Must be nice to have a high enough position in life to ignore security protocols at whim. If I did that I would be fired.
Just saying "No" without investigating alternative solutions to satisfy the spirit of the request is likely the problem.
It's also apparent that there was no routine security auditing which may have caught Clinton's behavior. I'm not sure you can claim the NSA was acting with security in mind when it's quite evident she was walking around with a blackberry every day in "Mahogany Row'.
How do we know there wasn't an audit done?
How is it the lacking of the NSA in considering security when a person who was told don't do that decided to ignore it?
A) People seeing this play out in their own lives enough to relate it to this experience B) That the quote wasn't "No", it was "shut up and go color", lmao
When "they" can't do something it's because they are malicious lazy idiots. Obviously.
It's illuminating how someone treats other professions that intersect with their own. If one security team acts in a way you disagree with fine. But if you view all security teams as inherently obstructionist, then that tells me you are self-centered or cut corners. Similar if you always have problems with HR, Accounting, etc...
They did it for the previous administration but refused to do it for her and offered no good alternative. She couldn't fire them and replace them and with someone more capable, so her team found an alternative.
This is exactly how a person who is used to getting shit done would operation. You either break down obstacles or you go around.
I can see how she would consider her actions to be the lesser to two evils, at least she could trust her people.
Mind you, I could see that being her thought process, it's very human. But it is hardly a ringing endorsement of her behavior and principles, to say the least.
There's also a real line between ultimately flaunting the rules and "just trying to get your job done" in these kinds situations. Obviously if you're imperiling classified secrets that distinction will not apply to you. But for most other people this is just an item in the toolbox for effecting the change you want to see, lol.
If you're a security professional who doesn't spend a fair amount of your energy making your users happy, you're failing at your main job of ensuring security, for exactly the reasons on display here. Security doesn't end when you've sent out the memo outlining your policy.
I was trying to enter a 26 characters wifi passcode when setting up a new MacBook recently (so without access to clipboard). All characters hidden, not even certain the keyboard was set up with the right region. It might be secure but the guy who designed this step of MacOS should still be fired.
I've posted about this before on here - "It was worse at $last_company where at my best count, I had 20+ different passwords, all with differing rules, and expiration policies, the solution in the end was a spreadsheet (contrary to IT policy) - which was stored on my workstation with full disk encryption."
If you have a choice between loosing 8 hours a week just to information access management or just ignoring the rules, which one would you pick?
The difficulty with the best protocols as designed by security professionals is that they are not necessarily designed based on how users actually work. And if they are not, it is likely that users will subvert them. This paper from 2010 is along those lines, "The True Cost of Unusable Password Policies: Password Use in the Wild" (http://www.cl.cam.ac.uk/~rja14/shb10/angela2.pdf).
I particularly like two of their observations from the introduction:
"Based on our results, we make three key observations:
1. When users cannot cope with the demands of strict password policies, it a) reduces their productivity, and b) leads them to adopt coping strategies - which usually reduce security.
2. Although passwords are usually considered in terms of authentication for a service or a device, today they are encountered in many other ways in the workplace – and existing password policies do not cover these. As a result, users adopt ad-hoc solutions, which are usually insecure."
The security we actually get is the result of the technology we use, and the human behavior that interacts with that technology. Sometimes, in order to get higher actual security, we may need to relax the technological security so that we get the human behavior we want.
In my company IT puts all kinds of restrictions on the network but for automated testing we need these restrictions removed or we can't do our job. Since IT didn't accommodate us or provide an approved workaround we had to hack around them and make the system less secure as a consequence.
Of course they were wrong to go through unofficial channels, but as a security professional, you don't plan for things to happen as you expect. You plan for things to go wrong, and you plan so they go wrong less.
> Must be nice to have a high enough position in life to ignore security protocols at whim. If I did that I would be fired.
Ivory towers take a stain too easily, so I only summer there. The rest of the year I stay on the ground with you commoners.
Only if you get caught, usually by (losing the device and having to tell everyone|getting a virus or what-not that noticeably impacts some other system). Which is sufficiently rare that you can get away with "it won't happen to me" for an arbitrary period of time.