Hacker News Reader

Comment by SCHiM | Hacker News Reader

I can attest that I have ran tests in a very similar vein at least three times. One of which also caused an uproar.

I also prefer my security measures procedural, technical and layered. Like I said before, phishing simulations don't really work for me at all... Currently many places where I do some work the security department have a large say in what happens, regardless of goodwill. Security measures always suck, are less efficient and cause no end of headaches, you mostly have 0 goodwill anyway.

View on HN

> Security measures always suck, are less efficient and cause no end of headaches, you mostly have 0 goodwill anyway.

Isn’t your job to make sure security measures don’t suck, aren’t less efficient, and don’t cause headaches?

This seems to be a very defeatist attitude to take.

From my personal experience one of the following happens when a security team takes your perspective: 1.) users work around security mitigations, causing worse security issues 2.) workers quit the company due to friction when working 3.) the security manager gets fired because they won’t ever compromise

Can you say who you work for? I don’t want to work for you either.

You seem oblivious to the fact that you can still be effective but not a shitty security team.

Your way of approaching this literally makes people who should listen to you and trust you want to do the opposite. What an awful security team you’re part of.

Over time security measures always cause friction. You'll always be the annoying presence, the naysayer, the 'needlessly' difficult person. Effective security imposes restrictions, hurts egos and interferes in natural social responses.

It's funny you say that my way of working literally makes people want to do the opposite of trust me, when I send them a phishing e-mail that's exactly what I'm aiming for ;P

I've worked at a place where the security team were a detached, nagging presence. Devs only interacted with them when they had to, so security became an afterthought.

I've also worked at a place where the security team were trusted collaborators. Devs were comfortable communicating with them. Their security skills improved over time, and so did the security of the software they wrote.

The latter strategy is far more effective at moving the needle over the long term.

can you rephrase this without the acerbic vitriol? I can't really take a security discussion seriously with someone who can't communicate professionally.

Treating people this way is not itself professional. The inhumanity of the people with power and the willingness to exert it upon others in this fashion is deserving of a little, as you say, vitriol. (I would say "contempt".)

Treat. People. Decently.

Why did you post this to GP? He's being an asshole.

Weren't you just complaining about profanity and name-calling?

Beginning to think he’s just a troll

Ah, yes — merely supporting fake bonuses during a historic economic crisis is perfectly professional, but describing that as awful is “acerbic vitriol”.

I'm sorry, did you read the post? It is full of profanity and name calling.

“Full of profanity and name calling”

I said shitty. No other swearing and no name calling. What exactly are you reading?

Can you elaborate on the uproar?

It was pretty much this scenario years back, as a result of that exact same scenario being used by bad actors.

The real thing happened, was detected and shut down. Then they did some trainings over the course of a year, and had us test the same thing again next year. Results were not particularly good, and people got upset that they did not receive the promised Christmas gifts.

Afaict, these trainings stop being effective at around 10%. That is, 10% of all people being phished like this will do everything you tell them to. Up to and including sending your their password and installing malware on their machines following your e-mail instructions.

Reply on news.ycombinator.com