70

Summary: I worked for a small startup, that was acquired by a mega corporation. Its IT security policies are excessive, but they don't add more security, and prevent me from doing work. How do I change that?


First some context: the startup (let's call it Tinyco) I worked for was bought last year by a large (thousands of people) tech oriented company (let's name it Megacorp for easier identification) with offices around the world. I lead a development team in said company. Part of my duties when we where still Tinyco included a lot of security related work & I'm proficient in said subjects but since the sale those duties have been delegated to Megacorp's dedicated information security team. Due to the nature of my position I'm still involved in a lesser capacity in security related issues.

The problem is that Megacorp's information security team seems to be obsessed with doing two things: to say no and to limit everything to which they don't say no to a level that is equivalent to saying no. For example:

  • We are required to use a single sign-on (SSO) solution. In itself it's a good idea, but the problem is we are required to use multiple SSO solutions. To be clear there is no technology reason for that; it is simply multiple accounts on the same SSO provider, each used in a different place.
    • This negates all the security benefits of SSO while increasing complexity, meaning you have more passwords to keep track off and have a higher chance of forgetting one/reuse them/have one cracked.
  • The information security team refuses to provide a self service password reset ability, instead requiring all passwords reset be done via IT tickets. They ignore the fact that opening an IT ticket requires the password that is often the one you need resetting, leading to a chicken and the egg problem quite often that's only resolved after the person needing the password resets asks his boss (or his boss's boss) by phone and have them work the office bureaucracy.
    • As a result, IT is now used to having people requesting password resets for other people, not a good security practice.
  • We have recently been told all work laptops will be configured to require two-factor authentication (the user's phone in this case) to login into them. Once again this sounds like a good idea, but when asked "what do you do if your phone breaks/lost/stolen and can't log in to your laptop?" their answer is "open a ticket for it". When asked again making sure they understand that you can't open a ticket for it as you can't log in without your phone and you can't contact anyone to open a ticket for you in person (due to COVID-19, we're all working remotely) and you can't call anyone (as you lost your phone), their answer was "we put a lot of thought into it" and they refused to state how an employee should notify them of the issue in that case.
    • If my phone is stolen with company data, I don't have any way of letting anyone know it needs to be remotely wiped and I can't log into my laptop to do it myself as a result.
    • In multiple cases they refused to make network changes, etc. for "security reasons" even though they couldn't explain why those changes pose any risk.
    • This just forced everyone to go in a roundabout way that is often less secure as the job still needs to happen.
  • There are many more cases. These are just a few random examples off the top of my head.

I tried talking to the information security team leader multiple times about it, but he just keeps saying that "we're required by insert random security standard here to do so" even though the majority of the things I mentioned above (and brought up to him in said talk) are not part of any security standard he mentioned.

I'm seriously at a loss as to what to do anymore as this is negatively affecting my work. I counted more than an hour just today only dealing with security related limitations and that's not unusual or rare which is considerably more than what it was when we where Tinyco and at the same time it feels considerably less secure. How do I get the information security team to see that?

  • 1
    Comments are not for extended discussion; this conversation has been moved to chat. – Neo Aug 12 at 13:47

10 Answers 10

127

Unless you're senior management, there's realistically nothing you can do to influence policy at a mega corporation, and the enforcers you're able to talk to can't change anything either.

Unfortunately, your choices are to either accept living with whatever BS they come up with, or to look for a less Dilbertesque employer.

