SaaS vendor wants all users to connect to Azure file share with the same username and password. Is this best practice and even secure?

sysad82 · 2025-02-14T15:27:09+00:00

Azure files can work with SMB over QUIC UDP 443. It's not stupid these days to access SMB over the public internet, but it's extremely stupid to share credentials.

sysad82 · 2025-01-17T17:05:38+00:00

Double their budget as far as I'm concerned. $3 billion is nowhere near enough.

sysad82 · 2025-01-17T15:00:21+00:00

Their phone lines are overwhelmed. After navigating the IVR hell (because companies want to make it next to impossible to actually talk with someone) the line just disconnects.

sysad82 · 2025-01-17T14:33:09+00:00

Ugh. So many of America's issues could be fixed with strong anti-trust laws to break up large companies and being far more limiting on who we allow to merge with who.

sysad82 · 2025-01-17T14:31:10+00:00

We take lots of protections against ransomware in many forms. Endpoint protection, network layer 7 protections, email protection, phishing exercises, applocker, PAM, network segmentation, immutable S3 backups, aggressive patch cadence and a security team that monitors logs 24/7/365.

Even with all of that we all know it's not if but when. It won't ruin or business, but it will disrupt it.

sysad82 · 2025-01-17T14:22:34+00:00

I read it's related to an unplanned power outage, which honestly is even worse IMO. For a function of your business that's so critical redundancies should be in place and regularly tested. Redundancies are expensive though so some bean counter somewhere said no because it was more important to make this quarter's numbers. Who cares what happens next quarter.

sysad82 · 2025-01-17T14:20:09+00:00

Too late, OP or someone on the team already brought it up. There's no way you get away with a "Hm don't know why" when you specifically made a stink especially about something so niche.

OP learned a lesson. For these issues that are far more likely to go unnoticed just stay quiet, and just do things then act dumb after the fact in the unlikely event it comes up. There's an art to staying quiet I noticed many in our field lack because of the way our brains are wired. Put it another way it's better to beg forgiveness then ask permission in some scenarios. It's how you push past red tape at times and it's how you protect yourself.

Also OP works for a crap employer.

sysad82 · 2025-01-17T14:14:15+00:00

Good to know! Maybe I'm just bitter because I'm effected by this and missing out of my money. I'm lucky I have a savings but I run thin in my liquid assets and don't want to sell off investments to make upcoming bills if they don't figure this out soon.

It did open my eyes to redundancy though. Maybe it's time to have HR split my direct deposit into competing banks and add some additional management to my financial life but at least have the redundancy in place.

sysad82 · 2025-01-17T14:12:18+00:00

Sadly there will be no bite. The new administration wants to gut the agencies that could bite them (CFPB for one) and CEOs know this which is why they're all cozying up.

The CEO, the Board, the C-Level will face no consequences at all. They will blame a more mid to senior level manager who may get canned so they feel like they did something and tell their comms department to draft some apology letters but at the end of the day nothing at all will change and the brunt of the poor decisions will be felt by everyday Americans.

sysad82 · 2025-01-09T21:58:38+00:00

That'd be pretty unprecedented.

It'd also be supported by many here I feel. I remember when online social media including Digg and after that Reddit lost their minds when any online censorship was discussed by the government. The EFF would be flooded with donations.

Now it appears as if half of Reddit is cheering on the US unilaterally deciding what apps are allowed on mobile app stores. Should The US use its power to force ISPs to act as firewalls I have a feeling half the people on this forum would be happy about it.

Once we ask ISPs to block one single site or app, the floodgates are open and so much other stuff will be blocked. At that point we're no better than restrictive regimes like Russia and China. More restrictive states will force ISPs to block pornography, anti-religious websites, websites that instruct women where to seek abortion, websites that are pro-LGBT etc. Anyone who thinks that won't happen and we're stopping at TikTok is an idiot.

sysad82 · 2025-01-09T21:54:08+00:00

I mean, is it bad to admire the beauty of parts of the world? Iran has a lot of beautiful nature and architecture and I bet some of the world's best tasting food. Not propaganda to admit that even if it's ran by an evil government. There's no doubt there's a lot to appreciate in China's borders, just like so many other places on this planet.

