Security so tight, you need to break the rules to be able to work?

  • 20 September 2023
  • 6 comments
  • 61 views

Userlevel 7
Badge +22

HI Everyone,

This post was inspired by our conversation on the KubeKorner about my (in the past 😁) using notepad and vim to great text files with info, how to’s, solutions to issues. I reminded me of all the times  that I have seen people do the same for passwords that are tightly stored away in password managers or other locations that require “extra effort” to gain access too. 

This made me think back to my career and the many incidents where I saw shortcuts taken in order to be able to work more effectively because of strict security measures.

The most hilarious thing that I ever saw was at one job where the security team were on steroid. There was a door to a confidential location that would automatically close and lock after you typed in your very long and annoying individual code on the small panel. The problem was that you had to do this to get in and to get out. However, the toilet was on the other side of that door.  Out of frustration the workers would jam the door with a broom handle so that it would not close and by then hanging at it reverse its movement. There was also an alarm that would go off if the door would not shut but one of the bright techies created some kind by  metallic pass thing that would stop the alarm from triggering. Whenever there was a boss type around or important guest, everything would be put back into place and people would suffer. The issue being that under pressure you could constantly get your code wrong and since the washroom was your destination…. well. 

Have you seen security procedures being so strict that they inevitably make sneaky humans find short cuts? The copying long passwords from a password manager to a text file comes to my mind since I encountered quite often. 


6 comments

Userlevel 7
Badge +8

Security for the sake of security!!!

I see it all the time.  That being said, protecting from external threats is always important, but I see people doing things to get around security measures being put in place frequently. 

 

I usually error on the side of caution these days with ransomware and hackers being so aggressive, but I work closely with our security team to either make sure that some of the policies CAN”T be shortcut, or implementing easy solutions where people don’t feel they have to.

“The issue being that under pressure you could constantly get your code wrong and since the washroom was your destination…. well. “

I need to badge both ways at work for elevators but at least I don’t have to punch in a code. Leaving a room I don’t either as I need to be able to get out in the case of a fire. When you gotta go, you gotta go. lol.

 

Userlevel 7
Badge +20

Security is top of mind here and we are making many adjustments due to recent events, etc.  So, we have to be mindful about how we do things, but this is still something that I do as it is convenient - yes not the way to be security focused.  Going to have to start changing that but still love my Notepad++, Notepads (Win11 App) and Notepad as they all support snapshots so you don’t have to save your work.  😋

Userlevel 7
Badge +22

Then there is the biometrics and your finger. So cycling to work in Canada in the winter something happens to your finger and the biometrics would not let me in :), then there was that time I cut my finger opening a can of beer, again biometrics did not let me in :(. Maybe it was a cheap setup.

Userlevel 7
Badge +22

Disclaimer, the beer can opening took place the night before and not the morning going to work :). Plus I have now not had a beer in 3 years!!! 😎

Userlevel 7
Badge +6

The downside of making things too secure is that your users will actively work against you to make things easier.  Sure, be secure, but if it’s too secure or too inconvenient, they will work to make their lives easier.  Good security doesn’t displace the end users, at least too much.

Userlevel 7
Badge +8

It’s an eternal debat usability (reality?!) vs security, sometimes you have to make concessions. Obviously to do it you need to do security analysis/audit (iso 27001?) and be aware of your breaches and weaknesses.

Comment