Experiences like the one you're currently enduring are one side of why many people work almost their entire career in companies of a similar size. The other half of that equation is people who like the big company way of doing things, not being able to handle the freewheeling chaos of a small company.

| improve this answer | |
  • 14
    Indeed, and the change in culture is most jarring for someone who's used to working in a startup with a strong just-do-it attitude. Your megacorp clearly values obedience to policy over getting things done; you either learn to live with it and become another just order-taker until you've worked your way to the top, or move on. – Julia Hayward Aug 10 at 20:47
  • 44
    +1. This is why startup people often bail after buyouts. Big corps buy small ones because they suck and don’t innovate any more. Now you’re on that side of the wall. Kick against it some of you have to stay due to golden handcuffs but otherwise it’s new startup time. – mxyzplk - SE stop being evil Aug 10 at 20:56
  • 6
    @mxyzplk-SEstopbeingevil your so right about the golden handcuffs, I would have ditched a long time ago if it wasn't very financially advantageous for me to stay for a few more years – cypher Aug 11 at 9:43
  • 1
    @Michael you can also scream into the void, and it will do as much good. If the polices that senior management has put in place favoring X over Y are something that's affecting a large portion of the work force, senior management is already aware and has decided X is more important to the company than Y. Complaints from a new hire at the minion or junior management level will accomplish nothing unless you're persistent enough in making them to get labeled a trouble maker. – Dan Is Fiddling By Firelight Aug 11 at 14:17
  • 9
    @cypher "Rest and vest". Or, stolen from some comment on here that I've forgotten, "I used to think Dilbert was a satire. Now I know it's a documentary." – user3067860 Aug 11 at 15:16
87

You're complaining to the wrong people.

You're coming from a start-up, so I assume two things:

  1. Your company was bought, because of the expertise of its employees. Normally start-ups have very little manpower compared to Megacorp. So Megacorp could easily copy your product in a short time, but they don't, because they would always be a step behind.
  2. Employees of big companies think they know better, because they working for a big company and you didn't. So your expertise and processes will be ignored.

If you're trying to bring change from bottom up, your working culture will dissolve in the bureaucracy of Megacorp.

Escalate to your manager

You need support to protect your way of work, therefore escalate the problems to your manager. Don't make it about us versus them, but clearly show the impact. No sugar coating, no "I can make it work" or similar allowed. You are not in a position to fix this on your own.

Best case would be if Megacorp agrees to try a new approach and adopts your ideas. Second best is that you can buy some time during which you can work independently until "things are sorted out".

Keep pressing

Don't expect immediate changes. The standard approach in Megacorp is to setup a meeting, discuss the issue, make a plan and then forget everything, because they have other high priority tasks. This might create the opportunity to take the lead by helping out the busy official lead.

If you really want to change something, you need endurance. So be sure about your motivation, else you might later feel that you wasted your time.

| improve this answer | |
  • 36
    THIS is exactly how to do it. Push it up to the people who can do something about it. Once management can $how the effect$ of the$e policie$ on the revenue $tream, megacorp will get the me$$age. We are in a similar situation right now. – Old_Lamplighter Aug 10 at 22:04
  • 5
    This. In particular, the key thing here is documenting the effect on the bottom line: How many hours/week are wasted on this. The other aspects (making things less secure rather than more) are much, much harder to push because no one wants someone outside their team telling them they're doing their jobs wrong. But it can be framed as a question of risk management: is the risk (employee loses phone, can't call, can't sign in to tell someone) worth the security benefit (which is their decision, not the OPs). Then you get into risk mitigation: Making sure employees have a phone number... – T.J. Crowder Aug 11 at 12:11
  • ...that isn't just on their phone that they can call from someone else's phone to raise a flag about the lost phone (and get access to their laptop), probably by quoting some kind of specific-to-them PIN they memorize. – T.J. Crowder Aug 11 at 12:12
  • @T.J.Crowder do you remember your boss phone number by heart so you can call him in case your phone is lost? I sure as hell don't... I keep it on my phone with backups to the cloud that's accessible from my laptop... both I won't be able to use in cases my phone is lost/damaged/stolen – cypher Aug 11 at 13:10
  • @cypher - No, I don't; most people don't. Which is why I said the mitigation would be "making sure that" employees have a number "that isn't just on their phone". Because people won't do it otherwise. Some IT departments have a phone number they affix to the laptop itself for this kind of purpose as well as the "please call if found" purpose. The point isn't the mechanism, it's the fact that explicit risk mitigation is required. – T.J. Crowder Aug 11 at 13:13
15

