Sadly, this story doesn't surprise me at all. An associate was called in to do a light security audit over and above what we regularly do. Upon arrival, he walked in to the reception area, he was early and so, decided to wait since he knew the client representative was not on site. Seeing a CAT5 connection, he unpacked his laptop and plugged in.. It only gets worse from there; after determining they had three servers, 8 printers and 35 workstations, he then determined that the file server shares didn't have security. He got a message from the company contact stating they were running behind, and to make himself at home. At the point, he packed his laptop and walked in. He made his way through the building without challenge or assistance to the server room, he logged into the servers using the password helpfully stuck on the monitor via post-it. When he was finished auditing all the equipment, he sent himself several reports, packed up and departed without ever speaking to anyone.
@@majorjohnson8001 I have worked at a call center and other place as an it guy you can walk around and no one will question you. If you look important and in a hurry you can get anywhere. Like in a call center you are looking at your screen and not at whats happening. Also security can look good and do nothing. I mean if you say this is your pin and you know they have three systems that use the pin to login than its a 33% chance that you get it right the first time. Also IT and IT security are viewed as cost centers meaning you are not making money for the company so why should we spend money on you type of thing. Also the fact that 75% of people running companies can hardly put in their password. Antoher thing is that IT depart alot of times is under HR or another department that has no clue on IT stuff. Just some common knowledge from someone that is working in IT.
@@melkiorwiseman5234 Security... : Failed before we got to Cyber Security.. I walked into the area from a Open fence, through an open door and sat in a conference room... Got myself a coffee and then met 2 people who I did not know and asked them a bunch of questions about the systems... No one actually questioned who I was..
As an architect, I go to buildings and facilities of varying amounts of security. I am always surprised that people don't stop me more often as what I take photos of, what restricted spaces that I am at, or why I am fiddling with stuff. Obviously I am not a typical tourist or employee. Am I surprised about accessing a building? Have I told you I have accessed a building with a small crowbar? Well I cannot tell you without a signed NDA...
@@WanderingHead91367suddenly I am really happy that our building-security actually works and no doors stay open unsupervised without a very loud alarm that the door needs to be closed 😂😂
The audio volume is MUCH BETTER in this one. My car audio is at about half volume and I didn't have to touch it when I changed from another video to yours. Thanks SO MUCH!
If he walked in the back door he cheated. It's clearly marked "exit", not "entrance". How is security supposed to know someone would be so uncouth as to use an exit as an entrance. That's rude!
Welcome to pen testing. Physical pen testers have _stories._ But most of them revolve around exit-only doors and elevators. Quick pop quiz: 1) Who gives absolutely zero fucks about your elevator key-card-based-access system? . . . . . . Fire fighters. 2) Where can you get a firefighter elevator key and how much do they cost? . . . . . . eBay at worst and about $2.
@@majorjohnson8001 Another quick pop quiz: 1) Who gives absolutely zero fucks about exit-only doors? . . . . . . . Lazy employees who also smoke. 2) How often do they forget to remove the brick they use to keep this exit-only door open? . . . . . . . Atleast twice a week.
As seen in the replies - this is pretty normal. I work security for a number of disparate properties. I think half my job is unbunging doors, and resecuring supposedly secure areas. The rest is checking for leaks/(pre)fires, making sure fence lines are unbroken and dislodging vagrants. It's not exactly incompetence, it's more human nature and complacency plus large numbers of people - they look similar. If someone goes out for a smoke and bungs a door open, then three or four more smokers wander out and the original smoker returns to work ... the door stays open. The other smokers trickle back to work eventually and the door stays open. That's how they found it, so it's supposed to be that way right? Wont they get in trouble for closing it if the door is propped open for a reason? It makes sense. So the company pays a security company to send a canary (in this case me) around a couple of times a day to sniff out and resolve issues. It's similar with alarms except every now and then the canary gets "coal mined" and police get dispatched to figure out what happened.
In my Cybersecurity training, we had a lot of info on Social Engineering. It's much easier to get in by bypassing physical security than firewalls, etc. Our trainer described exactly this. He went to company X, went to the loading dock, and hung out with the smokers. (He only smoked on these specific occasions.) He hung out until the whole group of people changed, then followed one of them back in the door. He hunted around until he found an unoccupied cubicle. This cubicle had "Star Trek" stuff all over it. He thinks "I wonder. . .?" Sits down at the PC, enters the user name from the cubicle sign as firstname.lastname, puts in "wolf359" as a password- and he was in.
Really liked that story series. I did field tech stuff for a while covered 400+ offices in. Best security had me buzzed in escorted sign in and called to confirm my identity before letting me start. Worst, no one even spoke to me. Walked in an open back door and began picking up computer and walking out with them. No one said anything. The kicker was the PC they has put on top of the businesses cash safe that was left open. And no one even looked at me. I even covered up my badge by this point (I was not wearing an identifiable uniform either). Finished the PC replacement and left. Not a word. Scary.
