When Employees Use Software That IT Hasn’t Approved • Hacker News Board

Re: When Employees Use Software That IT Hasn’t Approved

#131

Post by frosted-flakes » Wed, Jun 12, 2019, 4:18 PM UTC

esoterica wrote: post #122

beart wrote: post #57

Earlier quoted context omitted.

One example off the top of my head: It used to be (may still be) the case that you needed admin rights to install and run the Windows Subsystem for Linux. Sure, you might not need this to do your job, but IT is not really in a position to decide that. It could be that WSL greatly increases your productivity.

You can ask IT to install it for you. You don’t need to install it yourself.

But then you're waiting around for the rest of the day for them to come install it.

Re: When Employees Use Software That IT Hasn’t Approved

#132

Post by davvolun » Wed, Jun 12, 2019, 4:24 PM UTC

> The CIO admitted that he had been approached and explained that he had informed the VP that IT already had a project with SAP to deliver what the VP needed. “Yes, but that won’t be ready for me to use for three years, and I need something today,” retorted the VP. The CIO was silent. Then the CEO asked the VP, “I’ve known you for ten years. You don’t seem like someone who would do something to harm the company. Why did you do this?” The VP hit right back: “Since I started this digital customer acquisition program, we’ve increased revenue $1M per month. Before we were losing revenue. If you want, I can shut it down right now. What do you want me to do?”

Maybe not for this particular project, but another interpretation of that is "who cares about security if we're making money" which is a very dangerous argument as well.

Re: When Employees Use Software That IT Hasn’t Approved

#133

Post by rsuelzer » Wed, Jun 12, 2019, 4:31 PM UTC

Our IT security department was incentivized to deny everything from new tools to new internal applications.

We had an outside firm making security decisions and if there were any security issues it would end up being on them. So as long as they did not allow us to release any products and or install any software they could not be held responsible.

I made friends with a lower level contractor who told me off the record to use my judgement on what to install to get the job done, because the security department would never approve anything new unless directly instructed to by the CEO.

Fast forward three months, there was a major security flaw on our website (also built with outsourced labor) which allowed anyone to access private data without a login.

A few of us had reported to the security department that the code running the website was so poorly written that the odds of being insecure were close to 100 percent. We suggested upgrading the website and rewriting the code, and management was on board with this but security department refused to allow us to use any new frameworks since they were not approved. Of course in a matter of a few months the site was hacked and millions were spent as a result.

I quit this job after we were unable to release several products after a year even though we jumped through every hoop we needed to. That department killed all innovation.

Re: When Employees Use Software That IT Hasn’t Approved

#134

Post by la_barba » Wed, Jun 12, 2019, 4:32 PM UTC

Hehe, if you think this is nuts, come to pharma. We can't do jack shit with our machines. If you so much as change the time on your machine, that is a 'data integrity breach', and if your actions are determined to be malicious it can result in a firing.

Re: When Employees Use Software That IT Hasn’t Approved

#135

Post by flurdy » Wed, Jun 12, 2019, 4:40 PM UTC

drevil-v2 wrote: post #30

I still shudder thinking about my time working as a developer on corporate IT locked down IBM leased laptops. Every time I did npm install I needed to request admin access to Windows which took 2-3 hours to action by IBM team sitting on the other side of the world in India. One day a grey beard took pity on me and installed a Linux VM where I was admin, copied the security certs from the Windows host and I could acce…

Yup, back then my way around corporate locked down Windows machines was to only get permission to install VMware Workstation or Virtualbox.

Then fullscreen Ubuntu in a VM from then on. Slower but no restrictions. Even better when Workstation supported multiple screens.

Re: When Employees Use Software That IT Hasn’t Approved

#136

Post by kleborp » Wed, Jun 12, 2019, 4:42 PM UTC

hartator wrote: post #78

Isn't IT something from the past? I would expect people knowing how to use a computer and what they need to do their job.

As a lowly help desk technician perusing this thread, you couldn't be any further from the truth. The software devs never open tickets, everyone else does and its for the most banal problems

Re: When Employees Use Software That IT Hasn’t Approved

#137

Post by maxxxxx » Wed, Jun 12, 2019, 4:45 PM UTC

cmdkeen wrote: post #116

maxxxxx wrote: post #61

Earlier quoted context omitted.

