When Employees Use Software That IT Hasn’t Approved • Hacker News Board

Re: When Employees Use Software That IT Hasn’t Approved

#191

Post by syshum » Wed, Jun 12, 2019, 8:56 PM UTC

burfog wrote: post #14

spydum wrote: post #6

Earlier quoted context omitted.

No, CIO role often carries responsibility for security. VP violates policy is like skirting regulation - yes it cost less money, but for all you know they are not compliant with policy and aren’t doing the whole job. However it does often seem like IT doesn’t consider SaaS solutions - they always want to build something their selves without doing cost analysis.

I have to use SaaS solutions for work, and the security situation terrifies me. I have to put my corporate password, with access to all sorts of important stuff, into a sketchy 3rd-party web site. This looks mighty bad.

Properly implemented no you would never do that, you would use a trusted SAML auth server to Authentication with your Domain Creds,

Something like Azure AD, ADFS, or 3rd party (that you assume to trust) like OneLogin. In all cases you would never enter your password into the SaaS service you are redirected to a secure portal controlled by the Auth Service, a token is then issued back to the SaaS service

Further it would be recommended not to use an elevated account and certainly not something like a Domain Admin account for those services

Re: When Employees Use Software That IT Hasn’t Approved

#192

Post by maxxxxx » Wed, Jun 12, 2019, 8:57 PM UTC

user5994461 wrote: post #185

alkonaut wrote: post #176

Earlier quoted context omitted.

Out of curiosity, what's the benefit of me doing bad things in a VM, instead of on my own machine - assuming the VM has full access to the same networks and data as the physical machine? Unless the VM is somehow sandboxed it's just another box on the same network. So the same reasons for me not being admin on the physical machine (e.g. to not be able to download and run untrusted software because it might spread some…

Of course the VM is isolated. That's exactly the point of a VM. An account inside a VM will only let you play in that VM. Whereas your account on the host is available and automatically granted access to all machines, fileshares and services on the active directory network. If it got admin rights, then you've got admin pretty much everywhere.

“Whereas your account on the host is available and automatically granted access to all machines, fileshares and services on the active directory network. If it got admin rights, then you've got admin pretty much everywhere.”

Nonsense. You can have local admin rights that work only on one machine.

Re: When Employees Use Software That IT Hasn’t Approved

#193

Post by maxxxxx » Wed, Jun 12, 2019, 8:58 PM UTC

oxfordmale wrote: post #172

rb808 wrote: post #164

Earlier quoted context omitted.

I was a dev in the 90s and the start of the 2000s and always had admin rights. I dont need it any more. If you really had an edge case that requires admin rights I'm surprised. If you really need SQL server on your workstation you should think about using a different database. If your company says you have to use SQL server and you have to have it on your workstation and you need to reinstall it regularly and you're…

Try running Visual Studio without admin rights and you will weep. Regarding other rights, I tried to onboard a new Dev without admin rights, however, after the 25th IT ticket (that take days to get done), I gave up.

Or try LabView. It’s not doable.

Re: When Employees Use Software That IT Hasn’t Approved

#194

Post by closetohome » Wed, Jun 12, 2019, 9:01 PM UTC

rsuelzer wrote: post #133

Our IT security department was incentivized to deny everything from new tools to new internal applications. We had an outside firm making security decisions and if there were any security issues it would end up being on them. So as long as they did not allow us to release any products and or install any software they could not be held responsible. I made friends with a lower level contractor who told me off the recor…

I think it really depends on the company. If you're something like a nontechnical non-profit, sure, turn that decision making over to IT. In that case IT is performing a vital, skilled function.

But in most software shops, the workers are probably more qualified than the IT department to be making decisions about what applications to use, and what kind of security they need. IT is just there to make things run and fix them when they break. They don't really need to offer guidance.

Re: When Employees Use Software That IT Hasn’t Approved

#195

Post by noja » Wed, Jun 12, 2019, 9:02 PM UTC

There's a difference between using software that IT has approved and shipping customer data outside of the company.

Re: When Employees Use Software That IT Hasn’t Approved

#196

Post by user5994461 » Wed, Jun 12, 2019, 9:04 PM UTC

x38iq84n wrote: post #43

brixon wrote: post #25

Let's ignore the SaaS security issues for a second. When IT says "No" it's not like the area asking is going to go away and not try to solve their problem. Organizations are going to find ways to solve their issues and IT can either help from the beginning or help clean up the mess later. I try to take the stance of offering the right solution and a lot of the times a now solution at the same time. There is no saying…

I have seen IT being unaware of and unwilling to meet requirements of highly specialized technical teams, such as network engineering. You cannot have a TELNET client because the use of TELNET is prohibited by corporate policy, test TCP connections another way. You don't need vim when you have vi. You can't have admin rights but we don't support drivers for RS232 dongle so nope. Sometimes it's quite a challenge to ge…

Use netcat.

