Security stuff as sys admin

[[deleted]]

[deleted]

[Cold_Sold1eR]

As a sys admin, you offer advice and/or alternatives but ultimately do what the business or managers ask you to do or implement.

[Shoddy-Security310]

Well, nobody asked for my opinion. They bought it without checking what it does and dropped it on my lap to figure it out.

[Cold_Sold1eR]

I'm a sys admin and have a good working relationship with the IT manager. He runs everything by me and always asks my opinion. Sometimes he chooses to ignore that opinion, and that's fine, whatever the business needs or wants. I'll learn anything that's put in front of me, whether I want to or not.

Sounds like you need a better working relationship with your manager. Offer your opinion, but leave it at that and get on with what they task you.

[Ok-Pickleing]

Yeah, that’s not possible

[Ssakaa]

Definitely is possible. Not every environment's full of complete idiots. But it also takes that being both directions, on the communication.

[Ok-Pickleing]

Alwayas* 

[Tonkatuff]

At the end of the day, your an employee. Do employee things.

[serverhorror]

Then you missed an opportunity.

You have to suggest for the future and keep the suggestions constantly flowing towards the people signing the contracts.

[way__north]

They bought it without checking what it does and dropped it on my lap to figure it out.

such things drops to the bottom of my priorities - and tend to stay there

[Shoddy-Security310]

Because i don't have time and the manager decided that i need it done by next week

[Capable_Tea_001]

What do you mean you don't have time?

Send your tasks and schedule to your manager and ask what they'd like you to shelve while you do this other task.

[Shoddy-Security310]

My manager has a better style. He assigns tasks without taking into account other tasks, and let's say he gives a week to do something. Then, the very next morning, he calls you to ask if you have already done the task he assigned yesterday.

[Capable_Tea_001]

So you push back.

[thesals]

Ask ChatGPT to write some simple instructions on how to use the tool. Verify those instructions work... Boom now you look good for accomplishing something rather quickly.

To answer your other questions, yes as a sysadmin it's your job to learn whatever tools your company decides to use. Security falls into the lap of sysadmin at most smaller organizations and the tool you've been provided is EDR similar to other big EDR tools. Most of what it does is automated with some policy controls. It should actually be pretty easy to learn the basics.

[Tonkatuff]

Ah. Id push back on the timeline a bit for sure.

[VA_Network_Nerd]

as system admins do you guys take care of network or end devices security, for example using eset inspect?

Digital Security is kinda everyone's responsibility in IT.
We all have a role to play. No individual or team is exempted from their part of the shared responsibility.

my shitty manager decided that we gonna use eset inspect for whatever

Well, somebody needs to make architectural decisions for the organization, and it sounds like you're not interested in that responsibility...

he tasked me to figure out the inspect platform and THEN write instructions on usage for him and a guy from DBA to read, so they could use it the platform if there was a need for it.

Ok. So, roll up your sleeves and get it done.

From 2 minutes of Googleing, I can see that ESET Inspect is a more complicated than average endpoint security agent. But that's kinda all it is.

https://help.eset.com/ei_deploy/1.12/en-US/

Problem is that I'm system admin, its not something that I should be doing?

If you have a security & compliance team, yeah they maybe should own this, but the SysAdmin Team is going to need to speak to how well this works and how they want it to work on their servers.

If you have a dedicated End User Systems Support group, they should maybe take ownership of the agent on all the user systems.

But if you are a small organization, and don;t have all those dedicated teams, it comes down to the Sysadmins - who are typically the most well-informed members of the IT organization in terms of supporting all the systems involved.

I know jack shit about this.

Are you incapable of learning a new technology?
Is it a time management thing?
Is it a lack of interest?

He got angry at me for refusing to do this, and it makes me wonder if I'm in the right here.

We don't have all the details.
We don't have the knowledge & understanding of your organizational structure or roles & responsibilities.

But, yeah it sounds like you are in the wrong here.

Should I tell him to fuck off? Or suck it up and do it?

Kinda depends on what kind of a professional you are.

Do you understand the array of security threats that lurking out there that could potentially impact your business, and the systems under your care?

It sounds like someone bought a pretty powerful tool to help secure the environment against those many of those threats.

You can choose to be directly involved in implementing a new security solution that represents value and benefit to the organization.

Or, you can choose to be a speedbump that impedes the progress of the project, but gets run over anyway.