When filling in your timesheets (because you are now working for big megacorp I assume you have to do this now) be sure to register all the hours you were not doing any actual work but were being busy with the issues you mention. It certainly won't solve your problems immediately but if something is actually done with these timesheets maybe someone up the chain will notice and take action.

| improve this answer | |
  • 8
    I don't think most timesheet systems allow to use custom codes, so, except if you use a code that you are not supposed to use or overbook on some code, it is likely to get unnoticed. – Didier L Aug 11 at 11:27
  • Tinyco might have had freetext time reporting (if at all), but megacorp almost certainly has fixed time codes with no such flexibility. – Jacob Raihle Aug 11 at 12:19
  • 20
    Having done this, it's most likely to get your immediate manager to ask you to only book to specific approved codes, since the codes you're booking to don't have budget attached. The issue will not be escalated any higher than that. Timesheets are always lies, and always reflect the budget allocated to projects, rather than the actual work done. – James_pic Aug 11 at 12:45
  • Timesheets are generally required to reflect 'billing' of effort towards objectives, including all kinds of 'overhead' activities (meetings, tech issues, etc) that were required. There should be no such thing as "all the hours you were not doing any actual work" because, for example, if these 'security' measures mean that it took you four hours to make a (what should be) a five minute change, then the timesheet must reflect that the change 'cost' four hours, these hours were actual work that you needed to do to make that change happen. – Peteris Aug 12 at 11:15
15

I , myself, have been working in the cybersecurity profession for about close to 7 years. I agree with you that the security controls you mention, such as single sign on (SSO) and multi-factor authentication, (MFA) are a good idea when properly deployed.

I would begin by acknowledging that proper security is critical and that the security controls you mentioned are a good idea in theory. Start the conversation on the topics of agreement - that of the "what". This will show, you, as a security professional, are not against the idea of proper level of cybersecurity. Where it appears you disagree on , is how these security controls are implemented

As you appear to be in a technical role, I would fall back on your technical expertise to elicit the changes you desire. Show them how a proper SSO provider with the various identity protocols (e.g: SAML) is supposed to work. Show them the possible attack scenario in which a threat actor, such as a malicious IT employee, can compromise the account of another user and then impersonate him / her, using the current, broken password reset process. Ultimately, you want management to be absolutely clear that your concerns have real tangible consequences that adversely impact you getting work done. Being able to demonstrate your concerns are actually realizable, and not just fanciful, is critical.

| improve this answer | |
  • 6
    You might even be able to demonstrate those tangible consequences, if you can convince management to let you white-hat "hack" the system. "Hand me your laptop? Let's pretend that I was a malicious employee who stole it." – nick012000 Aug 11 at 11:21
  • Closest I got to this was an email I once sent to corporate security saying "I got this email claiming to be from corporate security and asking me to do XXXX. That doesn't seem very safe because YYYY. Did the email actually come from you, or was it from some hacker? And by the way, for next time, how would I know that emails claiming to be from corporate security are genuine?". – Michael Kay Aug 12 at 9:08
8

Document everything. How much time you're spending on 'X' or'Y' or 'Z'. Put everything into business terms - how much time is being spent and what this is costing the business.

You will not be able to make quick changes. Large organizations are like a battleship that takes forever to change directions.

| improve this answer | |
8

You are discovering what it's like to work in a large enterprise. The issues you describe will continue until the executive who oversees the security team, and the architect for that team, both agree that there is a problem, get a funded project to solve the problem, and are able to roll out a solution over the course of several months at least.

So get used to your situation, because it's going to be like that for a while, no matter how right you are. In the meantime, don't make yourself a pain in anybody else's rear. That would be a great way to limit your prospects for promotion or even lateral changes in role at MegaCorp.

