I am a software developer at a big bank. The hoops we are forced to jump to just do our jobs are ridiculous.
We resorted to using buggy and laggy remote development environments through a slow VPN.
It’s a miserable life, but at least the pay is good.
And yet you all are still using SMS two factor authentication. Why does my Xbox video game account have better security than my money?
Why does my Xbox video game account have better security than my money?
One is designed to securely collect and keep as much of our money as possible, and the other is just a bank.
Simple, it’s not a priority for them.
They care more about their stupid emails than about your money.
Xbox has all of microsoft behind it, and they linked xbox accounts with microsoft accounts many years ago, allowing them to leverage all the security tools they’re making for themselves and corporate customers of Azure/Entra. They also effectively have infinite money.
Banks, surprisingly, do not. They also are often using third party systems under the hood for things like online access to your account. Those third parties tend to have less money than a bank.
Laws can’t keep up with tech developments in security, and getting all your ducks in a row to be legally covered in the finance industry is a fucking nightmare.
Lastly, banks (and companies) don’t stay afloat by spending money on things that aren’t necessary. Until it shows a significant impact through a breach or in customers leaving specifically for the reason of lackluster MFA options, and until that impact is easily communicated to the executives, trying to fight for some budget to improve shit is an uphill battle.
I am so so glad that the closest my work gets to customers, legal, or anything regulatory is data rentention policies.
Honestly it blows my mind that my bank doesn’t support TOTP, they used to support email but recently removed that, they do support mobile push to their app so I usually use that but when you want to sign into the mobile app? Have to use SMS can’t very well push notify the app being signed into, no choice, very silly.
Really? My banks use the best 2fa I’ve seen so far. You have a card-reader which generates a code based on some input values related to the transaction and the physical chip on my bank-card.
(Although they have been pushing PuhsTan (app on phone) a lot recently :/)
To log in to your account online?
My bank (German, just like needanke’s probably is) requires that exact 2FA method once every 3 months or whenever you login via an unrecognized device. Also for every transaction you make and when you want to check bank statements more than 1 month in the past.
https://en.wikipedia.org/wiki/Transaction_authentication_number#ChipTAN_/_Sm@rt-TAN_/_CardTAN
“Will I have root on my dev machine” is on my list of interview questions, now.
Probably is for me too. This is something I’ve taken for granted as I work for a small company and I am the IT admin…and development team lead, I wear lots of hats. Not the owner though, basically like a CTO+.
Asking questions like that can cause hiring managers like myself to have no choice but to offer you higher pay grades, because that question is a strong signal of experience.
Experience shows that you still force me to use WSL, because you want to develop your stupid app in the same setup as the Windows store version and i have to fix the not-so-much cross-platform monster of three people before me who never heard of technical debt.
Absolutely.
My environment sucks almost as much as the next one. It just pays better and we get to be angry at difficult real problems caused by the previous people, instead of stupid self-inflicted problems caused by our own shortsightedness.
Edit: I mean, there’s still some problems caused by our own shortsightedness, obviously.
And technically I didn’t say you would like my answer, just that I’ll pay more because you asked. Lol.
IT guy here, if we gave developers the option to exclude whatever the hell they wanted from AV scanning it would just mean that we would end up with computers where the entire C: drive would be excluded.
No, can’t have that.
So what should a decent IT department do to give developers the access they need to do their job while maintaining a decent level of security?
Well, the least bad solution I have worked with was to have a non generic path that was excluded by policy.
Something like C:\Excluded
The directory was excluded from AV scan and allowed in policy, the user could put what they needed there and it would be fine.
Your user base must be better than mine.
Some chucklefuck over a decade ago caved to the “need” for a public shared drive. I can see the argument for things like HR policy documents and such. But they didn’t just give all users read access. Oh no, everyone got full read write. No fucking governance model, no process to check that PII wasn’t being stored there by people too lazy to follow proper procedure.
Thankfully that horror has been thoroughly killed, and MS Teams makes it so easy for people to spin up collab spaces and file storage that there’s no use case anymore.
So what should a decent IT department do to give developers the access they need to do their job while maintaining a decent level of security?
Give them a Linux machine?
This doesn’t remove security and compliance requirements for the business though. For our Linux endpoints we still deploy an AV on them and limit the user’s ability to add exclusions.
You ever worked in an average corporate job? You’re missing out on so much
The IT guys barely know Windows, they’ve most likely never even heard of Ubuntu, could you imagine such a thing :|
A machine that takes extra time and skills to manage?
As someone who does exactly that right now. Yes.
You need a Linux machine in a separate network with separate firewall rules and the developer has to devote a bit of their time to managing that machine.
It can even be centrally managed, if you have the capacity.But why would you want that? To secure your shit while allowing the devs to to what they like to their equipment.
In an ideal world I agree with you, but when resources are limited, running a separate environment is not allways realistic.
^ this
As an example of scale, my company has an entire IT team of a handful of people for managing such an environment for a thousand or so devs and engineers.
My past role was a combined role of these:
Helpdesk technician
VIP technician
Linux system administratorWe didn’t effectively administrate the Linux environment, I was the only linux admin at the company, and I wasn’t even doing it full time.
I appreciate you trying to keep your developers productive. Deeply appreciate the concern.
Because too many developers don’t understand cybersecurity.
As is obvious from some of these comments here.
Whats next, you want domain admin access to every computer/server you touch as well?
Nah, sudo is fine. I can create users without touching the domain stuff. 🙃
you want domain admin access to every computer/server you touch as well?
Heh. I’ve had it. It’s not all it’s cracked up to be. And I didn’t even get one of those humorous “all I got was this lousy T-shirt” shirts.
Ah, that time when my job required me to write an executable scanner, and all the AVs got jealous I was honing in on their turf.
AV running in kernel mode charges its CPU cycles to the process being monitored, instead of the AV doing the monitoring.
I got a whole bunch of “your program is slow” support tickets which were resolved by telling the client to follow the AV exclusion instructions.
Took me way to long to notice I was accidentally reading “charges” as “changes”. Now I finally got what you were saying.
Corporate antivirus is so great that it restricts windows update while not connected to the main network by ethernet.
Some of us are there once a month.
Last windows update broke it, and now nobody can update.
It also bring 5 seconds of load time to any website
You could, and I’m just spitballing here, start sending your compiled executables to the anti-virus provider and only continuing work once they’ve been added to the upstream exceptions. Bonus points for compiling hundreds and sending them all. Do that for a day or two and there is sure to be a number of communications many levels above you.
If executed perfectly and all goes well, you’ll get your exceptions access.
Worst case… uh. Maybe this isn’t such a good idea after all.
Trellix is just rebranded McAfee. Here’s instructions for How To Uninstall McAfee Antivirus.
This is not Trellix ePO as you can make exclusions. No, this reeks of Defender.
Click the link…
I also suspect it hangs Firefox’s network stack while it does its initial scan after each boot. Chrome does not have this issue.
Same. It is after all their own time they are wasting, so whatever. I get paid either way.