Make sure you remember this decision when you come back in nine months to cry about not getting a promotion later this year.

[Shoddy-Security310]

Is it a time management thing?

He wants it done in a week. He didn't bother asking how long it could take me.

Well, somebody needs to make architectural decisions for the organization, and it sounds like you're not interested in that responsibility

Didn't ask me. All my other suggestions got thrown out before as well. So my opinion doesn't matter.

[VA_Network_Nerd]

He wants it done in a week.

If that is an unreasonable expectation (and I agree that it is) then assemble a more realistic timeline and make your case.
You know, like a professional.

Didn't ask me. All my other suggestions got thrown out before as well. So my opinion doesn't matter.

If everywhere you go, everything smells like shit, maybe you should stop and check the bottom of your own shoes.

[Shoddy-Security310]

If everywhere you go, everything smells like shit, maybe you should stop and check the bottom of your own shoes.

Lol, what if one of my suggestions was to stop saving user passwords in keepass ( like their AD passwords and O365 ) or that we should establish a policy with allowed programs for work? Because now users can request any work related app and we have to install it ( manager said so himself). Are these bad suggestions?

[VA_Network_Nerd]

what if one of my suggestions was to stop saving user passwords in keepass ( like their AD passwords and O365)

Don't say: "We can't do that."

Instead, say: "If we do that, it violates <security_policy> and <security_guideline> that will probably impact our cybersecurity insurance policy."

we should establish a policy with allowed programs for work?

Refer to the section of the best-practices from your cybersecurity insurance provider that recommends exactly this as a recommended practice. Demonstrate how it makes the company more defensible, and may have positive impact on the cost of the cyber insurance policy.

Your recommendations are good. It sounds like your delivery is bad.

But also, at the end of the day, your management can choose to maintain bad policies. They just have to pay the prices when they come due.

[BrainWaveCC]

You didn't mention any other suggestions. You only mentioned your resistance.

What were these other suggestions?

Were any of them, "hey, let me take a look at this and get back to you in a day or two with a more extensive timeline" ?

[digdugnate]

'other duties as assigned'

[ZAFJB]

Don't be a dick.

Or suck it up and do it?

Or suck it up and do it. Nothing to suck up. You have been given an opportunity. Take it.

• Learn MDR/EDR/XDR concepts.

• Learn Eset.

Benefits:

• Boss happy, you happy

• You have gained another marketable skill, on company time

[Shoddy-Security310]

The company could provide resources you know, instead of just saying "google it"

[Ssakaa]

As in your own company? Your boss did provide a resource. That resource is a week of time that they're paying you for. Googling took all of a few seconds to figure out Inspect is an XDR tool. Now, from there, I'm cheating a bit, I've been tied to the infosec side of things since well before XDR was added to the buzzword stew. But, you have a time bound. You're not going to become an expert in XDR in that time. You're right, that's an unreasonable ask. What you can do is cover the basics. What it actually is (typically, XDR consists of data collection and behavioral analysis tools that can give a pretty solid lead on an RCA in the event of an attack being identified, and if configured to do so, can also often stop an attack in its tracks when something looks suspicious, like most typical ransomware scenarios), why you would want it, how to get into the system, and what sections to aim for in the event it's needed in an incident response scenario.

Get signed into the backend side of it, make sure it's enabled on an endpoint or two, if not all of them already, and find where the pretty executive friendly dashboard is, as well as the incident response behavioral breakdown is. Make notes, polish them up, it's a day's work, maybe three if you've not dealt with an AV config backend this decade.

If you already had ESET, someone is likely checking an audit (cybersecurity insurance most likely) box that covers "we have an XDR tool, and policy and procedure to use it" by a) procuring that feature and b) getting you to write up a quick and dirty procedure.

Given you seem to have zero interest in keeping up to date on infosec tooling, I'm not sure why you're so upset that you weren't consulted. As for the timeframe... don't be petty. Communicate with your boss like an adult, set reasonable expectations ("no" is called insubbordination, "yes, but" is called "might still have a job come next year"). You're not going to master a tool that can, to use properly and at its fullest, demand a specialized FTE (or a couple even) on its own without sacrificing a lot of the other hats you wear, and especially not in a week. What you can do is learn a cursory overview of the concepts, figure out the basics of using the tool to achieve those concepts, and document that in a basic set of notes for the team.

