IT Departments Fear Growing Expertise of Users

flatfilsoc recommends a long article in CIO magazine on users who know too much and the IT leaders who fear them. Dubbing the universe of consumer technology the "shadow IT department," the article highlights the extent to which the boundary between users' workplace and home have broken down. It notes the increasing clash — familiar to anyone who works in a company with an IT department — between users' home-grown productivity boosters and IT's mandate to protect corporate data. The inherent tendency of the IT department to want to crack down and control technology that it doesn't supply should be resisted at all costs, according to CIO. The article outlines strategies for co-existence. It just might persuade some desperate CIO somewhere not to embark on a career-limiting path of decreeing against gmail and IM.

Comments

Yeah, what he said....

[zappepcs]

and there are always groups of individuals in every company that DO NOT fit the one-size-fits-all software/security model.

Some people/groups really need a sandbox to work in, without interference from good intentioned IT departments.

A virus spread wildly throughout my company recently because IT had thought to conveniently map some not so useful drives for everyone... guess how that virus spread?

IT needs to learn to provide and protect without being so intrusive as to hinder real work being done.

Sighhh

Re:Yeah, what he said....

[bigtomrodney]

That is certainly true to a large degree, but let's not overshadow the need for tighter security. Ultimately users need to bear in mind that their PC is for working, and really should only provide for their working environment. It's best to put aside the 'it's my computer' attitude and push the 'it's a company tool' attitude. Speaking as someone who has worked for years in IT, I would be more of the opinion that most staff in the IT department fear user knowledge because their own knowledge is lacking. From experience of a few different departments it's usually only one or two who have the knowledge to begin with and another five or six who are all talk. That's more what causes the friction between users and IT staff. No one minds a straight no if it is qualified, but I don't think anyone will tolerate a grunt of 'no' from someone who's not even sure why in the first place.

Re:Yeah, what he said....

[Jhon]

Ultimately users need to bear in mind that their PC is for working, and really should only provide for their working environment.

Agreed. What need does a biller have in hooking up their IPOD to their work PC? Why would a clientservices-phone jockey need to hook up their USB memory stick? Why would a transcriptionist need access msn/hotmail/yahoomail?

Then again, if it's a small shop and you're not really dealing with protected information on the network (say, medical records for example), then you may be fairly lax as to what users can/can't do at the workstation.

*IF* however, you have federal and or state guidelines you MUST follow with regards to protecting identity and health information, then sorry pals, your workstation is locked down. Nope -- no unauthorized memory sticks. Nope, no internet access -- other than white listed work related sites. Nope, no access to install software.

I've had users ask me for permission to install some "app" they like to use. The simple answer is "no" and I don't want to waste my breath re-hashing the same reasons. So I say "No. Check your employee handbook, page 12 for why" and walk away. I'm not going to have anyone of my guys jump through paperwork hoops to keep CAP or CLIA or MediCal happy so someone can have their computer go "ding" at a certain time using their favorite software.

Re:Yeah, what he said....

[markov_chain]

What need does a biller have in hooking up their IPOD to their work PC? Why would a clientservices-phone jockey need to hook up their USB memory stick? Why would a transcriptionist need access msn/hotmail/yahoomail?

Morale.

This is a tricky thing and different for different types of work. A long time ago when I worked at a research lab, they tolerated my Linux boxes going onto their corporate network, which was a mix of Solaris and Windows. I even managed to interfere with their routing infrastructure by doing experiments with gated. They might have been upset about it, but in the end good work got done and the creative people were happy. If their policy had been draconian, the said good work would have been done at a competitor.

Re:Yeah, what he said....

[Jhon]

Morale.

And how would their morale hold up when their employer is either shut down, fined in to oblivian or loses their ability to bill medical or some critical private insurance (essentially, you go out of business) for not providing necessary safegards for indentity/medical history? I don't think that their morale will be that high when they get their last check...

A radio is fine. A tape deck. Even a CD player. Hell... even an MP3 player is fine so long as it's not hooked up (and unable to hook up) to a workstation.

Re:Yeah, what he said....

[Theaetetus]

And how would their morale hold up when their employer is either shut down, fined in to oblivian or loses their ability to bill medical or some critical private insurance (essentially, you go out of business) for not providing necessary safegards for indentity/medical history? I don't think that their morale will be that high when they get their last check...

Why is data so unsecured that the receptionist who plugs in her iPod can somehow get access to identity/medical histories? That's not the fault of the iPod or the receptionist.

Re:Yeah, what he said....

[ElleyKitten]

Why is data so unsecured that the receptionist who plugs in her iPod can somehow get access to identity/medical histories? That's not the fault of the iPod or the receptionist.

An iPod could have a virus/keylogger/spyware/whatever, and whatever information the receptionist (or data entry minion, or whoever has an iPod) works with as a part of her job can then be comprimised. It's not that she'd suddenly gain access to things she shouldn't, but that things that she does have and need access to need to be secured.

Re:Yeah, what he said....

