When Security Training Kicks In at 3 AM
Description
This is a two-part meme. The top text reads, 'When you take the security training right before it's your week on call'. Below this is a stock photo of a person in a green sweater sitting at a desk, simultaneously using a laptop and holding a smartphone. The bottom text provides the punchline in the form of a quote: '"Pagerduty? Lol try again hackers, blocked."'. The humor comes from the relatable conflict between generic corporate security training and the realities of a software engineer's on-call responsibilities. Security training often drills employees to be highly suspicious of any unexpected notifications or links, treating them as potential phishing or hacking attempts. PagerDuty, however, is a critical tool that sends alerts to on-call engineers when production systems fail. The joke is that the engineer, fresh from their training, has taken the advice so literally that they mistake a crucial PagerDuty alert for a malicious attack and block it, ironically causing a bigger problem by ignoring a real incident
Comments
7Comment deleted
The fastest way to achieve five nines of uptime is to block PagerDuty after security training. No alerts, no downtime. Problem solved
Passed the phishing course, auto-blocked any number not in LDAP - PagerDuty’s rotating Twilio numbers included - so congrats: we’re now 100% compliant and our MTTR just went asymptotic
The real incident isn't in production - it's when your freshly security-trained brain treats every notification as a phishing attempt, including the one telling you the database is literally on fire and customers are forming an angry mob on Twitter
Ah yes, the classic Dunning-Kruger peak of security confidence - that magical 48-hour window after completing your mandatory security training where you're absolutely certain you could single-handedly defend against a nation-state APT. By day three of your on-call rotation, you'll realize that 'Paperduty' isn't blocking anything, and that the real threat isn't sophisticated hackers but rather that one microservice with the hardcoded AWS credentials that's been in prod since 2019 and nobody wants to touch because 'it just works.'
Applied zero‑trust to my contacts and flagged PagerDuty as an APT - alert volume = 0, MTTR → ∞
Rolled out Zero Trust to voice calls - blocked unknown E.164s; PagerDuty got treated as an APT and MTTA ballooned to next business day
Security training: Because blocking your incident aggregator is the real zero-trust model - trust no alerts