[wolvoleo]

Yes but the balance has shifted a lot.

I remember working at a major company where important systems had an admin password of "<company name>123". That was stupid. I asked to change it but the answer was no because too many people would have to be told the new password.

That was too much in favour of convenience and I'm surprised they never got pwned in the worst way.

These days the balance has swung way too much in favour of security though. Even when it concerns assets that have no value.

[hnlmorg]

Given cyber attacks are more rampant than ever, it’s hard to argue that security has gone too far the other way.

[wolvoleo]

Shifting the balance towards security doesn't always improve the overall security stance. What you get is people getting sick of all the stupid hurdles and working around it. Using shadow IT. I find myself doing that too. For example, I was at a highly secured facility one time as a vendor to do a software upgrade. Blocked USB ports, severely reduced internet access etc. So I couldn't do the upgrade, I wasn't even allowed near the server. Nor could I connect my laptop to their network. All sensible precautions but how do I then upgrade the server software?

So what happened? Someone from IT came and said: "Oh yeah that always happens, just give me a USB stick and I'll stick it in the server". Which he did, no virus checking etc. This is the problem with processes that are too strict. They leave out usecases (often under a misguided "80/20 pareto" rule) and then people will figure out their workaround in unpredictable ways which you have no control over.

And most of the big hacks now are because of the move to cloud SaaS, especially salesforce instances are constantly being hit. Simply applying RBAC rules would fix that and not even interfere with anyone's job because the idea of RBAC is making sure that everyone can do just what they need to do their job and nothing more. But nothing LESS either. And of course some monitoring. If a local callcenter agent suddenly starts accessing 10.000 accounts per day instead of 20 a day, then yeah really you should be on the ball.

[hnlmorg]

> Shifting the balance towards security doesn't always improve the overall security stance.

What youre complaining about isn’t security. It’s security theatre. Which is bullshit

> What you get is people getting sick of all the stupid hurdles and working around it. Using shadow IT. I find myself doing that too.

Unfortunately it’s people like yourself who implement shadow IT that end up forcing security and infra teams to add those annoying bureaucratic hurdles to force people in line.

But you do raise a point that I’ve often argued: good security needs to make it easy for people to do the right thing.

Unfortunately that takes a lot of time, effort, and investment to get right.

> And most of the big hacks now are because of the move to cloud SaaS, especially salesforce instances are constantly being hit.

lol no. That’s not even the tip of the iceberg.

> Simply applying RBAC rules would fix that and not even interfere with anyone's job because the idea of RBAC is making sure that everyone can do just what they need to do their job and nothing more.

Salesforce already has RBAC.

Also RBAC doesn’t prevent you from being hacked. It just limits the blast radius of what is exposed when you do get hacked. It also makes it harder for those who “know enough to be dangerous” to do the wrong thing. Like the shadow IT shenanigans you’ve admitted to.

[wolvoleo]

> Unfortunately it’s people like yourself who implement shadow IT that end up forcing security and infra teams to add those annoying bureaucratic hurdles to force people in line.

It's because I still need to do my job. And I am also in the security team in fact. But we can't even "burn ISO's" anymore on memory sticks to install stuff in our test lab. When I ask they just say "80/20 rule" which apparently means, they spend the 20% effort on 80% of the usecases and the other 20% can go F themselves. Because the project manager doesn't care, he just wants to tick some boxes in the easiest way possible. That's how you get shadow IT.

> Also RBAC doesn’t prevent you from being hacked. It just limits the blast radius of what is exposed when you do get hacked. It also makes it harder for those who “know enough to be dangerous” to do the wrong thing. Like the shadow IT shenanigans you’ve admitted to.

Exactly, all the mega hacks with the release of millions of customers' data wouldn't have happened if that was properly implemented. Salesforce does have it but companies don't implement it.

And if people go to shadow IT it means that RBAC is not properly implemented because they don't have enough rights to do their job.

[hnlmorg]

You’re hugely over simplifying things.

For starters, your complaint about IT is representative of bad IT operations. NOT security as an industry, like you claim it is.

And your comments about RBAC are such a massive oversimplification that I wonder if you actually do work in security at all. Because no competent security professional would claim that RBAC is a silver bullet that solves all issues.