Random Tech (or IT Work!) Fail

[Hellfury]

People don’t care about security

Took us a,most 2 weeks to convince a client to update his exchange due to last 0 days

Guess what he got breached between when we asked him to patch and when he accepted

And now it’s our fault according to him

I sat there patching that alone, fortunately just one exchange server in hybrid, of course the latest pack made the webshell crap its pants, so that took some time, but that's why we patch at night, no? :D

[Ratatapa]

I sat there patching that alone, fortunately just one exchange server in hybrid, of course the latest pack made the webshell crap its pants, so that took some time, but that's why we patch at night, no? :D

I patch during the day no one will know since email are down they can’t contact us

[Hellfury]

our primary internal wireless network went down one day (radius issue), so I sent out a push notification to let people know that it was a known problem, and calling me any further was not necessary, and they could use one of the redundancy solutions temporarily.

CEO chews me out for not notifying people via E-mail / SharePoint....

My first mistake was pointing out the logic, or rather, lack thereof, of that demand, as she was venting her rage at her incompetent CTO (me). It kinda went downhill from there.

[Corrderio]

Also a quick rant: Why the hell do people install logging libraries for their project but hardly use it or mask stuff in if/else statements where the exception may not be thrown?

Ran into an issue last week where our employment management tool wasn't updating properly and took about 3 days to figure it out because the application would only log if an exception met a specific criteria, anything else would be ignored and not wrote into the logs.

[GSDragoon]

Also a quick rant: Why the hell do people install logging libraries for their project but hardly use it or mask stuff in if/else statements where the exception may not be thrown?

Ran into an issue last week where our employment management tool wasn't updating properly and took about 3 days to figure it out because the application would only log if an exception met a specific criteria, anything else would be ignored and not wrote into the logs.

This happens when the developers don't own their own deployment. They don't know troubleshooting or what good logging is because they never have to deal with it often, if at all.

[Ragns]

If you think this is bad the company I work for store full CC information in their database. I'm only waiting for my "told you so" moment.

[Ratatapa]

It’s always DNS anyway

[Boyiee]

My company has a pc with a nongenuine version of windows XP and a banner that says you may be a victim of software counterfeiting and another scada client with a different licensing banner. I took pictures for fun.

[Ratatapa]

I went at a McDonald once and the screen to order stuff was black saying the windows licence is invalid

[Byrthnoth]

I could go into detail about the lack of true information security at my company, but the honest truth is that there's very little of value on our network.

In the last year, our InfoSec department has leveraged every major breach to impose stricter rules, though, but they have zero experience actually implementing or maintaining firewall rules. We're ending up with network fragmentation instead of segmentation and it has cost me probably 1/3 productivity over the last six months with a negligible or negative impact on our actual information security, but no one cares. Our CI/CD pipelines break constantly because random new rules get thrown up and suddenly we have to spend weeks negotiating new firewall rules so Jenkins can talk to our staging server again. Wash, rinse, repeat with another connection or direction every month.

They have my whole team on a separate VPN profile and every time they add new servers or something they forget to expose them to us (even if the servers are explicitly for us).


Fortunately we're all WFH and can just work disconnected from the corporate network or the productivity impact to my team would def be >50%. I estimate ~1/3 for me but only because I'm the one who does the hacks / manual processes to keep everything flowing when our pipelines break.


PS. Protecting a network that contains nothing of value is actually a super big trap because it guarantees that everyone will come up with a different rationale for protecting it. Should I be able to access the internet because I'm doing research and need the freedom to experiment with new techniques, or should I be super locked down because I'm generating IP and our IP is the reason to secure the network? Ask a different person (or the same person on a different day) and get a different answer. I wish we fucking had billing information or something so they could put it in a digital castle and spend their nervous energy defending it, but all we have is inscrutable code that would be faster to rewrite from a product description than interpret and non-identifying information that can't be sold.

[Ratatapa]

Found it

[Corrderio]

If you think this is bad the company I work for store full CC information in their database. I'm only waiting for my "told you so" moment.

I actually found 2 instances of us logging credit card numbers without encryption I had to fix.

[Ratatapa]

If you think this is bad the company I work for store full CC information in their database. I'm only waiting for my "told you so" moment.

Guessing not PCI compliance ?

[Melena]

I remember when county IT pushed a new policy blocking access to county email through Google/apple mail clients as they want the ability to wipe someone's email if their phone becomes compromised, and the whole project nearly got killed because a single county board of supervisors rep was adamant about only using apple mail and not using outlook on their phone.

Sent from my SM-G975U using Tapatalk

[Yabby]

You guys are giving me flashbacks of some of the shit I had to deal with before I went into federal work.... bleh.

That said, the amount of work being put in over the SolarWinds hack is MASSIVE. I can't go into detail, but the amount of shit being built up from scratch and custom crawlers we are using is fucking nuts.

[Hellfury]

Part of my problem is that we actually have massive amounts of sensitive health information about people all over the place, In theory it's just supposed to be in a few well protected SQL databases stashed away in their own secure zone, but yeah right, whose users do not send stuff back and forth on e-mail, Teams, make local drafts, abuse OneDrive and so forth? :/

CEO: "But they're not supposed to!""
Me: "Well they do anyway"
CEO: Well they're not allowed to.
Me: "...."

But it's pretty clear she doesn't trust IT at all. Here the other day she wouldn't let me renew our SSL certificate, wanted one of our subcontractors to do it, much too important and so on, until our subcontractor pretty much went "wtf...?" on it.
(I did the architecture design and large parts of the implementation of all of it, spent 8 years getting it from zero to hero, even winning contracts that compliment our security measures, now this shit...)

But /livejournal! mea culpa.

Is federal level really that different in the US? I've been thinking about trying to get into the Norwegian version via a bunch of azure/ms certifications I started working on.

[Yabby]

In my experience, moving from private to federal is like night and day when it comes to security. All the hacking and shit that went on in the past 10 years have hit the right ears, and they have been tossing money at us. A lot of shit is contracted out, but the overall budget has been great to work with. And every time something big happens (Even if it only hits the private sector) we get a review that asks if we need more money (Hint, we always do).

[Hellfury]

That does sound nice, I need to dig in and find out if it's similar here. I know the central government and Parliament got hit 2-3 times lately and that's only the public stuff, so they will probably need to start taking the paths that the US gov seems to be on. (Parliament first got caught with their pants down without even basic MFA on Exchange, and then got hit again on the last general exchange round, maybe they're hiring soon? :D)

I need to start sending out applications soon, so thinking about where to try to head, Thanks for answering

[Ragns]

Guessing not PCI compliance ?

Hell no, it cost a lot less to make the team sign NDAs when breaches occurs.

[Corrderio]

Got a 3rd party building a new website for us and JFC these people. Last week they moved CSS/JS files around and broke the text styling on the site once I posted a new build with their changes. When they asked what happened I told them the build server ignores all files that aren't being referenced by Visual Studio so if they don't see the files in the solution explorer they won't be built.

They push a new build today and somehow manage to break the site more. So now I'm asking them WTF they did this time.