 40,000 blank discs laying around at all times… because they were a regular part of sending art/data proofs to customers.
o_O
I am not allowed to change my wallpaper.
This came from your security team? I usually see it from HR / management selling it as a branding issue or “professional” thing.
deleted by creator
deleted by creator
deleted by creator
Even worse here - we cant change the screensaver or screen lockout timeout settings!
I have a workaround by running a little looping script that keep the screen active. Its not that I particularly object to the screensaver, but once it activates I have to Ctrl Alt Delete 3-4 times and enter my password to get my desktop open again. Also it is an active screensaver that sometimes mucks up my desktop layout (I have a multiple monitor setup)
That is so annoying… when I’m working from home I just start a meeting with myself in Teams to keep the pc from autolocking.
That’s actually genius. Here’s me writing a script to just move the mouse randomly lol, starting a Teams meeting would’ve been way simpler
We have a largeish number of systems that IT declared catheorically could not connect directly to the Internet for any reason.
So guess what systems weren’t getting updates. Also guess what systems got overwhelmed by ransomware that hit what would have been a patched vulnerability, that came through someone’s laptop that was allowed to connect to the Internet.
My department was fine, because we broke the rules to get updates.
So did network team admit the flaw in their strategy? No, they declared a USB key must have been the culprit and they literally went into every room and confiscated all USB keys and threw them away, with quarterly audits to make sure no USB keys appear. The systems are still not being updated and laptops with Internet connection are still indirectly bridging them.
deleted by creator
Also, I keep a “rogue” laptop to self administrate along with my official it laptop to show I am in compliance. Updates are disabled and are only allowed to be fine y by IT. I just checked and they haven’t pushed any updates for about 8 months.
They do. In fact they mandate IT assets to have three competing patch management software on them. They mandate disabling any auto updates because they have to vet them first. My official laptop hasn’t been pushed an update in 8 months.
Do y’all need a consultant? That is so bad it’s a non starter.
Ironically, we actually have a Segment of our business that provides IT for other companies, and they do a decent job, but they aren’t allowed to manage our own IT. Best guess is that they are too expensive to waste on our own IT needs. If an IT staffember accidentally shows competence, they are probably moved to the billable group.
The irony…
Over 150 Major Incidents in a single month.
Formerly, I was on the Major Incident Response team for a national insurance company. IT Security has always been in their own ivory tower in every company I’ve worked for. But this company IT Security department was about the worst case I’ve ever seen up until that time and since.
They refused to file changes, or discuss any type of change control with the rest of IT. I get that Change Management is a bitch for the most of IT, but if you want to avoid major outages, file a fucking Change record and follow the approval process. The security directors would get some hair brained idea in a meeting in the morning and assign one of their barely competent techs to implement it that afternoon. They’d bring down what ever system they were fucking with. Then my team had to spend hours, usually after business hours, figuring out why a system, which had not seen a change control in two weeks, suddenly stopped working. Would security send someone to the MI meeting? Of course not. What would happen is, we would call the IT Security response team and ask if anything changed on their end. Suddenly 20 minutes later everything was back up and running. With the MI team not doing anything. We would try to talk to security and ask what they changed. They answered “nothing” every god damn time.
They got their asses handed to them when they brought down a billing system which brought in over $10 Billion (yes with a “B”) a year and people could not pay their bills. That outage went straight to the CIO and even the CEO sat in on that call. All of the sudden there was a hard change freeze for a month and security was required to file changes in the common IT record system, which was ServiceNow at the time.
We went from 150 major outages (defined as having financial, or reputation impact to the company) in a single month to 4 or 5.
Fuck IT Security. It’s a very important part of of every IT Department, but it is almost always filled with the most narcissistic incompetent asshats of the entire industry.
Jesus Christ I never thought id be happy to have a change control process
The past several years I have been working more as a process engineer than a technical one. I’ve worked in Problem Management, Change Management, and currently in Incident for a major defense contractor (yes, you’ve heard of it). So I’ve been on both sides. Documenting an incident is a PITA. File a Change record to restart a server that is in an otherwise healthy cluster? You’re kidding, right? What the hell is a “Problem” record and why do I need to mess with it?
All things I’ve heard and even thought over the years. What it comes down to, the difference between a Mom and Pop operation, that has limited scalability and a full Enterprise Environment that can support a multi-billion dollar business… Is documentation. That’s what those numb nuts in that Insurance Company were too stupid to understand.
Lots of safety measures really suck. But they generally get implemented because the alternative is far worse.
At my current company all changes have to happen via GitHub PR and commit because we use GitOps (ex: ArgoCD with Kubernetes). Any changes you do manually are immediately overwritten when ArgoCD notices the config drift.
This makes development more annoying sometimes but I’m so damn glad when I can immediately look at GitHub for an audit trail and source of truth.
It wasn’t InfoSec in this case but I had an annoying tech lead that would merge to main without telling people, so anytime something broke I had his GitHub activity bookmarked and could rule that out first.
Since we were on the platform team we were all GitHub admins 😩. So it all relied on trust. Is there a way to block even admins?
That sounds like a good idea. I’ll take another look at GitHub settings. Thanks!
You poor man. I’ve worked with those exact fukkin’ bozos.
Lack of a Change Control process has nothing to do with IT Security except within the domain of Availability. Part of Security is ensuring IT systems are available and working.
You simply experienced working at an organization with poor enforcement of Change Control policies. That was a mistake of oversight, because with competent oversight anyone causing outages by making unapproved changes that cause an outage would be reprimanded and instructed to follow policy properly.