As long as there are lazy people who also smoke it's easy to get into any building. This door isn't supposted to stay open? Ok, let's stop it from closing with a brick, so that we don't have to walk to the front entrance after our smoke break. And of course half of the time we forget to remove that brick.
One facility I delivered to when I drove Trucks solved that little foible by adjusting their Alarm System so it's ALWAYS Armed and Active but during Working Hours, the Alarm is on a Delay when certain doors are opened...leave a door open (even just propped open with a clipboard) for more than 30 seconds and the Alarm starts screaming it's head off...and the only way to open the door from the outside is with a keycard or press a buzzer and someone inside will open it from the inside... If you were an Employee and you caused the Alarm to go off by propping the door open, you got MASSIVELY Screamed at by Security and a Written Warning (your Employee Orientation was your Verbal, First Warning)...do it a second time and you're Fired FOR CAUSE... Yah, Security in that plant was THAT Anal Retentive and Paranoid, but the MINIMUM value of a 53 foot trailers worth of their product was $5,000,000.00 US (I think the most expensive load I pulled out of there was a little over $9,500,000.00) so they had a reason to be Paranoid and Anal Retentive where Security was concerned...and No, I won't tell you what it was...I don't know...For Security Reasons, I never saw the contents of my trailer, Security closed my trailer doors and sealed them while I waited in the cab and the Bill of Lading and Customs Documents were Generic...the ONLY thing about the loads I DO know are they were not Liquid (trailers have a certain feel when filled with liquid loads) or Hazmat (I wasn't Licensed or Insured for Hazmat Loads at that Company, nor was I given any Hazmat Placards when Loaded),,, And EVERY Security Guard at the Facility was armed with a pistol in a hip holster and their belts carried 3 magazine holders for a total of 7 mags of ammo (2 per holder and 1 in the pistol)...the squared off profile of the butt of the pistol suggests to me that they were Glock's of some kind but I don't know which specific model or caliber)...
Reminded me of the "Wheel of Time" series, where one whole book was devoted to lead female character's hairstyle and clothing...One kept reading because, in those days, one still had hope that the writer would GET TO THE DARNED POINT, eventually.
This is so much like almost everywhere...employees think that audits and risk assessments are just mean to "point the finger" and blame someone, while in reality it's a tool to improve the situation and save everyone's ass *before* the shit hits the fan. Yup, I have been asked many times to, uh, make my findings/observations "more palatable". No way. I only had one company where audits and risk assessments were accepted part of the company culture. Sadly, they had deadlines imposed by government organizations (and management act acting too slow, and too wrong), so it wasn't as relaxing as it should have been in that case, bur rather stressful. One example was that I was informed that I my #1 most important task was actually the #1 most important task, and that here was another #2 most important task, just with deadline Tuesday noon. It was Thursday afternoon, Monday was a national holiday. I stared the review immediately. I also called the responsible guy, who calmly explained that he was chosen to be "responsible" because he was new, and didn't know anything. I politely tried to coerce into weekend work, but he didn't want that. I asked him when he'd get up on Tuesday, and I schedules a meeting from 9 to 13 on Tuesday (hoping that if we miss the deadline by one hour, we'd still be fine). Friday morning, I already had 100+ "observations". That was going to shit. Basically, every statement in the report was wrong, contradicting other statements, or irrelevant to the controls. No way we could do that, the official ways, so I stared to completely rewrite everything. Instead of more than 400 "observations", I ended up with a reasonable documentation. I had worked on that project for quite a few months already, I knew the company procedures, I knew the Privileged Access Management (PAM) options they were using, I even knew which firmware their line cars were running, and I had access to their (extremely well maintained!) software and hardware databases. There was only one question I couldn't answer. Regardless, i wasn't the "responsible person", so we had to review my work on Tuesday. Tuesday arrived, we had our meeting, all went smooth. The one question I couldn't answer was, surprising, the one question the guy knew the answer for! Nice. Until the words "penetration testing" appeared on the screen. The guy paled and panicked immediately. "We're toast! We're done for! We..." Me: "No need to worry. We just need to enter a confirmed completion date for the measure, and that'll count as a 'pass' if it's in the near future." Him. "It's two hours until the deadline! And I don't even know who'd I have to ask to plan this! They fry us. We'd..." Me: "I know the correct person, and he's nice, cooperative, efficient, and does get up early." Him: "No was can even plan this in just two hours!" Me: "I'm extremely confident that this indeed possible in hours." Him: "I just checked his calendar! He's completely booked! No way! They'll kill us!" Me: "We can definitely do this in two hours. But let me shorten this discussion by just entering this completion dats..." Guy went into complete nuclear meltdown. "We can't lie here! They'll find out! They'll go down hard on us! The won't just kill us, they might even report us to HR!" Me: "Uh. You're right. But I mentioned that this guy gets up early, so I got up *fucking* early this morning as well. I received the guaranteed confirmed completion date two minutes before our meeting started; I just hadn't had the time to fill it in because I needed to grab some coffee first." Him: "..." Him: "..." Him: "..." We finished everything ahead of schedule. In the end, the guy also provided valuable input on risks identified. Teamwork at its best! And I was happy when this project was over.
