Comment by ssss11 | Hacker News Reader

Comment by ssss11 | Hacker News Reader

Parent Full thread

Only tangentially related but my wife used to work at a private institute research lab which was affiliated with a large university, and therefore used computing resources.

The University IT security staff did a great job enabling 2FA across the entire network.. big job, well done. They didn’t do the slightest bit of requirements analysis of those people using the network such as affiliated research labs. One day my wife went to use the computer _in the PC3 lab_ and couldn’t without 2FA. Even logistically getting a computer in - that computer can then never leave the lab. PC3 labs don’t allow you to bring in a phone or anything really.. you’re double gowned, double gloved, goggles etc… hilarious.

Took them about a week to explain themselves sufficiently for IT security to fix it.

Great case in point. In a well run org, that would've been elevated to a "security incident" just the same as a hack, with their jobs potentially on the line, rather than a week of pleading to them to have mercy.

a company may very well consider this a “security incident” or other high-priority issue, but at least in my experience, the method of reporting something like this can be vague. While the right answer should be a place to submit a ticket, even internal systems nowadays seem to not let the users set the priority on tickets and instead let L1s try to resolve everything, who may not have the experience to recognize something needs to be elevated. At that point, it seems the only good option is to run the issue up the chain and back down through the right department (which is probably more effective, at the end of the day).

Yeah she was on the L1 helpdesk ticket merry-go-round for a couple of days before I told her what she needed to say to them to have a security team member look at it

> with their jobs potentially on the line

That would be a bit much and not accomplish improvements.

> PC3

Physical Containment Level 3 = Biosafety Level 3. I think.

https://en.wikipedia.org/wiki/Biosafety_level#Biosafety_leve...

Reply on news.ycombinator.com