Earlier quoted context omitted.
Either that or “IT” is someone who doesn’t feel qualified enough to be assertive in their position. If I was this “IT” person, I would explain to the individual that there was a critical vulnerability found which will not be patched and then print up a liability waver form for them to sign and date, stating that they are doing this on their own terms and I cannot be held responsible should anything go wrong.
> If I was this “IT” person, I would explain to the individual that there was a critical vulnerability found which will not be patched and then print up a liability waver form for them to sign and date, stating that they are doing this on their own terms and I cannot be held responsible should anything go wrong. That's even worse advice than what I was responding to. Great way to anger a high-ranking executive and pr…
I get what you're saying, and I think that most corporate IT departments run themselves as little fiefdoms with false pretensions of importance and power. But if someone is insisting upon running systems that don't conform to reasonable standards of the company, then something needs to be done. I would consider requiring that device to be isolated from the network with a small firewall.
But the waiver is a good idea—though unlike your assumption that it would be handled by an junior, such matters ought to be sent up the chain to the CIO or equivalent, and it should be the responsibility of the CIO to get the signature or take personal responsibility themselves.