Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When Employees Use Software That IT Hasn’t Approved

hbr.org

Post reply on HN
Print view View original

251–260 of 326 posts

Re: When Employees Use Software That IT Hasn’t Approved

#251

Post by TheRealDunkirk »

philipodonnell wrote: post #36

> The CIO admitted that he had been approached and explained that he had informed the VP that IT already had a project with SAP to deliver what the VP needed. “Yes, but that won’t be ready for me to use for three years, and I need something today,” retorted the VP. The CIO was silent. Then the CEO asked the VP, “I’ve known you for ten years. You don’t seem like someone who would do something to harm the company. Why…

What does it mean, to you, to do a "required security audit" of a company like Salesforce, or any cloud provider, for that matter?

Re: When Employees Use Software That IT Hasn’t Approved

#252

Post by miqkt »

jrjarrett wrote: post #130

This thread hits home. I switched jobs a few years ago because the IT policies on workstations were being ratcheted down to make my job as a developer difficult to impossible. Now, the company I work for, ostensibly a _software_ company, got its ISO certifications, which meant policies and procedures that make developing hard or impossible again. How does a software business _successfully_ implement stringent access…

Alas, I'm in a similar situation with my current stint and looking for an exit.

The most maddening part for me is to literally sit around helpless and unable to do any development because you need to wait for your IT support ticket to be looked at. Then having to explain to your manager why work is behind schedule.

However, idle time alone doesn't seem like strong enough reason to open discussion on changing IT policies.

Re: When Employees Use Software That IT Hasn’t Approved

#253

Post by TheRealDunkirk »

fancyfish wrote: post #140
maxxxxx wrote: post #22

This is exactly extremely common. In my company there is this constant battle about the devs having admin rights on their machines. We need admin rights to do our job. We have had dozens of meetings explaining the situation but IT can’t come up with a solution so the devs go around security because they have no alternative if they want to finish their work . Same with Dropbox. They block it but we have suppliers who…

I've consulted for a big bank which blocks most file sharing sites and also blocks you from attaching scripts, server logs, etc to emails. Luckily, S3 is not blocked. I set up a bucket and have them upload to the bucket, which I then download on my own computer. Mission accomplished. Just getting free Windows applications procured and installed on the company laptop takes several layers of approval, emails back and f…

Outgoing SSH is blocked at my company, even to non-SSH ports. Even to virtual machines I had already setup in Azure before the block.

Sure, guys. Of all things to block, let's block the most secure one. That'll really improve our security posture.

At this point, I'm continually surprised they haven't superglued the USB ports.

Re: When Employees Use Software That IT Hasn’t Approved

#254

Post by Consultant32452 »

lightbritefight wrote: post #90
protomyth wrote: post #83

Earlier quoted context omitted.

I'm still not sure why developers aren't on their own network for development. Have a red box / blue box type system at the developers desk. Given modern networking, it wouldn't actually be that hard to setup and keep development / integration / system tests (or what names you use) away from a locked down production would not be such a bad thing[1]. Having some dual homed file shares wouldn't be that hard either. 1)…

Developer data can still be confidential/sensitive, so you still need to monitor and control this second network with many of the same restrictions as the main one. You still have most of the same risks to compensate for, like data exfiltration and cryptolocker, etc. It doesnt introduce that many positives for lots of admin overhead, not just in maintaijg two distinct networks, but also in ensurijg interoperability w…

My personal anecdata is that I've never worked at a place where I couldn't trivially exfiltrate real user data and source code without being traced. This is 20 years across defense contractors, banks, insurance companies, etc.

I understand your argument and in principle I agree with it, but in my experience nobody cares all that much about the data on the primary network, so creating a second network that grants devs things like local admin doesn't seem to increase risk by much.

Re: When Employees Use Software That IT Hasn’t Approved

#255

Post by TheRealDunkirk »

rb808 wrote: post #47
maxxxxx wrote: post #22

This is exactly extremely common. In my company there is this constant battle about the devs having admin rights on their machines. We need admin rights to do our job. We have had dozens of meetings explaining the situation but IT can’t come up with a solution so the devs go around security because they have no alternative if they want to finish their work . Same with Dropbox. They block it but we have suppliers who…

I think most of the reasons for admin rights are no longer valid. Its easy to change user environment variables and lots of applications can be installed as a user. Why would you need admin rights? Dropbox/googledrive is a huge security hole that is definitely blocked at most companies I work at.

> lots of applications can be installed as a user.