At 43:10, Surprised that he was able to walk right in. I got a good one for you. I walked right in to the Tesla factory in Fremont, CA. That was after playing with the Beta Model S prototype and original Roadster prototype sitting in a remote part of the parking lot. Walked right in through an open dock door, gave myself a tour, not a single person batted an eye. I did take video of the prototypes, pissed at how poor a condition they were and left outside to rot, instead of in a museum or showroom. Didn't record being in the factory, as they would have been a dead giveaway. Definitely wasn't dressed like an employee. I was head to toe in black. Black fedora, black mechanics shirt, black dress pants and black steel toe shoes. I was originally going to the factory for the Model 3 delivery event being held on the other side of the campus on the test track.
Lawtech, Gambette, TuxedoJax and Bytewave are among the best of contributors on TFTS. I'd include Airz but he's been cursed for never finishing his epic tale.
Ah man, this one really hits home. Except I was all of the people LawTechie spoke to (yes, occasionally I felt as clueless as Barry too) and expected to be LawTechie as well, all rolled into one. Also hits cause LawTechie managed to use two of my kids names in his story 😄
I'm glad I decided to go back and look at the words instead of just listening. "GreyGoo's" sounded like "Gray Goose" and I wondered what the vodka company had to do with this story.
Love the tales from tech support stories i love how i can relate to alot of them back in my tier 1 help desk days i had a customer fist ask how to make a capital "P" then ask how to copy and paste 🙃
Chutzpah is pronounced like Hootspah (the o's in hoot are said like the o's in foot)... I believe it's a Yiddish word which explains the weird sound to the ch... I think... 😄😁😆😅😂🤣
What the hell did I just listen to? This story was so full of buzzwords, metaphors and clichés that I feel I need a translator! XD I genuinely have no clue what it was about...
I'm an American who landed in Leeds to travel to York for a couple of days. Both places, and the people there, were very nice; no idea what OP meant by that comment.
I would have said to Barry.. There is no point trying to kick me out of the site.. You have a big hole in the rear that I walked in through. Talk about Cyber Security.. They don't even have security.
Unfortunately I have been part of worse security failures that had WWIII implications. This was in 1974. Implications that could have lead a Navy O-6 going to prison.
I know I'm late to the party, but does anyone besides me think reddit is just a place for English majors who have dreams of being the next John Graham?
@@KarmaStoriesPodcast no. I wasn't saying that I was mad about it, or calling foul. I just wanted to know if it was just me. Am I the only one that has intrusive thoughts like that in the middle of a decent story? I listened to the entire thing.
Jesus Christ. I don't even know where to begin. I would hate to be the IT Security Compliance Officer at any site for this company. And I'd hate to be the person trying to do their BCP or COOP plans. The penetration test, if done 7 months ago, likely already had its vulnerabilities addressed. If not, those same vulnerabilities would appear in the upcoming pen test. Which as scary as it may sound, is probably why these team members are pushing to downgrade the vulnerabilities. Because they know nothing has change in the network environment to prevent them and they don't want any of the same high level vulnerabilities to pop up on the next one. Because then they are really get raked over the coals. One for having the vulnerabilities. Two for not correcting them. Three for not addressing them with a corrective action plan to begin with the first time. As for the data center. You hire one person. You give them a title big enough that people have to listen to that person, and you set them loose to fully document everything. You are talking months of work at each site but at the end, you will be incompliance. Also if your trying to open the market to government entities who may be of interest in using the products / services you provide the documentation and testing to be a part of the market is huge. In short, this company is behind on getting a product out the door, neglected documentation and security over product stability, and just needs another year on their release date to get things done.
This story was just as much fun as the County bring your children to work day where the little kiddies were in the computer room nearly all day, given free range that ran the county's 9-1-1 system, payroll / personnel, assessor / treasurer systems, court / legal systems, permit system, with the hellion grandson of an operator running up and down the isles of millions of dollars worth of equipment flipping switches on and off. After that, I asked management there a polite "Why?". That was the very last bring your children to work day to the secured data center. l recovered somewhat and my high blood pressure seems to have returned to near normal again.
