When you work for a company, the computer issued for your use is not your computer. It belongs to the company.
Modern threats often target the user, and often through the web or email. The user is the target.
Of course no one who reads hacker news would ever have the same browser logged in with root/admin rights to a company system, and in the same session also be downloading and installing stuff, and browsing to sketchy web sites, and clicking on legit-looking phishing mails. Not to mention that they wouldn’t be doing local development but have a shared component with the production system because it’s not practical to make a staging version of the production service that acts like production. And certainly no one here would ever disable monitoring software, or write a cron job that resets a managed setting to a more palatable one every time the corporate security team enforces a value.
But believe it or not we see that sort of stuff Every. Single. Day. in infosec.
If you can’t stand not having full control over every aspect of your computing environment; if your ego doesn’t allow it- then corporate IT work is probably not for you.
But the company has to protect its interests as well, and often that includes setting stuff that makes your life less convenient or violates your ideas that you should be master of your computer. And sometimes there are reasons that you cannot know (like regulatory requirements or consent decrees) and you place the company at significant financial risk if you try to evade those policies.
That said, there do exist business that act like big brother - installing essentially managed spyware on your computer. The best thing to do there is resign.
But most businesses are just trying to do due diligence in protecting their systems and data (and users), and most users don’t need root access, and many users who think they need root access really don’t, even though it’s convenient.
> or write a cron job that resets a managed setting to a more palatable one every time the corporate security team enforces a value.
You write as if those are things one should feel guilty for. I proudly admit that I have done such things.
In my experience, whenever this happens, whenever the user goes above and beyond to do such things, the security team should revisit their values rather than the other way around.
Never ever it happens. Feedback is given. Stupid policies remain. At best you get some acknowledgement that they also realize it is stupid but it is what it is. As the tone of your post shows, the security guy thinks they are bestowed a divine power to restrict without fully understanding the trade-offs. That puts the user in an adversarial position with the security team. Stallman's philosophy ultimately sides with the user.
> In my experience, whenever this happens, whenever the user goes above and beyond to do such things, the security team should revisit their values rather than the other way around.
It may not be the value of the security team, but the values that are part of a cyber-insurance policy, or regulatory regime, and thus outside of what the security team are able to change.
Perhaps the user, at times, does not understand the larger context, and the risks that he is exposing the organization to.
If some security policy is only required for compliance and the security team agrees, the security team should do the bare minimum and look the other way smiling when the users circumvent that policy. Same with a good legal team.
I worked for a small legal company decades ago. I used a reverse ssh tunnel to administrate a Windows box remotely with Remote Desktop. Then I realized that I was circumventing a firewall. At a different company I had to be careful about such things. So I decided not to show this little hack to my boss. When a problem cropped up before going on commute I just logged in to the system from home and fixed the problem. Then at the box my boss asked me how long would I need to fix the problem and I said, I don't know. I rechecked my solution and after fifteen minutes I told him that all is well.
This story shows that Corporate's way to restrict user power can cause real inefficiencies.
And I am happy that I don't need to work for Corporate today.
When you work for a company, the computer issued for your use is not your computer. It belongs to the company.
Modern threats often target the user, and often through the web or email. The user is the target.
Of course no one who reads hacker news would ever have the same browser logged in with root/admin rights to a company system, and in the same session also be downloading and installing stuff, and browsing to sketchy web sites, and clicking on legit-looking phishing mails. Not to mention that they wouldn’t be doing local development but have a shared component with the production system because it’s not practical to make a staging version of the production service that acts like production. And certainly no one here would ever disable monitoring software, or write a cron job that resets a managed setting to a more palatable one every time the corporate security team enforces a value.
But believe it or not we see that sort of stuff Every. Single. Day. in infosec.
If you can’t stand not having full control over every aspect of your computing environment; if your ego doesn’t allow it- then corporate IT work is probably not for you.
But the company has to protect its interests as well, and often that includes setting stuff that makes your life less convenient or violates your ideas that you should be master of your computer. And sometimes there are reasons that you cannot know (like regulatory requirements or consent decrees) and you place the company at significant financial risk if you try to evade those policies.
That said, there do exist business that act like big brother - installing essentially managed spyware on your computer. The best thing to do there is resign.
But most businesses are just trying to do due diligence in protecting their systems and data (and users), and most users don’t need root access, and many users who think they need root access really don’t, even though it’s convenient.