Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When Employees Use Software That IT Hasn’t Approved

hbr.org

Post reply on HN
Print view View original

221–230 of 326 posts

Re: When Employees Use Software That IT Hasn’t Approved

#221

Post by yebyen »

davvolun wrote: post #179
yebyen wrote: post #138

Earlier quoted context omitted.

When a person says "we need this infrastructure project" and a project is commissioned, acknowledging the need, it is in my experience that unfortunately that person's job function is rarely placed on hold until the appropriate infrastructure has been made available. "Who cares about your pie-in-the-sky infrastructure project, my boss continues to measure our real performance with basic accounting, and is expecting t…

Of course that's the real question with the actual story in the actual article -- could they have implemented their security on the temporary infrastructure, or "good-enough" security, if the CIO knew about it? In that story, is the blame on the VP for going ahead instead of getting dialogue started between CEO, VP and CIO? Is it on the CIO for just saying "no" instead of recognizing the need and the value? Is it on…

I've been the one in the story who hears "no" enough times myself that I know which side I'm naturally going to fall on. But I've never been the one that did an Equifax, and now has to explain themselves to the board, so there's also that.

I've seen it said well in another comment on this post, I feel like could be said about more than a handful of orgs:

> The problem is, I write up a proposal identifying the risks associated with the exemption, along with minimum and recommended compensating controls. This then gets discussed among IT Management, where it is usually decided it's too much overhead, and to just deny the request or if the user can scream loud enough, allow it outright and get some director to sign something. The third oft-used response is ignore the problem and hope the user finds their own work around so we can get back to the 13 projects we're somehow expected to complete this quarter.

> ignore the problem and hope the user finds their own work around

> ignore the problem and hope the user finds their own work around

If this is even remotely the story of what happened, you can't really be surprised when the user went off and did their own thing. If they came to you with a specific priority business problem and an expectation of your support to solve it with a sense of necessary due urgency, and your answer is returned in the format of a 5 year plan... I don't think you can really act surprised in fairness when they end-around you and solve the problem somehow else, anyway.

If it means standing on a mountain of chairs for them to do so then I guess there'd have to be shared culpability. So how do we make sure that it never looks attractive to build that mountain of chairs?

I wish I knew more about the "digital customer acquisition program." The story makes it sound like this "VP for a declining line of business" honestly was not going to make it another 3.5 years without some help.

I struggle with this myself, when it seems like we could go ahead and solve a problem for like $80/mo, but instead we're going to study the problem and spend $20-40k out of peoples' salaries on coming up with a recommendation for an even more expensive project that can only be justified as necessary in order to avoid this other, cheaper tool we could have used.

There's obviously some mismatch when on one hand there's a major project with a vendor like SAP in the picture, but on the other hand there are basic needs that aren't being met, to the point where someone is going to set up "shadow-IT" on a personal credit card just to keep the basic business of the company moving in the right direction.

Re: When Employees Use Software That IT Hasn’t Approved

#222

Post by BonesJustice »

fancyfish wrote: post #140
maxxxxx wrote: post #22

This is exactly extremely common. In my company there is this constant battle about the devs having admin rights on their machines. We need admin rights to do our job. We have had dozens of meetings explaining the situation but IT can’t come up with a solution so the devs go around security because they have no alternative if they want to finish their work . Same with Dropbox. They block it but we have suppliers who…

I've consulted for a big bank which blocks most file sharing sites and also blocks you from attaching scripts, server logs, etc to emails. Luckily, S3 is not blocked. I set up a bucket and have them upload to the bucket, which I then download on my own computer. Mission accomplished. Just getting free Windows applications procured and installed on the company laptop takes several layers of approval, emails back and f…

Be careful. I work for such a bank, and even secure traffic is MITM’d when possible. There are data loss controls in place to analyze outbound traffic for things like source code.

Just because you’ve circumvented IT’s blocks doesn’t mean you won’t land yourself in hot water.

