Slashdot Mirror

← Back to Stories (view on slashdot.org)

IT Departments Fear Growing Expertise of Users

Posted by kdawson on from the illusion-of-control dept.

flatfilsoc recommends a long article in CIO magazine on users who know too much and the IT leaders who fear them. Dubbing the universe of consumer technology the "shadow IT department," the article highlights the extent to which the boundary between users' workplace and home have broken down. It notes the increasing clash — familiar to anyone who works in a company with an IT department — between users' home-grown productivity boosters and IT's mandate to protect corporate data. The inherent tendency of the IT department to want to crack down and control technology that it doesn't supply should be resisted at all costs, according to CIO. The article outlines strategies for co-existence. It just might persuade some desperate CIO somewhere not to embark on a career-limiting path of decreeing against gmail and IM.

43 of 499 comments (clear)

  1. Yeah, what he said.... by zappepcs · · Score: 5, Insightful

    and there are always groups of individuals in every company that DO NOT fit the one-size-fits-all software/security model.

    Some people/groups really need a sandbox to work in, without interference from good intentioned IT departments.

    A virus spread wildly throughout my company recently because IT had thought to conveniently map some not so useful drives for everyone... guess how that virus spread?

    IT needs to learn to provide and protect without being so intrusive as to hinder real work being done.

    Sighhh

    --
    Support NYCountryLawyer RIAA vs People
    1. Re:Yeah, what he said.... by bigtomrodney · · Score: 5, Insightful

      That is certainly true to a large degree, but let's not overshadow the need for tighter security. Ultimately users need to bear in mind that their PC is for working, and really should only provide for their working environment. It's best to put aside the 'it's my computer' attitude and push the 'it's a company tool' attitude. Speaking as someone who has worked for years in IT, I would be more of the opinion that most staff in the IT department fear user knowledge because their own knowledge is lacking. From experience of a few different departments it's usually only one or two who have the knowledge to begin with and another five or six who are all talk. That's more what causes the friction between users and IT staff. No one minds a straight no if it is qualified, but I don't think anyone will tolerate a grunt of 'no' from someone who's not even sure why in the first place.

      --
      I never get used to these constant resurrections
    2. Re:Yeah, what he said.... by Jhon · · Score: 5, Insightful

      Ultimately users need to bear in mind that their PC is for working, and really should only provide for their working environment.
      Agreed. What need does a biller have in hooking up their IPOD to their work PC? Why would a clientservices-phone jockey need to hook up their USB memory stick? Why would a transcriptionist need access msn/hotmail/yahoomail?

      Then again, if it's a small shop and you're not really dealing with protected information on the network (say, medical records for example), then you may be fairly lax as to what users can/can't do at the workstation.

      *IF* however, you have federal and or state guidelines you MUST follow with regards to protecting identity and health information, then sorry pals, your workstation is locked down. Nope -- no unauthorized memory sticks. Nope, no internet access -- other than white listed work related sites. Nope, no access to install software.

      I've had users ask me for permission to install some "app" they like to use. The simple answer is "no" and I don't want to waste my breath re-hashing the same reasons. So I say "No. Check your employee handbook, page 12 for why" and walk away. I'm not going to have anyone of my guys jump through paperwork hoops to keep CAP or CLIA or MediCal happy so someone can have their computer go "ding" at a certain time using their favorite software.
    3. Re:Yeah, what he said.... by markov_chain · · Score: 4, Insightful

      What need does a biller have in hooking up their IPOD to their work PC? Why would a clientservices-phone jockey need to hook up their USB memory stick? Why would a transcriptionist need access msn/hotmail/yahoomail?

      Morale.

      This is a tricky thing and different for different types of work. A long time ago when I worked at a research lab, they tolerated my Linux boxes going onto their corporate network, which was a mix of Solaris and Windows. I even managed to interfere with their routing infrastructure by doing experiments with gated. They might have been upset about it, but in the end good work got done and the creative people were happy. If their policy had been draconian, the said good work would have been done at a competitor.

      --
      Tsunami -- You can't bring a good wave down!
    4. Re:Yeah, what he said.... by Jhon · · Score: 4, Insightful

      Morale.


      And how would their morale hold up when their employer is either shut down, fined in to oblivian or loses their ability to bill medical or some critical private insurance (essentially, you go out of business) for not providing necessary safegards for indentity/medical history? I don't think that their morale will be that high when they get their last check...

