How can I get an information security team to see that their over-the-top security measures are only decreasing security?

Question

Summary: I worked for a small startup, that was acquired by a mega corporation. Its IT security policies are excessive, but they don't add more security, and prevent me from doing work. How do I change that?

---

First some context: the startup (let's call it Tinyco) I worked for was bought last year by a large (thousands of people) tech oriented company (let's name it Megacorp for easier identification) with offices around the world. I lead a development team in said company. Part of my duties when we where still Tinyco included a lot of security related work & I'm proficient in said subjects but since the sale those duties have been delegated to Megacorp's dedicated information security team. Due to the nature of my position I'm still involved in a lesser capacity in security related issues.

The problem is that Megacorp's information security team seems to be obsessed with doing two things: to say no and to limit everything to which they don't say no to a level that is equivalent to saying no. For example:

• We are required to use a single sign-on (SSO) solution. In itself it's a good idea, but the problem is we are required to use multiple SSO solutions. To be clear there is no technology reason for that; it is simply multiple accounts on the same SSO provider, each used in a different place.
  • This negates all the security benefits of SSO while increasing complexity, meaning you have more passwords to keep track off and have a higher chance of forgetting one/reuse them/have one cracked.
• The information security team refuses to provide a self service password reset ability, instead requiring all passwords reset be done via IT tickets. They ignore the fact that opening an IT ticket requires the password that is often the one you need resetting, leading to a chicken and the egg problem quite often that's only resolved after the person needing the password resets asks his boss (or his boss's boss) by phone and have them work the office bureaucracy.
  • As a result, IT is now used to having people requesting password resets for other people, not a good security practice.
• We have recently been told all work laptops will be configured to require two-factor authentication (the user's phone in this case) to login into them. Once again this sounds like a good idea, but when asked "what do you do if your phone breaks/lost/stolen and can't log in to your laptop?" their answer is "open a ticket for it". When asked again making sure they understand that you can't open a ticket for it as you can't log in without your phone and you can't contact anyone to open a ticket for you in person (due to COVID-19, we're all working remotely) and you can't call anyone (as you lost your phone), their answer was "we put a lot of thought into it" and they refused to state how an employee should notify them of the issue in that case.
  • If my phone is stolen with company data, I don't have any way of letting anyone know it needs to be remotely wiped and I can't log into my laptop to do it myself as a result.
  • In multiple cases they refused to make network changes, etc. for "security reasons" even though they couldn't explain why those changes pose any risk.
  • This just forced everyone to go in a roundabout way that is often less secure as the job still needs to happen.
• There are many more cases. These are just a few random examples off the top of my head.

I tried talking to the information security team leader multiple times about it, but he just keeps saying that "we're required by <insert random security standard here> to do so" even though the majority of the things I mentioned above (and brought up to him in said talk) are not part of any security standard he mentioned.

I'm seriously at a loss as to what to do anymore as this is negatively affecting my work. I counted more than an hour just today only dealing with security related limitations and that's not unusual or rare which is considerably more than what it was when we where Tinyco and at the same time it feels considerably less secure. How do I get the information security team to see that?

Edit/P.S.

And now the infosec team opened over 6000 Jira tickets (tasks) for my team to handle, that's not an exaggeration, they seriously opened over 6000 different tasks they expect my team of 2 to be able to handle... what the beep is wrong with them?

Answer 1

Unless you're part of senior management (typically at the level of being someone who reports directly to executives); realistically there's nothing you can do to influence policy at a mega corporation. The enforcers of policy that you're able to talk to can't change anything substantial either, so arguing with them won't accomplish anything except to possibly label you as a troublemaker.

Unfortunately, your choices are to either accept living with whatever BS they come up with; or to look for a less Dilbertesque employer.

Experiences like the one you're currently enduring are one side of why many people work almost their entire career in companies of a similar size. The other half of that equation is that many people who like the highly structured big company way of doing things, are unable to handle the freewheeling chaos of how many smaller companies operate.

Answer 2

You're complaining to the wrong people.

You're coming from a start-up, so I assume two things:

1. Your company was bought, because of the expertise of its employees. Normally start-ups have very little manpower compared to Megacorp. So Megacorp could easily copy your product in a short time, but they don't, because they would always be a step behind.
2. Employees of big companies think they know better, because they working for a big company and you didn't. So your expertise and processes will be ignored.

If you're trying to bring change from bottom up, your working culture will dissolve in the bureaucracy of Megacorp.

Escalate to your manager

You need support to protect your way of work, therefore escalate the problems to your manager. Don't make it about us versus them, but clearly show the impact. No sugar coating, no "I can make it work" or similar allowed. You are not in a position to fix this on your own.

