Summary: I worked for a small startup, that was acquired by a mega corporation. Its IT security policies are excessive, but they don't add more security, and prevent me from doing work. How do I change that?
First some context: the startup (let's call it Tinyco) I worked for was bought last year by a large (thousands of people) tech oriented company (let's name it Megacorp for easier identification) with offices around the world. I lead a development team in said company. Part of my duties when we where still Tinyco included a lot of security related work & I'm proficient in said subjects but since the sale those duties have been delegated to Megacorp's dedicated information security team. Due to the nature of my position I'm still involved in a lesser capacity in security related issues.
The problem is that Megacorp's information security team seems to be obsessed with doing two things: to say no and to limit everything to which they don't say no to a level that is equivalent to saying no. For example:
- We are required to use a single sign-on (SSO) solution. In itself it's a good idea, but the problem is we are required to use multiple SSO solutions. To be clear there is no technology reason for that; it is simply multiple accounts on the same SSO provider, each used in a different place.
- This negates all the security benefits of SSO while increasing complexity, meaning you have more passwords to keep track off and have a higher chance of forgetting one/reuse them/have one cracked.
- The information security team refuses to provide a self service password reset ability, instead requiring all passwords reset be done via IT tickets. They ignore the fact that opening an IT ticket requires the password that is often the one you need resetting, leading to a chicken and the egg problem quite often that's only resolved after the person needing the password resets asks his boss (or his boss's boss) by phone and have them work the office bureaucracy.
- As a result, IT is now used to having people requesting password resets for other people, not a good security practice.
- We have recently been told all work laptops will be configured to require two-factor authentication (the user's phone in this case) to login into them. Once again this sounds like a good idea, but when asked "what do you do if your phone breaks/lost/stolen and can't log in to your laptop?" their answer is "open a ticket for it". When asked again making sure they understand that you can't open a ticket for it as you can't log in without your phone and you can't contact anyone to open a ticket for you in person (due to COVID-19, we're all working remotely) and you can't call anyone (as you lost your phone), their answer was "we put a lot of thought into it" and they refused to state how an employee should notify them of the issue in that case.
- If my phone is stolen with company data, I don't have any way of letting anyone know it needs to be remotely wiped and I can't log into my laptop to do it myself as a result.
- In multiple cases they refused to make network changes, etc. for "security reasons" even though they couldn't explain why those changes pose any risk.
- This just forced everyone to go in a roundabout way that is often less secure as the job still needs to happen.
- There are many more cases. These are just a few random examples off the top of my head.
I tried talking to the information security team leader multiple times about it, but he just keeps saying that "we're required by <insert random security standard here> to do so" even though the majority of the things I mentioned above (and brought up to him in said talk) are not part of any security standard he mentioned.
I'm seriously at a loss as to what to do anymore as this is negatively affecting my work. I counted more than an hour just today only dealing with security related limitations and that's not unusual or rare which is considerably more than what it was when we where Tinyco and at the same time it feels considerably less secure. How do I get the information security team to see that?
And now the infosec team opened over 6000 Jira tickets (tasks) for my team to handle, that's not an exaggeration, they seriously opened over 6000 different tasks they expect my team of 2 to be able to handle... what the beep is wrong with them?
ping(ICMP) to an internal network for debugging purpose is somehow a security risk (just one of many many examples)