Re: When Employees Use Software That IT Hasn’t Approved

#223

Post by matchagaucho »

ownagefool wrote: post #199
snowwrestler wrote: post #159

Earlier quoted context omitted.

We've got a Salesforce implementation going at the nonprofit where I work. While there was some debate about which big CRM we'd buy, the need to consolidate was blindingly obvious. Why? Because our organization has been quite forward thinking about allowing managers and executives to source the technology they think they to succeed. As this article advocates for, IT was largely consultative rather than dictatorial, a…

Your problem statement does make it sound like you need a CRM, but I do wonder why is has to be a big CRM with a big consultancy, and why IT aren't delivering it? Who's going to run the thing afterwards? Will the bigdogs deliver something that you can maintain, or is that generally against their own interests? Finally, who's gonna secure all this customer data? Are they taking that on as part of their remit? They rar…

An IT culture that's built their budget and staff around managing a datacenter with on-premise software lacks incentive to support cloud implementations.

Re: When Employees Use Software That IT Hasn’t Approved

#224

Post by TeMPOraL »

protomyth wrote: post #101
lightbritefight wrote: post #90

Earlier quoted context omitted.

Developer data can still be confidential/sensitive, so you still need to monitor and control this second network with many of the same restrictions as the main one. You still have most of the same risks to compensate for, like data exfiltration and cryptolocker, etc. It doesnt introduce that many positives for lots of admin overhead, not just in maintaijg two distinct networks, but also in ensurijg interoperability w…

Developer data can still be confidential/sensitive Yes, there are confidential data, but it shouldn't be any real customer data. Right?!? Frankly, given best practices from professional developers, stuff like cryptolockers just aren't an issue (blank the machines). Developers need admin, so building a network for them is actually a lot easier.

> Yes, there are confidential data, but it shouldn't be any real customer data. Right?!?

But it might be. Whenever you're doing software other than for purely internal use, you have a customer that gives you sensitive data which devs absolutely need access to - like requirements for the software you're building!

Re: When Employees Use Software That IT Hasn’t Approved

#225

Post by TeMPOraL »

extra88 wrote: post #162
repolfx wrote: post #121

Earlier quoted context omitted.

Do you? Why can't you let developers admin their own network? At least some of them will know how to do the bulk of the work and a lot of the typical admin needed for Windows machines won't be that important for them (how often do they need to print something and how many of them would be unable to handle printer drivers themselves)? It doesn't introduce that many positives for lots of admin overhead For the IT depar…

> Why can't you let developers admin their own network? Being a good software developer doesn't mean you're a good network administrator or good at desktop support. And even if you are, a developer is paid more so it's a poor use of their time. I'm all for devs having admin access on their own machines, there are too many instances where it's needed, and reasonable exemptions from default policies when they conflict…

> But a "conflict" would be things like anti-malware software making builds fail, not merely making builds 10% slower.

Given developer salaries, a friction like making builds 10% slower is hemorrhaging money. And it gets worse if someone is actually waiting for the software to be delivered, and the amount of money the company gets is correlated to keeping the schedule.

Re: When Employees Use Software That IT Hasn’t Approved

#226

Post by analog31 »

lnanek2 wrote: post #125
pmorici wrote: post #87

Earlier quoted context omitted.

Shouldn't this kind of thing be a problem for the managers to address? If you just circumvent this kind of nonsense instead of addressing it head on it just proliferates and allows the people who promote it to think they are doing an acceptable job. At minimum you should inform your direct manager of the situation so they can address it or accept the consequences that the work that depends on the restricted resource…

I've heard security management say it is their job to say no all day. They definitely don't care about preventing work getting done. They will only get fired if a data leak occurs, etc.. Preventing work won't even ding their promo outcomes.

Whenever several people of a profession work together in one location, they tend to form a Guild. My dad couldn't plug something into an electrical outlet without having an electrician do it. This is human nature, and is as old as the hills.