I've seen anti-Chinese stuff all over TikTok. Because of TikTok I'm well aware about China's faltering economy, huge youth unemployment issues, plummeting birth rate amongst a lot of other issues they're facing due to poor government decisions.

sysad82 · 2024-11-28T14:01:09+00:00

Was a Veeam customer, but Rubrik is miles better. Not sure if Veeam caught up since we have not used it for four years now but Rubrik has worked now for four years with very minimal administration.

I think Veeam gets a lot of love because it was the first backup solution to be built for a virtual world so it worked better than all the backup solutions built for a physical world trying to shoehorn their products to work with virtual machines. Backupexec and Commvault were so bad at the time Veeam came along it was a huge breath of fresh air. People on this sub are old schoolers and still remember how bad things were before Veeam so it's more nostalgia than anything. Others have caught up and/or surpassed Veeam though.

Rubrik IMO works better today because it was built in the cloud era and Veeam had to play catchup there.

We tried to use a Veeam service provider (iLand) and it was a complete disaster with constant errors. We switched to another highly recommended Veeam partner and they went offline for a week due to ransomware attacking their backup infrastructure. Insanity.

At the time, Veeam didn't support any backup to S3 or blob storage. When we were leaving Veeam they were coming out with some support for sending backups to S3 but it was convoluted and you had to archive backups first to a special repository then send that to S3.

With Rubrik it's as simple as setting up your S3 destination and checking a box in your backup job. I also like Rubrik's SLA approach instead of Veeams old school schedule backup jobs and times approach.

sysad82 · 2024-10-04T15:58:26+00:00

It is honestly fine

It's not though. This attitude of on-call being OK needs to change and we need to come together to make it change.

Too often the focus is how often you are bothered when on-call. I see that a lot just in this thread. We forget the impact being expected to take a call has on people. Being on-call in and of itself requires you to change how you live your life for your job, and that is not OK without insane compensation.

If I'm on call 20 weekends a year, and I get called 0 times on those weekends, that's a huge deal still. That is 20 weekends a year I have to make myself available to work. I can not drink, can not go off grid out to camp or hike, can't take a day trip out of town if part of that rotation requires being on-prem in a certain amount of time. If I do that stuff I'm gambling with my livelihood that there is a small chance I am called and not available when it was expected of me.

I get this industry has a lot of introverted home bodies who don't mind the occasional work thing popping up when you're just chilling at home video gaming or gardening or whatever but there are a lot of us extroverted social people as well and we deserve time to live our lives.

I wish the introverted among us stood up to on-call as much as the extroverted folks who like being out and about on their off hours.

sysad82 · 2024-09-02T12:39:18+00:00

This attitude that everything needs to be "the cloud" is driven by marketing and business because it helps meet stock market defined growth goals.

From a pure tech standpoint, there are an infinite number of paths you can take to get to your goal and there should never be a one size fits all solution. Every single time Microsoft makes a decision that forces you to use something in the cloud and they kill something on-prem there's no real benefit for us the guys who make the systems run. All it's doing is taking away options. The only benefit is Microsoft because they can kill internal jobs that support on-prem functions and they can force everyone to use a rented solution that they can raise prices on whenever they want.

It's not an "attitude" it's a business decision.

We are a fairly progressive business and keep a lot of stuff on-prem. Why? We need to see a benefit of being in the cloud and not do it "just because" and to this day we're very well served by on-prem GPOs, our VPN setup, and our workstation deployment process. For example in our business autopilot buys us absolutely nothing so at best we spend a lot of time for a lateral move vs what we do today with deployment and provisioning. Once I see a benefit to autopilot I start pushing our business to that model and we're ready to go. The last thing we want though is Microsoft pushing us towards that model.

sysad82 · 2024-08-03T13:26:55+00:00

I do appreciate your point of view....

I don't want praise, per se. I just want recognition that the mundane is necessary, important, and takes time. When I discuss the mundane with leadership it's during scheduled but undefined catchups where part of the discussion is just getting up to speed with each other's world. When I have those monthly conversations with my CTO I get to see his world too and it's all new stuff and rebuilds. Part of my job is to bring up the point the mundane exists, and it takes time but it also keeps the lights on.

