IT BS thread

Expensive to implement and maintain.
Disruptive to core business processes.
etc.. etc..

Not patching servers because it may break something. I shudder when I see servers and security devices that have years of uptime. It means jack shit has been done to apply security patches to them.

 

Yeah, I've told our Unix admins that bragging that a particular server "hasn't been rebooted in years" isn't something to brag about.

 

Then the response to that bragging is "Why have we been paying you for years?"

 

FIFY

I bet I could get the user's credentials 8 times out of 10 just by using my best tech support voice. "Yeah, Hi this is JSI over in IT. Hey the flangedit system is having a bad day and I just need your user name and password to get it sorted out. What'd you think of the super bowl?! Loved that trick play Foles pulled off just before halftime. So let's get that flangedit system going for you ... " user gives up their credentials. I'm not saying users are dumb, just that if someone seems to know what they're doing they will give up the farm for nothing. We've gone so far as to warn our users on every email from the IT department that no one will ever ask for their username and password. And still we get people hacked a couple of times per year.

 

2-factor authentication negates the whole password issue. Users can’t give up passwords if they don’t have any, and you can’t hijack the private key without having the token so getting the PIN out of them doesn’t work.

Not enough companies are using 2FA, though.

 

Lol we patch monthly and if your servers need an exception, you have to talk to the ciso. If we can do it, anyone can do it. We have somewhere around 30k windows servers just for corporate, not counting the division servers that we don't manage. We run hospitals and patch monthly. When it goes wrong, we work nonstop, but usually it's fine.

 

I love 2FA and have it on every system that will support it, but I'll bet I could talk people out of their 2FA and get me logged in that one time. Back in college it talked the university computer system admins out of their credentials for the university computer mainframe. It wasn't 2FA but it was pretty complicated. I wasn't an IT major at that point, but I learned an important lesson. Be friendly and talkative and people will give you anything.

 

You can't make this shit up.

 

That is already on 15 bulletin boards throughout my facility, with notes about instant unemployment. He also has his security badge on clear display, strike 2. If this was in my former life, the simple fact that a camera got into the facility would be strike 3 and his clearance would have been revoked, commanders would be fired, and everyone would be pulling extra duty.

Crucify them all.

 

That describes a typical day at my place.

I got tired of my password expiring every 90 days, and the increasing difficulty of using more complex passwords. So I had someone set my password to "pass123", and set to never expire.

 

We have no passwords to post - all 2FA - but we have had other "stupid user tricks" that have gotten folks in hot water.

 

we have a portion of our servers out sourced, not by our choice. We were on a conference call\online meeting with a guy from the out sourcing company who was showing us a few things. We watched him open a .txt file and copy and paste some of our passwords to shared systems out of it. We were furious, tried everything in the book too get them fired, but someone's pockets were getting too much money and they did nothing more than a hand slap.

 

Agreed. I'll be honest that I was oblivious to development practices as always being on the infrastructure side of the house so now having to learn how to not only speak to developers but help bridge the gap from the infra/ops side of things is a challenge for sure. At the end of the day, applications and their time to market run the business and learning how to adapt is the competitive advantage for any firm.

It's still very exciting stuff and the underlying tools are pretty incredible, but I'm starting to feel dated at 35.

Also, I cannot seem to finish The Phoenix Project to save my life, I swear the pages have a dusting of melatonin.

 

You are at the perfect age to knock some sense into the new crew coming in. I'm too old, all they hear is "get off my lawn."

I have that book on my Kindle, just haven't gotten to it yet. Not sure I even need to read it at this point, I've gotten the Cliff's Notes version just through osmosis.

 

Anyone in the Arizona/Phoenix area planning on going to the Security Titans conference in Scottsdale on Friday?

 

i'm 38 and i'm starting to do a lot of mentoring of younger IT guys. Teaching them is fun, but also very frustrating at times.

 

Absolutely, it just reminds me of when I was in my early 20's and virtualization was coming in hot and heavy and when I would converse with older staff and realize they were waaayyyy behind the power curve.

I feel that I'm that guy now when my customers are hitting me with OpenStack, K8s, OpenShift, etc questions.

 

Never a dull day in the SMB market. One of our medium sized customers (~120 employees) just called and said they need to move their servers to their sister company, due to rising flood waters. Their office is right on the river and I’m told that they have a boat that can get them to the office, from a mile up the road, and that they want me to help. FML

Maybe they should have listened when I suggested they migrate to Office 365 and Sharepoint, drop the rest in the sister company’s datacenter, and only have a bare bones domain controller to handle DHCP and AD on-site......

 

That's the direction we're headed, just now wrapping up the O365 integration / training which by far is the biggest bitch of a project like you described.