4 ms·

Many people need to fail, including the author, for such a situation to arise. The author failed to understand the mission of the business and how non-complian

Many people need to fail, including the author, for such a situation to arise. The author failed to understand the mission of the business and how non-compliant technology posed a risk to it. The auditors failed to understand the developer, and educate them on the compromises needed to remain compliant. They also failed to engage in a discussion around alternatives. Everyone failed to actually care enough to solve this problem, but the author still found time for a snarky misinformed article. The vast majority of grating security/compliance tales come from a similar place of ignorance, apathy and snark. The people are the problem, and the misperception that they don't need to own these requirements for the business and are just in a hurry to check a box (on all sides).

cushychicken 6y ago
The people are the problem, and the misperception that they don't need to own these requirements for the business and are just in a hurry to check a box (on all sides). Agreed. I think the framing of compliance in most companies helps reinforce this mindset. It comes from a place of compliance as "avoiding downside in the form of fines or gov't censure", not compliance as "a set of standards we abide by, that provides upsides to all of our customers by virtue of our following them".
ISL 6y ago
Agreed. I generally encounter these kinds of complaints from safety-compliance perspectives. At the core is a lack of alignment and collective ownership of the necessary final outcome. My overriding impression has always been that at the high level, both safety inspectors and the people in the labs want the same thing: a safe working environment and the ability to get science done. There is always some tension there (scientists, especially young scientists, are sometimes willing to accept more risk to get science done, as it is their time, and hence lives, being gradually consumed by additional measures to improve safety), but there is general agreement that safe working conditions are a huge net benefit. It is difficult for the workers in the labs to place themselves in the shoes of the safety inspectors -- what seems like paperwork is actually a surface check to see if you are organized. If you can't explain your safety procedures to someone versed in scientific safety, how can you possibly explain them to an untrained worker/student? The one thing that can frustrate the entire process, which I suspect is at the root of most university troubles, is a lack of goal-alignment between departments within the organization. If safety inspectors don't feel ownership of getting quality science out the door and only want to reach internal safety targets and scientists are only interested in holding their small lab's accident rate to zero, rather than that of the much-larger university as a whole, nobody's goals will ever get met. When things are going right, inspections are a chance to show off how awesome your systems are and an opportunity to improve.
- michaelt 6y ago
  > My overriding impression has always been that at the high level, both safety inspectors and the people in the labs want the same thing: a safe working environment and the ability to get science done. The interests of workers, safety auditors and institutions only partly intersect - like a venn diagram. All parties can (hopefully) agree they don't want anyone killed or seriously injured. But only some parties are interested in shielding the institution from liability. Only some parties are interested in bright-line rules that choose rule simplicity over rule accuracy. Only some parties are interested in stopping the institution from skimping on safety equipment to save money. Only some parties are interested in seeing workers respected as masters of their crafts, able to use their own judgement. Only some parties benefit from producing the portion of compliance documentation that nobody will ever refer to. And only some parties are interested in work getting done in a timely manner.
deleted 6y ago
[deleted]

cushychicken 6y ago

The people are the problem, and the misperception that they don't need to own these requirements for the business and are just in a hurry to check a box (on all sides). Agreed. I think the framing of compliance in most companies helps reinforce this mindset. It comes from a place of compliance as "avoiding downside in the form of fines or gov't censure", not compliance as "a set of standards we abide by, that provides upsides to all of our customers by virtue of our following them".

ISL 6y ago

Agreed. I generally encounter these kinds of complaints from safety-compliance perspectives. At the core is a lack of alignment and collective ownership of the necessary final outcome. My overriding impression has always been that at the high level, both safety inspectors and the people in the labs want the same thing: a safe working environment and the ability to get science done. There is always some tension there (scientists, especially young scientists, are sometimes willing to accept more risk to get science done, as it is their time, and hence lives, being gradually consumed by additional measures to improve safety), but there is general agreement that safe working conditions are a huge net benefit. It is difficult for the workers in the labs to place themselves in the shoes of the safety inspectors -- what seems like paperwork is actually a surface check to see if you are organized. If you can't explain your safety procedures to someone versed in scientific safety, how can you possibly explain them to an untrained worker/student? The one thing that can frustrate the entire process, which I suspect is at the root of most university troubles, is a lack of goal-alignment between departments within the organization. If safety inspectors don't feel ownership of getting quality science out the door and only want to reach internal safety targets and scientists are only interested in holding their small lab's accident rate to zero, rather than that of the much-larger university as a whole, nobody's goals will ever get met. When things are going right, inspections are a chance to show off how awesome your systems are and an opportunity to improve.

michaelt 6y ago
> My overriding impression has always been that at the high level, both safety inspectors and the people in the labs want the same thing: a safe working environment and the ability to get science done. The interests of workers, safety auditors and institutions only partly intersect - like a venn diagram. All parties can (hopefully) agree they don't want anyone killed or seriously injured. But only some parties are interested in shielding the institution from liability. Only some parties are interested in bright-line rules that choose rule simplicity over rule accuracy. Only some parties are interested in stopping the institution from skimping on safety equipment to save money. Only some parties are interested in seeing workers respected as masters of their crafts, able to use their own judgement. Only some parties benefit from producing the portion of compliance documentation that nobody will ever refer to. And only some parties are interested in work getting done in a timely manner.

deleted 6y ago

[deleted]