Instead, find a challenge you want to solve, that management wants you to solve, and accept that challenge and go after it. The security policies are just part of the environment you have to operate in. If they cause you problems, make sure your stakeholders know about them and how you intend to work with them. And then move on.

| improve this answer | |
  • Those issues are not specific to large enterprises, startups can and should have also strict password reset procedures, role separations and the need to avoid password authentication. – eckes Aug 12 at 9:40
  • 2
    @eckes while startups may have the same problems, the space of feasible solutions and possibilities for organizational change are completely different. In a small organization you should be able to discuss and fix any flaws in policies affecting you, in large organizations often (depending on your role in the hierarchy) it won't be possible. – Peteris Aug 12 at 11:20
7

In most cases, you can't.

These "infosec" people are paid, praised and promoted for not having breaches that are traceable back to their own failures.

Breaches in general are not bad for them - as long as they can shift the blame to someone else. What's more, they can abuse the breach to get more budget and more power.

Halving (or worse) everyone else's prodictivity is not their problem. The upper management usually swears off the next "security measure" imposed on everyone and gets the policy relaxed for them. They don't see the burden of complying with everything at once. The ordinary employee doesn't have the same luxury and the productivity suffers from the boiled frog effect.

| improve this answer | |
  • 6
    "Breaches in general are not bad for them - as long as they can shift the blame to someone else." - I wonder if that's why the infosec guy at work fulminated once when I sent him information by email showing that the state security services had deprecated the use unreasonably complex passwords with constant changes, which he was looking to implement, as they reduced security and forced people to use patterns or write them down. At the time I took it as pure arrogance, but in hindsight perhaps it's because I'd put on record and in writing something which would prevent him blaming staff later. – Steve Aug 11 at 14:28
  • 1
    @Steve That is still arrogance; just of a different kind. – employee-X Aug 11 at 20:37
3

Don't get me wrong, I'm a developer too and I've worked in organisations like this myself but you stand very little chance changing things (In my own experience you may be able to make small changes but generally, you won't be able to make fundamental changes) so either learn to live with it or maybe find something else more to your liking.

Large companies tend to have restrictive security policies in place because the financial penalties of getting it wrong are so severe. As well as the threat of malicious attacks, depending on your particular industry there may be extremely heavy regulatory penalties for security breaches.

Organisations care about making money and disruption to the day of a software developer is preferable to, say paying a bazillion dollars in ransomware.

| improve this answer | |
  • 1
    At a megacorp I worked at I was told we couldn't move from a well known but pointlessly expensive and out-of-date database solution to a more modern open source one because "if we get sued, a judge will more likely side with us if we use X but penalize us if we use Y" was the answer I got. – shaunakde Aug 11 at 20:58
1

I am a believer in going as high as possible and to the most benevolent person you can find.

Be aware when using internal email that someone almost certainly is monitoring it. I would approach via the PA of the person, with a simple short printed memo showing the proposed point you want to make. Copy it to the requisite people before you send it so you are not going behind their backs. If they object then say, "Look this is important and we're not getting anywhere. Unless someone takes notice I'm going to have to go higher up."

Here's what I might write:

Dear VIP

I understand that TinyCo was taken over because of the expertise we have in security, however there is an area in which this expertise is not yet being fully used.

Specifically there are one or two important security requirements that need updating for today's world. However I have run into legacy rules inherited from MegaCorp that prevent me from pushing these measures forward. Not only would they improve data security but they would save considerable time and money in my opinion.

I wonder if you would consider putting me in touch with a Megacorp security expert so that I can formally submit these ideas and we can report back to you?

Sincerely

cypher


What this does

It brings it to the important person's notice without creating any work for them.

The only MegaCorp security expert they will know by name will be the top guy/gal. All the VIP has to do is send them a message saying, "Please look into this and report back." Then it is off their desk.

Warning

At no time must you bombard the VIP with technical talk about SSO or IT tickets - They probably have no idea what these are. If they are technically-minded then they can ask you for a technical summary if they want it.

What could go right

  1. You could end up greatly accelerating your career if your suggestions turns out to save the company a lot of wasted time and money. The VIP now knows your name.