This is about Windows desktop development. I need admin rights to install sql server, I need them to customize my machine so it’s similar to our target environment. I need to change user permissions all the time yo see how things behave under different conditions . There is a ton more I could walk you through and have done multiple times. Comments like yours come repeatedly from people who don’t know about the work w…

Being punchy about it you've never moved on from thinking you need admin rights on your machine. Chocolatey for Business' self-service installer, SCCM jobs, and a variety of other tools exist to enable you to get specific things that require elevation executed. If you're changing things to test various configurations wouldn't it be handy to have those scripted, get them peer reviewed / linted and you've got yourself…

Have you ever considered that some people are themselves writing tools like Chocolatey that inherently need elevated rights? I am working on a Windows service that needs to be elevated to work. In addition I need to change TPM keys and change registry settings in the machine hive. The SQL Server installation is local and IT will never be bothered with it. Just let me install it.

Re: When Employees Use Software That IT Hasn’t Approved

#138

Post by yebyen » Wed, Jun 12, 2019, 4:45 PM UTC

davvolun wrote: post #132

> The CIO admitted that he had been approached and explained that he had informed the VP that IT already had a project with SAP to deliver what the VP needed. “Yes, but that won’t be ready for me to use for three years, and I need something today,” retorted the VP. The CIO was silent. Then the CEO asked the VP, “I’ve known you for ten years. You don’t seem like someone who would do something to harm the company. Why…

When a person says "we need this infrastructure project" and a project is commissioned, acknowledging the need, it is in my experience that unfortunately that person's job function is rarely placed on hold until the appropriate infrastructure has been made available.

"Who cares about your pie-in-the-sky infrastructure project, my boss continues to measure our real performance with basic accounting, and is expecting to be able to report on growth each quarter, which I can't help without tools" seems to be a bit closer to the argument posed here, IMHO.

Re: When Employees Use Software That IT Hasn’t Approved

#139

Post by ativzzz » Wed, Jun 12, 2019, 4:49 PM UTC

basch wrote: post #65

brixon wrote: post #25

Let's ignore the SaaS security issues for a second. When IT says "No" it's not like the area asking is going to go away and not try to solve their problem. Organizations are going to find ways to solve their issues and IT can either help from the beginning or help clean up the mess later. I try to take the stance of offering the right solution and a lot of the times a now solution at the same time. There is no saying…

There can be a lot of steps between "help me fix this problem" and fixing the problem. They include qualifying the idea, scoping the request, possibly transforming the request into an abstract form and searching the organization for other people with forms of that abstract problem. Then you get to procurement and you need to figure out if you are getting a specific tool for a specific task or some kind of kitchen sin…

You're essentially suggesting "properly" going through the slow and inefficient bureaucracy machine, when the underlying issue is exactly that people tried to do what you suggested but ended up getting nowhere.

You realize you need a kitchen sink, it turns out there are 2 other teams who already created their own semi functioning kitchen sink which they want you to adopt, but doesn't fit in your kitchen, and the CIO is working with Home Depot to create standardized kitchen sinks for the entire company which will be ready in 3 years (realistically 5 years, or maybe never), but your current sink is leaking and is flooding your kitchen now, so you do what you can to fix it.

Basically a principle of asking for forgiveness rather than permission. Does it cause issues? Of course, any solution to today's problem becomes tomorrow's problem. Now there are 3 semi functioning kitchen sinks in your company, but at least they are functioning

Re: When Employees Use Software That IT Hasn’t Approved

#140

Post by fancyfish » Wed, Jun 12, 2019, 4:52 PM UTC

maxxxxx wrote: post #22

This is exactly extremely common. In my company there is this constant battle about the devs having admin rights on their machines. We need admin rights to do our job. We have had dozens of meetings explaining the situation but IT can’t come up with a solution so the devs go around security because they have no alternative if they want to finish their work . Same with Dropbox. They block it but we have suppliers who…

I've consulted for a big bank which blocks most file sharing sites and also blocks you from attaching scripts, server logs, etc to emails.

Luckily, S3 is not blocked. I set up a bucket and have them upload to the bucket, which I then download on my own computer. Mission accomplished.

Just getting free Windows applications procured and installed on the company laptop takes several layers of approval, emails back and forth, etc. Also the lovely forced password resets every 2 months.

This is true for the banks I've worked with/at. Security systems actively block you from the tools you need to do your job, let alone get the job done in an efficient manner.