2 ms·

Welcome to bigtime shadow IT then in a white collar / high performing workforce. People will be using personal laptops, spinning up AWS instances etc to get wor

Welcome to bigtime shadow IT then in a white collar / high performing workforce. People will be using personal laptops, spinning up AWS instances etc to get work done especially if they collaborate with others. I worked at a place, folks had to go to the neighboring copy/print place to FAX themselves documents, because IT in its wisdom had locked down their machines and prohibited scanning docs (ie, they faxed to a virtual fax, then took those PDFs and sent them on). I am convinced that part of the AWS appeal for many folks is to escape this "best practice" IT control that just results in no progress / ability to get work done. This was 10x during pandemic. When IT hasn't yet gotten Zoom into default image, and you need Zoom or whatever to talk with others practically, so annoying.

GekkePrutser 5y ago
AWS for us is even more locked down. Nobody gets access to that. Unless they sign up with their own account and pay for it themselves perhaps? But the idea is of course that the applications needed for work are all available in the company software catalog. When we locked this down we did extensive pilots. As an EU company we have to certify each tool for privacy anyway and we can't allow unvalidated tools (and even worse: cloud services) for this reason. The fines are huge and we have a responsibility to our customers. Personal machines are explicitly forbidden and not allowed on the network using 802.1x. The admin rights prevent people from bypassing security controls. Such as disabling the proxy which checks for forbidden services for which we don't have a data processing agreement, like Dropbox. I know it's not easy. But letting people do what they please is causing the kinds of data leaks we're seeing in the media almost every day. I agree some things are a step too far and inevitably drive people into shadow IT but admin rights are pretty low hanging fruit these days. And really, since we did this the company is still running :)

GekkePrutser 5y ago

AWS for us is even more locked down. Nobody gets access to that. Unless they sign up with their own account and pay for it themselves perhaps? But the idea is of course that the applications needed for work are all available in the company software catalog. When we locked this down we did extensive pilots. As an EU company we have to certify each tool for privacy anyway and we can't allow unvalidated tools (and even worse: cloud services) for this reason. The fines are huge and we have a responsibility to our customers. Personal machines are explicitly forbidden and not allowed on the network using 802.1x. The admin rights prevent people from bypassing security controls. Such as disabling the proxy which checks for forbidden services for which we don't have a data processing agreement, like Dropbox. I know it's not easy. But letting people do what they please is causing the kinds of data leaks we're seeing in the media almost every day. I agree some things are a step too far and inevitably drive people into shadow IT but admin rights are pretty low hanging fruit these days. And really, since we did this the company is still running :)