Personally, I'd have impaled the person responsible for Bring Your Child To Work Day on a Stake (like Vlad the Impaler did to HIS Enemies in the 15th Century) outside the front doors and then while staring at the resulting Graphic Warning about the Consequences of Poor Decisions, asked the person's Supervisor why their Subordinate was allowed to implement such a stupid decision... With the implication that if their answer to my question isn't satisfactory, THEY will join their Subordinate on a stake on the other side of the front doors... 😄😁😆😅😂🤣
@@HappilyHomicidalHooligan Unfortunately, the political environment was not in my favor at all there and any notes or comments needed to be as bland as possible, in spite of the county wide impact the dear little kiddies may have had. In fact, if they caused massive destruction, the corrupt administration (a married couple managing 82% of the agency in opposition to county law as confirmed by may attorney), I would be blamed for it and possibly fired. You know -- that's just the way it is. Empowerment was not a word that rank and file employees could ever hope to understand in any meaningful way unless... you were a diversity hire....
Loved this! If I was in OP’s place, I don’t think that I would have been as gracious. Consultant or not, it would have made my ears bleed, hearing all the incompetence running rampant🤪😫😳. I was just cringing with each tale.👍🏼👍🏼👍🏼👍🏼🇨🇦
BMW bike riders are the most unfriendly/snobby bike riders you will ever find on the road. At least in my tri state area. Not even going to call them bikers.
These people seem a little Squarely. Some are on the Mark some don't give a Chuck. Claraly no Ray of sunshine and some Barry bad management. Okay, I'll show myself out.
Ive done several tele jobs, sone call center some wfh, never seen a call center that advertised its location. Actually stumbled on one one night when a worker exited a steel door to have a smoke and i just happened to see rows of people on the phones...
Being a single mother and being on the spectrum as reasons for special treatment is getting old and I have thirty two years of service to people on the spectrum
Sadly, this story doesn't surprise me at all. An associate was called in to do a light security audit over and above what we regularly do. Upon arrival, he walked in to the reception area, he was early and so, decided to wait since he knew the client representative was not on site. Seeing a CAT5 connection, he unpacked his laptop and plugged in.. It only gets worse from there; after determining they had three servers, 8 printers and 35 workstations, he then determined that the file server shares didn't have security.
He got a message from the company contact stating they were running behind, and to make himself at home. At the point, he packed his laptop and walked in. He made his way through the building without challenge or assistance to the server room, he logged into the servers using the password helpfully stuck on the monitor via post-it. When he was finished auditing all the equipment, he sent himself several reports, packed up and departed without ever speaking to anyone.
How to not get questioned:
Look like you belong there and know what you're doing.
@@majorjohnson8001 I have worked at a call center and other place as an it guy you can walk around and no one will question you. If you look important and in a hurry you can get anywhere. Like in a call center you are looking at your screen and not at whats happening. Also security can look good and do nothing. I mean if you say this is your pin and you know they have three systems that use the pin to login than its a 33% chance that you get it right the first time. Also IT and IT security are viewed as cost centers meaning you are not making money for the company so why should we spend money on you type of thing. Also the fact that 75% of people running companies can hardly put in their password.
Antoher thing is that IT depart alot of times is under HR or another department that has no clue on IT stuff. Just some common knowledge from someone that is working in IT.
Jesus christ , so many security violations.
His report only needed to be two words...
"Security: Nonexistent"
@@melkiorwiseman5234 Security... : Failed before we got to Cyber Security.. I walked into the area from a Open fence, through an open door and sat in a conference room... Got myself a coffee and then met 2 people who I did not know and asked them a bunch of questions about the systems... No one actually questioned who I was..
Whoever runs facilities or site security for that free-standing door without walls of a call center probably needs to lose their job last month.
As an architect, I go to buildings and facilities of varying amounts of security. I am always surprised that people don't stop me more often as what I take photos of, what restricted spaces that I am at, or why I am fiddling with stuff. Obviously I am not a typical tourist or employee. Am I surprised about accessing a building? Have I told you I have accessed a building with a small crowbar? Well I cannot tell you without a signed NDA...
@@WanderingHead91367suddenly I am really happy that our building-security actually works and no doors stay open unsupervised without a very loud alarm that the door needs to be closed 😂😂
The audio volume is MUCH BETTER in this one. My car audio is at about half volume and I didn't have to touch it when I changed from another video to yours. Thanks SO MUCH!
Thank you Jody! They'll be that way going forward.
If he walked in the back door he cheated. It's clearly marked "exit", not "entrance". How is security supposed to know someone would be so uncouth as to use an exit as an entrance. That's rude!
Wow... just wow... can't believe that OP got into what should be a secure area like that...
Thanks to OP and KCC for this episode.