      A radio is fine. A tape deck. Even a CD player. Hell... even an MP3 player is fine so long as it's not hooked up (and unable to hook up) to a workstation.
    5. Re:Yeah, what he said.... by Theaetetus · · Score: 3, Insightful

      And how would their morale hold up when their employer is either shut down, fined in to oblivian or loses their ability to bill medical or some critical private insurance (essentially, you go out of business) for not providing necessary safegards for indentity/medical history? I don't think that their morale will be that high when they get their last check...

      Why is data so unsecured that the receptionist who plugs in her iPod can somehow get access to identity/medical histories? That's not the fault of the iPod or the receptionist.

    6. Re:Yeah, what he said.... by yuna49 · · Score: 4, Informative

      One of my clients is a community health center. We're looking into the Linux Terminal Server Project http://www.ltsp.org/ for precisely the reason that meeting HIPAA requirements for privacy and security is nearly impossible unless we can centrally control what's running on the workstations. In the next hardware tranche we're looking to go diskless with no CD writers and no USB support for mass-storage devices.

      Having only one, centrally managed, desktop image has a lot of appeal as well!

    7. Re:Yeah, what he said.... by dankney · · Score: 4, Insightful

      A good net admin is flexibile. If there's a good reason for it, any rule can be bent. I'm going to treat you like an adult and explain why your actions are potentially risky and are against policy -- I'll ask you to work with me to find a less risky way to accomplish the same goals.

      If you're doing network experimentation for a legitimate reason (work-related, not just being a dick), it's easy enough for me to vlan you off from the rest of the network. I'll even give you a gateway to the internet if you need it, but you'd better believe that your gateway is going to null route anything that's attempting to hit my servers or your co-worker's machines. My job may be to enable your research, but it's also my job to protect everyone else's data and productivity from your experiments should they go wildly wrong.

      I'll make sure you can do your work, but you may not be able to go about it in the way that you originally wanted to; my flexibility must be matched by yours. If you crash your own machine in the process, that's a risk you chose to take. I just have to make sure that everyone else on the network has the same choice and isn't subjected to yours.

    8. Re:Yeah, what he said.... by Jhon · · Score: 3, Informative

      Print Screen -> jpg -> IPOD HD.

      Cut/Paste from APP -> text File -> IPOD HD.

      Scan

      You've obviously never worked with state/federal payors who are cracking down on fraud. Not only from the entity making the claim for service, but forcing the entity making the claim to police their own CLIENTS for fraud. There are volumes of various types of regulations and procedures that CAP/CLIA/Medi require and we are regularly inspected for compliance.

      Sucks to be in IT in the medical field sometimes.

    9. Re:Yeah, what he said.... by SatanicPuppy · · Score: 4, Insightful

      It's always the sales guys. I actually saw a group of them complain so hard that they succeeded in getting access to streaming media sites, at a time when our bandwidth was just about at capacity. It started to affect the rest of the building, so we throttled their subnet.

      You've never heard so much screaming and whining. Goes all the way up to the top. CEO gets involved, wants to know the problem. We explain the problem, which was reasonably unsolvable at that point (no money for bigger pipe).

      Then we provided the logs. We were pretty pissed off, so we provided all the logs.

      Result? 3 people fired for what we'd consider "real" violations, and 11 people given warnings about the proper use of work equipment.

      To this day, we have the most viruses, the most spyware, and the most user-caused problems from that department. The people who work there are not tech savvy, they are not problem solvers. But each and every one of them believes that their position is by far the most important position in the company, above and beyond the people who actually produce the product.

      Now I understand that you want a certain type of person for sales, and I understand that by and large, the kind of person who works in sales needs to have certain character traits to be a good salesperson, and that that sort of person isn't usually over-supplied with introspection.

      But take this to heart: IT is there to keep things working. IT is there to introduce, after a period of testing, new software. IT is there to protect company data from malicious outsiders...and malicious insiders, and to maintain critical systems, and to fix technical problems.

      The purpose of IT is not to do whatever you want them to do; they have to take care of the whole organization, and the needs of the organization as a whole come first. It's not to bend the security guidelines for every program that one person thinks he needs. It's sure as hell not to mindlessly support every whim of every middle manager who is desperate for his department to have something to blame for his failure to meet sales goals.

      Some users we trust with elevated permissions. Some users we allow to install their own software. It may even be as high as 8 or 9 percent of our user base. Percentage in finance, for example, is like 60%. The percentage in the advertising department? Maybe 1 in 100. They are non-technical users who have a poor appreciation of security risks, and are incapable of not clicking on a pop-up if one pops up in front of them.

