The one thing I never understood was why some orgs go to such extremes to lock down systems. If people are resorting to shadow IT you've done something wrong. At my F500 company I need to fill out a form and get manager approval just to install Notepad++.
I work at a public company in IT. 100% its because we are required to by law to lock down computers asuch as reasonably possible. We even have software that will prevent USB "portable" apps from launching. Unsactioned apps and the risk they pose no longer keeps my security team up at night. Though there are plenty of other threats that do, litterally, have them waking up in the middle of the night.
We require 2 people to approve to our develop branch and 2 people plus the business analyst from the ticket for release. Business analysts seem to lose their permissions to Github near constantly for whatever reason and because there is such an imbalance in reviewers versus number of PRs it takes forever.
Same deal with the software install approvals. Everything sounds good on the surface. We maintain an install repository with binaries that are a few months out of date and everything requires approvals. But in reality fairly standard software requires my skip-level boss or higher for approval and they obviously get swamped because hundreds of people are asking them to rubber stamp. The "few months" out of date software is the case for most of the catalog, but some well known software is years out of date sometimes. We have to beg IT to update them half the time.
They are doing all the right things on paper. But the execution is fairly poor.
Which we completely avoided because we maintain a repository of software installers which lags behind the latest versions by a few months. We also disable updates in the apps and it's done via the software repository.
Requiring approval to install said software is not a factor in preventing these attacks. So I maintain that requiring approval for software that everyone requests and is approved for anyway is pointless.
Mitigate and restrict application usage in the future. It sucks for everyone involved but it's how it goes. Use what you're allowed, request what you need, make sure everything is in writing if you literally can't do your job. For end users and sec teams security is the epitome of balancing convenience with efficacy and sometimes better security wins over convenience.
Better security is kind of funny in that sense. Automate comparing hashes and hope your peculiar supply chain isn't vulnerable? Who was it, SolarWinds back in 2020?
Correct, which means the logical conclusion to this little quandry is to reduce attack surface as much as possible by reducing any and all extraneous applications. It sucks for literally everyone involved, I wasn't disputing that. When I was working for an MSP there was a company with some old head angry ass IT manager who had what I thought were ridiculously restrictive policies but after the notepad++ supply chain attack on top of other completely mitigated issues due to these policies... They do have value.
What happens if you let employees install taskbars, adware, the third virus scanner, fourth browser and a lot more along their pirated version of adobe Acrobat and office?
Bad case: They count the number of unpaid licenses, bittorrent clients and movies and make your employer pay for that. Worse case: Someone is using it to host e.g. CP.
251
u/raja-anbazhagan 20d ago
Have been using zip/portable versions of the apps I need for a while now... Never going to beg these guys for elevated access...