7 ms·
I’m having that argument now. The story is that the IT teams are detached completely from the reality of their end users and are driven by compliance box ticki
by gw99 4y ago
I’m having that argument now.
The story is that the IT teams are detached completely from the reality of their end users and are driven by compliance box ticking, off the shelf corporate malware sales marketoids, incompetence and ignorance.
Any attempt to confront anyone on that is met with defensive use of politics and budgetary concerns which don’t make logical sense at all. In reality the staff aren’t very good and can’t cope with the requirements of the organisation and this is being carefully hidden by the folk trying to protect their positions.
Thus we have several hundred people with inadequate hardware, inappropriate poorly configured software and friction so bad that doing an hour of productive work is a miracle. Of course corporate surveys that are sent out never address the concerns because that would mean someone has to be accountable for it.
At the same time IT teams are pushing BYOD for mobile devices because you can push a policy out which fucks the end user’s devices once a week and causes actual data loss on the personal side of things. So no one uses BYOD because it risks their own personal stuff and no one carries a corporate phone so no work gets done on the road.
The end game is I use my own hardware and do everything in clean room and push it to GitHub and pull it back into corporate env for integration.
The scary thing is I know enough people working at different organisations to know that this is the status quo. You can blame Gartner, Microsoft, the whole security sector and the army of solutions providers for mandating this mess.
- tut-urut-utut 4y ago> The end game is I use my own hardware and do everything in clean room and push it to GitHub and pull it back into corporate env for integration. ... and by doing that, you are breaking a number of corporate policies and rules and are leading yourself into a world of pain whenever they find out. Losing a job would be a least of a trouble. Honestly, don't do that. Don't use your equipment if the company did not explicitly permit that. If you can't do the job as quickly as you want using company provided equipment, maybe that's the price the company is willing to pay for having all those "compliances". Live with it or leave, but bring yourself in trouble by ignoring all "safety" measures.
- gw99 4y agoBold of you to assume I haven’t read and understood the contents of my contract which implicitly does not disallow this. Realistically I build spikes and prototypes on my own hardware and only push to the environment never pull. Production code, credentials and data never goes near personal equipment.
- afandian 4y agoThe latter part is the bit I can’t understand. If their risk calculus allows be my BYOD why can’t they supply a custom machine that would fall in the same envelope?
- gw99 4y agoI don’t understand any of it. Mostly it’s selfish CYA mentality rather than the business responsibility of being a service provider, and you know, actually providing service.
- briffle 4y ago> and are driven by compliance box ticking For many IT departments, passing audits is a huge deal, that is very important to senior management. I know for my last set of compliance audits, I had to show evidence that every employee workstation was encrypted, patched, and running up to date Anti-virus software. (My company deals with PHI data) I know there are other ways to solve many of the problems, but ensuring disk encryption and patching especially can be difficult if you have a mix of systems, and OS's. I think 2 of the biggest pushes for this lately is the huge cost of 'cyber insurance' for things like ransomware atacks, as well as reporting requirements for lost/stolen laptops that could potentially have PHI on them.
- gw99 4y agoOh completely agree with all of these but it's possible to deliver them without the malfeasance of actually measurably damaging the productivity of your staff. The big problem with modern IT teams is they are an independent authority that never actually wears the user's shoes for a moment.
- giancarlostoro 4y ago> The story is that the IT teams are detached completely from the reality of their end users and are driven by compliance box ticking, off the shelf corporate malware sales marketoids, incompetence and ignorance. At a former employer we all used custom built Linux boxes. Made it easier to say "sorry, that doesn't seem to run on Linux" and since most of our code was on Python, Linux was just fine for all of us. I don't mind some amount of corporate software, its not my hardware, but dont deter me from being able to install things.
- tempodox 4y ago> do everything in clean room and push it to GitHub and pull it back into corporate env Wouldn't using GitHub for proprietary stuff incur the risk of industrial espionage?