Welcome to pen testing. Physical pen testers have _stories._ But most of them revolve around exit-only doors and elevators.
Quick pop quiz:
1) Who gives absolutely zero fucks about your elevator key-card-based-access system?
.
.
.
.
.
.
Fire fighters.
2) Where can you get a firefighter elevator key and how much do they cost?
.
.
.
.
.
.
eBay at worst and about $2.
@@majorjohnson8001 😳
@@majorjohnson8001 Another quick pop quiz:
1) Who gives absolutely zero fucks about exit-only doors?
.
.
.
.
.
.
.
Lazy employees who also smoke.
2) How often do they forget to remove the brick they use to keep this exit-only door open?
.
.
.
.
.
.
.
Atleast twice a week.
@@majorjohnson8001 yea and canned air will open automatic doors. Film can open doors with handles well as well.
As seen in the replies - this is pretty normal.
I work security for a number of disparate properties. I think half my job is unbunging doors, and resecuring supposedly secure areas.
The rest is checking for leaks/(pre)fires, making sure fence lines are unbroken and dislodging vagrants.
It's not exactly incompetence, it's more human nature and complacency plus large numbers of people - they look similar.
If someone goes out for a smoke and bungs a door open, then three or four more smokers wander out and the original smoker returns to work ... the door stays open. The other smokers trickle back to work eventually and the door stays open. That's how they found it, so it's supposed to be that way right? Wont they get in trouble for closing it if the door is propped open for a reason?
It makes sense. So the company pays a security company to send a canary (in this case me) around a couple of times a day to sniff out and resolve issues.
It's similar with alarms except every now and then the canary gets "coal mined" and police get dispatched to figure out what happened.
In my Cybersecurity training, we had a lot of info on Social Engineering. It's much easier to get in by bypassing physical security than firewalls, etc. Our trainer described exactly this. He went to company X, went to the loading dock, and hung out with the smokers. (He only smoked on these specific occasions.) He hung out until the whole group of people changed, then followed one of them back in the door. He hunted around until he found an unoccupied cubicle. This cubicle had "Star Trek" stuff all over it. He thinks "I wonder. . .?" Sits down at the PC, enters the user name from the cubicle sign as firstname.lastname, puts in "wolf359" as a password- and he was in.
He guessed Wolf359? O crap... I'm going to have to put away all my Star Trek stuff and bring in my Dr Who stuff from home now. 🖖
Please explain wolf359
@@pianissimo7121 Wolf 359 is a star in the Leo constellation. In Star Trek the first major battle with the Borg occurred near Wolf 359.
When the pun is so "pun"ishing that even KCC groans.
PUNishing or PUNgent?
Both?
It certainly was PUNny...
😄😁😆😅😂🤣
Really liked that story series. I did field tech stuff for a while covered 400+ offices in. Best security had me buzzed in escorted sign in and called to confirm my identity before letting me start. Worst, no one even spoke to me. Walked in an open back door and began picking up computer and walking out with them. No one said anything. The kicker was the PC they has put on top of the businesses cash safe that was left open. And no one even looked at me. I even covered up my badge by this point (I was not wearing an identifiable uniform either). Finished the PC replacement and left. Not a word. Scary.
I love the chameleon with the cookie! Made my day better just by seeing that and listening to silly people
As long as there are lazy people who also smoke it's easy to get into any building. This door isn't supposted to stay open? Ok, let's stop it from closing with a brick, so that we don't have to walk to the front entrance after our smoke break. And of course half of the time we forget to remove that brick.
One facility I delivered to when I drove Trucks solved that little foible by adjusting their Alarm System so it's ALWAYS Armed and Active but during Working Hours, the Alarm is on a Delay when certain doors are opened...leave a door open (even just propped open with a clipboard) for more than 30 seconds and the Alarm starts screaming it's head off...and the only way to open the door from the outside is with a keycard or press a buzzer and someone inside will open it from the inside...
If you were an Employee and you caused the Alarm to go off by propping the door open, you got MASSIVELY Screamed at by Security and a Written Warning (your Employee Orientation was your Verbal, First Warning)...do it a second time and you're Fired FOR CAUSE...
Yah, Security in that plant was THAT Anal Retentive and Paranoid, but the MINIMUM value of a 53 foot trailers worth of their product was $5,000,000.00 US (I think the most expensive load I pulled out of there was a little over $9,500,000.00) so they had a reason to be Paranoid and Anal Retentive where Security was concerned...and No, I won't tell you what it was...I don't know...For Security Reasons, I never saw the contents of my trailer, Security closed my trailer doors and sealed them while I waited in the cab and the Bill of Lading and Customs Documents were Generic...the ONLY thing about the loads I DO know are they were not Liquid (trailers have a certain feel when filled with liquid loads) or Hazmat (I wasn't Licensed or Insured for Hazmat Loads at that Company, nor was I given any Hazmat Placards when Loaded),,,
And EVERY Security Guard at the Facility was armed with a pistol in a hip holster and their belts carried 3 magazine holders for a total of 7 mags of ammo (2 per holder and 1 in the pistol)...the squared off profile of the butt of the pistol suggests to me that they were Glock's of some kind but I don't know which specific model or caliber)...
