Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When Employees Use Software That IT Hasn’t Approved

hbr.org

Post reply on HN
Print view View original

101–110 of 326 posts

Re: When Employees Use Software That IT Hasn’t Approved

#101

Post by protomyth »

lightbritefight wrote: post #90
protomyth wrote: post #83

Earlier quoted context omitted.

I'm still not sure why developers aren't on their own network for development. Have a red box / blue box type system at the developers desk. Given modern networking, it wouldn't actually be that hard to setup and keep development / integration / system tests (or what names you use) away from a locked down production would not be such a bad thing[1]. Having some dual homed file shares wouldn't be that hard either. 1)…

Developer data can still be confidential/sensitive, so you still need to monitor and control this second network with many of the same restrictions as the main one. You still have most of the same risks to compensate for, like data exfiltration and cryptolocker, etc. It doesnt introduce that many positives for lots of admin overhead, not just in maintaijg two distinct networks, but also in ensurijg interoperability w…

Developer data can still be confidential/sensitive

Yes, there are confidential data, but it shouldn't be any real customer data. Right?!? Frankly, given best practices from professional developers, stuff like cryptolockers just aren't an issue (blank the machines). Developers need admin, so building a network for them is actually a lot easier.

Re: When Employees Use Software That IT Hasn’t Approved

#102

Post by iaw »

maxxxxx wrote: post #88
miahi wrote: post #85

Earlier quoted context omitted.

We had the same kind of "hidden" router at my previous employer, as we had a team of ~10 developers who needed a lot of different access to different servers and between eachother. We put the name of another tenant in the office building as the SSID :). After about a year the network through that router started to slow down. When we checked why we realized that we had more than 40 wifi clients, as other (non-dev) tea…

The funny thing is that after a recent remodel the router got moved and we don’t know where it is. It still works but nobody knows the exact location. It may be in the ceiling or the floor.

I hope it never needs to be reset.

Re: When Employees Use Software That IT Hasn’t Approved

#103

Post by natch »

maxxxxx wrote: post #68
ubermonkey wrote: post #67

Earlier quoted context omitted.

The "dumb" here isn't even limited to "block Dropbox." Lots of my customers have blanket "block everything that could plausibly be used for file sharing" policies, and explicitly include services literally AIMED at corporate/B2B data exchange like Citrix's ShareFile. No, we don't have an internal FTP site. No, I won't set one up for you. We use Sharefile for distribution so we don't have to do that. Your IT blocks it…

The funny thing is that they block Dropbox but then there are plenty of shady upload sites that aren’t blocked. We don’t use them because we think they aren’t secure but our IT guys would have no problem with that.

That highlights a problem woven through the industry which is that the IT department isn’t always the sharpest team in the building, even on security matters.

Re: When Employees Use Software That IT Hasn’t Approved

#104

Post by esoterica »

exabrial wrote: post #48
maxxxxx wrote: post #22

This is exactly extremely common. In my company there is this constant battle about the devs having admin rights on their machines. We need admin rights to do our job. We have had dozens of meetings explaining the situation but IT can’t come up with a solution so the devs go around security because they have no alternative if they want to finish their work . Same with Dropbox. They block it but we have suppliers who…

I really wish some big shots in the security world would write an ISO standard or something stating how harmful blanket 'block Dropbox' policies are for the reasons you list.

There’s nothing wrong with a block Dropbox policy. The problem here is a failure to establish a standardized method of transferring files in and out of the company.

Re: When Employees Use Software That IT Hasn’t Approved

#105

Post by toyg »

spydum wrote: post #6
tyingq wrote: post #2

"Soon enough the CIO sniffed out the project and called her in to a disciplinary council." Somebody has apparently lost touch with who the customer for IT is.

No, CIO role often carries responsibility for security. VP violates policy is like skirting regulation - yes it cost less money, but for all you know they are not compliant with policy and aren’t doing the whole job. However it does often seem like IT doesn’t consider SaaS solutions - they always want to build something their selves without doing cost analysis.

I have the opposite experience - most IT I know would rather outsource as much of their job to "the cloud" as they can, and go feet-up.

The problem is typically that cookie-cutter solutions don't necessarily map what the leadership requires: either the cost is too high, the knowledge gap is massive (e.g. the tool can do everything, but requires specialized knowledge of an obscure DSL and implementation details only three people in the world have actually mastered...) or the security implications are nontrivial.

To be fair, I do know also people who will always prefer to build their own anyway, because it makes them feel more in control (which they are). It's the CEO's job to rein in these tendencies when necessary, though.

