Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When Employees Use Software That IT Hasn’t Approved

hbr.org

Post reply on HN
Print view View original

181–190 of 326 posts

Re: When Employees Use Software That IT Hasn’t Approved

#181

Post by davvolun »

scarejunba wrote: post #161
davvolun wrote: post #132

> The CIO admitted that he had been approached and explained that he had informed the VP that IT already had a project with SAP to deliver what the VP needed. “Yes, but that won’t be ready for me to use for three years, and I need something today,” retorted the VP. The CIO was silent. Then the CEO asked the VP, “I’ve known you for ten years. You don’t seem like someone who would do something to harm the company. Why…

Yeah, but because each “who cares about money, we’re doing the secure thing” will be naturally outcompeted by the “money over security” guy since money is the measure of success and is the unit that lets you expand. The hard part is rapidly reacting to a realistic threat model for each situation. That’s why good security chiefs are so expensive. They know when to move that risk control dial in each direction.

Exactly, well stated. In the end, the only reason a business cares about security at all is because if they don't, it will come back and bite them, hard; e.g., Equifax.

Re: When Employees Use Software That IT Hasn’t Approved

#182

Post by thrower123 »

drevil-v2 wrote: post #30

I still shudder thinking about my time working as a developer on corporate IT locked down IBM leased laptops. Every time I did npm install I needed to request admin access to Windows which took 2-3 hours to action by IBM team sitting on the other side of the world in India. One day a grey beard took pity on me and installed a Linux VM where I was admin, copied the security certs from the Windows host and I could acce…

I'm curious, were you usually going through Sametime to make requests into that helpdesk?

Re: When Employees Use Software That IT Hasn’t Approved

#183

Post by user5994461 »

oceanghost wrote: post #113
maxxxxx wrote: post #22

This is exactly extremely common. In my company there is this constant battle about the devs having admin rights on their machines. We need admin rights to do our job. We have had dozens of meetings explaining the situation but IT can’t come up with a solution so the devs go around security because they have no alternative if they want to finish their work . Same with Dropbox. They block it but we have suppliers who…

I worked at a very bad company, where IT was aggressively incompetent, and mean about it. At best they were negligent, at worst they actively interfered with anyone who they thought was a threat, which included anyone who was more intelligent than them, which was virtually everyone since the company was full of senior EE/ME/RF/CS folks. And I mean incompetent-- our network would go do down for hours, every day, and t…

Why would you stay for years in a company like that? It's so dysfunctional and toxic.

Re: When Employees Use Software That IT Hasn’t Approved

#184

Post by alkonaut »

Security training focuses way to much on email phishing and not enough on this kind of stuff. Actually getting your work done, managing your own computer. Of course people can't be trusted if they havem't been trained. How to handle USB drives. What and from where you can download and run programs. What actually IS a program and what isn't. Many of us learned this the hard way by playing lots of cracked games in the 90s. But not everyone did that.

Try explaining to a non-technical person how how a desktop background image isn't a program so it's basically safe to grab from anywhere, while a screen saver is definitely a program and usually unsafe to get from most places, and a word document is some times a program that might eat your computer. Training could involve things like "which of these 5 webbpages would you consider it safe to download and run executable from"?

Having too cumbersome rules around security just means it's ignored or circumvented, increasing risks.

Re: When Employees Use Software That IT Hasn’t Approved

#185

Post by user5994461 »

alkonaut wrote: post #176
esoterica wrote: post #123

Earlier quoted context omitted.

Sounds like you need a VM, not admin permissions.

Out of curiosity, what's the benefit of me doing bad things in a VM, instead of on my own machine - assuming the VM has full access to the same networks and data as the physical machine? Unless the VM is somehow sandboxed it's just another box on the same network. So the same reasons for me not being admin on the physical machine (e.g. to not be able to download and run untrusted software because it might spread some…

Of course the VM is isolated. That's exactly the point of a VM.

An account inside a VM will only let you play in that VM.

Whereas your account on the host is available and automatically granted access to all machines, fileshares and services on the active directory network. If it got admin rights, then you've got admin pretty much everywhere.

Re: When Employees Use Software That IT Hasn’t Approved

#186

Post by lmkg »

snowwrestler wrote: post #159
S_A_P wrote: post #21

I see this a lot in consulting. When a new CIO (or CEO or other C level) arrives, they want to make their mark with a digital transformation intiative. This usually just means that the new C level employee is coming into a medium to large business and would like to add a bullet point to their resume and get that new shiny object everyone is talking about. Tableau, Salesforce, Data lakes, blockchain, ERP, Identity Man…

We've got a Salesforce implementation going at the nonprofit where I work. While there was some debate about which big CRM we'd buy, the need to consolidate was blindingly obvious. Why? Because our organization has been quite forward thinking about allowing managers and executives to source the technology they think they to succeed. As this article advocates for, IT was largely consultative rather than dictatorial, a…

One of the side-effects I'm seeing of GDPR is a stronger incentive to consolidate systems under central management. Companies that allowed different departments the leeway to control their own systems now find themselves literally not knowing how many different places a customer's data might live.

