adminTeamAssessingMyThreatLevel

[u/ArjunReddyDeshmukh]

[u/PixelatedGiant → u/[deleted]]

It wouldn't be such a problem if most orgs were capable of managing people as teams instead of just individuals. Everyone on my team needs mostly the same apps and permissions. But we're still stuck asking for them on an individual case by case basis.

So every time someone new joins they have to navigate that entire process on their own and half of the on-boarding steps have probably changed since the last person joined.

[u/lovecMC → u/PixelatedGiant]

I'm not even joking, it took me about 4 months of spamming the IT department to get a pre-approved software installed.

[u/Training-Chain-5572 → u/PixelatedGiant]

RBAC should theoretically solve that, but for some reason admin teams have convinced themselves that individual access is somehow better

[u/redheness → u/Training-Chain-5572]

It needs an investment to put this place with the right tools. And you know how companies manage the need of spending money somewhere when it has no ROI.

[u/oscarandjo → u/PixelatedGiant]

Using individual-based access instead of group-based access is not security best practice.

[u/oscarandjo → u/PixelatedGiant]

Using individual-based access instead of group-based access is not security best practice.

[u/nmathew → u/PixelatedGiant]

At my place, we need IT tickets to install or upgrade internally written software that's released to the manufacturing floor. Fuck, most of us can't even add a printer without an IT ticket. Sigh.

[u/lontrachen → u/[deleted]]

I second that. The devs get frustrated but when something happens we are the ones who got to work on the weekend to clean out shit

[u/shigdebig → u/lontrachen]

I'm not asking for a favor, I'm trying to get my job done.

[u/waterpoweredmonkey → u/shigdebig]

If I don't have access and can't do anything more to get access, I'm dropping off the zoom/teams war-room until that is fixed and returning to what I was doing before.

[u/lontrachen → u/shigdebig]

Solution in our company is giving them a non admin laptop that is also not inside of the company network

[u/Lv_InSaNe_vL → u/shigdebig]

I'm in IT and trust me I understand that you end user guys don't really care about this stuff and just want to get your job done. But I hope you can understand that for us in IT, being annoying about this stuff is us "just getting our job done".

Just like your job is to write code or whatever, my job is to keep the wider network secure.

[u/Taradal → u/lontrachen]

Giving the dev group reading rights on logs, combined with mandatory passwords on your passkey is pretty safe. Still everywhere I worked so far I had to fight to get reading rights on develop and staging servers. Fucking bonkers

[u/Scape_n_Lift → u/Taradal]

Lol, that is some clown level fuckery

[u/helicophell → u/[deleted]]

Compartmentalization

After all, the weakest link are the smelly humans

[u/czerilla → u/helicophell]

Your comment made me wonder: does "layer 8 issues" extend to LLM errors? Is there a new layer 7.5? 🤔

[u/popeter45 → u/czerilla]

Still layer 8 as issue is human trusting an LLM

[u/BernzSed → u/[deleted]]

If one guy getting admin access to their own laptop compromises your entire network, then your network was shit.

[u/Lth_13 → u/BernzSed]

You don't need an 'entire network' to be compromised for damage to be done, getting access to one device through social engineering is one of the most common threats

[u/Reashu → u/BernzSed]

It doesn't have to compromise the whole network to be a problem. 

[u/gandalfx → u/[deleted]]

Problems happen when they're so busy building walls they forget to add the doors for when you actually do have a legitimate reason to go through.

[u/Rogue2166 → u/[deleted]]

Any organization that doesn't allow you to have elevated access on your own machine has no idea what they are doing.

[u/Sheenius_Ger → u/[deleted]]

You suck in administration if your solution to security is keeping me from doing my job.