3 ms·
A number of comments here blame the security people or government IT in general for not being accommodating. That may be appropriate in some cases, but anyone w
by johngalt 11y ago
A number of comments here blame the security people or government IT in general for not being accommodating. That may be appropriate in some cases, but anyone who has worked in IT for any length of time understands how this happens. Systems that you don't like are created by bad policies, not bad IT people. Bad policies are driven by overly centralized security responsibility. The security department that says no to <X> because they are responsible for whatever you manage to do with <X>.
Think of a car accident. There is a diffusion of responsibility. The decisions both drivers made, road conditions, weather, speeds etc... You would only be concerned with the manufacturer of the car if one of the safety systems malfunctioned. Yet in the case of computer security we want to hang all the contributing factors/decions around one party: the security team. Imagine if General Motors was liable for every car accident; regardless of fault. Every time someone didn't put on their seatbelt, or drove through a flooded road etc... What kind of cars would be produced? Certainly not the kind you would enjoy driving.
The day that we can have the security departments we want is the day we understand that we can't absolve ourselves of all security responsibility.