Part 4 sounds like all he did in Pittsburgh was a meeting which he could have just as well done online.
The OP in the first story seems to love his own writing. I almost skipped to the end.
And so little of it is actually understandable.
I love his writing too.
@@impishrebel5969 You could always Google search the terms, and learn what they mean.
Reminded me of the "Wheel of Time" series, where one whole book was devoted to lead female character's hairstyle and clothing...One kept reading because, in those days, one still had hope that the writer would GET TO THE DARNED POINT, eventually.
@@Kayenne54 ,
Eventually... he died before eventually happened.
I've done more than one business trip on my bike while being paid mileage. Lovely!
This is so much like almost everywhere...employees think that audits and risk assessments are just mean to "point the finger" and blame someone, while in reality it's a tool to improve the situation and save everyone's ass *before* the shit hits the fan.
Yup, I have been asked many times to, uh, make my findings/observations "more palatable". No way.
I only had one company where audits and risk assessments were accepted part of the company culture. Sadly, they had deadlines imposed by government organizations (and management act acting too slow, and too wrong), so it wasn't as relaxing as it should have been in that case, bur rather stressful.
One example was that I was informed that I my #1 most important task was actually the #1 most important task, and that here was another #2 most important task, just with deadline Tuesday noon.
It was Thursday afternoon, Monday was a national holiday. I stared the review immediately. I also called the responsible guy, who calmly explained that he was chosen to be "responsible" because he was new, and didn't know anything. I politely tried to coerce into weekend work, but he didn't want that. I asked him when he'd get up on Tuesday, and I schedules a meeting from 9 to 13 on Tuesday (hoping that if we miss the deadline by one hour, we'd still be fine).
Friday morning, I already had 100+ "observations". That was going to shit. Basically, every statement in the report was wrong, contradicting other statements, or irrelevant to the controls.
No way we could do that, the official ways, so I stared to completely rewrite everything. Instead of more than 400 "observations", I ended up with a reasonable documentation. I had worked on that project for quite a few months already, I knew the company procedures, I knew the Privileged Access Management (PAM) options they were using, I even knew which firmware their line cars were running, and I had access to their (extremely well maintained!) software and hardware databases.
There was only one question I couldn't answer. Regardless, i wasn't the "responsible person", so we had to review my work on Tuesday.
Tuesday arrived, we had our meeting, all went smooth. The one question I couldn't answer was, surprising, the one question the guy knew the answer for! Nice.
Until the words "penetration testing" appeared on the screen. The guy paled and panicked immediately.
"We're toast! We're done for! We..."
Me: "No need to worry. We just need to enter a confirmed completion date for the measure, and that'll count as a 'pass' if it's in the near future."
Him. "It's two hours until the deadline! And I don't even know who'd I have to ask to plan this! They fry us. We'd..."
Me: "I know the correct person, and he's nice, cooperative, efficient, and does get up early."
Him: "No was can even plan this in just two hours!"
Me: "I'm extremely confident that this indeed possible in hours."
Him: "I just checked his calendar! He's completely booked! No way! They'll kill us!"
Me: "We can definitely do this in two hours. But let me shorten this discussion by just entering this completion dats..."
Guy went into complete nuclear meltdown. "We can't lie here! They'll find out! They'll go down hard on us! The won't just kill us, they might even report us to HR!"
Me: "Uh. You're right. But I mentioned that this guy gets up early, so I got up *fucking* early this morning as well. I received the guaranteed confirmed completion date two minutes before our meeting started; I just hadn't had the time to fill it in because I needed to grab some coffee first."
Him: "..."
Him: "..."
Him: "..."
We finished everything ahead of schedule. In the end, the guy also provided valuable input on risks identified. Teamwork at its best!
And I was happy when this project was over.
At 43:10, Surprised that he was able to walk right in.
I got a good one for you. I walked right in to the Tesla factory in Fremont, CA. That was after playing with the Beta Model S prototype and original Roadster prototype sitting in a remote part of the parking lot. Walked right in through an open dock door, gave myself a tour, not a single person batted an eye.
I did take video of the prototypes, pissed at how poor a condition they were and left outside to rot, instead of in a museum or showroom.
