One chestnut from my history in lottery game development:

While our security staff was incredibly tight and did a generally good job, oftentimes levels of paranoia were off the charts.

Once they went around hot gluing shut all of the “unnecessary” USB ports in our PCs under the premise of mitigating data theft via thumb drive, while ignoring that we were all Internet-connected and VPNs are a thing, also that every machine had a RW optical drive.

      • Machindo@lemmy.ml
        link
        fedilink
        arrow-up
        15
        ·
        1 year ago

        At my current company all changes have to happen via GitHub PR and commit because we use GitOps (ex: ArgoCD with Kubernetes). Any changes you do manually are immediately overwritten when ArgoCD notices the config drift.

        This makes development more annoying sometimes but I’m so damn glad when I can immediately look at GitHub for an audit trail and source of truth.

        It wasn’t InfoSec in this case but I had an annoying tech lead that would merge to main without telling people, so anytime something broke I had his GitHub activity bookmarked and could rule that out first.

        • shastaxc
          link
          fedilink
          arrow-up
          7
          ·
          1 year ago

          You can also lock down the repo to require approvals before merge into main branch to avoid this.

          • Machindo@lemmy.ml
            link
            fedilink
            arrow-up
            1
            ·
            edit-2
            1 year ago

            Since we were on the platform team we were all GitHub admins 😩. So it all relied on trust. Is there a way to block even admins?

            • shastaxc
              link
              fedilink
              arrow-up
              2
              ·
              1 year ago

              Hm can’t say. I’m using bitbucket and it does block admins, though they all have the ability to go into settings and remove the approval requirement. No one does though because then the bad devs would be able to get changes in without reviews.

              • Machindo@lemmy.ml
                link
                fedilink
                arrow-up
                1
                ·
                1 year ago

                That sounds like a good idea. I’ll take another look at GitHub settings. Thanks!

    • Canopyflyer@lemmy.world
      link
      fedilink
      English
      arrow-up
      9
      ·
      1 year ago

      The past several years I have been working more as a process engineer than a technical one. I’ve worked in Problem Management, Change Management, and currently in Incident for a major defense contractor (yes, you’ve heard of it). So I’ve been on both sides. Documenting an incident is a PITA. File a Change record to restart a server that is in an otherwise healthy cluster? You’re kidding, right? What the hell is a “Problem” record and why do I need to mess with it?

      All things I’ve heard and even thought over the years. What it comes down to, the difference between a Mom and Pop operation, that has limited scalability and a full Enterprise Environment that can support a multi-billion dollar business… Is documentation. That’s what those numb nuts in that Insurance Company were too stupid to understand.