Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When Employees Use Software That IT Hasn’t Approved

hbr.org

Post reply on HN
Print view View original

211–220 of 326 posts

Re: When Employees Use Software That IT Hasn’t Approved

#211

Post by mywittyname »

user5994461 wrote: post #183
oceanghost wrote: post #113

Earlier quoted context omitted.

I worked at a very bad company, where IT was aggressively incompetent, and mean about it. At best they were negligent, at worst they actively interfered with anyone who they thought was a threat, which included anyone who was more intelligent than them, which was virtually everyone since the company was full of senior EE/ME/RF/CS folks. And I mean incompetent-- our network would go do down for hours, every day, and t…

Why would you stay for years in a company like that? It's so dysfunctional and toxic.

Judging by the statement that he worked with some high-level EE/CS/ME people, I assume the actual job was pretty interesting or cutting edge.

Re: When Employees Use Software That IT Hasn’t Approved

#212

Post by twunde »

maxxxxx wrote: post #22

This is exactly extremely common. In my company there is this constant battle about the devs having admin rights on their machines. We need admin rights to do our job. We have had dozens of meetings explaining the situation but IT can’t come up with a solution so the devs go around security because they have no alternative if they want to finish their work . Same with Dropbox. They block it but we have suppliers who…

The problem may actually be compliance requirements. SOC2/HITRUST/SOX all mandate the removal of admin rights from computers, mandate an approval process w/ manager approval. Regulated industries, especially banking have more security-related compliance requirements causing a lot of the pain.

Unfortunately from a security perspective devs and system admins are probably the highest risk targets since they typically have access to servers and admin rights. At the very least they have source code an attacker could analyze, and likely have access to external services.

The reality is that compliance, security and usability are often in direct conflict that can only be solved to make everyone happy with significant work.

Re: When Employees Use Software That IT Hasn’t Approved

#213

Post by tropo »

maxxxxx wrote: post #70
rb808 wrote: post #66

Earlier quoted context omitted.

If you want a proper dev environment that matches your target you need a proper server to have sql server installed on. I'm pretty sure someone can install sql server on your workstation if you really need it. User permissioning is a dbo task. After that you just have to live with it like the rest of us.

You sound exactly like every other IT guy who doesn’t understand what we are working on. We then explain everything to them and usually they disappear and are never heard of again. That is, until the next guy shows up a year later and the cycle repeats.

It's not crazy to give you another PC or two.

Corporate IT can admin the box for corporate training PowerPoint gunk. You get another box to run what you have written, and maybe another to run the development environment. Those don't go on IT's network. You can run a private LAN around the office, not connected to the outside world, in which you break things as you please.

This solution is even good enough for people who are intentionally dealing with malware.

Re: When Employees Use Software That IT Hasn’t Approved

#214

Post by TeMPOraL »

IMTDb wrote: post #189
lmkg wrote: post #186

Earlier quoted context omitted.

One of the side-effects I'm seeing of GDPR is a stronger incentive to consolidate systems under central management. Companies that allowed different departments the leeway to control their own systems now find themselves literally not knowing how many different places a customer's data might live.

> stronger incentive to consolidate systems under central management Which in turn makes it easier to over analyse and identify user data, exactly what GDPR was meant to avoid.

Not necessarily. Another way of looking at it is that GDPR is forcing companies to eliminate a common dysfunction, while at the same time restricting their ability to play shenanigans with user data. The end result is companies that are more efficient at what they should be doing, and restricted from doing what they shouldn't be doing. A win-win.

(While many business people used to how things worked are unhappy with the changes, sometimes you really have to bludgeon a fix through the broken incentive structures that plague businesses.)

Re: When Employees Use Software That IT Hasn’t Approved

#215

Post by novok »

jnosCo wrote: post #112
maxxxxx wrote: post #22

This is exactly extremely common. In my company there is this constant battle about the devs having admin rights on their machines. We need admin rights to do our job. We have had dozens of meetings explaining the situation but IT can’t come up with a solution so the devs go around security because they have no alternative if they want to finish their work . Same with Dropbox. They block it but we have suppliers who…

I'm one of those assholes that makes security policy. I deal with the same requests. The problem is, I write up a proposal identifying the risks associated with the exemption, along with minimum and recommended compensating controls. This then gets discussed among IT Management, where it is usually decided it's too much overhead, and to just deny the request or if the user can scream loud enough, allow it outright an…

It's an incentive misalignment. IT is evaluated in 'how secure things are' or 'how easy is it to maintain' or 'does this give me more headcount'.

Not letting people do their jobs, or in how fast they can do their job. Employees are a captive audience, and if there was competition they would probably chose something else.

