Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When Employees Use Software That IT Hasn’t Approved

hbr.org

Post reply on HN
Print view View original

71–80 of 326 posts

Re: When Employees Use Software That IT Hasn’t Approved

#71

Post by thisisnico »

scarface74 wrote: post #23
thisisnico wrote: post #7

Earlier quoted context omitted.

To be honest, I find it odd when you treat it as if everyone else that you work with is a customer. I don't believe in this philosophy. The business is my customer. The business is what IT is trying to protect. If you have individuals that are not following policies, they would be disciplined like HR would discipline for not following policies. It's all in place to protect the business and what's best for the busines…

I find most “IT security policies” that hamper developers to be mostly security theatre. No matter how many policies they put in place, since they aren’t developers, one junior developer can write: var sql = “select * from Customer where firstname = ‘“ + firstname + “‘“; And thwart all of your security “best practices.” I was the lead dev at a medium size non tech company, and the hoops I had to go through to get any…

I agree that the current systems and policy for security is in-efficient. It seems that Security policies are mostly roadblocks to production, roadblocks for developers. It's a sad state at the moment and that I absolutely agree with. In this case IT isn't as worried about the users data on that machine. We're worried about the state of that machine taking everything else down with it. Users data should be stored on the network, some data may be local. A user with local admin access and installing malicious software has a higher risk of propagating everywhere. This is what I notice where a divide is between developers and IT. You must change you perspective. It's not a single user we're talking about, it's everything, the integrity of the system and the integrity of the network is based upon the integrity of every node on the network. A vast majority of the threats faced are user based. Somebody clicked on a link, somebody was spear-phished. The biggest threat to IT Security is ourselves.

Re: When Employees Use Software That IT Hasn’t Approved

#72

Post by maxxxxx »

basch wrote: post #69
maxxxxx wrote: post #62

Earlier quoted context omitted.

Exactly. Unfortunately windows admin rights are not very granular so if you do anything serious you end up needing full admin soon.

Application control is granular if you use SCCM or Intune and Application Guard. https://docs.microsoft.com/en-us/windows/client-management/m... There is absolutely middle ground if you have the time and resources to get it running smoothly.

I am sure solutions could be found. But it would require effort from IT to understand what we are doing and finding real solutions.

Re: When Employees Use Software That IT Hasn’t Approved

#73

Post by maxxxxx »

abledon wrote: post #34
drevil-v2 wrote: post #30

I still shudder thinking about my time working as a developer on corporate IT locked down IBM leased laptops. Every time I did npm install I needed to request admin access to Windows which took 2-3 hours to action by IBM team sitting on the other side of the world in India. One day a grey beard took pity on me and installed a Linux VM where I was admin, copied the security certs from the Windows host and I could acce…

wow. that sounds horrible. did they ask you fizzbuzz or mergesort in the interview?

Probably not. The interviewer didn’t know how to do fizz buzz himself.

Re: When Employees Use Software That IT Hasn’t Approved

#74

Post by fphhotchips »

How many years since The Phoenix Project and this conversation has barely moved an inch?

CIO probably wins this battle and gets the VP fired, but will be mystified when they're reporting to the CFO or a Chief Digital Officer when it happens 3 more times by the end of the year.

Re: When Employees Use Software That IT Hasn’t Approved

#75

Post by basch »

woofie11 wrote: post #27
thisisnico wrote: post #7

Earlier quoted context omitted.

To be honest, I find it odd when you treat it as if everyone else that you work with is a customer. I don't believe in this philosophy. The business is my customer. The business is what IT is trying to protect. If you have individuals that are not following policies, they would be disciplined like HR would discipline for not following policies. It's all in place to protect the business and what's best for the busines…

I don't think it's reasonable to treat everyone you work with as your customer, but that's not what's being proposed. IT's role is generally to support the organization. The organization is its customer. For the most part, it doesn't "work with," but it supports. In any organization, there's a complex network of who is a customer, who is a client, who is a peer, and so on. There are places I'm not IT's customer, but…

Boxing IT into a support role minimizes its potential contribution. If business enablement is the goal, that includes innovation, business development, and fixing what isnt broke. Coming to management with new business ideas instead of either waiting to be handed something, or only moving forward with ideas because they address risk and security.

Re: When Employees Use Software That IT Hasn’t Approved

#76

Post by noir_lord »

lzol wrote: post #49
S_A_P wrote: post #21

I see this a lot in consulting. When a new CIO (or CEO or other C level) arrives, they want to make their mark with a digital transformation intiative. This usually just means that the new C level employee is coming into a medium to large business and would like to add a bullet point to their resume and get that new shiny object everyone is talking about. Tableau, Salesforce, Data lakes, blockchain, ERP, Identity Man…

This resonates so much and seems to be a major trend in non-traditional tech companies. I've mostly worked in the financial industry and the executives' knowledge of technology is almost always horrible. As you said, a couple buzz words and very set opinions on the ways to do things. It's like they get pet projects in their head from reading an article in a magazine and get locked into it. I don't really have an issu…

> It's like they get pet projects in their head from reading an article in a magazine and get locked into it.

It's not like that, it's often exactly that.

I'm extremely fortunate in that while my boss sets the goals he never specifies how they should be achieved.

That means I get to implement them as we need them.

I'll never underestimate the value of smart management :).

Re: When Employees Use Software That IT Hasn’t Approved

#77

Post by mxuribe »

maxxxxx wrote: post #73
abledon wrote: post #34

Earlier quoted context omitted.

wow. that sounds horrible. did they ask you fizzbuzz or mergesort in the interview?

Probably not. The interviewer didn’t know how to do fizz buzz himself.

When has the lack of info/knowledge ever stopped interviewers from asking such questions? ;-)

Re: When Employees Use Software That IT Hasn’t Approved

#79

Post by bena »

maxxxxx wrote: post #70
rb808 wrote: post #66

Earlier quoted context omitted.

If you want a proper dev environment that matches your target you need a proper server to have sql server installed on. I'm pretty sure someone can install sql server on your workstation if you really need it. User permissioning is a dbo task. After that you just have to live with it like the rest of us.

You sound exactly like every other IT guy who doesn’t understand what we are working on. We then explain everything to them and usually they disappear and are never heard of again. That is, until the next guy shows up a year later and the cycle repeats.

It's like they don't realize that it's all software. Software that needs to do administrative tasks needs administrative permissions on the machine.

I really don't see how you can develop such software without having at least the ability to easily gain administrative permission on the machine.

Post reply on HN