[dankney]

A good net admin is flexibile. If there's a good reason for it, any rule can be bent. I'm going to treat you like an adult and explain why your actions are potentially risky and are against policy -- I'll ask you to work with me to find a less risky way to accomplish the same goals.

If you're doing network experimentation for a legitimate reason (work-related, not just being a dick), it's easy enough for me to vlan you off from the rest of the network. I'll even give you a gateway to the internet if you need it, but you'd better believe that your gateway is going to null route anything that's attempting to hit my servers or your co-worker's machines. My job may be to enable your research, but it's also my job to protect everyone else's data and productivity from your experiments should they go wildly wrong.

I'll make sure you can do your work, but you may not be able to go about it in the way that you originally wanted to; my flexibility must be matched by yours. If you crash your own machine in the process, that's a risk you chose to take. I just have to make sure that everyone else on the network has the same choice and isn't subjected to yours.

Re:Yeah, what he said....

[SatanicPuppy]

It's always the sales guys. I actually saw a group of them complain so hard that they succeeded in getting access to streaming media sites, at a time when our bandwidth was just about at capacity. It started to affect the rest of the building, so we throttled their subnet.

You've never heard so much screaming and whining. Goes all the way up to the top. CEO gets involved, wants to know the problem. We explain the problem, which was reasonably unsolvable at that point (no money for bigger pipe).

Then we provided the logs. We were pretty pissed off, so we provided all the logs.

Result? 3 people fired for what we'd consider "real" violations, and 11 people given warnings about the proper use of work equipment.

To this day, we have the most viruses, the most spyware, and the most user-caused problems from that department. The people who work there are not tech savvy, they are not problem solvers. But each and every one of them believes that their position is by far the most important position in the company, above and beyond the people who actually produce the product.

Now I understand that you want a certain type of person for sales, and I understand that by and large, the kind of person who works in sales needs to have certain character traits to be a good salesperson, and that that sort of person isn't usually over-supplied with introspection.

But take this to heart: IT is there to keep things working. IT is there to introduce, after a period of testing, new software. IT is there to protect company data from malicious outsiders...and malicious insiders, and to maintain critical systems, and to fix technical problems.

The purpose of IT is not to do whatever you want them to do; they have to take care of the whole organization, and the needs of the organization as a whole come first. It's not to bend the security guidelines for every program that one person thinks he needs. It's sure as hell not to mindlessly support every whim of every middle manager who is desperate for his department to have something to blame for his failure to meet sales goals.

Some users we trust with elevated permissions. Some users we allow to install their own software. It may even be as high as 8 or 9 percent of our user base. Percentage in finance, for example, is like 60%. The percentage in the advertising department? Maybe 1 in 100. They are non-technical users who have a poor appreciation of security risks, and are incapable of not clicking on a pop-up if one pops up in front of them.

Re:Yeah, what he said....

[Anonymous Coward]

"Print Screen -> jpg -> IPOD HD.

Cut/Paste from APP -> text File -> IPOD HD.

Scan"

Pen -> paper -> pocket

Pencil -> post-it note -> pocket

Information that is valuable enough to protect should be valuable enough to teach employees at all levels how to protect.

How about the IT guys start teaching safety instead of just bitching about how little the employees know about it.

Re:Yeah, what he said....

[jp10558]

I'm sorry, but making users responsible for their own machines is a nightmare in a largeish orginzation. How do you track patches? Licensing? Do you send them to the Geek Squad when some random conflict between the 500 freeware programs, 3 improperly licensed programs, 3 work programs, 5 OSS programs, 2 pirated programs and 1000 spyware traces comes up? Do you just reformat and reinstall? How long does that take you?

And how the hell do you roll out new software packages? Cause you have no idea what state the individual machine is in, I'm guessing you don't have a mass deployment tool, so do you put it on a file share and say go for it in an e-mail?

Re:Yeah, what he said....

[RESPAWN]

I was going to compose my own post, but you pretty much summed up what I was going to state. Most of these people posting here have probably never worked in the Healthcare IT industry. With the HIPPA laws (or is it HIPAA? I forget.) there are extremely stringent guidelines describing what will happen to a company if they mistakenly allow data to be released without authorization. Merely not being in compliance with the regulations (and there are many, including a stipulation regarding removable media) can bring reprecussions for a company.

I think the problem with /. is that a lot of people here are obviously smart, computer-centric, people and naturally chafe at the idea of having restrictions imposed on their use of technology. Additionally, these people can probably be trusted not to mistakenly introduce a vulnerability to their company's network. But if you spend enough time in IT -- especially in an environment populated with high school educated people with little computer experience (such as a healthcare billing office), many /.'ers will gain a newfound respect for why IT occasionally has to institute many of its policies.

Re:Yeah, what he said....

[MobyDisk]

Everyone clap. You just met the IT guy you have all been loathing, and he posts on Slashdot. Thank you, take a bow.

What need does a biller have in hooking up their IPOD to their work PC? Why would a clientservices-phone jockey need to hook up their USB memory stick? Because if you whitelist sites, then when the boss says "go to site XXX and tell me this..." they can't. And when the HR department says "go to www.friendlyHRpeople.com" to file a complaint they can't do it. But if you blacklist sites, then they can get to what they want anyway using some workaround. slashdot.com is blocked but engaget.com isn't. Or you can see it through someones blog, or redirection, or RSS feed, or a cache, or an anonymizer. This is a battle nobody can win.