  2. It sows the seed in the big corps mind that you are not a junior lackey but that you are an equal whose ideas count.

  3. It may even lead to MegaCorps people having to consult you before they proceed with anything new.

What could go wrong

I don't think there is much risk because if the VIP ignores you or just says "Speak to your immediate boss", you haven't lost anything. If however the VIP is benevolent and clever and facilitates you - no-one is going to argue.

Disclaimer

Every action or inaction has risks and consequences. I personally don't think there is a downside to my suggestion but you have to weigh up any risks for yourself. Is years of frustration better than taking a slightly risky action?

Random thoughts

Maybe don't use a private memo but avoid going over anyone's head by telling them you are going to communicate directly to the VIP because there is no progress currently because of rules. Again, if they object, say "But this is really important and we're not getting anywhere." If they still object then take the moral high ground, "I'm sorry but the current situation is costing the company time and money. I wouldn't be doing my duty if I didn't challenge it. I have no option"

Never blame a person or department - You are not trying to get people into trouble. Always lay out the benefits and improvements your scheme will provide.

| improve this answer | |
  • 1
    Doing this is a very long shot, but you would improve those odds considerably by attaching a calculation for lost time & money. For example, how many people need password resets, how much time is wasted (people unable to work) whenever one is needed, and what's the cost of that time in engineer-hours? – lambshaanxy Aug 13 at 1:13
0

Get ready to talk to management and security guys.
But first of all, make sure to talk with everyone with the "language" they understand most.

Talk "time and money" with your higher management. Don't talk much about how/why it is insecure. They may not be concerned with it. Management is more concerned about how much time/money it costs or how much is lost - and that's how you should talk. To prepare for it, answer these questions first.

  • How much time it takes from you per month? (include the "blocked" time too)
  • How much time it takes from the team (or organization) per month?
  • How much work can be done instead of it? (e.g. tasks, features, story points)

If the time/month is very little, perhaps its better not to go for it.
But if it's noticeably big and/or blocks the team - go for it!
Make sure to translate the time into visible units of work or money, before talking to your managers.
For example: Issues are seen by each member of team once a month. It takes 2-3 hours to fix. If team has 10 members, that would do 20-30 hours per month, which is 2-4 full work-days. So it can be translated into:
"Team loses 3 full work-days per month for being blocked on these issues."
"We can implement 5 more higher-priority features per month if we don't have these issues."

Talk "security" with your security leads. Don't talk much about how inconvenient it is for you or your team. They may not care, security is not about convenience. They are concerned of how secure/insecure it is, how less (or no) work they should do to overcome it.

  • Research for solutions. Write down the issues. Then research each of them and prepare solutions (in your mind, or written) of how it should be done. You need to have a clear representation of which issues you want to fix and how they can be fixed in order to have constructive conversations.
  • Estimations. If possible, count how much time it will take to implement each fix. If possible, consult with mates who are good in security (in your team, or in other corps) If the implementation time is little, less than the time it takes from you/team (per month), then use this point in your conversations. Make sure the estimations are realistic. It may become a decision-bending argument.

Arrange meetings. Talk with manager, security team, then arrange meeting with involved parties. In the end it will all boil down to these questions: "How much will it cost?", "Is it worth the cost?", "Will we gain more business value if we do it?". Be ready for these questions. And if it's definitely worth the cost, the management will start pushing the security team after a while.

After this all, you will need patience. Be ready to go through the steps above few times. Also,

  • Keep counting statistics. Write down the time you (or teammates) are blocked - in your notes and in reports. You will need it in your next talks. As soon as you have got enough "numbers", your proposals will start to get noticed. The opposite is also possible - you may notice that from business-perspective it's not worth the "cost" (depending on the issue).
  • Don't go "against", go for "fixing it". Don't use destructive blames and complaints. Such acts are seen as indicators of incompetence, non-professionalism, may negatively impact your career.
  • Keep raising it - consistently, constructively. The change won't happen the next day. It may take months depended on your corporation size.

In the end, if you succeed, it will be seen as an act of leadership and will positively impact your career. Don't forget to share the results in few months :)

| improve this answer | |

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .