3 ms·

Is not the tech a part of the organizations way of doing business? These things are highly related to what’s going down in a thread [1] from yesterday (about “

Is not the tech a part of the organizations way of doing business? These things are highly related to what’s going down in a thread [1] from yesterday (about “shitty projects”). I’m sure these guys spend many millions each year on security products, but either people in the know on the tech side is ignored, or they have no competencies left. In the thread I mention above I have actually posted about my general experience from a major insurance player. A concrete example: We were making changes to a custom software and as there were concerns about bandwidth requirements and latency I took it upon myself to figure out what a specific process looked like, from the business perspective. In short, in the middle of the workflow, customers journals was written to CD and mailed to physicians. Encryption? Eh, no... Any process in place to ensure safe keeping and return/destruction? Uh, forget about it... This was in the time when a lot of these “lost usb devices” and hacked systems seemed to pop up daily. I obviously raised this with the security team, the security officer and the business unit. No one wanted to touch this finely tuned business process. It felt like I was working at fawlty towers. Again, that companies have drawn this line between business and tech, “‘cause tech is not core bidniz”, will haunt a lot of big players for years to come. [1] https://news.ycombinator.com/item?id=19998806 https://news.ycombinator.com/item?id=19998806

zhte415 7y ago
> In short, in the middle of the workflow, customers journals was written to CD and mailed to physicians. Encryption? Eh, no... Any process in place to ensure safe keeping and return/destruction? Uh, forget about it... That's a manually initiated transaction done internally and should be a red flag to anyone. Data outside of the organisation is data with no control. You could keep escalating this. That's an example of no 'speaking up' channel. If a channel to escalate is missing or poorly implemented, frauds will happen by internal or external agents. The process doesn't sound finely tuned at all.
- jordanbeiber 7y ago
  Of course I was being ironic about it being ”finely tuned”! What I’m saying is that in spite of having, in a sense, all the resources at their disposal, this process was chosen by the business, for the business. An encrypted on-line service could, and should, have been implemented. But being far from tech & dev the business choose a process matching their compentecies. Messing with this several years in, and trying to digitize a process obviously in need for it, is met with much resistance. Another gem of a process: Many (like hundreds) employees needed personal printers. But why?! Because: - printing claim from “modern” client/server system. - Pinning an also printed bar-code to the pages from step one - scanning these in to software that reads the bar-code and adds them to queues for mainframe processing. D/A -> A/D? Huh?! Holy cow! I almost fell off my chair... And the inherent security risks in play here, not to mention acres of forrest consumed during the years. My mind is boggling... Am I actually living my working life inside a Dilbert strip?! It’s not even funny, because it’s true. What I’m saying is that many large corps are anything but in fine tune with tech. It’s gonna’ cost em’ in the long run.
  - zhte415 7y ago
    Right. I'm 'business' and the split 'business' vs 'tech' should not be there. I'm sure we've both seen terrible things, these are reinforced by organisational constructs. Escalate escalate escalate if you see something wrong. To coin a bigcorp slogan, of a company I admire the mission of, "Do the right thing" and "Not good enough." I recently opened a new bank account in the UK and chose a 'challenger' bank. The process was secure, very smooth, the customer support very nice. They have no branches. This is regulationtech, not so much fintech, and challengers are coming from all sides, including in insurance. I wish these challengers well as being on the inside of incumbents I'm just left scratching my head "Why?".
    - jordanbeiber 7y ago
      I for one am through escalating stuff in a hierarchical organization. Too much politics. I’ve been out of that game for a few years and have no ambitions make a career for myself at such a place. In a very big, top down org. ponder the following: Granting, in a specific scenario, that I’m right — this “whatever” is a disaster waiting to happen or possibly an already flaming disaster, heads have to roll. Someone always have to take the blame, as this most likely will affect someones budget or set goals. It might have profound effects on the current “1.” or “.One” consolidation & synergetic tech project that management is giving misdirected focus at the moment. The “1Whatever” projects usually have bizarre amounts of $$$ attached, and end up holy. Have you worked big enough companies you know about the “whateverOne” projects I’m referring to!
      - throwaway743 7y ago
        Yup, raise any flags and risk being treated as an outsider/treated poorly. That's my current situation after raising concerns ranging from being way overcharged on a government client project by a vendor who happens to be friends with a manager, and catching a now ex manager pulling mitm attacks on a router (to snoop/play politics) which happens to be on the same network as servers housing client data. It's an awful feeling not being able to have glaring issues resolved or be treated like shit after doing what seemed right and in the best interest of the company. Needless to say, I'm making moves to get the hell out of there