Didn't record being in the factory, as they would have been a dead giveaway. Definitely wasn't dressed like an employee. I was head to toe in black. Black fedora, black mechanics shirt, black dress pants and black steel toe shoes. I was originally going to the factory for the Model 3 delivery event being held on the other side of the campus on the test track.
this one is gonna be fun. I'm studying cybersecurity, I love this stuff hahah
I like this guy's style. I how we get more from him
Lawtech, Gambette, TuxedoJax and Bytewave are among the best of contributors on TFTS.
I'd include Airz but he's been cursed for never finishing his epic tale.
Ah man, this one really hits home. Except I was all of the people LawTechie spoke to (yes, occasionally I felt as clueless as Barry too) and expected to be LawTechie as well, all rolled into one. Also hits cause LawTechie managed to use two of my kids names in his story 😄
I'm glad I decided to go back and look at the words instead of just listening. "GreyGoo's" sounded like "Gray Goose" and I wondered what the vodka company had to do with this story.
Love the tales from tech support stories i love how i can relate to alot of them back in my tier 1 help desk days i had a customer fist ask how to make a capital "P" then ask how to copy and paste 🙃
How to get someone to pay for your road trip.
Might not be worth all the hassle and ID107s you have to deal with....
Chutzpah is pronounced like Hootspah (the o's in hoot are said like the o's in foot)...
I believe it's a Yiddish word which explains the weird sound to the ch...
I think...
😄😁😆😅😂🤣
It is.
“Dug some man-size holes in the woods when things went bad.”
That. Was. Awesome.
Bytewave and LawTechie are probably my 2 favorite Reddit posters EVER
What the hell did I just listen to?
This story was so full of buzzwords, metaphors and clichés that I feel I need a translator!
XD
I genuinely have no clue what it was about...
I worked for a company that worked on air handling units for call centers data centers and the like. Most of them were security nightmares
As a Yorkshireman, I formally object to the disparaging remarks made about the glorious city of Leeds
I'm an American who landed in Leeds to travel to York for a couple of days. Both places, and the people there, were very nice; no idea what OP meant by that comment.
Security audits of this nature need to be authorized at the highest level of the company. Interference from people like Barry should not be tolerated.
The classic stories I used to love reading were the fireworks guy.
I would have said to Barry.. There is no point trying to kick me out of the site.. You have a big hole in the rear that I walked in through. Talk about Cyber Security.. They don't even have security.
Half of his writing is incomprehensible gibberish that only he seems to get the references to.
Lots of adjectives. Unnecessary, useless, boring adjectives.
It's one thing to get backdoor access to a system... but this is just silly. He got _literal_ backdoor access.
4:07 that frame is amazing. I need it to be framed and pinned to a wall
I’m waiting for the plain English version of this story to come out.
I am so glad that my route through a development career never included any consulting/contracting work. This would be hell to me.
Very enjoyable. Unfortunately, I understood his every ironic point. Security and staff are seldom compatible.
7:01 had me shouting "What?!"
Unfortunately I have been part of worse security failures that had WWIII implications. This was in 1974.
Implications that could have lead a Navy O-6 going to prison.
And … the day is off to a great start … and … it’s Rob! Thanks Rob!
Okay, someone needs to turn these stories into a sitcom!
Bet a leading cause of Issues on this Subreddit is P.I.C.N.I.C. issues. (Problem In Chair, Not In Computer)
The Palo Alto fw is not easy to handle … and can do just what Barry said , if failover isnt set up in a special way. Oooups.
This really deserves more parts. Great story.
i love these stories, im big into tech repair/IT these stories are great
Its why I loved freelance back in the early 2000s
I know I'm late to the party, but does anyone besides me think reddit is just a place for English majors who have dreams of being the next John Graham?
Does it really matter though? It's all entertaining!
@@KarmaStoriesPodcast no. I wasn't saying that I was mad about it, or calling foul. I just wanted to know if it was just me. Am I the only one that has intrusive thoughts like that in the middle of a decent story?
I listened to the entire thing.
Oh jeez. I know that coffee machine
This guy knows his shit if he can spot a /7
Also: 603 is ole' New Hampshah
Wicked cool.
Z.Cavarichis bring back memories
Only because of OP's name, I'm wondering if Law Techy was inspired by the name of the lockpickinglawyer or LPL.
"She's given me what I asked for, not what I want" well,.OP, then ask for exactly what you want. She complied with your request as asked.
Jesus Christ. I don't even know where to begin. I would hate to be the IT Security Compliance Officer at any site for this company. And I'd hate to be the person trying to do their BCP or COOP plans.
The penetration test, if done 7 months ago, likely already had its vulnerabilities addressed. If not, those same vulnerabilities would appear in the upcoming pen test. Which as scary as it may sound, is probably why these team members are pushing to downgrade the vulnerabilities. Because they know nothing has change in the network environment to prevent them and they don't want any of the same high level vulnerabilities to pop up on the next one. Because then they are really get raked over the coals. One for having the vulnerabilities. Two for not correcting them. Three for not addressing them with a corrective action plan to begin with the first time.