Re: When Employees Use Software That IT Hasn’t Approved

#216

Post by FooHentai »

geekamongus wrote: post #20

It sounds like the author recommends embracing the Agile philosophy of letting your teams choose their tools, then working with IT/Sec to make sure implementation is sound. I like that philosophy.

Great until you have five teams, each having chosen a different tool, and now you're wondering why the IT support costs are out of control.

Still possible to support but requires a different model e.g. one where IT delivers a new, unconfigured workstation to your new team member and it's up to them to build it. If it breaks, their loss of productivity is their problem and not ITs.

Authority for something (e.g. software selection) must go in conjunction for responsibly for consequences arising. Those things must always move in lockstep to avoid perverse outcomes.

Re: When Employees Use Software That IT Hasn’t Approved

#217

Post by novok »

extra88 wrote: post #162
repolfx wrote: post #121

Earlier quoted context omitted.

Do you? Why can't you let developers admin their own network? At least some of them will know how to do the bulk of the work and a lot of the typical admin needed for Windows machines won't be that important for them (how often do they need to print something and how many of them would be unable to handle printer drivers themselves)? It doesn't introduce that many positives for lots of admin overhead For the IT depar…

> Why can't you let developers admin their own network? Being a good software developer doesn't mean you're a good network administrator or good at desktop support. And even if you are, a developer is paid more so it's a poor use of their time. I'm all for devs having admin access on their own machines, there are too many instances where it's needed, and reasonable exemptions from default policies when they conflict…

They tend to make builds 2x-3x slower, and the solution usually ends up being 'don't scan git directories and build software' or similar solutions that make them effectively useless anyway.

Re: When Employees Use Software That IT Hasn’t Approved

#218

Post by TeMPOraL »

noir_lord wrote: post #177
alecco wrote: post #174

Earlier quoted context omitted.

>> It's like they get pet projects in their head from reading an article in a magazine and get locked into it. >It's not like that, it's often exactly that. And it usually is sold also from within from know-it-all primadonnas who want to climb the ladder. Or at least put something "spectacular" on their CV.

Start a ground breaking project that will be amazing in 2 years. Get promoted/leave for more money after 18mths. 2 years rolls around, everything is on fire but the guy with the matches is nowhere to be found. Sounds very very familiar to me.

When reading these stories, part of me wants to give up and switch to the dark side. Instead of worrying about whether what we're doing is even useful for anyone, I could be earning money and prestige by leading large companies to deploy random SaaS solutions. What's not to like? I mean, except making your organization waste couple billion dollars and hundreds of man-years?

Re: When Employees Use Software That IT Hasn’t Approved

#219

Post by jillesvangurp »

hartator wrote: post #78

Isn't IT something from the past? I would expect people knowing how to use a computer and what they need to do their job.

My thoughts exactly. It's been a while since I last saw a company with an actual IT department and even longer where they had an actual clue. The reality is that IT in most SMEs simply sucks and no longer requires a college education. Working in IT for an SME is not a career plan. You're at constant risk of being outsourced and essentially all you do is done better by a gazillion companies as a service that probably cost less than a few months of your salary. Frankly, most SMEs would be better off doing exactly that. Most startups I work with do this from day one for obvious reasons.

Once you hit a certain scale different dynamics may kick in but even then, outsourcing is an option.

As a freelancer these days, I bring my own laptop and am granted access to stuff for the duration of the project. It's understood and expected of me that I do such things as encrypt disks, use 2FA, and don't use "secret" as the password. Most stuff I access for these projects is SAAS based. I'd probably walk away from projects where that wasn't the case.

Re: When Employees Use Software That IT Hasn’t Approved

#220

Post by TeMPOraL »

novok wrote: post #215
jnosCo wrote: post #112

Earlier quoted context omitted.

I'm one of those assholes that makes security policy. I deal with the same requests. The problem is, I write up a proposal identifying the risks associated with the exemption, along with minimum and recommended compensating controls. This then gets discussed among IT Management, where it is usually decided it's too much overhead, and to just deny the request or if the user can scream loud enough, allow it outright an…

It's an incentive misalignment. IT is evaluated in 'how secure things are' or 'how easy is it to maintain' or 'does this give me more headcount'. Not letting people do their jobs, or in how fast they can do their job. Employees are a captive audience, and if there was competition they would probably chose something else.

> It's an incentive misalignment. IT is evaluated in 'how secure things are' or 'how easy is it to maintain' or 'does this give me more headcount'.

I tend to summarize my experience with IT in large companies and universities like this: IT is evaluated in "how secure things are", or "whether things are not broken". The only sure-fire way to ensure a system is secure and not broken is to make it completely unusable, so that people don't use it. If people don't use a system, they can't break it!

Post reply on HN