      --
      ad logicam Claiming a proposition is false because it was presented as the conclusion of a fallacious argument.
    10. Re:Yeah, what he said.... by jp10558 · · Score: 3, Insightful

      I'm sorry, but making users responsible for their own machines is a nightmare in a largeish orginzation. How do you track patches? Licensing? Do you send them to the Geek Squad when some random conflict between the 500 freeware programs, 3 improperly licensed programs, 3 work programs, 5 OSS programs, 2 pirated programs and 1000 spyware traces comes up? Do you just reformat and reinstall? How long does that take you?

      And how the hell do you roll out new software packages? Cause you have no idea what state the individual machine is in, I'm guessing you don't have a mass deployment tool, so do you put it on a file share and say go for it in an e-mail?

      --
      Opera, Proxomitron-Grypen,GPG 0x0A1C6EE3
    11. Re:Yeah, what he said.... by MobyDisk · · Score: 5, Insightful
      Everyone clap. You just met the IT guy you have all been loathing, and he posts on Slashdot. Thank you, take a bow.

      What need does a biller have in hooking up their IPOD to their work PC? Why would a clientservices-phone jockey need to hook up their USB memory stick? Because if you whitelist sites, then when the boss says "go to site XXX and tell me this..." they can't. And when the HR department says "go to www.friendlyHRpeople.com" to file a complaint they can't do it. But if you blacklist sites, then they can get to what they want anyway using some workaround. slashdot.com is blocked but engaget.com isn't. Or you can see it through someones blog, or redirection, or RSS feed, or a cache, or an anonymizer. This is a battle nobody can win.

      This is the type of attitude that gets us into the game of "If I rename the extension to .rar then I can send you this critical document you've been needing!" Then .rar files are blocked the next day. Then you zip the rar and it gets through again. The war escalates forever. Perhaps each employee should make a formal request to their boss, then to the IT department, then write a formal justification for why you need to visit each web site.

      Of course, it is probably all moot because you had to give everyone local administrator priviledges so they could run the ActiveX time-sheet application your IT department mandated.

      This is the mysterious "IT guy" who thinks he knows the fixed-length list of things that each and every person in the company needs to do their job. They create a blacklist of everything they think you could do on your computer that is bad, and use some 3rd-party product to scan everything you do and disable those actions. They already know better than you every tool needed for every position in the company. Really, this person could just do your job.

      I've had users ask me for permission to install some "app" they like to use. The simple answer is "no" and I don't want to waste my breath re-hashing the same reasons. Yes, you surely know every app they are going to need and have pre-installed it for them. And every application you haven't heard of is probably a virus. Of course, if you had setup their permissions properly then they couldn't install applications anyway. Instead of policing each application, set appropriate domain policies and work policies that make sense. Limit the size of email attachments. Put quotes on their accounts. Make sure the network drives have appropriate permissions.

      Trying to monitor every application used on every PC is a modern version of micro-management. Do you look at every tool that is on someone's desk? Do you approve each stapler? If you don't let people visit web sites, can they bring in books and newspapers? Do you blacklist/whitelist the phone numbers they can call and receive calls from?

      So I say "No. Check your employee handbook, page 12 for why" and walk away. Then you are a jerk.

      This will probably get modded as a troll. But I bet every person with mod points on this system has had to deal with the likes of you. I'm glad I got to find you and finally say it.
    12. Re:Yeah, what he said.... by gmack · · Score: 4, Insightful

      The problem most of the time isn't theft. The problem is users who THINK they know what they are doing but really don't. I have worked in several offices where everyone felt they could do whatever they felt like to their own computers and only called the admin when they were at a loss of how to fix it.

      Some noteable moments:
      • The user who decided he needed a better sound card so he switched his with a "less important" user. I get called in when both machines have screwed up drivers
      • The user who thought that his department should have his own file server but then didn't secure it properly. They had to shut the server down to block the resulting viral infection that took out half the office.
      • The constant complaints that our 10 meg fiber internet connection feeding an office of 30 people just wasn't fast enough thanks to some user thinking (s)he closed his/her file sharing app but only backgrounded it.
      • The screaming panicked call from my boss telling me our website was hacked because our web page now contained links to other websites.. Turned out the machine he was viewing it on had adware installed that came with his favorite file sharing service.
      • Why is our traffic so high and why are we getting spam complaints? Traced to a user with a non secured wireless gateway being hijacked by some spammer.
      • Spotty network connectivity traced by another admin to a wireless gateway plugged in BACKWARDS and was feeding DHCP packets onto the network that provided a network connection to nowhere.

      Show me a way in advance to know what users can be trusted and I'll consider letting users have more control. Until then I'll demand that users don't' mess with anything for no other reason that I end up with more work every time they mess up.

    13. Re:Yeah, what he said.... by Jhon · · Score: 3, Funny

      Walk through the offices four months later, flip the keyboards, and you'll find post-it notes with the last four passwords they've used placed underneath. Typically "1, 2, , 4." Teaching doesn't work
      Funny story:

      During a routine maintenance job (clean workstations/mice/keyboards), one of my guys found a post-it under a plebs keyboard. It read: "Do you think I'm foolish enough to keep my password here? HAH! I use my birth date so I don't have to!"

      I found the note hillarious. It was a HS kid working as a data entry drone. Now she works for me while going to college earning twice as much.
    14. Re:Yeah, what he said.... by markov_chain · · Score: 3, Informative

      It would be much easier to use a digital camera.

      --
      Tsunami -- You can't bring a good wave down!
    15. Re:Yeah, what he said.... by RMH101 · · Score: 3, Funny
      Add to this the tool who brought in an apple airport and hooked it up to the corporate network without any wireless security, so that he could sit by the window. I'd have given him a longer patch cable, if he'd asked.

      Also add to this the other tool who plugged in another WAP with the internal DHCP server turned on and serving addresses in the same address range as his office network.

      A little knowledge is a dangerous thing? Just look what a *lot* of it can do...

  2. My personal nemesis... by NerveGas · · Score: 5, Insightful


        Has always been the user who *thinks* he knows too much, and is out to prove it - usually causing problems, havoc, and destruction in so doing. You know, the kind of guy who gets pissed when you won't give them root/Administrator priveliges because he thinks he's a real big-shot. I've heard arguments as silly as "Well, I'm learning Linux on my own at home, so sooner or later, I'm going to know how to use it whether you give me root or not." Yeah, good for you.

        It seems that every company I've worked for has had one. Maybe it's a small part of my personal castigation for the things I've done wrong. Who can say...

    --
    Oh, you're not stuck, you're just unable to let go of the onion rings.
    1. Re:My personal nemesis... by russ1337 · · Score: 4, Interesting

      For a moment I thought you were talking about me....

      But seriously. My IT department guys were kind enough to give me admin privileges on my workstation and on my colleagues workstations in my department. I didn't ask for it, but they obviously trust me to some extent and i've built that trust over time. I'm not a sysadmin and have never been one.

      It could have something to do with the fact I'm overseeing a highly technical project involving setup of IT systems of sorts. This leads me to the same problem the article mentions. Our system must stay isolated from the world - physically and connectively (no inter-tubes for you!). The problem is its users 'think' they know better and think its ok to put in a CD, or plug in a USB drive to play MP3's or whatever because they can at home. (I don't think I need to tell /.'ers of the dangers of CD's after the Sony rootkit debacle). Of course we've removed all accessible means in - CDROMS/USB slots etc... and have some very harsh rules. But still, it's only a matter of time before I walk in and find some guy with his mp3 player hanging from a machine, or installing something unauthorized... because they thought they knew better.

    2. Re:My personal nemesis... by 0100010001010011 · · Score: 5, Insightful

      My personal nemesis is the layers of abstraction you have from someone that actually knows something and the mentality of those people.

      My laptop at work continuously reboots. I ran a memtest on it and narrowed it down to a bad memory chip. IT wants me to send in my laptop. I'm sorry. I don't have time to deal with that down time, so I just put up with it restarting.

      The most annoying one is when they redid a few dozen internal webservers. All of a sudden the redirect didn't work (If you went to an internal site and it had been X minutes it redirected you to Corporate Web Login).

      I did some research on my own and found that when they upgraded to the newest webserver someone forgot to bring along the configuration. All the redirect websites were being sent out as plain/text. Firefox correctly rendered it as... plain text. When I e-mailed IT about it I got a nice form letter about "Firefox isn't supported, we use IE, etc".

      I then copy and pasted curl -v logs of all the websites that were broken. I didn't just tell them what was broken, I told them HOW to fix it. I never got a reply back and everything magically worked within a week.

      Sometimes there ARE users out there who know what we're talking about. I'm not asking for admin rights or root access. But I do want to be able to do my job and when your fuckups impede that, it does tick me off. The IT people I know are the ones that seem to have the hardest time saying the two 3 word phrases that every engineer (in my opinion) must learn before leaving college: "I don't know." and "I was wrong."

      In the mean time I wrote a greasemonkey script that when it saw the redirect page it sent me to the correct website.

    3. Re:My personal nemesis... by Stamen · · Score: 3, Insightful

      I agree 100%, I don't understand this slave mentality we have these days. Employers treat their employees like children and, of course, people live up to expectations and act like children.

      My rules for employees are simple, do your job well, or I will fire you. The rest I don't care about. I'm not paying to have a pet around that only does what I say while attached to a leash. I'm hiring someone to do a job, a job they are agreeing to do.

      Employees are just vendors that are permanent (for a period of time) and exclusive. But they are vendors, vendors of work. If I don't like the work, I'll replace them with another vendor if a better one exists.

      This is how a free market works, it's sad that this basic concept of American life left so long ago. In 1900 most people owned their own business and had a stake in the community. Now-a-days, we are just a number of micro-communist-nations, I.E, large corporations. I just don't get it.

      If the management doesn't know if employees are doing their jobs then I'd find new managers.

      Unless you have special needs, like government mandated privacy laws, such as medical databases, what does it matter if employees spend all day on IM or EBay or Gmail. If they aren't doing their job, fire them, if they are, then let them continue; how they choose to do their job is up to them, they aren't children or pets.

      Oh, how did we get along for 100s of years without employers monitoring everything an employee does. The founding fathers and mothers wouldn't be happy with how we turned out, we became what they fought so hard against.

      Wow, I feel better now, thanks for listening.

  3. IT title does not an expert make by yagu · · Score: 5, Insightful

    I've met uncountable numbers of idiots when it comes to understanding technology. Guess what... many of them were peers in IT. In retrospect, it makes sense. I'd anticipated my move from college to a "real" job as a release from the world of idiots in the CS curricula. Finally, I'd get a chance to work shoulder to shoulder with people who knew.

    Not so much.

    I'd never considered where the rest of my university peers had to go -- into the same work force I entered -- duh.

    In the non-IT universe I discovered many were also clueless around technology, as I'd expected. What I hadn't expected was there were many non-IT people who got it, who understood technology, and worked with it adeptly. Many "got it" more than my peers. Some of the most profound ideas and innovation I've seen in IT have come from nontraditional non-IT people.

    I agree (without reading the entire article) with the summary and gist of the article -- IT does itself no favors ruling by fiat and instead should collaborate with users.

    This doesn't dismiss bad things happening and messes created by users left behind for IT to clean up. People who mess up should help clean up, but my experience has been many IT people are equally inept and likely to make messes.

    A degree and title in IT and CS means only that one has a degree in IT and CS, nothing more. It doesn't mean they're anointed and it doesn't mean they know more about technology than users.

  4. IT Isn't Master of All by Anonymous Coward · · Score: 5, Funny

    I'm sick and tired of IT departments that try to control everything I do when I know perfectly well that WeatherBug and WinFixer are the right tools for the job. I am a smart and knowledgeable IT consumer, and I've been using these fine products at home for some time now. Why not at work too?

  5. I experience this every day... by doormat · · Score: 4, Interesting

    As a software developer outside of the IT department (I'm under direction of the Engineering group), I get this all the time. I get the run around, exclusion from important meetings, no say in things I have a large stake in, put at the bottom of the priority queue, and sometimes even people working to throw roadblocks in my way.

    I've always been a fan of decentralized IT - a core group working to "keep the lights on" and seperate groups providing services embedded in the groups they're providing services to, responsible to the managers of the groups who use the tools. Meetings still happen with the needed staff, but someone is a few cubes down the hall or at least on the same floor to answer questions and get feedback.

    --
    The Doormat

    If you're not outraged, then you're not paying attention.
  6. And why not? by Realistic_Dragon · · Score: 5, Interesting

    I would be 7 kinds of mad if anyone was using gmail and IM in my office.

    We work with NATO restricted data. *Everything* requires appropriate handling. E-mail is carefully fenced and the IM service is encrypted.

    But even if you aren't a company with such a strong need for data protection... well actually there is no such thing. At the very least you have financial data and client information on your systems. Losing some of that stuff is considerably more harmful than restricting people to company provided communication tools.

    Anyone placing data that hasn't been cleared for release (even by the very informal process of being sent out on purpose) onto services run by people with whom you have no contract and no reasonable expectation of integrity is, frankly, no better than the idiots who don't back up their data and are then surprised to find out that MTBF is not a guarantee. After all if your employees are using gmail et al you don't even know what data you *have* let alone what steps you need to take to protect it.

