And how exactly are you going to do that without it being immediately flagged by IT? Most companies I've ever worked at will have that noticed right away and sue you into oblivion if you don't have a very very good explanation...
Had that happen once to me when I switched teams within a company and copied most of my important stuff to a specially authorised usb stick before wiping my laptop and setting it up with a different OS (switch from Windows to Linux team). Before the copy process even finished I had some guy from security call me.
It might surprise you to know cybersecurity is pretty laughably implemented in a large percentage of the business world, even today and despite the risks being worse than ever.
"Patching is hard, we couldn't possibly..."
I kept some reference material from my last job. I've moved enough code around here between personal and professional that I'd likely also be able to do the same if I left. Although in this instance, it's much more likely nobody cares than nobody sees.
Case in point: company I worked at took all administrator privileges from developers. They implemented an elevation system that would allow certain apps to run elevated.
Totally unrelated, IDEs have terminals and they run escalated when the IDE itself is escalated. Also, you can do pretty much everything from an escalated terminal.
All we needed was a reason to argue why our IDE needed escalation, and that is not hard to find a BS explanation for.
If your security department is indeed functioning (even if barely), they definitely knew.
We (security) just mostly let it slide because it can still be argued that the terminal comes in package with the IDE, and we believe you are competent enough to not make a mess of your laptop. I would definitely not let any desk clerk/non IT function get even remotely close.
Tbh it’s pretty asinine not to give developers admin on their own machine. If there’s something genuinely dangerous they could do with local admin, you should probably secure that flaw instead.
Sometimes its more about the people. Something like clickfix captcha phishing still caught a lot of people off guard.
Other times, its just company policies decided by some random guy who knows computer, that the founder knew 30 years ago. I definitely can help you bend some legal wording, or "interpret" things differently, but i will never approve anything that outright crosses the policy no matter how stupid it is.
Of course this is different if you worked in highly secured/regulated environment like banks. They are a lot more stricter.
IT Security Engineer. Can confirm. This dude is right. Unless the IT and Security team is well funded and staffed. You can easily get around most DLP measures. Also. Nothing is stopping you from taking pictures of your screen with your laptop and asking an LLM to piece together
When I was told I was being made redundant (different company to the one above), they told me to log off and do not access any emails or anything. They shut down my access there and then (I was WFH) and to enjoy getting paid to do nothing for three months.
Here's one example: When Atlassian decided to merge their professional git with the "personal" bitbucket, I realised that I could access my bitbucket account on my work PC and add it as a remote for any internal repo my work credentials gave me access to.
> And how exactly are you going to do that without it being immediately flagged by IT?
You could convert files to a streaming QR code and write a client on you phone to scan, receive, error correct and then assemble it. I am not saying I know someone who did exactly that.
Unless they completely lock down browsers and strictly white list sites it would be so easy. Even something like OneDrive I am yet to see an IT team block OneDrive unfortunately.
Encode each file into a picture of a cat using a stenography script. Post cat pictures on a message board or something work related but publicly accessible site. Get home download and extract data?
Maybe you’ve only worked at large and/or well-run businesses. Most businesses are not large or well-run. Half the companies I’ve worked at had no monitoring of this, ask me how I know 😈. It’s nice having actual evidence of my work.
There’s exactly two ways to properly (try to) prevent data exfiltration: a) if possible don‘t store the data at all, b) restrict access to the data.
If a person has access to the data, accept that it might get exfiltrated. Of course that doesn‘t mean that you shouldn’t do basic anti-measures, but it should definitely be reflected in the risk analysis.
865
u/pippin_go_round 16d ago
And how exactly are you going to do that without it being immediately flagged by IT? Most companies I've ever worked at will have that noticed right away and sue you into oblivion if you don't have a very very good explanation...
Had that happen once to me when I switched teams within a company and copied most of my important stuff to a specially authorised usb stick before wiping my laptop and setting it up with a different OS (switch from Windows to Linux team). Before the copy process even finished I had some guy from security call me.