As for the data center. You hire one person. You give them a title big enough that people have to listen to that person, and you set them loose to fully document everything. You are talking months of work at each site but at the end, you will be incompliance. Also if your trying to open the market to government entities who may be of interest in using the products / services you provide the documentation and testing to be a part of the market is huge.
In short, this company is behind on getting a product out the door, neglected documentation and security over product stability, and just needs another year on their release date to get things done.
SO Grey Goo is Electronic Arts?
Idk what the KY equivalent for Chutzpah is, but look up that pronunciation. It's not a hard 'ch'; it's a throat sound. Or you can say Hutzpah.
Yep, act like you're trying to hock a loogie.
This story was just as much fun as the County bring your children to work day where the little kiddies were in the computer room nearly all day, given free range that ran the county's 9-1-1 system, payroll / personnel, assessor / treasurer systems, court / legal systems, permit system, with the hellion grandson of an operator running up and down the isles of millions of dollars worth of equipment flipping switches on and off.
After that, I asked management there a polite "Why?". That was the very last bring your children to work day to the secured data center. l recovered somewhat and my high blood pressure seems to have returned to near normal again.
Personally, I'd have impaled the person responsible for Bring Your Child To Work Day on a Stake (like Vlad the Impaler did to HIS Enemies in the 15th Century) outside the front doors and then while staring at the resulting Graphic Warning about the Consequences of Poor Decisions, asked the person's Supervisor why their Subordinate was allowed to implement such a stupid decision...
With the implication that if their answer to my question isn't satisfactory, THEY will join their Subordinate on a stake on the other side of the front doors...
😄😁😆😅😂🤣
@@HappilyHomicidalHooligan Unfortunately, the political environment was not in my favor at all there and any notes or comments needed to be as bland as possible, in spite of the county wide impact the dear little kiddies may have had. In fact, if they caused massive destruction, the corrupt administration (a married couple managing 82% of the agency in opposition to county law as confirmed by may attorney), I would be blamed for it and possibly fired. You know -- that's just the way it is.
Empowerment was not a word that rank and file employees could ever hope to understand in any meaningful way unless... you were a diversity hire....
Thanks Rob. Have a good night
I love this guy.. story was amazing 😂😂
Living the life
Pittsburg is best seen from the back mirror?
The real life Lenny face in the thumbnail brings...questionable implications to the title.
Loved this! If I was in OP’s place, I don’t think that I would have been as gracious. Consultant or not, it would have made my ears bleed, hearing all the incompetence running rampant🤪😫😳. I was just cringing with each tale.👍🏼👍🏼👍🏼👍🏼🇨🇦
Sounds like Waukesha Wisconsin
... emperor dorn I recognize your story...:)
Christ, its my days and united health come back to haunt me!!!!
Cargo Cult, ha ha, bet 90% don't know what religion that is.
Any connection with Clutch Cargo?
Love these long stories
BMW bike riders are the most unfriendly/snobby bike riders you will ever find on the road. At least in my tri state area. Not even going to call them bikers.
I would walk out after 30 minutes.
These people seem a little Squarely. Some are on the Mark some don't give a Chuck. Claraly no Ray of sunshine and some Barry bad management.
Okay, I'll show myself out.
Crypto dude will be working there til he dies then.
Me re: Crypto since day 1: "The emperor has no clothes!"
Now this is interesting because he came to my city
you did the kevin in the big rig series how about lawtekkie on tech support series?
Palo Alto Routers are just the best.
Ive done several tele jobs, sone call center some wfh, never seen a call center that advertised its location. Actually stumbled on one one night when a worker exited a steel door to have a smoke and i just happened to see rows of people on the phones...
Being a single mother and being on the spectrum as reasons for special treatment is getting old and I have thirty two years of service to people on the spectrum
Showcases of Professionalism or Passive Aggressive Spatula Fights! OMG, I died laughing. Very Cool.
Another great video
Sometimes I mute sound, and speed up text to 1:25 via settings. This one I decided to speed it up by 1.5. Because life is short.
YES!
..... OMG so funny!
How BORING!!!
So... Do you feel better when you make comments like this?
This was too technical for me. Gave up.
Damn OP has some really good writing skills. Fascinating and sadly not so uncommon string of happenings 😅
Good morning
Law techie always has good stories
Early video today
❤❤❤❤
No link to OP, downvote, this is stolen content peeps.
😍➡️🦎
Go-dot 🤨
Go-dot?!! Waiting for Go-dot??! Do you think that's the name of a domain name finding service maybe, or something?!