    --
    Beep beep.
  7. Re:I don't see a problem by smooth+wombat · · Score: 5, Insightful
    IT lost this fight when the USB memory stick became popular.


    Lock down usb ports.

    Besides, no matter what they do, they can't stop me from creating a knoppix cluster from my coworkers pc's after they all leave for the day.

    They can fire you.

    See, not so hard.

    --
    We will bankrupt ourselves in the vain search for absolute security. -- Dwight D. Eisenhower
  8. The day this is a reality by Oriumpor · · Score: 4, Funny

    Is the day hundreds of callcenters close down their Level 1 support. I always thought it funny to have columns and rows of people that do nothing but open the documentation the users have and read it to them over the phone. Since the phones are still ringing, I think this announcement is still quite a bit premature.

  9. "Idiots" data that hasn't been cleared for release by Cr0w+T.+Trollbot · · Score: 3, Insightful

    Anyone placing data that hasn't been cleared for release (even by the very informal process of being sent out on purpose) onto services run by people with whom you have no contract and no reasonable expectation of integrity is, frankly, no better than the idiots who don't back up their data and are then surprised to find out that MTBF is not a guarantee.

    Be sure to let Jimbo Wales know he's an idiot for doing it that way.

    I'm not advocating Wiki methods for a nuclear missle silo, but I think a lot more companies can profit from a Wiki-type approach to (some) data than those that can beneift from an NSA "everything is top secret and must be locked down at all costs" approach.

    Crow T. Trollbot

  10. Re:IT dept's delay work. by aquatone282 · · Score: 5, Funny

    It makes you wonder if they spend more time reading my email and slashdot posts than actual IT work.

    Reading your email and your slashdot posts IS our actual work.

    Signed,

    Your IT Department

    P.S. You're fired.

    --
    What?
  11. Sometimes it "has to fit" by winkydink · · Score: 4, Informative

    whether you like it or not.

    In the US, Sarbanes-Oxley places some strict requirements on data retention for publicly-traded companies. Employees choosing to use IM and gmail, could cause those requirements to be circumvented.

    --

    "I'd rather be a lightning rod than a seismometer." -Ken Kesey

    1. Re:Sometimes it "has to fit" by LurkerXXX · · Score: 4, Informative

      This is why the clever IT guy who doesn't want to get blamed for limiting user, as in the blurb, should bring in the corporate lawyers to lay down the law. This way it isn't the good IT director who wants to supply any needed technology, but the lawyer cracking down on things that could get the company in hot soup.

  12. For every rule, there are exceptions by bhmit1 · · Score: 5, Interesting

    I've been a user that is locked into crazy setups. The traveling consultant at client sites who's PC is setup to be managed from the corporate network. At one point, I got tired of the insanity, took a ghost image of the machine they gave me, and installed linux on the machine (and then restored the ghost image in a vmware session).

    But here's the thing, I don't ask for support from the IT department because I'm the odd guy. I know they can't support me. What annoys me (as the one who helps other IT departments manage lots of PC's) are the people that install various applications that cause our automated installs to fail. 90% of the machines are managed with little to no effort. It's the 10% that cause days of work while we try to figure out which of the 20 apps you installed is breaking our install tool.

    And for all those against IM and email lockdown, I've been to trading companies where that's the law. They get in trouble when they don't have logs of what people said on IM, email, phone calls, etc because that's how they catch insider trading. Of course for every sensible rule, I've seen 10 that make no sense at all. As has been said before, the USB key should force companies to reevaluate their policies.

  13. The power user vs the not so power user by onkelonkel · · Score: 5, Insightful

    1. "My hard drive is howling like a panther passing a kidney stone. Every time I run chkdsk I lose a few more sectors. I've backed up all my work to the network drive. When you get a chance can you come and fix my computer?"

    2. "My computer won't start. It's been making this squealy noise for about two weeks and then all of a sudden it just died. You have to come right now and fix it because all the annual budget files are on my desktop."

    Which call would you rather get?

    --
    None of them can see the clouds; The polished wings don't care.
    1. Re:The power user vs the not so power user by garcia · · Score: 4, Interesting

      I'm a fairly knowledgeable computer user with 10 years of Linux experience on top of the standard Windows use since 3.1. When I have an IT problem I play stupid, real stupid. You know why? Because the second they think that I'm self diagnosing a problem it becomes priority 0.