This is the type of attitude that gets us into the game of "If I rename the extension to .rar then I can send you this critical document you've been needing!" Then .rar files are blocked the next day. Then you zip the rar and it gets through again. The war escalates forever. Perhaps each employee should make a formal request to their boss, then to the IT department, then write a formal justification for why you need to visit each web site.

Of course, it is probably all moot because you had to give everyone local administrator priviledges so they could run the ActiveX time-sheet application your IT department mandated.

This is the mysterious "IT guy" who thinks he knows the fixed-length list of things that each and every person in the company needs to do their job. They create a blacklist of everything they think you could do on your computer that is bad, and use some 3rd-party product to scan everything you do and disable those actions. They already know better than you every tool needed for every position in the company. Really, this person could just do your job.

I've had users ask me for permission to install some "app" they like to use. The simple answer is "no" and I don't want to waste my breath re-hashing the same reasons. Yes, you surely know every app they are going to need and have pre-installed it for them. And every application you haven't heard of is probably a virus. Of course, if you had setup their permissions properly then they couldn't install applications anyway. Instead of policing each application, set appropriate domain policies and work policies that make sense. Limit the size of email attachments. Put quotes on their accounts. Make sure the network drives have appropriate permissions.

Trying to monitor every application used on every PC is a modern version of micro-management. Do you look at every tool that is on someone's desk? Do you approve each stapler? If you don't let people visit web sites, can they bring in books and newspapers? Do you blacklist/whitelist the phone numbers they can call and receive calls from?

So I say "No. Check your employee handbook, page 12 for why" and walk away. Then you are a jerk.

This will probably get modded as a troll. But I bet every person with mod points on this system has had to deal with the likes of you. I'm glad I got to find you and finally say it.

Re:Yeah, what he said....

[gmack]

The problem most of the time isn't theft. The problem is users who THINK they know what they are doing but really don't. I have worked in several offices where everyone felt they could do whatever they felt like to their own computers and only called the admin when they were at a loss of how to fix it.

Some noteable moments:

• The user who decided he needed a better sound card so he switched his with a "less important" user. I get called in when both machines have screwed up drivers
• The user who thought that his department should have his own file server but then didn't secure it properly. They had to shut the server down to block the resulting viral infection that took out half the office.
• The constant complaints that our 10 meg fiber internet connection feeding an office of 30 people just wasn't fast enough thanks to some user thinking (s)he closed his/her file sharing app but only backgrounded it.
• The screaming panicked call from my boss telling me our website was hacked because our web page now contained links to other websites.. Turned out the machine he was viewing it on had adware installed that came with his favorite file sharing service.
• Why is our traffic so high and why are we getting spam complaints? Traced to a user with a non secured wireless gateway being hijacked by some spammer.
• Spotty network connectivity traced by another admin to a wireless gateway plugged in BACKWARDS and was feeding DHCP packets onto the network that provided a network connection to nowhere.

Show me a way in advance to know what users can be trusted and I'll consider letting users have more control. Until then I'll demand that users don't' mess with anything for no other reason that I end up with more work every time they mess up.

Re:Yeah, what he said....

[don_bear_wilkinson]

It's not the IT department's job to teach [safety] security. That should come as a series of internal policies and training from HR and other departments - after the policy comes from 'on high'.

IT bitches because most companies have a huge lack of understanding on all sides, next to zero real policy direction from the top (IT is not at the Board table), and thus are left to clean up the mess. With too little money, too few staff and no way to prevent the problem without making enemies. Of people like you.

My personal nemesis...

[NerveGas]

    Has always been the user who *thinks* he knows too much, and is out to prove it - usually causing problems, havoc, and destruction in so doing. You know, the kind of guy who gets pissed when you won't give them root/Administrator priveliges because he thinks he's a real big-shot. I've heard arguments as silly as "Well, I'm learning Linux on my own at home, so sooner or later, I'm going to know how to use it whether you give me root or not." Yeah, good for you.

    It seems that every company I've worked for has had one. Maybe it's a small part of my personal castigation for the things I've done wrong. Who can say...

Re:My personal nemesis...

[0100010001010011]

My personal nemesis is the layers of abstraction you have from someone that actually knows something and the mentality of those people.

My laptop at work continuously reboots. I ran a memtest on it and narrowed it down to a bad memory chip. IT wants me to send in my laptop. I'm sorry. I don't have time to deal with that down time, so I just put up with it restarting.

The most annoying one is when they redid a few dozen internal webservers. All of a sudden the redirect didn't work (If you went to an internal site and it had been X minutes it redirected you to Corporate Web Login).

I did some research on my own and found that when they upgraded to the newest webserver someone forgot to bring along the configuration. All the redirect websites were being sent out as plain/text. Firefox correctly rendered it as... plain text. When I e-mailed IT about it I got a nice form letter about "Firefox isn't supported, we use IE, etc".