Re: When Employees Use Software That IT Hasn’t Approved

#187

Post by JakeTheAndroid »

alkonaut wrote: post #184

Security training focuses way to much on email phishing and not enough on this kind of stuff. Actually getting your work done, managing your own computer. Of course people can't be trusted if they havem't been trained. How to handle USB drives. What and from where you can download and run programs. What actually IS a program and what isn't. Many of us learned this the hard way by playing lots of cracked games in the…

It's tough, I give security awareness trainings myself and I completely agree with what you're saying. However, that's a lot of information to give to a group of new employees that can span any department and technical understanding.

I actually was talking today with a customer during a logical assessment about if I talked about downloading malware in the training. I dedicate an entire section to downloading documents, but I don't really give people the information you're talking about. I tell them how to avoid ever having to download anything, and if they must do it, how to try and do it properly. All of this is ended with the process on how to report incidents because eventually something bad will happen.

As a company you kind of expect this to be solved at a number of layers. Endpoint management should hopefully help resolve this issue. Restricting web access where it makes sense can help. Sec Awareness Training helps keep people aware. Etc, etc, etc. You hope your controls are what save you from incidents, because there is no way you can effectively train your entire company on security topics to a degree that they can make good, security conscious decisions. That said, many of these SAT's are really just checking compliance requirements, because thats the real need. I put my own training together starting with what I know needs to be covered for compliance (pii handling, passwords, acceptable use policy, common threats, security incident response reporting, etc). Anything else that makes it in is purely because I have extra time and I know it to be important.

Re: When Employees Use Software That IT Hasn’t Approved

#188

Post by PeterisP »

tyingq wrote: post #15
mc32 wrote: post #12

Earlier quoted context omitted.

It depends. If the company has instituted SSO and MFA and someone goes out and uses a solution that is outside of that, they could be exposing the company to liability.

It's the fact that something like a "disciplinary council" exists, and that it was the first tactic the CIO went with that bothers me. There's a reason they went around the CIO. I suspect if the CIO had met with this person they could have learned and helped.

In the situation described in the article, the manager had gone to the CIO but CIO refused to help them.

"The CIO admitted that he had been approached and explained that he had informed the VP that IT already had a project with SAP to deliver what the VP needed. “Yes, but that won’t be ready for me to use for three years, and I need something today,” retorted the VP."

The manager had a valid and valuable reason ("increased revenue $1M per month") to require a service that CIO and their organization was unable to provide in a reasonable timeframe, but other companies on the market were.

Re: When Employees Use Software That IT Hasn’t Approved

#189

Post by IMTDb »

lmkg wrote: post #186
snowwrestler wrote: post #159

Earlier quoted context omitted.

We've got a Salesforce implementation going at the nonprofit where I work. While there was some debate about which big CRM we'd buy, the need to consolidate was blindingly obvious. Why? Because our organization has been quite forward thinking about allowing managers and executives to source the technology they think they to succeed. As this article advocates for, IT was largely consultative rather than dictatorial, a…

One of the side-effects I'm seeing of GDPR is a stronger incentive to consolidate systems under central management. Companies that allowed different departments the leeway to control their own systems now find themselves literally not knowing how many different places a customer's data might live.

> stronger incentive to consolidate systems under central management

Which in turn makes it easier to over analyse and identify user data, exactly what GDPR was meant to avoid.

Re: When Employees Use Software That IT Hasn’t Approved

#190

Post by user5994461 »

oxfordmale wrote: post #172
rb808 wrote: post #164

Earlier quoted context omitted.

I was a dev in the 90s and the start of the 2000s and always had admin rights. I dont need it any more. If you really had an edge case that requires admin rights I'm surprised. If you really need SQL server on your workstation you should think about using a different database. If your company says you have to use SQL server and you have to have it on your workstation and you need to reinstall it regularly and you're…

Try running Visual Studio without admin rights and you will weep. Regarding other rights, I tried to onboard a new Dev without admin rights, however, after the 25th IT ticket (that take days to get done), I gave up.

Visual Studio does not require admin rights to run at all. It stopped needing that almost ten years ago.

The only exceptions are some parts of the C++ debugger and the driver development kit.

Post reply on HN