Re: When Employees Use Software That IT Hasn’t Approved

#106

Post by geggam »

maxxxxx wrote: post #88
miahi wrote: post #85

Earlier quoted context omitted.

We had the same kind of "hidden" router at my previous employer, as we had a team of ~10 developers who needed a lot of different access to different servers and between eachother. We put the name of another tenant in the office building as the SSID :). After about a year the network through that router started to slow down. When we checked why we realized that we had more than 40 wifi clients, as other (non-dev) tea…

The funny thing is that after a recent remodel the router got moved and we don’t know where it is. It still works but nobody knows the exact location. It may be in the ceiling or the floor.

LOL

reminds me of a very old bash.org

http://www.bash.org/?5273

Re: When Employees Use Software That IT Hasn’t Approved

#107

Post by sgt101 »

Well, that cleared that up then! Gosh I had no idea that the solution would be so simple.

It does shock me that the people who've had their whole infrastructure compromised and held to ransom by viruses and the people who've been held over a barrel by suppliers or had vast amounts of money burned by being locked into a dozen vendor contracts for the same service are so silly and hysterical about it when the solution is as simple as "identify when you need to be best in class and stay small everywhere else".

Re: When Employees Use Software That IT Hasn’t Approved

#108

Post by jlj »

S_A_P wrote: post #60
bt3 wrote: post #51

Earlier quoted context omitted.

> Nobody every gets fired for hiring Accenture/Deloitte/PwC. What usually happens in the non trivial niches is that these big shops sleeve the boutiques through them to get things done... To provide a prospective as someone who works for a consulting firm like the ones you've mentioned... Hiring the "big" firms versus boutiques is a lot about a perception of risk, maintaining partnerships (procurement with new vendor…

Agreed. There is a perceived risk with the F500 so they may spend more to do something than is required because they feel they have recourse with the big shops. There are some good teams of folks out there, but there are also some shops that are happy to send a dozen folks @250-300/hr that generate process maps in visio and power point slides instead of delivering/implementing a project. I have seen these big shops d…

There's a strong case for decoupling the process flows, requirements, business analysis, scoping, current state understanding; from the implementation. Maybe even having a separate consulting firm do that work up front before going to bid on the ERP.

Many ERP implementations fail because of wrong assumptions about the business, or inflexibility of the client to modify their business process to fit the ERP. Enter expensive customizations.

These types of projects also affect peoples' jobs and that can bring up fears of being replaced that can quickly derail morale on a project. Successful projects empower the people with hands on the keyboard who know and live those processes, to own and define their future process too. When the consultants or executives are making future business process decisions without that experience, it is risky.

Re: When Employees Use Software That IT Hasn’t Approved

#109

Post by argd678 »

S_A_P wrote: post #21

I see this a lot in consulting. When a new CIO (or CEO or other C level) arrives, they want to make their mark with a digital transformation intiative. This usually just means that the new C level employee is coming into a medium to large business and would like to add a bullet point to their resume and get that new shiny object everyone is talking about. Tableau, Salesforce, Data lakes, blockchain, ERP, Identity Man…

> One somewhat disturbing trend I've seen at some of the largest corporations- cut/outsource IT support staff to near egregiously low levels to "save money".

I see the opposite too, they just staff up on tons of IT people thinking they have a resource shortage, and end up with massive departments that deliver just a little as before.

> It also seems that C level folks are hesitant to hire boutique/small shops that have industry experience and years of experience in favor of big consulting.

The reason this makes sense is because they need to work with companies that have enough resources that they can be really inefficient and have enough capital that they can run for long periods of time and not go under. It’s more of an insurance policy, the quality of the work would be better at the smaller shop of course but they likely couldn’t complete it due to bureaucracy.

Re: When Employees Use Software That IT Hasn’t Approved

#110

Post by busterarm »

TheCoelacanth wrote: post #99
spydum wrote: post #6

Earlier quoted context omitted.

No, CIO role often carries responsibility for security. VP violates policy is like skirting regulation - yes it cost less money, but for all you know they are not compliant with policy and aren’t doing the whole job. However it does often seem like IT doesn’t consider SaaS solutions - they always want to build something their selves without doing cost analysis.

The security triad is confidentiality, integrity and availability . If a security expert doesn't make sure that their security policies give users access to the things that they need, then they are only doing two-thirds of their job.

Every triad ever is a Choose Two situation.
Post reply on HN