I then copy and pasted curl -v logs of all the websites that were broken. I didn't just tell them what was broken, I told them HOW to fix it. I never got a reply back and everything magically worked within a week.

Sometimes there ARE users out there who know what we're talking about. I'm not asking for admin rights or root access. But I do want to be able to do my job and when your fuckups impede that, it does tick me off. The IT people I know are the ones that seem to have the hardest time saying the two 3 word phrases that every engineer (in my opinion) must learn before leaving college: "I don't know." and "I was wrong."

In the mean time I wrote a greasemonkey script that when it saw the redirect page it sent me to the correct website.

Re:My personal nemesis...

[jcgf]

Sometimes there ARE users out there who know what we're talking about.

Maybe there are users like you, but for every one of them there are ten that think they're like you.

Re:My personal nemesis...

[Stamen]

I agree 100%, I don't understand this slave mentality we have these days. Employers treat their employees like children and, of course, people live up to expectations and act like children.

My rules for employees are simple, do your job well, or I will fire you. The rest I don't care about. I'm not paying to have a pet around that only does what I say while attached to a leash. I'm hiring someone to do a job, a job they are agreeing to do.

Employees are just vendors that are permanent (for a period of time) and exclusive. But they are vendors, vendors of work. If I don't like the work, I'll replace them with another vendor if a better one exists.

This is how a free market works, it's sad that this basic concept of American life left so long ago. In 1900 most people owned their own business and had a stake in the community. Now-a-days, we are just a number of micro-communist-nations, I.E, large corporations. I just don't get it.

If the management doesn't know if employees are doing their jobs then I'd find new managers.

Unless you have special needs, like government mandated privacy laws, such as medical databases, what does it matter if employees spend all day on IM or EBay or Gmail. If they aren't doing their job, fire them, if they are, then let them continue; how they choose to do their job is up to them, they aren't children or pets.

Oh, how did we get along for 100s of years without employers monitoring everything an employee does. The founding fathers and mothers wouldn't be happy with how we turned out, we became what they fought so hard against.

Wow, I feel better now, thanks for listening.

IT title does not an expert make

[yagu]

I've met uncountable numbers of idiots when it comes to understanding technology. Guess what... many of them were peers in IT. In retrospect, it makes sense. I'd anticipated my move from college to a "real" job as a release from the world of idiots in the CS curricula. Finally, I'd get a chance to work shoulder to shoulder with people who knew.

Not so much.

I'd never considered where the rest of my university peers had to go -- into the same work force I entered -- duh.

In the non-IT universe I discovered many were also clueless around technology, as I'd expected. What I hadn't expected was there were many non-IT people who got it, who understood technology, and worked with it adeptly. Many "got it" more than my peers. Some of the most profound ideas and innovation I've seen in IT have come from nontraditional non-IT people.

I agree (without reading the entire article) with the summary and gist of the article -- IT does itself no favors ruling by fiat and instead should collaborate with users.

This doesn't dismiss bad things happening and messes created by users left behind for IT to clean up. People who mess up should help clean up, but my experience has been many IT people are equally inept and likely to make messes.

A degree and title in IT and CS means only that one has a degree in IT and CS, nothing more. It doesn't mean they're anointed and it doesn't mean they know more about technology than users.

Re:IT title does not an expert make

[PitaBred]

I think that CS people should get more experience in IT. I've seen so many people with CS degrees just toss all kinds of stuff on the stack and not know why it slows down, they don't understand the connection between the software and the hardware resources. But that's completely off-topic :)

Most users are experts at being idiots

[Fatchap]

Quote from the article:

According to Pew, 42 percent of Internet users download programs, 37 percent use instant messaging, 27 percent have used the Internet to share files, and 25 percent access the Internet through a wireless device. (And these numbers are all one or two years old. Rainie "would bet the ranch" that the current numbers are higher.) Quote from Vin Cerf:

...approximately 600 million computers are connected to the Internet, and that 150 million of them might be participants in a botnet--nearly all of them unwilling victims. (http://arstechnica.com/news.ars/post/20070125-870 7.html) Yep as a CIO / CSO I would really be an idiot not to let my users do exactly what they do at home would n't I!!

The simple fact is most users think they know what they are doing, but the lack the skills to adequately assess the risks of their actions. That is why they need to have rules around acceptable use and security policies to protect them from their own idiocy.

Re:I don't see a problem

[smooth wombat]

IT lost this fight when the USB memory stick became popular.

Lock down usb ports.

Besides, no matter what they do, they can't stop me from creating a knoppix cluster from my coworkers pc's after they all leave for the day.

They can fire you.

See, not so hard.

"Cheap" support

[kbinx]

If you want complete control put the dumb terminals back. Otherwise let the creative users solve their problems and stand back. Sysadmins can still control access to sensitive data. If a user screws up a machine, slap the standard install image back on and try try again. There really is no reason for a PC "support" position

IT dept's delay work.

