IT guy here, if we gave developers the option to exclude whatever the hell they wanted from AV scanning it would just mean that we would end up with computers where the entire C: drive would be excluded.
No, can't have that.
So what should a decent IT department do to give developers the access they need to do their job while maintaining a decent level of security?
Well, the least bad solution I have worked with was to have a non generic path that was excluded by policy.
Something like C:\Excluded
The directory was excluded from AV scan and allowed in policy, the user could put what they needed there and it would be fine.
So what should a decent IT department do to give developers the access they need to do their job while maintaining a decent level of security?
Give them a Linux machine?
This doesn't remove security and compliance requirements for the business though. For our Linux endpoints we still deploy an AV on them and limit the user's ability to add exclusions.
I appreciate you trying to keep your developers productive. Deeply appreciate the concern.
Your user base must be better than mine.
Some chucklefuck over a decade ago caved to the "need" for a public shared drive. I can see the argument for things like HR policy documents and such. But they didn't just give all users read access. Oh no, everyone got full read write. No fucking governance model, no process to check that PII wasn't being stored there by people too lazy to follow proper procedure.
Thankfully that horror has been thoroughly killed, and MS Teams makes it so easy for people to spin up collab spaces and file storage that there's no use case anymore.
At our place it's the IT guys trying to tell us to exclude the entire Downloads folder. One of our devs had to put her foot down and say no, we'd do something more sensible/limited instead!
That deserves a slap
I am a software developer at a big bank. The hoops we are forced to jump to just do our jobs are ridiculous.
We resorted to using buggy and laggy remote development environments through a slow VPN.
It's a miserable life, but at least the pay is good.
And yet you all are still using SMS two factor authentication. Why does my Xbox video game account have better security than my money?
Why does my Xbox video game account have better security than my money?
One is designed to securely collect and keep as much of our money as possible, and the other is just a bank.
Simple, it's not a priority for them.
They care more about their stupid emails than about your money.
Xbox has all of microsoft behind it, and they linked xbox accounts with microsoft accounts many years ago, allowing them to leverage all the security tools they're making for themselves and corporate customers of Azure/Entra. They also effectively have infinite money.
Banks, surprisingly, do not. They also are often using third party systems under the hood for things like online access to your account. Those third parties tend to have less money than a bank.
Laws can't keep up with tech developments in security, and getting all your ducks in a row to be legally covered in the finance industry is a fucking nightmare.
Lastly, banks (and companies) don't stay afloat by spending money on things that aren't necessary. Until it shows a significant impact through a breach or in customers leaving specifically for the reason of lackluster MFA options, and until that impact is easily communicated to the executives, trying to fight for some budget to improve shit is an uphill battle.
I am so so glad that the closest my work gets to customers, legal, or anything regulatory is data rentention policies.
Honestly it blows my mind that my bank doesn't support TOTP, they used to support email but recently removed that, they do support mobile push to their app so I usually use that but when you want to sign into the mobile app? Have to use SMS can't very well push notify the app being signed into, no choice, very silly.
Ah, that time when my job required me to write an executable scanner, and all the AVs got jealous I was honing in on their turf.
AV running in kernel mode charges its CPU cycles to the process being monitored, instead of the AV doing the monitoring.
I got a whole bunch of “your program is slow” support tickets which were resolved by telling the client to follow the AV exclusion instructions.
Took me way to long to notice I was accidentally reading "charges" as "changes". Now I finally got what you were saying.
"Will I have root on my dev machine" is on my list of interview questions, now.
Asking questions like that can cause hiring managers like myself to have no choice but to offer you higher pay grades, because that question is a strong signal of experience.
Probably is for me too. This is something I've taken for granted as I work for a small company and I am the IT admin...and development team lead, I wear lots of hats. Not the owner though, basically like a CTO+.
Because too many developers don't understand cybersecurity.
As is obvious from some of these comments here.
Whats next, you want domain admin access to every computer/server you touch as well?
Nah, sudo is fine. I can create users without touching the domain stuff. 🙃
What they don't understand is their own machine can get compromised, and in turn compromise their accesses and other infrastructure in a pivot attack.
Developers tend to have quite a lot of access, and some can even deploy to production. At my company, the dev workstations are even more locked down than the regular users' computers for that reason, they can't even leave the province.
I hate blanket generalization. You know when you get to that point that your company is over managed and understaffed, not creating a good work environment.
you want domain admin access to every computer/server you touch as well?
Heh. I've had it. It's not all it's cracked up to be. And I didn't even get one of those humorous "all I got was this lousy T-shirt" shirts.
Corporate antivirus is so great that it restricts windows update while not connected to the main network by ethernet.
Some of us are there once a month.
Last windows update broke it, and now nobody can update.
It also bring 5 seconds of load time to any website
You could, and I'm just spitballing here, start sending your compiled executables to the anti-virus provider and only continuing work once they've been added to the upstream exceptions. Bonus points for compiling hundreds and sending them all. Do that for a day or two and there is sure to be a number of communications many levels above you.
If executed perfectly and all goes well, you'll get your exceptions access.
Worst case... uh. Maybe this isn't such a good idea after all.
Trellix is just rebranded McAfee. Here's instructions for How To Uninstall McAfee Antivirus.
RIP you glorious bastard.
I’d like to think he’s up in heaven getting shit on by a beautiful Brazilian lady.
If you haven't seen it: https://www.youtube.com/watch?v=tfe4Fjf3sds
This is not Trellix ePO as you can make exclusions. No, this reeks of Defender.
Click the link..
I also suspect it hangs Firefox's network stack while it does its initial scan after each boot. Chrome does not have this issue.
Same. It is after all their own time they are wasting, so whatever. I get paid either way.
