3 ms·

From the article "Nevertheless, the presence of Shadow IT in an organization speaks to some larger problems: (1) Lack of effective communication from security a

by ethbr0 4y ago

From the article "Nevertheless, the presence of Shadow IT in an organization speaks to some larger problems: (1) Lack of effective communication from security and IT teams about security risks (2) Employees who feel they aren’t given the tools they need and with no clear way to ask for them (3) No visibility into endpoints to reveal the presence of unapproved tools" I have yet to work for a company that has IT security and IT management in the same org. Which is insane. Why are companies empowering someone to say "No" (CISO), without requiring that same individual to justify not saying "Yes"? If a user requests a tool, IT sec/management should be leaning in and asking "What can we provide you will that will satisfy this need?" Instead, and I assume my experience generalizes to everyone who's worked in regulated tech, the response is "No, that's not approved" and ends the conversation.

DiggyJohnson 4y ago
My thoughts exactly. I noticed a pattern in my personal behavior of “can I install an unapproved developer tool early in the onboarding process”. Even on enterprise machines in IT departments of firms you’ve certainly heard of, I’ve found that I can get away with my portable install / side loaded browser plug-in every single time. This is just my rambling thoughts, not sure if I have a main point, but realizing this pattern has certainly contributed to my personal sense of disillusionment.
PeterisP 4y ago
For the same reason why companies don't have their internal audit in the same org as their accountants and their financial controllers under business unit managers, inherent conflict of interest. The job that the security org is doing for the board/owners/etc is controlling risk because they don't trust if their IT org says "everything is totally fine", and consider it likely that if the decision about whether to implement some activity or not is left purely to the IT org, then the convenience of implementation will override the level of risk control that the board/owners desire, so they choose to put these controls in a separate organization, empowering someone to say "Not until you do all this unwelcome work to implement it to the standards the company has chosen", preventing all the many mid-managers to save their effort or their costs by cutting corners at the expense of risks to "someone else's" money. Of course, having these functions together is much more efficient in many ways! But the principal-agent problem is very real, especially so in large organizations, so that's why these choices get made this way, designing organizational structures that act as checks and balances on each other, not expecting everyone to magically cooperate for the greater good.
- ethbr0 4y ago
  > empowering someone to say "Not until you do all this unwelcome work to implement it to the standards the company has chosen" It has not been my experience that this is what most IT security orgs say in practice. It's usually "No, unless we do it" followed by "And we don't have time to do it." Which is fundamentally because they're a cost center, and typically staffed like one.
- BackBlast 4y ago
  > For the same reason why companies don't have their internal audit in the same org as their accountants and their financial controllers under business unit managers, inherent conflict of interest. That's bogus. Having the policies be in the same org as the provider just makes sense. You can run a separate security auditing department if you're keen to do that, nothing is stopping you. You can have independent oversight while you don't totally hamstring your organization. Those auditors aren't also the ones approving expenditures, are they?

by ethbr0 4y ago

DiggyJohnson 4y ago

My thoughts exactly. I noticed a pattern in my personal behavior of “can I install an unapproved developer tool early in the onboarding process”. Even on enterprise machines in IT departments of firms you’ve certainly heard of, I’ve found that I can get away with my portable install / side loaded browser plug-in every single time. This is just my rambling thoughts, not sure if I have a main point, but realizing this pattern has certainly contributed to my personal sense of disillusionment.

PeterisP 4y ago

For the same reason why companies don't have their internal audit in the same org as their accountants and their financial controllers under business unit managers, inherent conflict of interest. The job that the security org is doing for the board/owners/etc is controlling risk because they don't trust if their IT org says "everything is totally fine", and consider it likely that if the decision about whether to implement some activity or not is left purely to the IT org, then the convenience of implementation will override the level of risk control that the board/owners desire, so they choose to put these controls in a separate organization, empowering someone to say "Not until you do all this unwelcome work to implement it to the standards the company has chosen", preventing all the many mid-managers to save their effort or their costs by cutting corners at the expense of risks to "someone else's" money. Of course, having these functions together is much more efficient in many ways! But the principal-agent problem is very real, especially so in large organizations, so that's why these choices get made this way, designing organizational structures that act as checks and balances on each other, not expecting everyone to magically cooperate for the greater good.

ethbr0 4y ago
> empowering someone to say "Not until you do all this unwelcome work to implement it to the standards the company has chosen" It has not been my experience that this is what most IT security orgs say in practice. It's usually "No, unless we do it" followed by "And we don't have time to do it." Which is fundamentally because they're a cost center, and typically staffed like one.
BackBlast 4y ago
> For the same reason why companies don't have their internal audit in the same org as their accountants and their financial controllers under business unit managers, inherent conflict of interest. That's bogus. Having the policies be in the same org as the provider just makes sense. You can run a separate security auditing department if you're keen to do that, nothing is stopping you. You can have independent oversight while you don't totally hamstring your organization. Those auditors aren't also the ones approving expenditures, are they?