[dahwang]

CIOs and IT departments limit and control software on their computers by taking 2 months to install MS Office on my desktop. I've had IT departments take 3 weeks to "install" software on my workstation, when all they had to was add shortcuts to my start menu and map the path to software on remote servers. It makes you wonder if they spend more time reading my email and slashdot posts than actual IT work.

"Idiots" data that hasn't been cleared for release

[Cr0w T. Trollbot]

Anyone placing data that hasn't been cleared for release (even by the very informal process of being sent out on purpose) onto services run by people with whom you have no contract and no reasonable expectation of integrity is, frankly, no better than the idiots who don't back up their data and are then surprised to find out that MTBF is not a guarantee.

Be sure to let Jimbo Wales know he's an idiot for doing it that way.

I'm not advocating Wiki methods for a nuclear missle silo, but I think a lot more companies can profit from a Wiki-type approach to (some) data than those that can beneift from an NSA "everything is top secret and must be locked down at all costs" approach.

Crow T. Trollbot

The power user vs the not so power user

[onkelonkel]

1. "My hard drive is howling like a panther passing a kidney stone. Every time I run chkdsk I lose a few more sectors. I've backed up all my work to the network drive. When you get a chance can you come and fix my computer?"

2. "My computer won't start. It's been making this squealy noise for about two weeks and then all of a sudden it just died. You have to come right now and fix it because all the annual budget files are on my desktop."

Which call would you rather get?

But for the I-D-Ten-T

[ShaggyIan]

Yes, most corporate users surf the web at home.

Yes, most of their home machines are horribly infected with spyware, viruses, and other things I grow weary of cleaning up. I have friends who make their livings cleaning up home PC's. Most of them have "regulars".

I have no problem helping my advanced, capable users be more productive through technology. I will even grant local admin when warranted.

I have major problems letting my users chat with their friends on IM while surfing porn, watching last nights CSI on YouTube, and unwittingly sending out spam on behalf of a botnet (while trying to infect the rest of the network). Whenever we (and by we I mean management) loosen the reigns, this is what I find all over my network.

Giving your users admin/root (i.e. ticket to ride) trying to make your life (or their life) easier only tends to make both of your lives harder later on.

Top down corporate stragedy types really don't need to be worrying so much about individual users. Good IT staff with sufficient decision making authority renders this entire "concern" moot.

Why fear when you can enlist their help.

[thomasa]

When I come across someone who I find reasonably able to fix problems, I sometimes
enlist their help on assisting their computer neighbors. I also find that people
who think they know a lot quite often mess up their computer even more and consequently
require my help more - That is okay, it keeps me employed. It is changing though
with users losing admin rights. They really cannot do anything as a standard user.
On UNIX computers, The users tend to be more technical (I find) but still require
assistance sometimes. Especially when they do not have root.

Re:I don't see a problem

[Volante3192]

If IT locks down USB ports, I'm sure they'd have gone over the possibility that they could be locking out legit reasons and have planned for it. No IT department worth its carbon would lock down something that close to the user without preparing for the eventual onslaught of calls asking "Why is my USB drive is broken?!" ...that or their admin is a sadistic bastard and goes on unreachable vacation the next two weeks...

Work tech. is for WORK

[brendanoconnor]

Letting users do whatever they want on company computers is a great way to have a lot of things go wrong very quickly. When you are at work, you are there to be working, not playing around on the internet, talking to your buddies, exchanging ims and emails an whatever else you could possibly be doing that has absolutely nothing to do with your job.

At my work, our computers are completely locked down and we cannot change anything, no matter how mundane. I personally thing this is great because I know that whenever I go to the computer, it will just work. If we could change things, I have no doubt a few of the employees would just have to screw with things and then when it didn't work, it would then screw up my job and cost the company a lot of money, not to mention cause my workers and I unneeded stress.

All this comes from someone who has several computers running from home with various operating systems doing various tasks. I could probably improve things at my work in regards to how tech is handled, but it is not my job. If I want to play sysadmin, I can do it with my own gear, on my own time.

Re:I don't see a problem

[0racle]

If the company has decided that they are going to lock the use of unsanctioned peripherals, then the question becomes not, 'why doesn't my USB drive work,' but 'why are you bringing a USB drive in?'

The good, the bad and the dumbass

[e.coli]

As an IT tech, I have known users who knew their stuff, maybe 0.5% of the employees of any given company. And I have know techs who did not know their stuff, maybe 60%.

But all in all there are reasons why computers are locked down and there are reasons why IT mandates that "thou shalt not". Too many times there have been licensing issues where a know-it-all user with the ability to install software on their local box has brought in a package from home to install because they could get their work done better/faster/more colorfully with it than they could with the software that the company licensed. And when the project/document/spreadsheet that they created in that software can't be read or modified by any of the licensed software, they instantly become indignant and blame IT for not finding a way to convert their information. Contrary to popular mis-belief, IT does not have experience in EVERY piece of software out there. And when some disgruntled soul left the company they would let the anti-piracy folks know about the illegal installs.

And then there are the ones who download every bit of shareware/freeware/spyware in the known universe to their local box, turning their machine into a zombie or worse.

