Post

I'm gonna tell you about a guy named Peter. He called for support often and it wasn't stupid stuff. But it was complex. He drove a BMW. He was divorced. He was of course a sales person. Probably the most successful sales person in California and maybe the country. He serviced the government.

SwiftOnSecurity@swiftonsecurity.com

You meet the users where they are to stop them doing the stupidest shit imaginable. You have no idea how much this paid off. The number of infected media players people downloaded in the age before Windows Media Player had more than three codecs is unimaginable Who knows if I saved the firm

Peter knew exactly how valuable he was, but he wasn't entitled about it. When he had a problem he called. And eventually he always asked for me. Because he had weird problems. You have no idea how many problems users have, when they know they are entitled to being serviced. He deserved the title.

The mandate I made through technical command alone that every computer we delivered come with VLC was partly because of Peter. It wasn't anime but he was always trying to play some weird goddamn fucking file. And Peter got what he want. I installed VLC and he stopped calling about the video files.

And I realized. Holy shit I just need to install VLC and people will stop installing this weird stuff. Because at that point for some reason I ran the antivirus for the entire firm. You have no idea. You just don't. It was all fake media players. If you wanna learn what users want run the antivirus.

Connection to the users and their desire paths is the most important path of working in security and nobody goddamn does it. You are gonna make compromises. And they're all gonna be worth it. Because you understand what they want and you're gonna deliver it and they're gonna stop doing stupid shit.

32 reposts245 likes

What a lot of our peers don't get is; if you work with the people, know when to bend and even when to 'cave'*,it builds their trust in you. That when you do have to throw the hard no, they are more likely to listen and respect it. *I was fine letting you do the thing, but you totally won Bob :)

The fact is that users have enormous desires that you never deliver on as IT. And in this they are susceptible to lures and being hacked. The hackers are gonna deliver them what you don't.

One of the weird things about me is I wrote the guide the most popular adblocker in the world cites about how to deploy it to corporations. You have to do weird shit if you want to win. You have to be different. The hackers are battling the average corporate. And you can never afford to be that.

I noticed something funny about our security incidents. It was people clicking weird shit they saw on a webpage. And how do you fix that? With an adblocker. You do it with the audacity no one has, which is just fucking doing it. I deployed this to one of the largest companies in the world.

My dept. was sold from one company to another. Co A provided all IT support for the dept. They dealt with requests for admin rights by giving to anyone who asked. Shortly after the ransomware attack, my company ended the support contract early.

My weird difference as a admin / network engineer is I keep the Russian and Chinese keyboards installed along with sysmon on my laptop. I’ve seen enough examples of ransomware kill switches for those language and I figure my machine looks more like a honeypot than workstation.

Right now we're in a fight with IT at my job because they keep updating nodejs on dev machines but our entire codebase is still using an older LTS version that just ended support. Most frustrating thing in the world.

This reminds me of when i made an « official » media streaming server for the hockey games inside our stores when i was doing retail IT. Suddenly we stopped having internet connection issues and a lot less malware. And also, productivity went up since nobody was hiding to watch the game anymore.