Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When Employees Use Software That IT Hasn’t Approved

hbr.org

Post reply on HN
Print view View original

271–280 of 326 posts

Re: When Employees Use Software That IT Hasn’t Approved

#271

Post by tyingq »

richk449 wrote: post #258
twunde wrote: post #212

Earlier quoted context omitted.

The problem may actually be compliance requirements. SOC2/HITRUST/SOX all mandate the removal of admin rights from computers, mandate an approval process w/ manager approval. Regulated industries, especially banking have more security-related compliance requirements causing a lot of the pain. Unfortunately from a security perspective devs and system admins are probably the highest risk targets since they typically ha…

> SOC2/HITRUST/SOX all mandate the removal of admin rights from computers, mandate an approval process w/ manager approval I’ve heard this before, but never with any detail. Can you explain further, or point to a resource? For example, clearly SOX doesn’t say that nobody can have admin rights - because IT does. And I highly doubt that the law says that only departments with IT in the title can have admin access. So w…

SOX doesn't actually say much about IT at all. It says mostly that you need internal controls to maintain the integrity of financial information. Anything more specific than that, around IT, is just someone extrapolating out what they think a good set of internal controls are.

Mostly when you hear "because SOX", that person has never actually read the document.

Re: When Employees Use Software That IT Hasn’t Approved

#272

Post by orionblastar »

maxxxxx wrote: post #22

This is exactly extremely common. In my company there is this constant battle about the devs having admin rights on their machines. We need admin rights to do our job. We have had dozens of meetings explaining the situation but IT can’t come up with a solution so the devs go around security because they have no alternative if they want to finish their work . Same with Dropbox. They block it but we have suppliers who…

Or they block Youtube, and you got clients using Youtube to describe how they want things done. Watch it on your phone or at home.

Re: When Employees Use Software That IT Hasn’t Approved

#273

Post by mgamache »

TheRealDunkirk wrote: post #253
fancyfish wrote: post #140

Earlier quoted context omitted.

I've consulted for a big bank which blocks most file sharing sites and also blocks you from attaching scripts, server logs, etc to emails. Luckily, S3 is not blocked. I set up a bucket and have them upload to the bucket, which I then download on my own computer. Mission accomplished. Just getting free Windows applications procured and installed on the company laptop takes several layers of approval, emails back and f…

Outgoing SSH is blocked at my company, even to non-SSH ports. Even to virtual machines I had already setup in Azure before the block. Sure, guys. Of all things to block, let's block the most secure one. That'll really improve our security posture. At this point, I'm continually surprised they haven't superglued the USB ports.

You can switch SSH to port 80 or 443, right?

Re: When Employees Use Software That IT Hasn’t Approved

#274

Post by voltagex_ »

oxfordmale wrote: post #172
rb808 wrote: post #164

Earlier quoted context omitted.

I was a dev in the 90s and the start of the 2000s and always had admin rights. I dont need it any more. If you really had an edge case that requires admin rights I'm surprised. If you really need SQL server on your workstation you should think about using a different database. If your company says you have to use SQL server and you have to have it on your workstation and you need to reinstall it regularly and you're…

Try running Visual Studio without admin rights and you will weep. Regarding other rights, I tried to onboard a new Dev without admin rights, however, after the 25th IT ticket (that take days to get done), I gave up.

I run Visual Studio without admin rights every day. But, if you're doing driver development, working with older IIS, certain parts of the registry or developing installers then yeah you're going to have a bad time.

Re: When Employees Use Software That IT Hasn’t Approved

#275

Post by Aeolun »

Shivetya wrote: post #180
maxxxxx wrote: post #22

This is exactly extremely common. In my company there is this constant battle about the devs having admin rights on their machines. We need admin rights to do our job. We have had dozens of meetings explaining the situation but IT can’t come up with a solution so the devs go around security because they have no alternative if they want to finish their work . Same with Dropbox. They block it but we have suppliers who…

I have rarely found that they need admin rights on a day to day basis unless the tool is badly designed. I have one software delivery platform that requires full admin rights, it cannot write just to the user configuration! However developers are very good at presenting it otherwise. Myself, I have run into issues where admin rights were needed, again always because of some poor installer. USB has been blocked as wel…

Even if you need admin rights only once a week, if it takes a day to get them you waste 20% of your time.

