this post was submitted on 15 Mar 2024
106 points (94.9% liked)

Selfhosted

40359 readers
304 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

  1. Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.

  2. No spam posting.

  3. Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.

  4. Don't duplicate the full text of your blog or github here. Just post the link for folks to click.

  5. Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).

  6. No trolling.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 1 year ago
MODERATORS
ruud@lemmy.world
Loki@lemmy.world
CannaVet@lemmy.world
devve@lemmy.world
HybridSarcasm@lemmy.world
HybridSarcasm@lemmy.hybridsarcasm.xyz
106
Appreciation / shock at workplace IT systems (lemmy.world)
submitted 8 months ago by brewery@lemmy.world to c/selfhosted@lemmy.world
49 comments fedilink hide all child comments
 

After self hosting several services for a few users, with SSO, backups, hardware issues etc, I really appreciate how good the IT was in my old company. Everything was connected, smooth, slick and you could tell it was secure. I had very few issues and when I did, they were quickly solved. Doing this all at scale for thousands of employees spread across the world, it is a wonderful sight to see.

Now at my current company, it's at the opposite end of the scale where I almost believe that I could do a better job by myself! They've trying to do everything you would expect but somehow doing it wrong. They are so heavy on security I have a Citrix environment that takes me 3 logins to get to, fails constantly and means I can't work without internet (like on a long train journey for work purposes recently), and on the other hand they've only just turned off admin rights for users so we could've installed anything we wanted!!! All our attachments (incoming and outgoing) are saved to a secure website (like OneDrive) and replaced with a link. It doesn't save the file names on the email so it's really tricky to find old emails if it's a document you're looking for. I could go on but just venting at this point as it's so frustrating!!!

Thank you to the good IT people out there. Your roles are so important but not appreciated enough!

you are viewing a single comment's thread
view the rest of the comments
[–] Dirk@lemmy.ml 79 points 8 months ago (25 children)

They are so heavy on security I have a Citrix environment that takes me 3 logins

My daily routine:

  1. Take laptop out of locked shelf
  2. Start Laptop and enter boot password
  3. Enter Bitlocker password
  4. Enter username (not saved) and password
  5. Open Citrix website and login with different username and password
  6. Enter MFA token to access said website
  7. Start server connection
  8. Enter different username/password (not saved) to access server
  9. Enter different MFA token for the server login
  10. Start the business-specific application with 3rd set of not saved and different login data

They also have plans to make MFA mandatory for laptop login, too.

Passwords need to be at least 15 characters long for laptops and 30 for servers and 10 for the business-specific application. All need to have uppercase, lowercase, numbers, and special characters and need to be changed every 60 days (for the server login) and cannot be the last 30 passwords.

[–] NeoNachtwaechter@lemmy.world 3 points 8 months ago (2 children)

My advice for this company: fire 2/3 of all IT staff (including managers). Then tell the remaining ones to cut off unneccessary things and do it better in the future.

[–] Dirk@lemmy.ml 7 points 8 months ago* (last edited 8 months ago) (1 children)

Big international corporate, IT security hired by personal connections instead of skill, IT security never worked in daily business.

The fun thing is, that they refer to NIST guidelines. Which is even funnier because NIST says 12 digits are enough, user-generated 8 digits are fine, no complexity rules, and password changes only "when necessary" (i.e. security breaches).

https://sprinto.com/blog/nist-password-guidelines ff.

[–] lemmyng@lemmy.ca 2 points 8 months ago

Or they work in a regulated industry that requires pseudo-airgapped machines for remote users, e.g. the machine actually interacting with the systems needs to be within the controlled boundary but the company has a presence in multiple locations, so the solution is to have a Citrix server that the users remote into. But because the SSP also has access control requirements at every stage that take a long time to get updated to newest industry standards, the user still needs to have passwords rotated, MFA, and all that kaboodle.

load more comments (22 replies)