IT is usually mandated to keep the network running smoothly, virus and spyware free, and within the licensing agreements of the software that they have purchased. To do that they have to lock down the network, the computers and the user rights because the know-it-alls don't care about security, safety or licensing. They just want to run Weatherbug because they are too lazy to check into the WeatherChannel.

And then there are the users who listen to Internet radio (sucking down bandwidth), download illegal music and software (because it's faster than at home), and cruise the porn and game sites. Most users don't remember that the computer, network and internet connection still belong to the company that they work for and the aim of IT is to make sure that everyone can play and work together to the betterment of the company.

Give me a user who will work within the guidelines, request the software that they need to do their job and, at the end of the day, tend to their personal internet needs from their home computers.

When they need your help

[Twillerror]

It sounds all fine and dandy to allow the user to install all kinds of stuff on there machines. And without a company mandate with some teeth ( termination or write ups ) most people will install things on their own anyways. We have prevented people from having root access, but generally they figure out what the password is or someone in IT tells them.

The only problem with these sorts of users is the support they require when it turns out they don't know what they are doing. Any boob can install iTunes, but even the smarter ones start having problems trying to figure out why there machine crashes afterwords. Then IT is called and blamed.

I'm fine with having these users install whatever they want, just as long as they realize that when they have a problem of any kind of size ( word won't start ) I'm going to blast the machine. If they are smart enough to install all the extra software they are smart enough to put their data on the network or at least in one folder where I can copy it. If they say I lost all my MP3's I'm not going to have a problem telling them tough.

These same people don't have to sign the invoices for their expensive laptops, I do. It is company property and companies should have every right to tell individuals what they can and can't install. At the same time they cannot be so stubborn as to not allow for newer software to get added, even if it does pose some sort of risk. Instant messenger and those types of programs can greatly increase productivity if used correctly. If the employee is chatting with his wife, I'd rather he do that then go in the hallway and call him on his cell...chances are he is actually doing something in between the chat lines.

That said the company still has the right to monitor the person for any traffic going over their network. If the guy gets in trouble and they find that he chatted with his wife all the time it should be admissable in determining his dismisal. Everyone out there knows when enough is enough, those that don't usually end up without a job.

I'm more liberal than CostCo with my employees

[Travoltus]

and I still say:

1) It's my property (well, the owner of the company is my boss, but I manage this data center)

2) On my property, it's my internet usage rules, as long as I'm fair about it.

3) I bear the full responsibility for stuff going boom (physically, financially or legally), so I have the full right to monitor and control network usage.

4) You can always go home and use IM and gmail if you want. I have no control over that (though one jackass company in Michigan certainly would want to).

I support SOX, though I admit we're not a publicly traded company...

It's called "physical security".

[khasim]

Why is data so unsecured that the receptionist who plugs in her iPod can somehow get access to identity/medical histories? That's not the fault of the iPod or the receptionist.

Because without physical security there is no security.

Locking down the PC so that the receptionist cannot move data to his/her iPod would also, logically, prevent the iPod from doing anything that s/he would want it to do.

Unless you configured an iPod specific rule. And security is broken by "exceptions".

Re:Irony

[Anonymous Coward]

Why would you assume he's posting from work? Not to mention he has a UK domain and it's late evening there.

It's not the technical users we fear...

[gillrock]

This is not fear we have. I certainly don't fear the Software Developer that has good Unix or Windows knowledge. Hell, I'll try and learn a thing or two from those folks. However, we in IT have a job to do and we're trying to do that job with a couple of things in mind.

1. Keep the Lowest Common Denominator employee productive and not constantly working on their system(s). If you're a hot shot techie at home, you have to realize that IT needs to make things work for the non-techie employees as well as you. Admin Assistants are a good example. They don't know about SysInternals or Slashdot or Linux and they don't care. They do care about office applications working then they need them for that presentation their boss (sometimes your boss) is about to give or whatever else is their important issue of the day.
2. IT is not interested in how you do things at home and telling us that's how we should do it at the office. We're running a business, we're not running your little computing playground you have setup in your house. Hell, we have them too, but those solutions are not business solutions, they are home solutions and are different solutions that employ some of the same technology. It's an apple and an orange. IT is not really interested in how you have your computers at home on a certain switch or how you do backups or you telling IT how they should setup their network and what their problem is. Personally, I'm interested in talking to you about that for stuff and comparing it to what I do in my home, but not the business I work for.
3. IT places restrictions for good of the business and so that IT can focus its energy on a limited number of products. If IT let everyone just run what they wanted on their systems, IT would be a nightmare and the company couldn't get good quality people to do the job well. Everyone has products they like and favor, even the IT people, I certainly wouldn't want to work for a company where I had to support every anti-virus software in existence or every Linux distribution because it was the whim of the person who's office the system was installed. I want to see a buisness reason for supporting multiple Linux distributions or anti-virus software. IT makes business choices based on best practices and industry leading technology products. Well, at least IT tries to do this, in most cases.

