Where are we going and why are we in this handbasket? (Part 1)

*I'm not the OP. This entire tale was originally posted in r/talesfromtechsupport by u/lawtechie. Due to length I have split this post into two parts. Edit: link to the second BORU post at the bottom*

[part 1](https://old.reddit.com/r/talesfromtechsupport/comments/aszpc8/where_are_we_going_and_why_are_we_in_this/) posted on Feb 21, 2019

I'm working for the Earl Scheib of consulting firms. We'll do anything for a mid-market blended rate. This also means we pinch every penny- our expenses, travel and staffing are janky to deal with. Non-security people get staffed on security projects, and I get staffed on implementation projects.

I'm getting sent to the far suburbs of Salt Lake City to do a week long find and fix for an insurance broker (INSCO). To back-stop me, I'm getting Ian, a 'real cybersecurity rockstar' to help me.

Over the next few years, I will call Ian a lot of things, but 'rockstar' won't be one of them.

I'm Eastern Standard Tribe, so I have to spend half a day flying out there. I'm beginning to learn that Kevin, our in-house travel agent is dangerously stupid. Per Kevin, I have a connection in Chicago.

I'm flying into O'Hare, but my flight out is Midway. Good job, Kevin.

I'm alternating between downloading whatever data dumps INSCO has made available to us and leaving annoyed voice mails at Kevin:

me:"Hey, Kevin. I need you to change my flight tomorrow. I don't know if I can cross Chicago and get to my gate in 45 minutes"

me:"Hey, Kevin. It's LawTechie. Can you get back to me once you get this? That'd be great"

...

I'm also reading over what INSCO actually does. They sell any kind of insurance you can imagine from multiple insurance companies. This means that they'll have to meet the nitpicky requirements of every insurer they do business with. They also take credit cards, which rhymes with PCI.

And nothing from their network design suggests that they actually meet any of these requirements. We're going to be busy finding issues, convincing INSCO that they're issues, then coming up with fixes that won't make INSCO kick our asses to the curb.

Kevin finally gets back to me.

Kevin:"I understand you have a question about your flights tomorrow? Your connection is through Chicago"

me:"No, it's through Chicago. Two different airports"

Kevin:"Well, there's a non-refundable fee to change the tickets"

me:"I'm sure it's cheaper than a cross-town taxi ride"

Kevin:"Sigh. I'll fix it. It will be a later flight to SLC. I'll change the budget accordingly"

I'll try to be a good co-worker and let Ian know I'm going to be an hour or two late. I send him an email giving him my new arrival time to SLC and that we can take my rental car from the airport to the hotel.

I stupidly think that everything's settled and go back to reviewing docs.

I fly out the next day. Radio silence from Ian when I'm at O'Hare. I fly to SLC and land around 10 pm local time.

I see that I have three emails. I skim them while waiting to get off the plane.

Boss:"LT- your utilization numbers are low. Travel isn't billable anymore"

Kevin:"To meet budget on this project, I moved your rental reservation to Ian. Let me know if you have any questions"

Ian:"Waited half an hour. Drove to the hotel"

I trudge out to the baggage carousel and wait for my checked bag. I make my way to the one rental agency that I have some status at in the hopes that I can get some other fine car and make my way to the hotel before midnight.

Very cheerful rental agent:"Hi, what's your reservation number?"

me, sliding a credit card and my driver's license towards Cheerful:"Someone who is soon to be deceased cancelled my reservation. I may not be friendly, but I am flexible. What do you have available?"

Still cheerful rental agent, typing away at his terminal:"I'm still looking. I see you're from $city. Are you a fan of sportsball?"

me, trying to restrain myself:"No. Not really. You know we're not known for being good fans. We had to grease the light poles when a team won the championship. We threw snowballs at Santa Claus because reasons. We're not good people. The quickest way to get me away from you is to give me the keys to a rental car"

Not as cheerful rental agent:"I don't have anything available"

I open my wallet and push a $50 towards the agent.

me:"Ulysses Grant says I'm amenable to something that just got checked in. I don't care if it needs to be cleaned or given an oil change. I want a ride to $suburb and to get a good night's sleep."

Much quieter rental agent:"I have a 15 passenger van but..."

me:"Sold."

I get some paperwork and make my way to the lot. Sure enough, there's a church van and keys. I get to drive this monster to some low-range hotel, check in and sleep fitfully through the night.

In the morning, I clean up, put on a suit and make my way to the free breakfast. Hopefully I can find Ian and discuss our plan for the day.

Pretty much the only people eating the boxed scrambled eggs are construction workers. Someone who clearly doesn't fit in walks in. He's twitchy, eating his try toast while reading something on a laptop covered with hacker-stickers.

I walk over and sit down.

me:"Hello, Ian. I'm LT. Let's talk about how we're going to split up the work this week"

Ian:"I had to get my own rental car. That was annoying"

me:"Yeah. I share your annoyance"

Ian launches into an one sided discussion about how smart he is. I realize that he's never successfully interviewed staff about how things actually work so I get him to agree that I'll run the first interview with the operations crew and he'll take notes and chime in when necessary.

It seemed so simple over weak coffee and styrofoam eggs.

We drive over to INSCO's office park. We are ushered into a generic conference room where a handful of sullen and guarded IT staff. I lead with some self-deprecating humor, mention that I used to be a sysadmin back when linux was a hobby and 'real Unix' was used for heavy lifting and start asking easy questions. Within ten minutes, they're confessing all their sins:

* Every customer interaction is stored in MasterDB

* MasterDB is hosted on the same system as www

* Credit cards and CVVs are stored in MasterDB

* There's a shared root account. Developers, IT and for some perverse reason, customer service all have the password.