Security Theater: Believing Screenshots

I heard a statement today that interested me greatly. I'll quote it directly for accuracy:

"Our auditors accept screenshots for proof of our licensing use, but not spreadsheets because spreadsheets can be manipulated."

Overflowing

Do you ever have trouble learning outside of work? I certainly do. In college, during the summers, I felt like I had tons of time and concentration to dedicate to personal projects and ideas. Now, when I try to pick up a technical book outside of work, my brain stalls. Have the time, when I try to pick up a technical book at work my brain stalls. Here's my theory. Your brain is like this:

And the water is all of the topics you're expected to keep

Platonic Computer Science

Recently I encountered a file permissions issue. Long story short, I had a service that needed to run a .bat file, but because of a Windows quirk, it needed list access to the root of the drive the file was on. I called up my friends at our Information Security department and after getting transferred around a bit, I was informed that their policy was to not grant special access to the root of any

Knee-jerk Scripting

Some people become programmers because they like math, some because they like video games, but most because they are lazy. That's right, lazy. Picture this scenario (the names have been changed to protect the guilty).

Hold on....why did they let it do that?

When we work with computer systems, we rarely imagine the people who designed them. If we do, we only think of them in their work context, abstract entities that give us their product and answer our questions about it. We don't like to think about them being dumb, or having a sense of humor. I'm not sure which of those two to chalk this

I was told there would be support?

If you work in a technical position and use any sort of vendor product you have likely had to call them for help with their technology.

Here we run into a question: do you have engineers answer the questions more slowly or hire non technical people to answer more quickly.

No Progress Bars in Hacking

I have played through the following scenario at least three times now.

Me: Hello Information Security, I need admin access to <server> for <amount of time> to complete <activity>. Would you be able to give it to me?

Info Sec: Thanks for the request. We'll get back to you.