On the flipside of the coin, the company where I work now has in it's IT policy that checking your personal email (Gmail, Yahooo Mail, hotmail, etc.) is not allowed. I don't get this, personally, but that's the policy and everyone scoffs at it. Also, IM is not allowed/supported, but there is a way around it that everyone uses.

Policy and practice by IT is there for the wide abuser IMHO. For example, an employee who puts 8 different firewalls, 3 anti-virus programs, and a slew of other non-work applications on his company issued laptop that has the company anti-virus and firewall. This person has the balls to call the help desk and complain that his laptop is performing like crap. Genius, uninstall 7 firewalls and two anti-virus programs and I bet your laptop performs a whole lot better.

I think everyone in any company should spend two weeks working in the company's IT group as part of orientation and I think seeing and hearing the issues first hand from that side of the fence will generate a different set of articles from this one.

You're missing the point

[KingSkippus]

The point of the article is not that you should or shouldn't try to lock things down. It is that that no matter how much you try to lock things down, your users will find ways to open it up to get their work done.

If you're smart, you'll figure out ways that you can both get what you want: Your security and manageability, and their productivity and ease-of-use. Handing edicts from on high is a pretty stupid idea. The point of the article is that you're not shutting down what they call "Shadow IT," you're simply driving it underground where it's harder to see and deal with.

But, you know, it's your property and your rules, so by all means, do with it what you will, and good luck with that.

Re:IT is there for the Users to use

[Peter Trepan]

Perhaps more importantly, smart users should love you. IT departments suffer because they don't forge relationships outside their department. While everyone else has friends and advocates at budget time, IT workers are viewed as interchangeable, even redundant. If you snub or ignore technically smart users, you're alienating the one outside segment that's even capable of understanding why you're needed.

It's a question of misplaced priorities.

[Kadin2048]

If the receptionist is assumed to be untrustworthy, then they could just as easily install a real hardware keylogger in between the PC and the keyboard. (And that would be a lot easier to get than an iPod-disguised keylogger.)

I'm not saying that there aren't situations where barring anything that could carry data away is appropriate. It's just that IT types seem to hone in on the "security breaches" that they can shore up, to the greatest inconvenience of users, while ignoring glaring holes elsewhere. If you're going to tell the secretary that she can't charge her iPod from the USB port because of the risk of keylogging, I hope that the keyboard's PS/2 connector is superglued in, or the entire chassis is encased in a locked steel container. Otherwise you're ignoring an obvious avenue of attack (like these), but going after a highly unlikely one, even though the treatment for the unlikely one annoys the user more.

Most IT departments have so many security problems and vulnerabilities, it's hard to even know where to start. But rather than working through them in a rational way, they seem to begin with the premise that "anything that annoys the users in the name of security must be good." (Probably not their fault; it's probably an attempt to placate a PHB somewhere by making the security really obvious...)

It's ultimately a glass-houses issue. Before overt, draconian security measures are put in place, everything else ought to be locked up already. Otherwise, it just makes the IT department look like they're power-tripping, regardless of the real motivation. And in the corporate world, it's not good to make everyone else hate you. Particularly the secretaries.

Re:It's a question of misplaced priorities.

[Jhon]

"anything that annoys the users in the name of security must be good."

I think it's more the case that you are focused in on the restrictions that effect you rather than getting a view of the "big picture". The trees are blocking your view of the forest.

Validation and Regulation

[Mutatis Mutandis]

This is a general observation that can be made regarding 'regulatory' departments that are concerned with security and legal compliance. Generally the rules are written down by someone senior, who uses common sense to reach what seems, at the time, a reasonable compromise and a practical approach. Next, they are handed down to a team of juniors, who enforce without understanding, because that is what they have been told to do. Through habituation, the regulations become Holy Writ and nobody is allowed to touch them --- a situation the original author(s) would probably have regarded as silly and dangerous. Finally, everybody formally adheres to the rules while circumventing them by any means possible, making a total nonsense of the original purpose.

This is by no means limited to IT. It also applies to finance or health care, or for that matter the US Constitution. It seems to a general human phenomenon. But it just seems that IT departments are more prone than others to the extreme aberration that I would call IT fascism: The belief that the ideal organization is regimented, uniformed, homogeneous, goose-stepping, controlled, and obedient; and that any exceptions need to be eliminated. Maybe the use of binary code stimulates binary thinking.

Of course, for any commercial organization, this can be a real killer in the long run. I've seen creativity and innovation totally stifled by regulation, until most people were so marinated in the status quo that they became completely incapable of independent decision-making, and the creative minds got frustrated and left. It's pretty much the reason why, if I were to make a SWOT analysis of our firm, I would classify much of our IT department under 'threats'. It's not because these people are of ill will, but the idea of trying, stimulating, or even supporting something new has become alien to them.

They are taking care of the daily business, according to present regulation, and they just can't imagine that there might be more to the job than that. To be fair, most of them are so far from the "frontline" that they no longer hear the din of the battle for survival.

No I don't

[Usekh]

I have worked in helldesk for..far..too long. Far far far too long. Er anyway. I have to say no I don't feel expertise of users. I fear users who -think- they are experts and really have no clue.