      When I called up to tell them that my co-workers computer was denying Groupwise proxy rights via a VBA Access module for a single proxy account and not any others, they ignored me for *four weeks*.

      When I call up and say, "my computer doesn't work" they show up in minutes and do whatever it is that they need to do.

    2. Re:The power user vs the not so power user by Heisman · · Score: 5, Funny

      Well, since user #1 is probably a typical /.er, and user #2 is probably the long leggy blond girl from accounting/payroll. I'm going to go hang out under #2's desk for a while. I'll see you guys later.

  14. IT is there for the Users to use by Junior+J.+Junior+III · · Score: 3, Interesting

    We should love smart users. If they come up with their own solutions to problems, they're de facto developers. If the business is run well, good workers will succeed and advance while poor workers fail and leave the company. In time, we'll have evolved a class of competent users, even experts, and have application development in the hands of everyone, along with the skillset to actually make decent software. It's a long way off, and maybe a pipe dream, I know, but don't squash the dream. Please.

    --
    You see? You see? Your stupid minds! Stupid! Stupid!
  15. Re:I don't see a problem by 0racle · · Score: 4, Insightful

    If the company has decided that they are going to lock the use of unsanctioned peripherals, then the question becomes not, 'why doesn't my USB drive work,' but 'why are you bringing a USB drive in?'

    --
    "I use a Mac because I'm just better than you are."
  16. The good, the bad and the dumbass by e.coli · · Score: 3, Insightful

    As an IT tech, I have known users who knew their stuff, maybe 0.5% of the employees of any given company. And I have know techs who did not know their stuff, maybe 60%.

    But all in all there are reasons why computers are locked down and there are reasons why IT mandates that "thou shalt not". Too many times there have been licensing issues where a know-it-all user with the ability to install software on their local box has brought in a package from home to install because they could get their work done better/faster/more colorfully with it than they could with the software that the company licensed. And when the project/document/spreadsheet that they created in that software can't be read or modified by any of the licensed software, they instantly become indignant and blame IT for not finding a way to convert their information. Contrary to popular mis-belief, IT does not have experience in EVERY piece of software out there. And when some disgruntled soul left the company they would let the anti-piracy folks know about the illegal installs.

    And then there are the ones who download every bit of shareware/freeware/spyware in the known universe to their local box, turning their machine into a zombie or worse.

    IT is usually mandated to keep the network running smoothly, virus and spyware free, and within the licensing agreements of the software that they have purchased. To do that they have to lock down the network, the computers and the user rights because the know-it-alls don't care about security, safety or licensing. They just want to run Weatherbug because they are too lazy to check into the WeatherChannel.

    And then there are the users who listen to Internet radio (sucking down bandwidth), download illegal music and software (because it's faster than at home), and cruise the porn and game sites. Most users don't remember that the computer, network and internet connection still belong to the company that they work for and the aim of IT is to make sure that everyone can play and work together to the betterment of the company.

    Give me a user who will work within the guidelines, request the software that they need to do their job and, at the end of the day, tend to their personal internet needs from their home computers.

  17. When they need your help by Twillerror · · Score: 3, Insightful

    It sounds all fine and dandy to allow the user to install all kinds of stuff on there machines. And without a company mandate with some teeth ( termination or write ups ) most people will install things on their own anyways. We have prevented people from having root access, but generally they figure out what the password is or someone in IT tells them.

    The only problem with these sorts of users is the support they require when it turns out they don't know what they are doing. Any boob can install iTunes, but even the smarter ones start having problems trying to figure out why there machine crashes afterwords. Then IT is called and blamed.

    I'm fine with having these users install whatever they want, just as long as they realize that when they have a problem of any kind of size ( word won't start ) I'm going to blast the machine. If they are smart enough to install all the extra software they are smart enough to put their data on the network or at least in one folder where I can copy it. If they say I lost all my MP3's I'm not going to have a problem telling them tough.

    These same people don't have to sign the invoices for their expensive laptops, I do. It is company property and companies should have every right to tell individuals what they can and can't install. At the same time they cannot be so stubborn as to not allow for newer software to get added, even if it does pose some sort of risk. Instant messenger and those types of programs can greatly increase productivity if used correctly. If the employee is chatting with his wife, I'd rather he do that then go in the hallway and call him on his cell...chances are he is actually doing something in between the chat lines.

    That said the company still has the right to monitor the person for any traffic going over their network. If the guy gets in trouble and they find that he chatted with his wife all the time it should be admissable in determining his dismisal. Everyone out there knows when enough is enough, those that don't usually end up without a job.