Because most of the non-insignificant ones still CAN'T be, under Windows, to this day. So special people get a completely separate account with pseudo-admin rights. I have to enter those credentials several times a day.

Then I spoke to a help desk guy, who said he had to enter his domain admin account password 40 TIMES a day.

What a waste.

Re: When Employees Use Software That IT Hasn’t Approved

#256

Post by TheRealDunkirk »

frosted-flakes wrote: post #131
esoterica wrote: post #122

Earlier quoted context omitted.

You can ask IT to install it for you. You don’t need to install it yourself.

But then you're waiting around for the rest of the day for them to come install it.

DAY!? What magical place do you work at where IT is so specialized that you have to request them to install an application, and it only takes ONE DAY?

Re: When Employees Use Software That IT Hasn’t Approved

#257

Post by count »

matchagaucho wrote: post #223
ownagefool wrote: post #199

Earlier quoted context omitted.

Your problem statement does make it sound like you need a CRM, but I do wonder why is has to be a big CRM with a big consultancy, and why IT aren't delivering it? Who's going to run the thing afterwards? Will the bigdogs deliver something that you can maintain, or is that generally against their own interests? Finally, who's gonna secure all this customer data? Are they taking that on as part of their remit? They rar…

An IT culture that's built their budget and staff around managing a datacenter with on-premise software lacks incentive to support cloud implementations.

What IT org with that kind of focus has time to learn an entirely new stack? And nobody wants to add headcount to an overhead org...

Re: When Employees Use Software That IT Hasn’t Approved

#258

Post by richk449 »

twunde wrote: post #212
maxxxxx wrote: post #22

This is exactly extremely common. In my company there is this constant battle about the devs having admin rights on their machines. We need admin rights to do our job. We have had dozens of meetings explaining the situation but IT can’t come up with a solution so the devs go around security because they have no alternative if they want to finish their work . Same with Dropbox. They block it but we have suppliers who…

The problem may actually be compliance requirements. SOC2/HITRUST/SOX all mandate the removal of admin rights from computers, mandate an approval process w/ manager approval. Regulated industries, especially banking have more security-related compliance requirements causing a lot of the pain. Unfortunately from a security perspective devs and system admins are probably the highest risk targets since they typically ha…

> SOC2/HITRUST/SOX all mandate the removal of admin rights from computers, mandate an approval process w/ manager approval

I’ve heard this before, but never with any detail. Can you explain further, or point to a resource? For example, clearly SOX doesn’t say that nobody can have admin rights - because IT does. And I highly doubt that the law says that only departments with IT in the title can have admin access. So what does it really say?

Re: When Employees Use Software That IT Hasn’t Approved

#259

Post by ClassyJacket »

user5994461 wrote: post #209
maxxxxx wrote: post #192

Earlier quoted context omitted.

“Whereas your account on the host is available and automatically granted access to all machines, fileshares and services on the active directory network. If it got admin rights, then you've got admin pretty much everywhere.” Nonsense. You can have local admin rights that work only on one machine.

Nonsense, there are endless ways to escalate and pivot once you get local admin. That being said, there are indeed restrictions that can and should be set on admin rights. Not that IT would know about it or that it would limit pivoting much.

"Nonsense, there are endless ways to escalate and pivot once you get local admin."

Why not report your findings to Microsoft and get your bug bounty payout?

And if this is true, wouldn't they also just do that from inside the VM?

Re: When Employees Use Software That IT Hasn’t Approved

#260

Post by wdb »

bt3 wrote: post #51
S_A_P wrote: post #21

I see this a lot in consulting. When a new CIO (or CEO or other C level) arrives, they want to make their mark with a digital transformation intiative. This usually just means that the new C level employee is coming into a medium to large business and would like to add a bullet point to their resume and get that new shiny object everyone is talking about. Tableau, Salesforce, Data lakes, blockchain, ERP, Identity Man…

> Nobody every gets fired for hiring Accenture/Deloitte/PwC. What usually happens in the non trivial niches is that these big shops sleeve the boutiques through them to get things done... To provide a prospective as someone who works for a consulting firm like the ones you've mentioned... Hiring the "big" firms versus boutiques is a lot about a perception of risk, maintaining partnerships (procurement with new vendor…

My experience with working with those consulting firms is that you start with 2 of them and at the end of the year you end up with 6 while still wondering why and having the test team somewhere offshore not doing what they promised so you end up doing it yourself as boutique firm
Post reply on HN