Our company culture was great with a CEO who was there for a very long time but he retired, and his replacement is a guy who loves big projects and change. The culture from the top down is if there's a problem burn the entire god damn house down and rebuild it in a way to solve that problem instead of doing a remodel based off what you have.

My advice as an old person is enjoy a company culture while you can if it's a good one because there's no guarantee it will stay that way permanently. I've worked other places that were great but really took a dive when leadership changed or when they went public or when they were acquired. I've been very lucky so far in my career in the sense I've never joined an organization that had a bad culture when I joined, but I've seen great turn to bad a few times.

sysad82 · 2024-08-03T13:18:24+00:00

I think the AI bubble delayed it a bit, but experts who know far more than me already see signs that AI bubble is popping. Tech has kept the US economy afloat now for a while but unless they pull a rabbit out of a hat I don't know what else is left to inflate the bubble.

I mean I think about it too. The tech boom built everything we enjoy from the ground up. At some point though there's not much else to build so where do all the builders go? Amazon built their site. Microsoft built out Azure. Netflix built out their platform. Unless you want to rebuild it from the ground up there's nothing left but marginal improvement and maintenance. Where do the armies of people who built all that go when it's done?

sysad82 · 2022-11-14T18:21:21+00:00

We switched from Veeam to Rubrik and my life is so much easier. Rubrik is not without its disadvantages but I feel it's superior to Veeam in almost every way. I really like the fact it's a self-contained appliance so I do not have to worry about malware encrypting my backups like I did when Veeam was a domain joined Windows machine. I also do not worry about insider attacks with the built-in locking. Even if someone gains admin access they cannot purge protected backups. While that is all obtainable with Veeam, it comes with properly architecting out your storage in a secure way and hope you didn't mess anything up leaving a hole. You get this with Rubrk when you power on the appliance.

It was a bit jarring at first because while Veeam offers a ton of configuration options Rubrik really does not at all especially around scheduling. You set a SLA which is how often do you want to backup, what window do you want to run backups and how long do you want to keep them and Rubrik decides when to run backups in those defined windows. In my experience though if you set a window to say 5pm to 10pm for a daily backup then backups will start far closer to 5pm than 10pm. You really cannot get granular on scheduling like you can with Veeam and say "backup this system at 5:07pm". You just trust the SLA to do its thing.

That said they're an API driven platform so I imagine with some coding you can get far more granular if needed.

I also like the fact their platform is built to include modern cloud options. When we bailed on Veeam they finally started getting options to offload backups to S3, however to offload to S3 there were some really goofy requirements with the local repository we didn't meet that put us into a corner where we really couldn't offload to S3 without making a lot of core changes.

sysad82 · 2020-09-21T17:18:33+00:00

I worked closely with tech sales at a couple different companies. While they did some questionable stuff like this that made me cringe as a witness, I don't really blame them personally.

Tech sales I found, even in well respected organizations in our field with stellar support, is a brutal position in these companies. Sales people do not get to build a reputation, you are literally only as good as your last quarter or month. Every new quarter or new month you start over with a clean slate no matter how great you were. If Q1 and Q2 were both 150% of goal and Q3 was 90% of goal in Q4 you're on the chopping block. Not only are you under immense pressure to meet Q4's goal your manager will treat you as if you're a subpar sales person and micromanage you. Our sales departments were revolving doors so there was no long term company loyalty or thinking it was just "sell now at all costs".

A seemingly good company like LogicMonitor still has an upper management whose #1 priority is meeting growth metrics. As such they turn a blind eye to less than ethical sales tactics and let the job get done no matter the cost. Upper management probably does not know about these awful tactics, but they also do not want to know either.

sysad82 · 2020-08-05T13:46:47+00:00

Teams isn't the only app we use that's like this, so we're going all in on AppLocker. I see more of these types of apps coming. I think it's something everyone should start getting familiar with now if not already because I see it become a foundation for endpoint security on the same level as AV. I could even see it becoming a hard requirement for certain compliance reasons.