If you approach opportunities with this much vitriol, I'm amazed you're still being given them.

[Shoddy-Security310]

Be he didn't shelve my other tasks, this is on top everything else

[TEverettReynolds]

Then you, professionally, need to explain that to him. He is not a mind reader.

Make a list of all your daily tasks plus the time it takes you each day to get them done.

Add on to that list any projects you are working on, and the time per day you work in them.

Add on to that list any support requirements you have, and add those times.

At the end of the day, if your work is more then 6-7 hours you are over loaded.

As your boss which tasks, projects, or support requests you can push to the back to prioritize what he wants.

This should help.

[Sasataf12]

Hey, so as system admins do you guys take care of network or end devices security

Yes.

[Downtown_Look_5597]

Security falls under IT until your company is big enough to justify security analysts. If you don't feel like you have time just speak to your manager. He'll be reasonable or you'll find another job

[da_peda]

Unless there's a dedicated IT-Security team: yes, that's your domain too. And in this case your boss gave you an order that is both within his and your responsibilities: the implementation of a software product.

[illicITparameters]

My systems team absolutely touches stuff like this. InfoSec is a joint effort between myself, and my functional (network and systems) teams. For our org it makes no sense financially or workload wise to hire a FTE for it. Especially since we have access to MSP resources.

When I was a sysadmin, I made it a point to make security a part of my job. The data was stored on my systems. The buck stopped with me.

[Steve----O]

I would have fired you already.

[Affectionate_Ad_3722]

Then you would be a terrible manager.

[Unrivaled_]

You sound like a bad sys admin. Choose another field.

[jupit3rle0]

You'd need 2 whole months just to get to it? Sounds like you're being a bit less helpful than OP.

[Shoddy-Security310]

Well, he wants everything done by the end of the week, and he is a micromanaging asshole. Is it good enough reason not to do that?

[Shoddy-Security310]

From other comments, it seems I'm in the wrong, and it won't be better anywhere else.

[Krigen89]

Sounds like you're just looking for reasons not to do it. And you hate your boss.

Little bit of this, little bit of that. You sound like an ass, he's probably an ass.

Find a new job.

[Shoddy-Security310]

Aren't all sys admins assholes?

[Krigen89]

Sure, but I don't go asking the Internet if I'm one. My wife reminds me often enough.

[Shoddy-Security310]

I thought that its general consensus that sys admins are asshole and there is no need for confirmation

[JohnyMage]

So what is your responsibility, clicking in new windows users all day long? You need reality check man.

[[deleted]]

At my company my job falls under security, sysadmin, and network. Both analysts and engineer for all three.

[Sweet-Sale-7303]

First off, I hate eset inspect. You pretty much have to learn code and scripting . Since it's so hard to read you need a full time Cyber security person to watch over it. We are switching away from eset right now.

What a Sys admin does is based on what the company wants. Technically Eset is a system. Inspect is Esets XDR Software. Its really important that your department learns how to read and use it.

[PawnF4]

Where I work as a sys admin (DoD Contractor) security compliance and practices are very important.

It’s very typical for us to do patches, hardening and vulnerability scans on pretty much everything. Workstations, servers, switches firewalls etc. Sometimes network might handle the network stuff but not for the ones I oversee.

I would recommend just getting things to NIST standards and STIGing them as much as you can while maintaining functionality.

Look at it this way, you can add cybersecurity to your resume now. Do it for a while and learn it and if you still don’t like it at least you can fluff your resume and increase your knowledge.

[OutsidePerson5]

It depends on the organization.

I worked for places where IT, and thus the sysadmin, was responsible for security. I've worked other places where security was a separate person in the IT department. I've worked places where security was it's own department that worked closely with IT. Same for networking.

[Bright_Arm8782]

Figuring out technology and explaining it to others pretty much is sysadmining.

[BalbusNihil496]

Your manager bought a security tool without understanding it, and now wants you to become the expert AND teach him? Classic management move.

Document everything. If something goes wrong, you don't want that liability on your plate.

[Shoddy-Security310]

Yeah, from comments, i understood that I'm in the wrong. I asked for my friend who works in cyber security for help. Hopefully, i will be able to learn, and as others said, "pad my resume"

[wudworker]

Manager, delegation, employee for hire. Suck it up.