Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When Employees Use Software That IT Hasn’t Approved

hbr.org

Post reply on HN
Print view View original

161–170 of 326 posts

Re: When Employees Use Software That IT Hasn’t Approved

#161

Post by scarejunba »

davvolun wrote: post #132

> The CIO admitted that he had been approached and explained that he had informed the VP that IT already had a project with SAP to deliver what the VP needed. “Yes, but that won’t be ready for me to use for three years, and I need something today,” retorted the VP. The CIO was silent. Then the CEO asked the VP, “I’ve known you for ten years. You don’t seem like someone who would do something to harm the company. Why…

Yeah, but because each “who cares about money, we’re doing the secure thing” will be naturally outcompeted by the “money over security” guy since money is the measure of success and is the unit that lets you expand. The hard part is rapidly reacting to a realistic threat model for each situation. That’s why good security chiefs are so expensive.

They know when to move that risk control dial in each direction.

Re: When Employees Use Software That IT Hasn’t Approved

#162

Post by extra88 »

repolfx wrote: post #121
lightbritefight wrote: post #90

Earlier quoted context omitted.

Developer data can still be confidential/sensitive, so you still need to monitor and control this second network with many of the same restrictions as the main one. You still have most of the same risks to compensate for, like data exfiltration and cryptolocker, etc. It doesnt introduce that many positives for lots of admin overhead, not just in maintaijg two distinct networks, but also in ensurijg interoperability w…

Do you? Why can't you let developers admin their own network? At least some of them will know how to do the bulk of the work and a lot of the typical admin needed for Windows machines won't be that important for them (how often do they need to print something and how many of them would be unable to handle printer drivers themselves)? It doesn't introduce that many positives for lots of admin overhead For the IT depar…

> Why can't you let developers admin their own network?

Being a good software developer doesn't mean you're a good network administrator or good at desktop support. And even if you are, a developer is paid more so it's a poor use of their time.

I'm all for devs having admin access on their own machines, there are too many instances where it's needed, and reasonable exemptions from default policies when they conflict with their work. But a "conflict" would be things like anti-malware software making builds fail, not merely making builds 10% slower.

Re: When Employees Use Software That IT Hasn’t Approved

#163

Post by protomyth »

extra88 wrote: post #162
repolfx wrote: post #121

Earlier quoted context omitted.

Do you? Why can't you let developers admin their own network? At least some of them will know how to do the bulk of the work and a lot of the typical admin needed for Windows machines won't be that important for them (how often do they need to print something and how many of them would be unable to handle printer drivers themselves)? It doesn't introduce that many positives for lots of admin overhead For the IT depar…

> Why can't you let developers admin their own network? Being a good software developer doesn't mean you're a good network administrator or good at desktop support. And even if you are, a developer is paid more so it's a poor use of their time. I'm all for devs having admin access on their own machines, there are too many instances where it's needed, and reasonable exemptions from default policies when they conflict…

If you have a group of developers, it would probably be a decent idea to have at least one sysadmin dedicated to developer services. It would go a long way to make build deploys go a lot more smoothly.

Re: When Employees Use Software That IT Hasn’t Approved

#164

Post by rb808 »

maxxxxx wrote: post #70
rb808 wrote: post #66

Earlier quoted context omitted.

If you want a proper dev environment that matches your target you need a proper server to have sql server installed on. I'm pretty sure someone can install sql server on your workstation if you really need it. User permissioning is a dbo task. After that you just have to live with it like the rest of us.

You sound exactly like every other IT guy who doesn’t understand what we are working on. We then explain everything to them and usually they disappear and are never heard of again. That is, until the next guy shows up a year later and the cycle repeats.

I was a dev in the 90s and the start of the 2000s and always had admin rights. I dont need it any more. If you really had an edge case that requires admin rights I'm surprised. If you really need SQL server on your workstation you should think about using a different database. If your company says you have to use SQL server and you have to have it on your workstation and you need to reinstall it regularly and you're obviously screwed you go up the management chain with your unsolvable problem that breaks their policy. Is very unusual now - most people just moan they want admin rights when they can live perfectly fine without it.

Re: When Employees Use Software That IT Hasn’t Approved

#165

Post by exabrial »

dasil003 wrote: post #114
esoterica wrote: post #104

Earlier quoted context omitted.

There’s nothing wrong with a block Dropbox policy. The problem here is a failure to establish a standardized method of transferring files in and out of the company.

