Hacker News Reader

Comment by jasonhansel | Hacker News Reader

This is a great idea for defense contractors, and (probably) an exceptionally draconian idea for most other workplaces.

I do not agree. This should also be implemented in financial institutions and any company that has access to overly sensitive information, especially that which you can not easily change or that would put your family at risk of harm.

I would add in my proposal that if a percentage of employees under a director fall for it, the director gets let go. If a number of directors are let go, the C-Level is let go and so on.

Like the sibling comment, I think it all should depend on the roles of the people as well. You need strict access controls in place to ensure that access rights are well defined such as no/read-only access for certain data in certain environments, physical access control, etc. Someone who does client-facing retail at a financial institution should not have access to production data. As such, them getting phished won't have the same impact as senior developer with production read access.

I completely agree. If the company has performed proper compartmentalization of access and clearly documented who has access to what and it isn't just pencil-whipping, but you can prove the access is really compartmentalized, then the risk is reduced.

I mention the pencil whipping because I have seen financial institutions put on a really good show, but under the covers they are not doing proper management of ssh key trusts, ssh multiplexing, port forwarding, sudo or network access or encryption keys and they know which engineers to put in front of the auditors.

In practice there's often a way to escalate privilege. Defense in depth requires that one be good at each layer. Being good against phishing attacks is important even when the victim has apparently-inconsequential access.

At a financial institution I worked for, they had a separate entrance with separate badges and alarms for the really sensitive stuff.

I only entered that area once, as I was a low-level programmer.

It was also the only company where I never ever made a query on the production server :) (I worked for another financial institution on a more senior role and I did have scary access to the production DB).

I agree that a very strict version of this is too draconian for most workplaces, but depending on the person's role and how many times they've failed a phish test I think it's reasonable to have consequences. For positions where getting phished would be disastrous, something along the lines of a warning or training after the first and second strikes then firing after the third doesn't strike me as exceptionally draconian.

Seagate had all of its employees W2s phished because someone in HR messed up badly. If you have access to PII or other confidential information, phishing is a big deal.

That’s the problem with HR: the same role deals with lots of outside emails and lots of employee data.

They have to compromise between security and keeping it easy for people to apply.

The more companies that have complicated application portals, the fewer applicants they’ll have. Particularly from occasional job-seekers that already have other jobs.

Reply on news.ycombinator.com