Skip to main content

Dear infosec 'professionals,'

Stop shitting on the IT team when there's an incident because we didn't/couldn't do everything perfectly. How businesses operate in the real world is completely different than your isolated test rooms. We're only human and even with all the tools to monitor and protect our environments there is a lot of ground to cover. Many of us are a one person operation.

Do not belittle my employees because they fell for a nicely executed scam. They already feel like shit. I will call you out on this at every turn and then treat my coworker to ice cream or the treat of their choice and make sure they are okay.

We know we got fucked and we are asking for help while doing internal damage control and mitigating things to the best of our abilities. Do not talk to us like we are computer illiterate cave people. We already know you are good at what you do, that is why you are here. Do not waste billable hours on calls autofelating yourself over how brilliant you are.

In summary, please act like a professional.

Sincerely,
IT Teams Everywhere

in reply to Mr. Crab - Sysadmin from Heck

NOP Slide
NOP Slide
• •
There’s only one inadequate party in that exchange, and it’s not the IT folks.
in reply to Mr. Crab - Sysadmin from Heck

James Hubbard
James Hubbard
• •
The plan is that a worker is 100% accurate 100% of the time to keep the system 100% secure.
youtu.be/lWPJzGtmiOQ?t=150

- YouTube

Enjoy the videos and music that you love, upload original content and share it all with friends, family and the world on YouTube.
youtu.be
in reply to Mr. Crab - Sysadmin from Heck

Juliet Merida, Dum Tran Elf 🏳️‍⚧️
Juliet Merida, Dum Tran Elf 🏳️‍⚧️
• •

As an incident responder, this really grinds my gears. How the hell do you expect people to trust you during really stressful moments if you can't act like a human?

A tiny sliver of empathy goes a very long way.

@CrabbyIT@infosec.exchange

@Mr. Crab - Sysadmin from Heck
in reply to Juliet Merida, Dum Tran Elf 🏳️‍⚧️

Amber
Amber
• •
clearly what people need during an already stressful event is to be screamed at and berated adding to the existing pile of stress - upper management
in reply to Amber

Juliet Merida, Dum Tran Elf 🏳️‍⚧️
Juliet Merida, Dum Tran Elf 🏳️‍⚧️
• •

I had a conversation with a help desk coworker just this morning about what it feels like to realize you fell for a scam. He couldn't see how a reasonably smart person could fall for a particular kind of scam. I reminded him that he and I are immersed in tech. We're experts. We're good at our jobs.

But those users of ours who fall for stuff? They're good at their jobs too! They're just not good at our jobs. And when they realize they messed up and they call us for help? Don't you ever be unkind to them. They're well aware they messed up and yet they still called us. That's admirable, not shameful!

@puppygirlhornypost2@transfem.social @CrabbyIT@infosec.exchange

@Mr. Crab - Sysadmin from Heck @Amber
in reply to Juliet Merida, Dum Tran Elf 🏳️‍⚧️

Amber
Amber
• •
even if I think it was immensely stupid of a client to fall for a scam the last thing I would ever do is chastise them for it. all that does is make people hesitant to reach out for help in the future, creating a hostile work environment for no reason. A lot of scams might seem really obvious because of typos, misspelling, bad formatting but people forget about the visually impaired. If people with great eyesight can still get confused by B and 8, by rn and m… there’s a lot more wiggle room for the visually impaired to be misled.
in reply to Amber

Amber
Amber
• •
some things are also not obvious. my first year i encountered a weird phishing attempt. It was an html file that you were meant to open, and of course when you opened it there was a log in for sharepoint. Stupidly I advised someone to enter their login (forgetting that we had opened an html page and that might contain scripts that can reach the outside internet). I locked their acc immediately and reset their password but it was still dumb. sometimes people just don't know where to look.
in reply to Amber

Amber
Amber
• •
to a frustrated user who just wants to open up (and in this case I believe the file was supposed to be billing statements) a file it's very easy to overlook the tiny things like why is this sent as html instead of .pdf or .docx?
in reply to Amber

Juliet Merida, Dum Tran Elf 🏳️‍⚧️
Juliet Merida, Dum Tran Elf 🏳️‍⚧️
• •

We've spent decades telling people "don't click on shit" while at the same time giving them more and more complex workflows that require clicking on all the shit and then we get mad at them when they click on the wrong thing because we told them not to click on shit, but their job literally requires clicking on shit.

