The Water Cooler

12:08 AM

Just need quick advice. My notice period is ending in 8 days and still some of my colleagues don't know I am leaving. I am thinking of just sending a company-wide E-Mail tomorrow to everyone to let them know

Is this a standard practice when you leave your job?

Richard U

12:49 AM

@VarunAgw I typically, I send out an email on my last day.

Anthony

To the many developers here

Anyone familiar with security nazi concept? someone taking security to excess?

Had a good chat on IT Sec about this, but to hear from non IT sec folks, what did you do to work with such a person?

Richard U

@Anthony TWO WORDS: Malicious compliance. Work it to the book, let the work pile up, then explain why.

Anthony

1:12 AM

Rich, malicious Compliance? what is that?

Malicious compliance

Malicious compliance is the behaviour of intentionally inflicting harm by strictly following the orders of a superior knowing that compliance with the orders will not have the intended result. The term usually implies the following of an order in such a way that ignores the order's intent but follows it to the letter. For example, when a group of firefighters were ordered by management to wear the unwanted self-contained breathing apparatus that they were being issued with for safety reasons, they took to wearing the equipment on their backs while ignoring it and breathing normally. This made...

so like white mutiny of a sort?

forest

It means complying, knowing that things will end up worse.

"You want to encrypt everything, including our ancient log backups? OK, I guess we'll have to shut down the backend for several days while we do this. We'll also have to divert efforts that otherwise would be going to a valuable client. Whatever you say!"

Anthony

Removing the A of CIA...nice one!

forest

Yup

The problem with people with a naïve understanding of infosec is that they completely neglect availability as an aspect of security.

It's common with the defeatist "the only secure computer is an unplugged computer" mentality where a quantifiable and manageable confidentiality or integrity risk is turned into an absolute and non-negotiable loss of availability.

Anthony

yes...cant get to it making the most secure asset worthless ;)

Would you say that statement is absolute in itself? Say if the data is very sensitive, could the loss of confidentiality be worse than a system thats unusable?

forest

If loss of confidentiality is a problem, then authorization controls should be improved.

Anthony

1:21 AM

And authentication - and accountability - AAA triad

forest

Never heard of it as the AAA triad. I always call accountability non-repudiation. :P

Anthony

Might be a different context, I guess, network based vs auditability in general

Forest, if confidentiality is often non - recoverable once lost

forest

Then you need to either accept the risk or improve authorization.

Richard U

@Anthony.....

3

forest

:D

Richard U

1:37 AM

I worked at one place where not even IT had admin access to their own machines. Nothing like having to walk the help desk through doing their own jobs.

Anthony

Nice one, should show that to some new team members...

forest

To be fair, in some of the riskier environments, it's a very good thing to prevent IT from having admin access. Of course, it requires role-based access controls be set up to allow them to do a subset of administration tasks...

Anthony

@forest - what is the standard for "riskier"?

how would you measure that?

forest

@Anthony Risk analysis, of course.

But I'm talking about environments right around the level where you need NATO SDIP-27 certification for hardware (EMSEC to avoid "TEMPEST" attacks).

Many jobs like that require security clearance (though not all).

MITRE is an example of a corporation that uses those kinds of controls.

Anthony

Not to challenge, where I work that would be waaaaaaaaay overboard...although we are regulated sector

forest

1:46 AM

What industry?

Anthony

Insurance , and little bits of healthcare

Lots of state DOI stuff and Sarbanes 404 as well

forest

ah

Anthony

Tried an experience to improve our security posture... and results were mixed

experiment*

forest

What would you say is the biggest area that needs to be improved security-wise?

Anthony

8

Q: Handling fallout due to new security policies

I am an InfoSec professional working as an IT auditor. For several months now, I have working closely with our information security team to strengthen the security controls governing our PCI and SOX compliance efforts. Last week, new security policies went live in the production environment. In r...

security

Lots of crying and complaining...

forest

1:50 AM

PCI can be a little silly tbh. :P

Given that the jump proxy example you gave really isn't that hard for people to use, I think the people complaining should have just sucked it up lol

Anthony

Kinda...tried to explain why...we are not being arbitrary or a security nazi by any means

Imagine if CC #s fall into wrong hands...get rich on the black market ;)

forest

A thing for people to remember is that good security controls require nothing more than learning a new way of management/maintenance/administration, whereas bad security controls permanently prevent someone from doing their job.

Most grumbling is due to the former, so they should just suck it up.

Anthony

Would love for you to work at my company with that attitude, :) Open spots interested lol?

forest

I only work for smaller companies/private individuals because I hate bureaucracy. :P

Things like PCI's requirement to use antivirus everywhere pisses me off.

Anthony

What would you say is the biggest area that needs to be improved security-wise? - I say third party risk / vendor monitoring from my workplace

The concept of "shared risk" when outsourcing, you know?

forest

1:56 AM

yup

Outsourcing without proper risk analysis is a recipe for disaster.

Anthony

to use antivirus everywhere...

forest

Antivirus has only very narrow use-cases, despite what many people think.

Anthony

A little surprised...are you saying endpoints, servers, are too much?

forest

It depends on the system and what is passing through it. For an email or file hosting server it makes sense simply to slow the spread of malware. But for a well-regulated system which is not downloading random files from the internet or being used to store arbitrary, user-submitted files, AV only serves to increase attack surface area.

It's much better to use a reputable IDS than signature/heuristic-based antivirus.

Anthony

Yea...given due to polymorphism

forest

2:02 AM

Not just that but simply because they're so easy to bypass and they're a goldmine for privilege escalation bugs (making them worse than nothing).

Anthony

We are also starting a BYOD...how does that change the importance of AV? Meeting with management actually later this week

forest

122

A: Alternatives to anti-virus for keeping oneself safe

Antivirus is more dangerous in that it parses complex attacker-controlled data in a highly privileged context. This is a recipe for privilege escalation exploits. As a result, sophisticated attackers can often abuse antivirus programs to gain SYSTEM privileges. This is not a rare occurrence or on...

I wrote about it here. There are so many better alternatives...

Anthony

What has your experience been?

forest

That doesn't really change the importance much (though I don't have direct experience with it) unless people are uploading their own files. It's probably a good idea for them to use AV, but protection from a compromised e.g. laptop should be done with network access controls and the like. And, of course, making sure no one device has too much access (use a physical terminal for the most sensitive machines, etc).

The problem with BYOD is that the heterogeneity is a nightmare for IT. It also makes some of the more advanced techniques like remote attestation (TPM) network access controls where each computer cryptographically proves that the software it is running is known good before being allowed to connect impractical to implement.

Anthony

For them to run AV...yes. As users connect VPN, safety relies on security of the end host as it will be no different than if the users are directly connected to a port. Thanks for that!

forest

2:09 AM

yep

What I just find silly is when e.g. Linux or Unix log servers run Norton 360...

When they have only UDP port 514 port for syslog and TCP port 22 for SSH open.

Anthony

Like a vehicle that transport malware on BYOD assets to the corporate network. Although we do have DMZ as an extra layer of security

forest

The best way to deal with that is to take trust away from the devices.

But of course that makes people grumble when they can no longer telnet in as root to an important production server from the same computer they play video games on.

Anthony

Haha - back to my linked question of using jump hosts... when I was working on that, thought almost exactly the same1

!

forest

:P

Anthony

Since you asked me, from where you work, what would you say is you biggest security issue?

forest

2:22 AM

hm

Well I'm a contractor.

But right now I'm dealing with a small company that has no clue what it's doing.