CIO

[dlhm]

I have been recieving CIO magazine for a couple years, and I have come to think of it as a book of Humor. On occasion I find some of the articles interesting, but mostly just amusing. I don't fear my users, unless they can keep up with the learning curve, they will fall behind quickly after new products come out. Most Users don't want to know how things work, they just want it to work. On the other hand if you have a user that is trying to flex thier computer skills in your face, you can bet they are doing much more behind you. Watch those users.. this article may also be biased based on the the service/software the mention in it and those who buy ads in this magazine. After all, how can CIO say don't let users use Gmail, or IM's. I think thier sponsers would flip...

The nerdiness of IT warfare

[Mutatis Mutandis]

From the posts in this thread, one gets the impression that there are rather a lot of places where IT people and other employees are locked in a state of permanent warfare, or at best uneasily living together in mutual disdain.

The curious thing is that rather a lot of IT people seem smugly satisfied with this. They are confident that they have everything "locked down" and that nothing can go wrong as long as they don't allow the users to do anything important -- whatever that means.

To me this seems the ultimate in IT nerdiness. It gets pretty close to programmers who exclaim that they "didn't change anything" when their product suddenly starts to misbehave -- only applied to people, who are even more unpredictable than even the most chaotic software product.

The reality is that if people hate you, they will find a way to subvert your systems, and IT won't know. People are resourceful. I strongly believe that a security system that is not supported by the people who have to live with it, will be valueless in the long run. People are your major threat and your strongest vulnerability, but potentially they are also your best line of defense. A serious outside attack is not unlikely to have a strong social engineering aspect to it.

I've met IT technicians who blithely assumed that outsiders could never guess an internal password, because their systems strictly limited the number of login retries and required frequent password changes. It never occurred to them that someone might entice out a password by putting on a lab coat and looking official, that people are rather stimulated to write down passwords if they have to change them too often and any mistake brings about a clash with IT, or that the use of incremental suffixes permits any outsider to predict the new passwords years in the future. They sought refuge in strict IT rules, but their psychology (and their logic) was all wrong.

Apparently, there is this curious notion in some places that IT is about managing machines. Curious, because any engineer in another field could tell the IT staff that a big part of effective support is dealing with people, their needs, expectations, and perceptions. An IT group that is just busying itself with keeping the hardware and software in a good state and not positively interacting with and educating users, is an IT group that is failing in its job.

Of course it is much easier to concentrate on the machinery and ignore or crush the users. Machines are far more predictable and easier to work with, and sadly a lot of IT people are still conforming to stereotype and not blessed with great social skills. But at the end of the day they should watch out for their own interest --- there is no future in being a glorified window(s) cleaner.

Smart users; smarter IT.

[brxndxn]

Any IT department that fears its users are learning too much is a goddamn shitty IT department. Seriously.

I'm an IT guy.. at an engineering firm. Pretty much everyone here is a 'computer guru' by todays' standards. So, for about 100 employees, the three of us 'IT guys' get to spend most of our time doing real engineering, programming, HMI design, drafting, etc. Our job is made much easier since we can give users full administrative control over their own computers/laptops (necessary in engineering anyway). We just 'lay down the law' in terms of what users are allowed to install and uninstall and we never have to take away privileges from people that know what they're doing.

So, for years, the entire network and seven servers is managed as a 1-10hour/week job for one of our three 'IT guys.' We secure the network and the servers.. and we don't even bother to secure the servers per user - we just have them making tons and tons of backups so if a user does remove/move files that are important, we just replace them with backed up copies from whatever date we want.

Having a smart userbase allows a 'smarter' IT dept. to spend less time on IT unless the IT dept. is a bunch of bumbling idiots who find it hard to stay ahead of the curve. It's really nice not to have users that need help just because they cannot map a drive.. or because they cannot install a different version of Industrial Software X because it is incompatible with Industrial Software Y.

Re:I don't see a problem

[misanthrope101]

No problem, twinkletoes. All that work that was getting done because I was working around your restrictions just stop getting done. That 1.4MB Powerpoint presentation I was working on at home, off the clock? Well, I guess the ETA just got pushed back, since I'm certainly not living in my office for you.

Just a few days ago I ran an entire meeting of 12 Powerpoint presentations from my USB drive because the network drive went down the very morning the VIP showed up to have his apple polished. I thought ahead, realized that our network goes down all the time is about as reliable as the Iraqi army, so I had the foresight to copy the files to my personal USB drive. No longer--now I'll just shrug my shoulders and the organization looks only as competent as we really are for a change. I'm actually ecstatic when they lock the computers down a bit more. Already my workplace has cut off webmail, much to the joy of all the workers who now can't be held responsible for not knowing about (and completing the tasking from) an email sent out at 10PM Friday. Lock everything down, please. Could you please take my printer? Who knows what sort of shenanigans I might get up to with that.

Give me a diskless workstation that only works during business hours, and make sure it's the only place from which I can access company data, and I'll buy you lunch for a week. Don't forget that company cellphones and blackberries and PDAs are also the spawn of Satan. Keep up the good work! We love you!