I'm going to write a blog post that is a bit more personal that usual. I could hire a psychologist or bartender to pour my soul out to, but I already have a blog, so this is cheaper.
Observing people ignore or circumvent good security practices has a large negative impact on my mental health. When I see this, I start to dwell on it. It affects my sleep and productivity. It affects my motivation and my willingness to engage with others.
I assume most people know the basic rules for good security practices. Just in case, I wrote a blog post a few years ago (InfoSec 101) to outline the rules. Despite this I see people share their accounts or passwords with others, and it makes me cringe.
When an administrator or organization provides you with an account and password, that is a great privilege. It is a symbol of trust and partnership. They are granting you and you alone a certain set of privileges on systems that are important and valuable to them.
Failing to protect this is disrespectful to the people that granted it. This erodes trust.
Computer security is not about you verse the computer. Systems are owned, administered, and used by people. Gaining access to a system (even with permission) isn't about getting over the security hurdles the computer has put in place. Accessing those systems is engaging in a collaborative way with those other people. If you respect their rules, they will respect you.
Compromising this trust doesn't just affect you. A bad actor reflects poorly on everyone. Administrators don't stop trusting you, they stop trusting everyone, including me.
If this goes on for too long this can lead to a toxic environment. Users trying to thwart administrators. Administrators imposing arcane rules on their users to force them to comply.
It is hard for me to watch. Witnessing a security violation is like witnessing a violent crime or watching someone use a salad fork to eat their main course. It is a breakdown of the basic rules of society and civilization. When I see someone sharing a password in Slack, I will usually immediately leave that channel.
This breakdown occurs because of a general lack of empathy between people. I do have empathy for those that feel they need to violate security protocols. I assume they know that they shouldn't share passwords, but they are under pressure to get something done.
Security systems do have good designs. Users can be assigned to groups and those granted privileges/roles. Building on this basic building blocks security systems can implement policies of Least Privilege and Zero Trust. If users are sharing accounts or doing everything possible to workaround the security system, this will impede the administrator's ability to provide a collaborative system.
People may violate good security principles once or twice to get something done. But if this isn't corrected, these poor security decisions become standard operating procedure. Employees once knew what good security practices where, but it can be trained out of them. A culture of poor security can be created. Cultural changes can be the most difficult transformations an organization has to make.
I'm not an IT/security person; I am a developer. User authentication and authorization systems generally a solved problem for applications. A security module is just one of the many modules and features that are offered in the systems I develop.
Like the design of a security system, software development has its own set of principles that are core to having a well-designed system. For example, software systems should not have duplication and should be expressive. When I see a developer violate the design of a security system, I am immediately worried that they may violate the design principles of systems we write together. Under the constant pressure of having to get something done, will they simply copy and paste the same code repeatedly (duplication). If they are asked to add a Social Security Number to the system, will they tell users just use the Fax Number field they weren't planning on using instead (expressiveness violation).
If a developer is willing to disrespect the design rules of a security system, I assume they are more likely to violate good software engineering principles as well. Respect breeds trust.