We need to do better.

Empathy is the future of security.

@puppygirlhornypost2@transfem.social

@Amber
in reply to Juliet Merida, Dum Tran Elf 🏳️‍⚧️

Amber
Amber
• •
genuinely annoys the shit out of me how modern applications are. you will literally open up a site, it asks for your login, you accept 500 banners everywhere, it wants you to bring out your phone for a 2fa and the entire experience feels clunky. nobody is paying attention, everyone is used to just clicking "OK" to get one more thing off their screen. we have really fucked up everything haven't we
in reply to Amber

Amber
Amber
• •
I have caught myself several times (and i am a professional sysadmin) trying to click OK NEXT CONTINUE and ignoring instructions completely while hitting errors and not even reading them. it is so ingrained to us. going on autopilot and then realizing "oh this is asking for $X instead of $Y that's why it keeps failing"
in reply to Amber

Mr. Crab - Sysadmin from Heck
Mr. Crab - Sysadmin from Heck
• •

@puppygirlhornypost2 @julie We are just happy they let us know they clicked on something sus.

It is our jobs to know and notice things too but like everyone else our workflows are complex and we are only human too.

@Juliet Merida, Dum Tran Elf 🏳️‍⚧️ @Amber
in reply to Mr. Crab - Sysadmin from Heck

Shambolic Matter
Shambolic Matter
• •

every other email that comes down from our corporate overlords looks like a phishing attempt. "Click the mangled link if you want to keep your job."

I regularly have to ask if something is a real email.

in reply to Mr. Crab - Sysadmin from Heck

Andy Wootton
Andy Wootton
• •
I worked in InfoSec (policy not tech) for a year or two, educating myself from general IT knowledge to define my own role. The first things I learned were that you manage risk to information, not to tech environments and the biggest threat is usually gaps in the knowledge of employees. 'InfoSec professionals' who fly in to blame staff for not knowing something have already failed by arriving too late. Maybe they knew that and thought they needed to deflect blame?
in reply to Mr. Crab - Sysadmin from Heck

szakib
szakib
• •
Is it then OK to shit on you, the IT manager, who kept your team under-staffed, overworked, and underpaid so that even though they would know better, they are forced to operate a flaming clown car of an IT setup?
This entry was edited (1 week ago)
in reply to szakib

Mr. Crab - Sysadmin from Heck
Mr. Crab - Sysadmin from Heck
• •
@szakib If you are that poor of a boss then perhaps. If your hands are tied because upper management won't give you the budget to expand your team or hire competent people then no.
@szakib
in reply to Mr. Crab - Sysadmin from Heck

🏳️‍🌈Alex
🏳️‍🌈Alex
• •

I suspect most of us work collectively on our own demise by not treating security costs as inherent cost to doing anything.

By complying to build $thing with less security, rather than less $thing including security, we collectively set a standard for how much $thing can be built for how much money, security be damned.
There's a tragedy of the commons here.

This can likely be fixed by regulation mandating security practice. We know that from other fields of engineering.

This entry was edited (5 days ago)
in reply to Mr. Crab - Sysadmin from Heck

Ingo Paschke
Ingo Paschke
• •
That's what I hate about the @ccc Filling large congress centers to laugh at the incompetence of other IT professionals is not as funny as you think. It's just another symptom of the techbro superiority complex.
@Chaos Computer Club
in reply to Mr. Crab - Sysadmin from Heck

field94Mop
field94Mop
• •
single Person IT deps are a flaw in itself for a range of reasons. It's a fatal misunderstanding on the CEO level of how IT works and the dependency of any enterprise on IT.
in reply to Mr. Crab - Sysadmin from Heck

sudoedit@fosstodon :~ $
sudoedit@fosstodon :~ $
• •
Maybe it's just me, but in my experience IT Security generally aren't worth the money they are paid. Every place I've ever worked the only people who actually understand how IT systems operate and are skilled enough to secure them are the infrastructure people.
⇧