  18. It's called "physical security". by khasim · · Score: 3, Insightful

    Why is data so unsecured that the receptionist who plugs in her iPod can somehow get access to identity/medical histories? That's not the fault of the iPod or the receptionist.

    Because without physical security there is no security.

    Locking down the PC so that the receptionist cannot move data to his/her iPod would also, logically, prevent the iPod from doing anything that s/he would want it to do.

    Unless you configured an iPod specific rule. And security is broken by "exceptions".
    1. Re:It's called "physical security". by rsborg · · Score: 3, Informative

      Locking down the PC so that the receptionist cannot move data to his/her iPod would also, logically, prevent the iPod from doing anything that s/he would want it to do.
      This is not true. The receptionist should be using his/her PC/Mac at HOME to load the iPod with *her* music. No interaction between the mp3 player and the workstation/laptop is necessary. The iPod still plays songs/video as it should, but without interacting with the work computer.
      --
      Make sure everyone's vote counts: Verified Voting
  19. You're missing the point by KingSkippus · · Score: 3, Insightful

    The point of the article is not that you should or shouldn't try to lock things down. It is that that no matter how much you try to lock things down, your users will find ways to open it up to get their work done.

    If you're smart, you'll figure out ways that you can both get what you want: Your security and manageability, and their productivity and ease-of-use. Handing edicts from on high is a pretty stupid idea. The point of the article is that you're not shutting down what they call "Shadow IT," you're simply driving it underground where it's harder to see and deal with.

    But, you know, it's your property and your rules, so by all means, do with it what you will, and good luck with that.

  20. Validation and Regulation by Mutatis+Mutandis · · Score: 4, Insightful

    This is a general observation that can be made regarding 'regulatory' departments that are concerned with security and legal compliance. Generally the rules are written down by someone senior, who uses common sense to reach what seems, at the time, a reasonable compromise and a practical approach. Next, they are handed down to a team of juniors, who enforce without understanding, because that is what they have been told to do. Through habituation, the regulations become Holy Writ and nobody is allowed to touch them --- a situation the original author(s) would probably have regarded as silly and dangerous. Finally, everybody formally adheres to the rules while circumventing them by any means possible, making a total nonsense of the original purpose.

    This is by no means limited to IT. It also applies to finance or health care, or for that matter the US Constitution. It seems to a general human phenomenon. But it just seems that IT departments are more prone than others to the extreme aberration that I would call IT fascism: The belief that the ideal organization is regimented, uniformed, homogeneous, goose-stepping, controlled, and obedient; and that any exceptions need to be eliminated. Maybe the use of binary code stimulates binary thinking.

    Of course, for any commercial organization, this can be a real killer in the long run. I've seen creativity and innovation totally stifled by regulation, until most people were so marinated in the status quo that they became completely incapable of independent decision-making, and the creative minds got frustrated and left. It's pretty much the reason why, if I were to make a SWOT analysis of our firm, I would classify much of our IT department under 'threats'. It's not because these people are of ill will, but the idea of trying, stimulating, or even supporting something new has become alien to them.

    They are taking care of the daily business, according to present regulation, and they just can't imagine that there might be more to the job than that. To be fair, most of them are so far from the "frontline" that they no longer hear the din of the battle for survival.

  21. Re:I don't see a problem by misanthrope101 · · Score: 4, Insightful
    No problem, twinkletoes. All that work that was getting done because I was working around your restrictions just stop getting done. That 1.4MB Powerpoint presentation I was working on at home, off the clock? Well, I guess the ETA just got pushed back, since I'm certainly not living in my office for you.

    Just a few days ago I ran an entire meeting of 12 Powerpoint presentations from my USB drive because the network drive went down the very morning the VIP showed up to have his apple polished. I thought ahead, realized that our network goes down all the time is about as reliable as the Iraqi army, so I had the foresight to copy the files to my personal USB drive. No longer--now I'll just shrug my shoulders and the organization looks only as competent as we really are for a change. I'm actually ecstatic when they lock the computers down a bit more. Already my workplace has cut off webmail, much to the joy of all the workers who now can't be held responsible for not knowing about (and completing the tasking from) an email sent out at 10PM Friday. Lock everything down, please. Could you please take my printer? Who knows what sort of shenanigans I might get up to with that.

    Give me a diskless workstation that only works during business hours, and make sure it's the only place from which I can access company data, and I'll buy you lunch for a week. Don't forget that company cellphones and blackberries and PDAs are also the spawn of Satan. Keep up the good work! We love you!