231–240 of 326 posts
Earlier quoted context omitted.
And what if two companies standardized methods are incompatible?
They could hire a third company to copy the data from one standardized method to the other.
Earlier quoted context omitted.
I'm heading down this path right now. How do I obtain my certs while also allowing enough freedom for the dev teams to operate. We have to deal with the fallout when they screw something up, there has to be a happy medium somewhere.
What's the issue specifically? Developers don't need admin rights for much of anything in this decade. No need to bother with that. Common software has to be made available in self-service, so developers can install development tools like notepad++ or visual studio. Deployment is usually the challenge because you have to store binaries somewhere, copy it to some random servers and finally execute it, each step causin…
Earlier quoted context omitted.
One of the side-effects I'm seeing of GDPR is a stronger incentive to consolidate systems under central management. Companies that allowed different departments the leeway to control their own systems now find themselves literally not knowing how many different places a customer's data might live.
> stronger incentive to consolidate systems under central management Which in turn makes it easier to over analyse and identify user data, exactly what GDPR was meant to avoid.
GDPR "cares" about identifying user data - how else are you going to protect it and control access to it?
As for over analysing it (whatever that means), it really doesn't care too much about that as long as you have explicit meaningful informed permission from the user to do so, protect it properly, and let them control what happens to it (both during and afterwards).
Earlier quoted context omitted.
I'm one of those assholes that makes security policy. I deal with the same requests. The problem is, I write up a proposal identifying the risks associated with the exemption, along with minimum and recommended compensating controls. This then gets discussed among IT Management, where it is usually decided it's too much overhead, and to just deny the request or if the user can scream loud enough, allow it outright an…
It's an incentive misalignment. IT is evaluated in 'how secure things are' or 'how easy is it to maintain' or 'does this give me more headcount'. Not letting people do their jobs, or in how fast they can do their job. Employees are a captive audience, and if there was competition they would probably chose something else.
It sounds like the author recommends embracing the Agile philosophy of letting your teams choose their tools, then working with IT/Sec to make sure implementation is sound. I like that philosophy.
Great until you have five teams, each having chosen a different tool, and now you're wondering why the IT support costs are out of control. Still possible to support but requires a different model e.g. one where IT delivers a new, unconfigured workstation to your new team member and it's up to them to build it. If it breaks, their loss of productivity is their problem and not ITs. Authority for something (e.g. softwa…
Earlier quoted context omitted.
I worked at a very bad company, where IT was aggressively incompetent, and mean about it. At best they were negligent, at worst they actively interfered with anyone who they thought was a threat, which included anyone who was more intelligent than them, which was virtually everyone since the company was full of senior EE/ME/RF/CS folks. And I mean incompetent-- our network would go do down for hours, every day, and t…
Why would you stay for years in a company like that? It's so dysfunctional and toxic.
This is exactly extremely common. In my company there is this constant battle about the devs having admin rights on their machines. We need admin rights to do our job. We have had dozens of meetings explaining the situation but IT can’t come up with a solution so the devs go around security because they have no alternative if they want to finish their work . Same with Dropbox. They block it but we have suppliers who…
I've consulted for a big bank which blocks most file sharing sites and also blocks you from attaching scripts, server logs, etc to emails. Luckily, S3 is not blocked. I set up a bucket and have them upload to the bucket, which I then download on my own computer. Mission accomplished. Just getting free Windows applications procured and installed on the company laptop takes several layers of approval, emails back and f…
Earlier quoted context omitted.
It's an incentive misalignment. IT is evaluated in 'how secure things are' or 'how easy is it to maintain' or 'does this give me more headcount'. Not letting people do their jobs, or in how fast they can do their job. Employees are a captive audience, and if there was competition they would probably chose something else.
We attempt to address this by making IT's annual bonus tied in part to our dev's project completion. It's not perfect, but the heart is in the right place. A big problem with this is that when we're dealing with limited manpower, we'd rather throw it at the easy issues than the hard ones, and ultimately get more things done.
Earlier quoted context omitted.
Developer data can still be confidential/sensitive Yes, there are confidential data, but it shouldn't be any real customer data. Right?!? Frankly, given best practices from professional developers, stuff like cryptolockers just aren't an issue (blank the machines). Developers need admin, so building a network for them is actually a lot easier.
> Yes, there are confidential data, but it shouldn't be any real customer data. Right?!? But it might be. Whenever you're doing software other than for purely internal use, you have a customer that gives you sensitive data which devs absolutely need access to - like requirements for the software you're building!
Earlier quoted context omitted.
I think most of the reasons for admin rights are no longer valid. Its easy to change user environment variables and lots of applications can be installed as a user. Why would you need admin rights? Dropbox/googledrive is a huge security hole that is definitely blocked at most companies I work at.
This is about Windows desktop development. I need admin rights to install sql server, I need them to customize my machine so it’s similar to our target environment. I need to change user permissions all the time yo see how things behave under different conditions . There is a ton more I could walk you through and have done multiple times. Comments like yours come repeatedly from people who don’t know about the work w…