Best case would be if Megacorp agrees to try a new approach and adopts your ideas. Second best is that you can buy some time during which you can work independently until "things are sorted out".

Keep pressing

Don't expect immediate changes. The standard approach in Megacorp is to setup a meeting, discuss the issue, make a plan and then forget everything, because they have other high priority tasks. This might create the opportunity to take the lead by helping out the busy official lead.

If you really want to change something, you need endurance. So be sure about your motivation, else you might later feel that you wasted your time.

Answer 3

I , myself, have been working in the cybersecurity profession for about close to 7 years. I agree with you that the security controls you mention, such as single sign on (SSO) and multi-factor authentication, (MFA) are a good idea when properly deployed.

I would begin by acknowledging that proper security is critical and that the security controls you mentioned are a good idea in theory. Start the conversation on the topics of agreement - that of the "what". This will show, you, as a security professional, are not against the idea of proper level of cybersecurity. Where it appears you disagree on , is how these security controls are implemented

As you appear to be in a technical role, I would fall back on your technical expertise to elicit the changes you desire. Show them how a proper SSO provider with the various identity protocols (e.g: SAML) is supposed to work. Show them the possible attack scenario in which a threat actor, such as a malicious IT employee, can compromise the account of another user and then impersonate him / her, using the current, broken password reset process. Ultimately, you want management to be absolutely clear that your concerns have real tangible consequences that adversely impact you getting work done. Being able to demonstrate your concerns are actually realizable, and not just fanciful, is critical.

Answer 4

When filling in your timesheets (because you are now working for big megacorp I assume you have to do this now) be sure to register all the hours you were not doing any actual work but were being busy with the issues you mention. It certainly won't solve your problems immediately but if something is actually done with these timesheets maybe someone up the chain will notice and take action.

Answer 5

In most cases, you can't.

These "infosec" people are paid, praised and promoted for not having breaches that are traceable back to their own failures.

Breaches in general are not bad for them - as long as they can shift the blame to someone else. What's more, they can abuse the breach to get more budget and more power.

Halving (or worse) everyone else's prodictivity is not their problem. The upper management usually swears off the next "security measure" imposed on everyone and gets the policy relaxed for them. They don't see the burden of complying with everything at once. The ordinary employee doesn't have the same luxury and the productivity suffers from the boiled frog effect.

Answer 6

Document everything. How much time you're spending on 'X' or'Y' or 'Z'. Put everything into business terms - how much time is being spent and what this is costing the business.

You will not be able to make quick changes. Large organizations are like a battleship that takes forever to change directions.

Answer 7

You are discovering what it's like to work in a large enterprise. The issues you describe will continue until the executive who oversees the security team, and the architect for that team, both agree that there is a problem, get a funded project to solve the problem, and are able to roll out a solution over the course of several months at least.

So get used to your situation, because it's going to be like that for a while, no matter how right you are. In the meantime, don't make yourself a pain in anybody else's rear. That would be a great way to limit your prospects for promotion or even lateral changes in role at MegaCorp.

Instead, find a challenge you want to solve, that management wants you to solve, and accept that challenge and go after it. The security policies are just part of the environment you have to operate in. If they cause you problems, make sure your stakeholders know about them and how you intend to work with them. And then move on.

Answer 8

Don't get me wrong, I'm a developer too and I've worked in organisations like this myself but you stand very little chance changing things (In my own experience you may be able to make small changes but generally, you won't be able to make fundamental changes) so either learn to live with it or maybe find something else more to your liking.

Large companies tend to have restrictive security policies in place because the financial penalties of getting it wrong are so severe. As well as the threat of malicious attacks, depending on your particular industry there may be extremely heavy regulatory penalties for security breaches.

Organisations care about making money and disruption to the day of a software developer is preferable to, say paying a bazillion dollars in ransomware.

Answer 9

I am a believer in going as high as possible and to the most benevolent person you can find.

Be aware when using internal email that someone almost certainly is monitoring it. I would approach via the PA of the person, with a simple short printed memo showing the proposed point you want to make. Copy it to the requisite people before you send it so you are not going behind their backs. If they object then say, "Look this is important and we're not getting anywhere. Unless someone takes notice I'm going to have to go higher up."

Here's what I might write:

Dear VIP

I understand that TinyCo was taken over because of the expertise we have in security, however there is an area in which this expertise is not yet being fully used.

Specifically there are one or two important security requirements that need updating for today's world. However I have run into legacy rules inherited from MegaCorp that prevent me from pushing these measures forward. Not only would they improve data security but they would save considerable time and money in my opinion.

I wonder if you would consider putting me in touch with a Megacorp security expert so that I can formally submit these ideas and we can report back to you?

Sincerely

cypher

---

What this does

It brings it to the important person's notice without creating any work for them.

