• hcf@sh.itjust.works
    link
    fedilink
    English
    arrow-up
    21
    ·
    3 days ago

    The weakest link in any system is the user, not the security policy (or lack thereof).

    I’ve seen this particular policy aggravate users to the point where they would rather export sensitive company data onto their own personal machines rather than deal with having to reauth once per hour into some Entra ID SSO-backed web app.

    Or even users who generate service account credentials that they share around with their team such that nobody uses their own account to login anymore

    When your policy teeters towards aggravating users, many of them will just find clever ways to circumvent it, which is a losing situation for everyone.

    • Passerby6497@lemmy.world
      link
      fedilink
      English
      arrow-up
      3
      ·
      3 days ago

      Once per hour is just stupid, but once per shift is reasonable in my opinion.

      If your users can’t be bothered to auth once a day, they probably shouldn’t be working with anything remotely sensitive.

    • OshaqHennessey@midwest.social
      link
      fedilink
      English
      arrow-up
      1
      ·
      3 days ago

      The weakest link in any system is the user

      Correct. No policy is an adequate substitute for security training or phishing awareness training. That doesn’t mean to allow abuse cases though

      export sensitive company data onto their own personal machines

      Intune can be (and usually is) used to enforce logins only from enrolled devices. Personal devices can be enrolled, then Conditional Access policies can be applied to silo app data from company data, preventing this abuse case

      reauth once per hour

      No way. One per day, at most. No one should have to re-auth every hour, except maybe Global Admin accounts, which shouldn’t be used for day-to-day tasks anyway.

      users who generate service account credentials

      To do this in Entra, you need the Application Administrator role assigned, which is a Privileged Role, so it should be controlled by PAM to prevent/detect this abuse case.

      When your policy teeters towards aggravating users, many of them will just find clever ways to circumvent it

      Not for long. And usually not without leaving an audit trail that indicates violating acceptable use policies, security policies, or access control standards, which then becomes an HR issue, not an IT issue