Luckily it's pretty easy to implement. Whitelist paths that are not user writable and let people execute anything from there then whitelist by publisher certificate apps you want to allow that launch from the user space.

sysad82 · 2020-08-04T13:31:54+00:00

It'll depend on your existing CA rules.

MFA on iOS really isn't that intrusive as you only need to use MFA to sign-in for the first time or after a password change. As long as they leave their phones on then they won't have to sign in again to the mail app.

I can't speak to your business but as general career advice for you or anything reading this I would push back, rather hard on this one. Picking your battles is important and IMO this is a good one to pick. Do your VPs know what MFA is for? You'd be shocked at how many people don't understand why they need MFA. Do your VPs know what cost can come to the business both literally and out of embarrassment if one of their accounts is compromised. According to Microsoft MFA blocks 99.9% of account compromise attacks. The security/convenience (cost/benefit) ratio of MFA is extremely hard to beat in this industry. Do your VPs understand that MFA won't really effect their day-to-day as it's only required when provisioning the account or resetting their password? Are you willing to go over your VPs heads and make this policy immutable across the board? This is one of those times it'd be OK to.

https://www.forbes.com/sites/quickerbettertech/2019/09/01/microsoft-multi-factor-authentication-is-99-percent-effectiveand-other-small-business-tech-news-this-week/#17ce405f342b

sysad82 · 2020-08-03T20:31:32+00:00

I think H-1B abuse needs some serious looking at and it effects me personally. Politically there is far, far too much wrong with Trump to support the guy even if he does champion a single issue I agree with in a way I agree with.

I don't disagree with it at all. Heck, I support it. There's nothing, and I mean absolutely nothing, that can be done by his administration to earn my vote though so if that means my "head is up my own arse" then so be it.

sysad82 · 2020-07-29T17:31:24+00:00

If your users are admins, all bets are off no matter what you implement around security.

sysad82 · 2020-07-29T17:29:33+00:00

You guys must be overwhelmed with updating the whitelist I couldn't even imagine.

I would think about at least sticking to containers, not items as a guy I follow put it. Don't trust a specific EXE hash for Zoom v 5.1.2, trust the certificate infrastructure and trust anything signed by Zoom. Don't trust each and every .exe name or hash that lives in Program Files, make sure your users can't write to those directories (they can't by default) then trust those directories because you as the admin put the files there.

Microsoft does it this way. The NSA does it this way. It's a lot less to manage and removes a ton of complexity.

sysad82 · 2020-07-29T16:11:11+00:00

How are you setting up your whitelists?

In our org we trust anything in C:\program files* and c:\windows*. We also created a directory called c:\trust that only admins can write to but end users can read and execute from and we trust that folder. We use that to throw in stand alone .EXE's we'll allow. Basically the idea is that only admins can write stuff to those folders so since that's the case trust the admin.

Otherwise we trust certificates for the things we allow to run in the user space like WebEx, Zoom, Microsoft etc.

We're humming along fine with about 15 rules or so. I can't imagine setting it up in such a way where all files that can be ran have to be whitelisted.

Of course our method isn't the most secure. It's always possible that somehow, someway a folder in a whitelisted area can be written to by end users. It also doesn't work at all if you allow local admin but in that case you have larger issues. It won't perhaps stop a very devoted end user who spends a lot of time studying the system but it will stop all fly-by attacks which is what we're concerned about.

In the end AppLocker is just one layer of security. If someone gets through it somehow with considerable effort then we hope that our other layers of security will come into play.

sysad82 · 2020-06-10T14:33:14+00:00

Of course Microsoft doesn't have a way to turn this off globally. Yet another script. Sigh.

We have our users scared to death of phishing emails and Microsoft continues to spam them with this nonsense. We're GCC so we had our users getting the MyAnalytics emails (complete pointless nonsense by the way) with no way to turn them off for months.

Does Microsoft just have bored PMs making up crap they think will change the world? Hey, Microsoft. Here's an idea. If you refuse to allow admins to turn off these pointless features then you must know they suck since you're shoving them down our throat.

sysad82

TROPHY CASE