The only MegaCorp security expert they will know by name will be the top guy/gal. All the VIP has to do is send them a message saying, "Please look into this and report back." Then it is off their desk.

Warning

At no time must you bombard the VIP with technical talk about SSO or IT tickets - They probably have no idea what these are. If they are technically-minded then they can ask you for a technical summary if they want it.

What could go right

1. You could end up greatly accelerating your career if your suggestions turns out to save the company a lot of wasted time and money. The VIP now knows your name.

2. It sows the seed in the big corps mind that you are not a junior lackey but that you are an equal whose ideas count.

3. It may even lead to MegaCorps people having to consult you before they proceed with anything new.

What could go wrong

I don't think there is much risk because if the VIP ignores you or just says "Speak to your immediate boss", you haven't lost anything. If however the VIP is benevolent and clever and facilitates you - no-one is going to argue.

Disclaimer

Every action or inaction has risks and consequences. I personally don't think there is a downside to my suggestion but you have to weigh up any risks for yourself. Is years of frustration better than taking a slightly risky action?

Random thoughts

Maybe don't use a private memo but avoid going over anyone's head by telling them you are going to communicate directly to the VIP because there is no progress currently because of rules. Again, if they object, say "But this is really important and we're not getting anywhere." If they still object then take the moral high ground, "I'm sorry but the current situation is costing the company time and money. I wouldn't be doing my duty if I didn't challenge it. I have no option"

Never blame a person or department - You are not trying to get people into trouble. Always lay out the benefits and improvements your scheme will provide.

Answer 10

6,000 JIRA tickets: Assuming you do two weekly sprints, you calculate which sprint would fall into the two weeks after you retire, and that’s where they go.

Seriously, that’s a task for your manager’s manager’s manager. But I think it’s possible in JIRA to close 6,000 tickets as “Won’t do”. Better yet: “Need more information”. Even better: Call a meeting for prioritisation. Invite someone two levels higher up, just for the first ten minutes. Print out all the JIRA and bring them in boxes. Just to demonstrate the absurdity of this.

Answer 11

Get ready to talk to management and security guys.
But first of all, make sure to talk with everyone with the "language" they understand most.

Talk "time and money" with your higher management. Don't talk much about how/why it is insecure. They may not be concerned with it. Management is more concerned about how much time/money it costs or how much is lost - and that's how you should talk. To prepare for it, answer these questions first.

• How much time it takes from you per month? (include the "blocked" time too)
• How much time it takes from the team (or organization) per month?
• How much work can be done instead of it? (e.g. tasks, features, story points)

If the time/month is very little, perhaps its better not to go for it.
But if it's noticeably big and/or blocks the team - go for it!
Make sure to translate the time into visible units of work or money, before talking to your managers.
For example: Issues are seen by each member of team once a month. It takes 2-3 hours to fix. If team has 10 members, that would do 20-30 hours per month, which is 2-4 full work-days. So it can be translated into:
"Team loses 3 full work-days per month for being blocked on these issues."
"We can implement 5 more higher-priority features per month if we don't have these issues."

Talk "security" with your security leads. Don't talk much about how inconvenient it is for you or your team. They may not care, security is not about convenience. They are concerned of how secure/insecure it is, how less (or no) work they should do to overcome it.

• Research for solutions. Write down the issues. Then research each of them and prepare solutions (in your mind, or written) of how it should be done. You need to have a clear representation of which issues you want to fix and how they can be fixed in order to have constructive conversations.
• Estimations. If possible, count how much time it will take to implement each fix. If possible, consult with mates who are good in security (in your team, or in other corps) If the implementation time is little, less than the time it takes from you/team (per month), then use this point in your conversations. Make sure the estimations are realistic. It may become a decision-bending argument.

Arrange meetings. Talk with manager, security team, then arrange meeting with involved parties. In the end it will all boil down to these questions: "How much will it cost?", "Is it worth the cost?", "Will we gain more business value if we do it?". Be ready for these questions. And if it's definitely worth the cost, the management will start pushing the security team after a while.

After this all, you will need patience. Be ready to go through the steps above few times. Also,

• Keep counting statistics. Write down the time you (or teammates) are blocked - in your notes and in reports. You will need it in your next talks. As soon as you have got enough "numbers", your proposals will start to get noticed. The opposite is also possible - you may notice that from business-perspective it's not worth the "cost" (depending on the issue).
• Don't go "against", go for "fixing it". Don't use destructive blames and complaints. Such acts are seen as indicators of incompetence, non-professionalism, may negatively impact your career.
• Keep raising it - consistently, constructively. The change won't happen the next day. It may take months depended on your corporation size.

In the end, if you succeed, it will be seen as an act of leadership and will positively impact your career. Don't forget to share the results in few months :)