And what if two companies standardized methods are incompatible?

You write a new standard to unify the existing two standards

Re: When Employees Use Software That IT Hasn’t Approved

#166

Post by SerLava »

philipodonnell wrote: post #36

> The CIO admitted that he had been approached and explained that he had informed the VP that IT already had a project with SAP to deliver what the VP needed. “Yes, but that won’t be ready for me to use for three years, and I need something today,” retorted the VP. The CIO was silent. Then the CEO asked the VP, “I’ve known you for ten years. You don’t seem like someone who would do something to harm the company. Why…

If your company can't replace a doorknob in a decade, destroy that company. It has no value.

Re: When Employees Use Software That IT Hasn’t Approved

#167

Post by maxxxxx »

rb808 wrote: post #164
maxxxxx wrote: post #70

Earlier quoted context omitted.

You sound exactly like every other IT guy who doesn’t understand what we are working on. We then explain everything to them and usually they disappear and are never heard of again. That is, until the next guy shows up a year later and the cycle repeats.

I was a dev in the 90s and the start of the 2000s and always had admin rights. I dont need it any more. If you really had an edge case that requires admin rights I'm surprised. If you really need SQL server on your workstation you should think about using a different database. If your company says you have to use SQL server and you have to have it on your workstation and you need to reinstall it regularly and you're…

It will be really hard to argue for a complete redesign of a medical device app, complete retesting and waiting for FDA approval only because some guy at IT doesn’t like the devs to have admin.

Re: When Employees Use Software That IT Hasn’t Approved

#168

Post by [deleted] »

protomyth wrote: post #83
maxxxxx wrote: post #22

This is exactly extremely common. In my company there is this constant battle about the devs having admin rights on their machines. We need admin rights to do our job. We have had dozens of meetings explaining the situation but IT can’t come up with a solution so the devs go around security because they have no alternative if they want to finish their work . Same with Dropbox. They block it but we have suppliers who…

I'm still not sure why developers aren't on their own network for development. Have a red box / blue box type system at the developers desk. Given modern networking, it wouldn't actually be that hard to setup and keep development / integration / system tests (or what names you use) away from a locked down production would not be such a bad thing[1]. Having some dual homed file shares wouldn't be that hard either. 1)…

[deleted]

Re: When Employees Use Software That IT Hasn’t Approved

#169

Post by CrossWired »

jrjarrett wrote: post #130

This thread hits home. I switched jobs a few years ago because the IT policies on workstations were being ratcheted down to make my job as a developer difficult to impossible. Now, the company I work for, ostensibly a _software_ company, got its ISO certifications, which meant policies and procedures that make developing hard or impossible again. How does a software business _successfully_ implement stringent access…

I'm heading down this path right now. How do I obtain my certs while also allowing enough freedom for the dev teams to operate.

We have to deal with the fallout when they screw something up, there has to be a happy medium somewhere.

Re: When Employees Use Software That IT Hasn’t Approved

#170

Post by scarface74 »

thisisnico wrote: post #71
scarface74 wrote: post #23

Earlier quoted context omitted.

I find most “IT security policies” that hamper developers to be mostly security theatre. No matter how many policies they put in place, since they aren’t developers, one junior developer can write: var sql = “select * from Customer where firstname = ‘“ + firstname + “‘“; And thwart all of your security “best practices.” I was the lead dev at a medium size non tech company, and the hoops I had to go through to get any…

I agree that the current systems and policy for security is in-efficient. It seems that Security policies are mostly roadblocks to production, roadblocks for developers. It's a sad state at the moment and that I absolutely agree with. In this case IT isn't as worried about the users data on that machine. We're worried about the state of that machine taking everything else down with it. Users data should be stored on…

Users data should be stored on the network, some data may be local.

If the user has read/write access to the network, so does anything the user run.

A user with local admin access and installing malicious software has a higher risk of propagating everywhere.

A sibling post just use an old example of the ILOVEYOU virus that didn’t require admin access to run or spread.

Somebody clicked on a link, somebody was spear-phished.

And if that happens, and if the user gave up their username and password. The perpetrator has access to everything the user has access to. The perpetrator will probably target a user with the access they desire. You say enforce two factor authentication? That’s also easy to scam out of user - get then to tell you the 2FA code. It was happening to Uber drivers.

If you can’t trust the user not to do something stupid, you can’t trust anything that the user runs not to do something malicious or be tricked into giving up confidential information.

Post reply on HN