No, security professionals should find adequate solutions to a changing technological (and the corresponding sociological) landscape.

Just saying "No" without investigating alternative solutions to satisfy the spirit of the request is likely the problem.

It's also apparent that there was no routine security auditing which may have caught Clinton's behavior. I'm not sure you can claim the NSA was acting with security in mind when it's quite evident she was walking around with a blackberry every day in "Mahogany Row'.

Because when "we" can't do something it's for reasons that are varied, nuanced and entirely justifiable.

When "they" can't do something it's because they are malicious lazy idiots. Obviously.

It's illuminating how someone treats other professions that intersect with their own. If one security team acts in a way you disagree with fine. But if you view all security teams as inherently obstructionist, then that tells me you are self-centered or cut corners. Similar if you always have problems with HR, Accounting, etc...

Probably a combination of:

A) People seeing this play out in their own lives enough to relate it to this experience B) That the quote wasn't "No", it was "shut up and go color", lmao

If you re-read that portion of the article, the State Department rep used that phrase to paraphrase the NSA's response. That was not the actual response; nobody who wants to keep their job communicates inter-agency like that.

I think he means, if you tell somebody that you can't do something that's technically possible, they will find someone who can and will do it.

They did it for the previous administration but refused to do it for her and offered no good alternative. She couldn't fire them and replace them and with someone more capable, so her team found an alternative.

This is exactly how a person who is used to getting shit done would operation. You either break down obstacles or you go around.

Just to be clear, in this case "getting shit done" meant recklessly creating a massive security breach at the highest levels of the government.

During a period of time when government insiders were leaking damaging classified information on the internet.

I can see how she would consider her actions to be the lesser to two evils, at least she could trust her people.

That's the equivalent of someone who sees a bunch of broken windows in the neighborhood and therefore figures it's okay to toss a beer bottle out the window of their car.

Mind you, I could see that being her thought process, it's very human. But it is hardly a ringing endorsement of her behavior and principles, to say the least.

And that's how you open up security holes that people can breach. People who do such things should not be commended.

Welcome to the downside of disruption.

No, he's saying if you work in a department that has been given the power to oversee security at your organization, then your job is as much to service your customers (the other departments) as much as it is to ensure their safety. Trying to use that position as a means to be change-averse or to power-play is just going to ultimately lead to people finding another way.

There's also a real line between ultimately flaunting the rules and "just trying to get your job done" in these kinds situations. Obviously if you're imperiling classified secrets that distinction will not apply to you. But for most other people this is just an item in the toolbox for effecting the change you want to see, lol.

I would hope security's main concern is security, not making people feel happy about their preferences. If a person can show that it is a power-play then those security people are failing at their jobs, which is a different matter. So far I've only seen speculation that this situation was politics.

There are a lot of situations in life that end up having come down to "do you want to be right or do you want solve the problem?"

If you're a security professional who doesn't spend a fair amount of your energy making your users happy, you're failing at your main job of ensuring security, for exactly the reasons on display here. Security doesn't end when you've sent out the memo outlining your policy.

So back in the real world, no one's job is ever to go "do the best for the best's sake", outside of maybe academia. That's not how people work together, and as you get into more heavily politicized environments, the more true that is.

And we wonder why we see so many companies and government agencies failing at security.

It's a very high standard to force a user to change his password every 24 hours. It also guarantees this user will write it down on a post it next to the screen. Security professional should think also in term of practicality.

I was trying to enter a 26 characters wifi passcode when setting up a new MacBook recently (so without access to clipboard). All characters hidden, not even certain the keyboard was set up with the right region. It might be secure but the guy who designed this step of MacOS should still be fired.

I've worked in an environment where it'd be impossible to do your job if you didn't ignore IT.

I've posted about this before on here - "It was worse at $last_company where at my best count, I had 20+ different passwords, all with differing rules, and expiration policies, the solution in the end was a spreadsheet (contrary to IT policy) - which was stored on my workstation with full disk encryption."

If you have a choice between loosing 8 hours a week just to information access management or just ignoring the rules, which one would you pick?

Document and lose the 8 hours/week. Its not your 8 hours.

When you're a contractor, you often dont have that advantage - if for example all of your co-workers (and managers) violate policy in the same way, you're left being the odd man out, which does not bode well for your employment future. That said a large amount of "I cant because I'm locked out" was tolerated - if for no other reason that managing the account circus was too much for any one person.

I'll go against the grain and say yes.

The difficulty with the best protocols as designed by security professionals is that they are not necessarily designed based on how users actually work. And if they are not, it is likely that users will subvert them. This paper from 2010 is along those lines, "The True Cost of Unusable Password Policies: Password Use in the Wild" (http://www.cl.cam.ac.uk/~rja14/shb10/angela2.pdf).

I particularly like two of their observations from the introduction:

"Based on our results, we make three key observations:

1. When users cannot cope with the demands of strict password policies, it a) reduces their productivity, and b) leads them to adopt coping strategies - which usually reduce security.

2. Although passwords are usually considered in terms of authentication for a service or a device, today they are encountered in many other ways in the workplace – and existing password policies do not cover these. As a result, users adopt ad-hoc solutions, which are usually insecure."

The security we actually get is the result of the technology we use, and the human behavior that interacts with that technology. Sometimes, in order to get higher actual security, we may need to relax the technological security so that we get the human behavior we want.

I think he is saying that often people have a legitimate need and security professionals should try understand these needs and not just say "No".

In my company IT puts all kinds of restrictions on the network but for automated testing we need these restrictions removed or we can't do our job. Since IT didn't accommodate us or provide an approved workaround we had to hack around them and make the system less secure as a consequence.

The point is the security professionals exist in order to facilitate the needs of the users they serve, not the other way around. It's always easier to just say no, but a good security professional knows how to assess risks, find creative ways to mitigate them, and serve the needs of the user to as great an extent possible without compromising security.

If you say "yes" rather than "no", you become involved in the process of implementing the system and can provide security fixes and mitigations. If you say "no" they they probably do it anyway, stick it in Digital Ocean, and never tell you about it. It stops getting patched when they leave the company. Years later, someone kicks the door down and finds it littered with your IP.

Of course they were wrong to go through unofficial channels, but as a security professional, you don't plan for things to happen as you expect. You plan for things to go wrong, and you plan so they go wrong less.

> Must be nice to have a high enough position in life to ignore security protocols at whim. If I did that I would be fired.

Ivory towers take a stain too easily, so I only summer there. The rest of the year I stay on the ground with you commoners.

"Must be nice to have a high enough position in life to ignore security protocols at whim. If I did that I would be fired."

Only if you get caught, usually by (losing the device and having to tell everyone|getting a virus or what-not that noticeably impacts some other system). Which is sufficiently rare that you can get away with "it won't happen to me" for an arbitrary period of time.

I think most companies (large and small) are unwilling to dismiss c-suite executives on the word of a security professional in their IT department.

And we wonder why we see so many companies and government agencies failing at security.