Telnet is pretty hard to procure since it's not included by default since Windows 7.

Re: When Employees Use Software That IT Hasn’t Approved

#197

Post by kelnos » Wed, Jun 12, 2019, 9:08 PM UTC

repolfx wrote: post #121

lightbritefight wrote: post #90

Earlier quoted context omitted.

Developer data can still be confidential/sensitive, so you still need to monitor and control this second network with many of the same restrictions as the main one. You still have most of the same risks to compensate for, like data exfiltration and cryptolocker, etc. It doesnt introduce that many positives for lots of admin overhead, not just in maintaijg two distinct networks, but also in ensurijg interoperability w…

Do you? Why can't you let developers admin their own network? At least some of them will know how to do the bulk of the work and a lot of the typical admin needed for Windows machines won't be that important for them (how often do they need to print something and how many of them would be unable to handle printer drivers themselves)? It doesn't introduce that many positives for lots of admin overhead For the IT depar…

> Why can't you let developers admin their own network?

Because I don't want to, and that's not (and shouldn't be) a core part of my job. It's a distraction that will reduce my productivity.

Re: When Employees Use Software That IT Hasn’t Approved

#198

Post by peteradio » Wed, Jun 12, 2019, 9:11 PM UTC

snowwrestler wrote: post #159

S_A_P wrote: post #21

I see this a lot in consulting. When a new CIO (or CEO or other C level) arrives, they want to make their mark with a digital transformation intiative. This usually just means that the new C level employee is coming into a medium to large business and would like to add a bullet point to their resume and get that new shiny object everyone is talking about. Tableau, Salesforce, Data lakes, blockchain, ERP, Identity Man…

We've got a Salesforce implementation going at the nonprofit where I work. While there was some debate about which big CRM we'd buy, the need to consolidate was blindingly obvious. Why? Because our organization has been quite forward thinking about allowing managers and executives to source the technology they think they to succeed. As this article advocates for, IT was largely consultative rather than dictatorial, a…

Whatever you want implemented smartly probably doesn't need each of these buzzwords. Implemented smartly could live on a desktop in a closet.

Re: When Employees Use Software That IT Hasn’t Approved

#199

Post by ownagefool » Wed, Jun 12, 2019, 9:11 PM UTC

snowwrestler wrote: post #159

S_A_P wrote: post #21

I see this a lot in consulting. When a new CIO (or CEO or other C level) arrives, they want to make their mark with a digital transformation intiative. This usually just means that the new C level employee is coming into a medium to large business and would like to add a bullet point to their resume and get that new shiny object everyone is talking about. Tableau, Salesforce, Data lakes, blockchain, ERP, Identity Man…

We've got a Salesforce implementation going at the nonprofit where I work. While there was some debate about which big CRM we'd buy, the need to consolidate was blindingly obvious. Why? Because our organization has been quite forward thinking about allowing managers and executives to source the technology they think they to succeed. As this article advocates for, IT was largely consultative rather than dictatorial, a…

Your problem statement does make it sound like you need a CRM, but I do wonder why is has to be a big CRM with a big consultancy, and why IT aren't delivering it?

Who's going to run the thing afterwards? Will the bigdogs deliver something that you can maintain, or is that generally against their own interests?

Finally, who's gonna secure all this customer data? Are they taking that on as part of their remit? They rarely do.

Re: When Employees Use Software That IT Hasn’t Approved

#200

Post by user5994461 » Wed, Jun 12, 2019, 9:14 PM UTC

CrossWired wrote: post #169

jrjarrett wrote: post #130

This thread hits home. I switched jobs a few years ago because the IT policies on workstations were being ratcheted down to make my job as a developer difficult to impossible. Now, the company I work for, ostensibly a _software_ company, got its ISO certifications, which meant policies and procedures that make developing hard or impossible again. How does a software business _successfully_ implement stringent access…

I'm heading down this path right now. How do I obtain my certs while also allowing enough freedom for the dev teams to operate. We have to deal with the fallout when they screw something up, there has to be a happy medium somewhere.

What's the issue specifically?

Developers don't need admin rights for much of anything in this decade. No need to bother with that.

Common software has to be made available in self-service, so developers can install development tools like notepad++ or visual studio.

Deployment is usually the challenge because you have to store binaries somewhere, copy it to some random servers and finally execute it, each step causing numerous security headaches, so there has to be some approved tooling to handle that.