Re: When Employees Use Software That IT Hasn’t Approved

#227

Post by TeMPOraL »

natch wrote: post #103
maxxxxx wrote: post #68

Earlier quoted context omitted.

The funny thing is that they block Dropbox but then there are plenty of shady upload sites that aren’t blocked. We don’t use them because we think they aren’t secure but our IT guys would have no problem with that.

That highlights a problem woven through the industry which is that the IT department isn’t always the sharpest team in the building, even on security matters.

It's worse than that. I haven't met an IT person yet that wasn't as smart as the developers they worked with, except in slightly different domain. But the incentive structures are aligned in a way that makes IT's real job to execute cover-your-ass directives which freeze work. Doing the right thing is literally the opposite of what IT is being paid for.

Re: When Employees Use Software That IT Hasn’t Approved

#228

Post by mcshicks »

Shivetya wrote: post #180
maxxxxx wrote: post #22

This is exactly extremely common. In my company there is this constant battle about the devs having admin rights on their machines. We need admin rights to do our job. We have had dozens of meetings explaining the situation but IT can’t come up with a solution so the devs go around security because they have no alternative if they want to finish their work . Same with Dropbox. They block it but we have suppliers who…

I have rarely found that they need admin rights on a day to day basis unless the tool is badly designed. I have one software delivery platform that requires full admin rights, it cannot write just to the user configuration! However developers are very good at presenting it otherwise. Myself, I have run into issues where admin rights were needed, again always because of some poor installer. USB has been blocked as wel…

I think it really depends on what kind of development you are doing. I worked at an IC company, and among other things we developed (and tested) USB drivers for our devices. We installed them on literally hundreds of windows machines for testing before they were signed/ whql approved. This happen all the time. So really no way do our jobs without admin passwords. We did have the machine on isolated networks, but even on the regular networks many of the team member frequently would need to hand install drivers. This is just one of many examples. If you do anything even remotely hardware related, it can really be a totally different problem. We had IT installed USB filter drivers (we were not told about for security reasons) that actually broke a lot of testing in our labs and it took us months to figure out.

Re: When Employees Use Software That IT Hasn’t Approved

#229

Post by closeparen »

rifung wrote: post #178
repolfx wrote: post #124

Earlier quoted context omitted.

The issue here seems more cultural than technical - it seems non-tech firms are vastly more paranoid about data sharing or leakage, despite usually having less valuable data. The amount of effort put into anti-exfiltration measures in finance is staggering compared to what existed at Google, and it kills productivity to an enormous degree. This seems to go hand in hand with a much greater obsession over IP. I've seen…

> My guess is that outside the tech industry, new ideas are relatively rare so even very simple ideas feel incredibly valuable. Are they not rare even inside the tech industry?

Put it this way: if all our engineering design documents and presentations leaked, our competitors would get less value from their contents than they would have to spend on the reading.

Re: When Employees Use Software That IT Hasn’t Approved

#230

Post by novok »

cmdkeen wrote: post #116
maxxxxx wrote: post #61

Earlier quoted context omitted.

This is about Windows desktop development. I need admin rights to install sql server, I need them to customize my machine so it’s similar to our target environment. I need to change user permissions all the time yo see how things behave under different conditions . There is a ton more I could walk you through and have done multiple times. Comments like yours come repeatedly from people who don’t know about the work w…

Being punchy about it you've never moved on from thinking you need admin rights on your machine. Chocolatey for Business' self-service installer, SCCM jobs, and a variety of other tools exist to enable you to get specific things that require elevation executed. If you're changing things to test various configurations wouldn't it be handy to have those scripted, get them peer reviewed / linted and you've got yourself…

Then I hit another 'no-admin' roadblock, that requires a day or weeks of hostile IT bureaucracy and the IT department has just wasted another +$3000 of employee time. This behavior might drive them to quit, leading to a premature +$30k recruiting and on ramping cost to replace them.

Now iterate that over 1000s of other instances and you see the financial reason why devs need admin.

Post reply on HN