3 ms·

A widespread problem I've been wondering about, not specific to Okta... When an established company -- with something to lose; not a disposable serial startup

by neilv 3y ago

A widespread problem I've been wondering about, not specific to Okta... When an established company -- with something to lose; not a disposable serial startup -- outsources some IT function to a SaaS/PaaS/vendor that exhibits a pattern of problems, and then the company then gets bit by such a problem, how often does the company actually care? Does the CTO or CISO take a hit? Do the CEO and board even know that it was a bad selection from the start? Does the company just want to be able to say it was a "partner" who was at fault (even if the company was negligent in trusting that partner)?

etchalon 3y ago
The last one. Very much the last one.
tcgv 3y ago
I'd say that more often than not C-Levels only take a hit if the bottom line is impaired, otherwise (like just some temporary heat from bad PR) it's business as usual.
mbb70 3y ago
Part of what the enterprise is buying is someone to blame. Same can be said for consultancies, outsourcing etc. It is a very real part of the politics of decision making at large orgs.
- johndhi 3y ago
  Not at my org. We always recognize a vendor error is perceived as our error by customers
  - sonicanatidae 3y ago
    Same here. The client/EndUser gives 2 entire shits about the source of the problem. What they care about is "Why isn't this working and what is this gibberish on my screen" and rightly so.
Nextgrid 3y ago
The other comments about blame outsourcing are absolutely on point, but another reason is that we've done a great job of breeding an engineering culture where anything beyond gluing some overpriced AWS services together is considered too complicated and an absolute no-no to do in-house and should instead be outsourced to "experts" like Okta who are supposedly gods and the only ones allowed to do the stuff. Every time you suggest anything remotely complicated (that your average sysadmin could and did run a decade ago without making a fuss about it) such as running Keycloak or other $ON_PREM_SOFTWARE_PACKAGE is immediately met with lots of hostility. Of course the cloud companies and other SaaS vendors love this. It's quite puzzling - one one hand it's encouraged to build overcomplicated FAANG-wannabe engineering playgrounds full of microservices, yet a fairly mundane task of "run this self-contained piece of open-source software, monitor logs and apply reasonable security principles" (that every company did till a decade ago) is now considered out of range of mere mortals.

by neilv 3y ago

etchalon 3y ago

The last one. Very much the last one.

tcgv 3y ago

I'd say that more often than not C-Levels only take a hit if the bottom line is impaired, otherwise (like just some temporary heat from bad PR) it's business as usual.

mbb70 3y ago

Part of what the enterprise is buying is someone to blame. Same can be said for consultancies, outsourcing etc. It is a very real part of the politics of decision making at large orgs.

johndhi 3y ago
Not at my org. We always recognize a vendor error is perceived as our error by customers
- sonicanatidae 3y ago
  Same here. The client/EndUser gives 2 entire shits about the source of the problem. What they care about is "Why isn't this working and what is this gibberish on my screen" and rightly so.

Nextgrid 3y ago

The other comments about blame outsourcing are absolutely on point, but another reason is that we've done a great job of breeding an engineering culture where anything beyond gluing some overpriced AWS services together is considered too complicated and an absolute no-no to do in-house and should instead be outsourced to "experts" like Okta who are supposedly gods and the only ones allowed to do the stuff. Every time you suggest anything remotely complicated (that your average sysadmin could and did run a decade ago without making a fuss about it) such as running Keycloak or other $ON_PREM_SOFTWARE_PACKAGE is immediately met with lots of hostility. Of course the cloud companies and other SaaS vendors love this. It's quite puzzling - one one hand it's encouraged to build overcomplicated FAANG-wannabe engineering playgrounds full of microservices, yet a fairly mundane task of "run this self-contained piece of open-source software, monitor logs and apply reasonable security principles" (that every company did till a decade ago) is now considered out of range of mere mortals.