zhte415 7y ago

> In short, in the middle of the workflow, customers journals was written to CD and mailed to physicians. Encryption? Eh, no... Any process in place to ensure safe keeping and return/destruction? Uh, forget about it... That's a manually initiated transaction done internally and should be a red flag to anyone. Data outside of the organisation is data with no control. You could keep escalating this. That's an example of no 'speaking up' channel. If a channel to escalate is missing or poorly implemented, frauds will happen by internal or external agents. The process doesn't sound finely tuned at all.

jordanbeiber 7y ago
Of course I was being ironic about it being ”finely tuned”! What I’m saying is that in spite of having, in a sense, all the resources at their disposal, this process was chosen by the business, for the business. An encrypted on-line service could, and should, have been implemented. But being far from tech & dev the business choose a process matching their compentecies. Messing with this several years in, and trying to digitize a process obviously in need for it, is met with much resistance. Another gem of a process: Many (like hundreds) employees needed personal printers. But why?! Because: - printing claim from “modern” client/server system. - Pinning an also printed bar-code to the pages from step one - scanning these in to software that reads the bar-code and adds them to queues for mainframe processing. D/A -> A/D? Huh?! Holy cow! I almost fell off my chair... And the inherent security risks in play here, not to mention acres of forrest consumed during the years. My mind is boggling... Am I actually living my working life inside a Dilbert strip?! It’s not even funny, because it’s true. What I’m saying is that many large corps are anything but in fine tune with tech. It’s gonna’ cost em’ in the long run.
- zhte415 7y ago
  Right. I'm 'business' and the split 'business' vs 'tech' should not be there. I'm sure we've both seen terrible things, these are reinforced by organisational constructs. Escalate escalate escalate if you see something wrong. To coin a bigcorp slogan, of a company I admire the mission of, "Do the right thing" and "Not good enough." I recently opened a new bank account in the UK and chose a 'challenger' bank. The process was secure, very smooth, the customer support very nice. They have no branches. This is regulationtech, not so much fintech, and challengers are coming from all sides, including in insurance. I wish these challengers well as being on the inside of incumbents I'm just left scratching my head "Why?".
  - jordanbeiber 7y ago
    I for one am through escalating stuff in a hierarchical organization. Too much politics. I’ve been out of that game for a few years and have no ambitions make a career for myself at such a place. In a very big, top down org. ponder the following: Granting, in a specific scenario, that I’m right — this “whatever” is a disaster waiting to happen or possibly an already flaming disaster, heads have to roll. Someone always have to take the blame, as this most likely will affect someones budget or set goals. It might have profound effects on the current “1.” or “.One” consolidation & synergetic tech project that management is giving misdirected focus at the moment. The “1Whatever” projects usually have bizarre amounts of $$$ attached, and end up holy. Have you worked big enough companies you know about the “whateverOne” projects I’m referring to!
    - throwaway743 7y ago
      Yup, raise any flags and risk being treated as an outsider/treated poorly. That's my current situation after raising concerns ranging from being way overcharged on a government client project by a vendor who happens to be friends with a manager, and catching a now ex manager pulling mitm attacks on a router (to snoop/play politics) which happens to be on the same network as servers housing client data. It's an awful feeling not being able to have glaring issues resolved or be treated like shit after doing what seemed right and in the best interest of the company. Needless to say, I'm making moves to get the hell out of there