Re: When Employees Use Software That IT Hasn’t Approved

#276

Post by avgDev »

noir_lord wrote: post #76
lzol wrote: post #49

Earlier quoted context omitted.

This resonates so much and seems to be a major trend in non-traditional tech companies. I've mostly worked in the financial industry and the executives' knowledge of technology is almost always horrible. As you said, a couple buzz words and very set opinions on the ways to do things. It's like they get pet projects in their head from reading an article in a magazine and get locked into it. I don't really have an issu…

> It's like they get pet projects in their head from reading an article in a magazine and get locked into it. It's not like that, it's often exactly that. I'm extremely fortunate in that while my boss sets the goals he never specifies how they should be achieved. That means I get to implement them as we need them. I'll never underestimate the value of smart management :).

I work with a guy, that can't code, is a DBA but I have to fix his queries but when it comes to new projects, he has all the answers on how to implement everything and has not written a single line of code in an application.

Recently, I even told him just to tell me what he wants to achieve because his implementations do not make sense and its my job.

At least my boss also let's me do it my way, still annoying.

Re: When Employees Use Software That IT Hasn’t Approved

#277

Post by Kalium »

lnanek2 wrote: post #125
pmorici wrote: post #87

Earlier quoted context omitted.

Shouldn't this kind of thing be a problem for the managers to address? If you just circumvent this kind of nonsense instead of addressing it head on it just proliferates and allows the people who promote it to think they are doing an acceptable job. At minimum you should inform your direct manager of the situation so they can address it or accept the consequences that the work that depends on the restricted resource…

I've heard security management say it is their job to say no all day. They definitely don't care about preventing work getting done. They will only get fired if a data leak occurs, etc.. Preventing work won't even ding their promo outcomes.

The opposite scenario also happens. When security management's job is to never prevent work getting done, their inability to say no to even the most abusive practices can become an issue.

Cloning a production database full of private customer data for testing? Well, we can't interfere with a practice that gets features shipped and the team doesn't have space on their roadmap to build out synthetic data...

Re: When Employees Use Software That IT Hasn’t Approved

#278

Post by analog31 »

Something that's crossed my mind is John Gall's observation that complex systems operate in failure mode 100% of the time. I understand "failure mode" to mean that built-in guards have been bypassed in order to enable the system to do anything at all. Germane to this thread, the "guards" are IT approvals.

I suspect that if a business is complex enough to have IT policy, that policy is always being bypassed in some way, at any given time. Somebody is using unofficial software, or using official software in an unofficial way.

Re: When Employees Use Software That IT Hasn’t Approved

#279

Post by vikingcaffiene »

maxxxxx wrote: post #22

This is exactly extremely common. In my company there is this constant battle about the devs having admin rights on their machines. We need admin rights to do our job. We have had dozens of meetings explaining the situation but IT can’t come up with a solution so the devs go around security because they have no alternative if they want to finish their work . Same with Dropbox. They block it but we have suppliers who…

> In my company there is this constant battle about the devs having admin rights on their machines.

I ended up leaving my last job over this and more stuff like it. They had a url filter in place for instance, that would randomly block access to our network resources. It would never be the same one so every now and again your stuff would start failing and you would lose a few hours debugging until you realized.... GAH! Then have to email and lose the rest of your day waiting for them to fix it.

Never. Again.

Re: When Employees Use Software That IT Hasn’t Approved

#280

Post by mayniac »

mgamache wrote: post #273
TheRealDunkirk wrote: post #253

Earlier quoted context omitted.

Outgoing SSH is blocked at my company, even to non-SSH ports. Even to virtual machines I had already setup in Azure before the block. Sure, guys. Of all things to block, let's block the most secure one. That'll really improve our security posture. At this point, I'm continually surprised they haven't superglued the USB ports.

You can switch SSH to port 80 or 443, right?

You can switch it to any port you want. Problem is that it's super easy to spot on security monitoring tools. I deal with "SSH not on port 22" alerts at least once a month.

It's possible to get around this by tunneling SSH over other protocols: http://dag.wiee.rs/howto/ssh-http-tunneling/. Bear in mind if you do this in a corporate environment, security will throw the largest book they can find at you.

Post reply on HN