8

I have been recently hired as a security engineer on a company.

They provided me a MacBook Pro as a company laptop. As I always do in any computer in my possession - including in previous jobs - I rebooted in order to reinstall the operating system. I consider it to be good hygiene, since I don't know what's on the company's standard image, and by default I don't trust it. Besides, I expect to make my own choices regarding its initial configuration.

However, I noticed I am unable to enter the recovery screen because it is locked with a firmware password.

After requesting its removal, I was told by IT that this is a new company practice and they will not make any exceptions (other than laptops provided before this policy). The password will remain, and I am expected to use the base image only.

The way I see it, this is appropriate for non-tech-savvy users, but inappropriate in scenarios where autonomy is required, and employees are skilled, typically on technical teams.

I don't think any self-respecting security professional would be comfortable knowing that they do not have full control over their laptop, and that it was installed by someone else, with unknown defaults. Yes, it's the company's property and their decision, but as my main work tool, I should be able to use it anyway I need, including reinstalling the OS or booting from a live pen drive.

Effectively, I am being trusted to secure the company's business, but am not being trusted to secure my own laptop. This is a moral issue to me.

My questions:

  1. Is my behavior unreasonable (or an overreaction)?
  2. Is locking down a computer in this way for a security engineer commonplace in industry?
  3. How do I resolve this without quitting?

I am perfectly aware that the company can choose anything they want, as it is their property, but security folk tend to be paranoid, and I am no exception.

I don't mean to turn this into a dispute, but I feel I will be so uncomfortable working like this that I am more likely to consider not remaining on this company.

closed as unclear what you're asking by Masked Man, HorusKol, Michael Grubey, gnat, Mister Positive Jul 21 '17 at 11:27

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 38
    Hang on... you are a security engineer... and think that you should be able to do whatever you want with company provided equipment without their approval? D'ya see the irony? – HorusKol Jul 21 '17 at 5:40
  • Ultimately, if you think you really need to do something, you should take it up with your boss who will then take it up with whoever he needs to get the job done – HorusKol Jul 21 '17 at 5:44
  • 6
    Your focus should be not that you dont have control over the laptop as you say but on the tools that suposedly are missing. Your issue should be with the second part, and instead of requesting unlimited access on it, request what is missing to be officially installed/modified to your liking. – Leon Jul 21 '17 at 9:50
  • 7
    This sounds more like a rant, then a real question. – BЈовић Jul 21 '17 at 11:13
  • 2
    Maybe that's a behaviour that needs to be reevaluated - in my circles we work to least privilege (even developers - even myself, the head of development and at my own instigation) - too often we hear about news about developers and administrators putting dumpfiles in places they shouldn't and creating significant data breaches. Or cowboy deployments breaking production... And so on... – HorusKol Jul 21 '17 at 22:58
7

You should realise that this is largely a question of responsibility. Since the IT department is responsible for the correct functioning of the machine they provide for you to use, they need a certain degree of control over the machine in order to be able to provide that guarantee. For them, this has nothing to do with you personally: they are providing a laptop to an employee of the company and are treating you like any other employee.

While I understand that distrust is an occupational hazard of a security engineer, I would advocate that when it comes to your own company's employees, you employ an "innocent until proven guilty" attitude. If you have a need for certain configuration of the machine, with certain tools installed and certain access rights, make a request for that configuration through the normal channels within the company. Only when the normal process fails do you have a reason to go to your manager and explain why and how the current situation prevents you from doing your job properly.

I can understand wanting full control over your own personal machine, or a machine that is in your domain of responsibility, but for a machine provided to you by someone else it seems unrealistic to expect full control. Anecdotally, I also fail to see how a pre-imaged machine would prevent you from doing your job: I've worked with security engineers that had barely any control over their own machine, they simply worked with their company's IT department in order to get their machine to the state they required.

19

I doubt that letting them know your feelings are hurt is going to do much good.

If you have legitimate job functions that you can't perform because of this policy, then that's how you need to approach it with your management.

With this policy in effect, I am unable to do X, Y and Z, which are critical to my role as a security engineer. I need an exception or some other work around to this policy in order to do my job.

And let them take it from there. It's useless for you to simply rail at the IT department. If they violate the policy for you, then it's on them if it gets discovered. Whoever has the power to make the exception, it's going to be up to them.

  • This is absolutely the right approach. Ask for what you NEED not what you WANT. – Mister Positive Jul 24 '17 at 19:04
13

am not being trusted to secure my own laptop

It's not your laptop, it is a tool the company have provided you in order to do your job. However, I do sympathise. It's normal for companies to have a standard image. And I agree, when handing out a laptop to a generic user I would usually ensure quite a few restrictions were applied so that users didn't screw with the machine.

If you need specific tools, you can and should request them.

What I recommend you do in the first instance however is - go and talk to your Manager, explain explain why you need/want it configured in a particular way, and ask if it is possible to have the restrictions lifted. If your manager OK's it, then they should go back to IT and instruct accordingly, at which point the IT team can and should work with you to get the setup you need.

However, if your Manager says no, then that's the answer. And you have to accept it.

  • "It's not your laptop" - I acknowledged this, at least twice, in the initial post. "go and talk to your Manager" - I did that today, and am expecting an answer. My manager agrees with me (thankfully), but he has to request the IT department for an exception, which they already refused once. I'm expecting a new answer, through him, which should be due next week. – user74326 Jul 21 '17 at 22:28
  • @user74326 I know you acknowledged it, I didn't suggest otherwise, but it is a vital point as far as the IT Department is concerned. Anyway, seeing as the Manager agrees with your view and he has said he will take care of it, it's a good result. Good luck with the IT Dept - as your manager is instructing them, they are more likely to honour your wishes. – AdzzzUK Jul 24 '17 at 7:10
  • sadly, they didn't, so I'm left working on a computer I can't trust. It's not the end of the world, but makes me uncomfortable enough to think about moving to a different company. It's funny how the human psyche works. – user74326 Aug 22 '17 at 22:49

Not the answer you're looking for? Browse other questions tagged or ask your own question.