Slashdot Mirror
Pleasing Google's Tech-Savvy Staff
An anonymous reader writes "Douglas Merrill, Google Inc.'s chief information officer, is charged with answering that question. His job is to give Google workers the technology they need, and to keep them safe — without imposing too many restrictions on how they do their job. So the 37-year-old has taken an unorthodox approach. Unlike many IT departments that try to control the technology their workers use, Mr. Merrill's group lets Google employees download software on their own, choose between several types of computers and operating systems, and use internal software built by the company's engineers. Lately, he has also spent time evangelizing to outside clients about Google's own enterprise-software products — such as Google Apps, an enterprise version of Google's Web-based services including e-mail, word processing and a calendar."
Unfortunately it will take only one mistake by one employee to ruin it for everyone.
With all the restrictions on tools and languages, it seems like our IT holds us back more often than pushing us forward.
I recently built an application for my group that started off in PHP/MySQL. The customers were using it and loving it, but IT said they're not interested in supporting PHP and we weren't allowed to stand up a server. After months of talk with them and compromising, it was rewritten into JSP/Oracle. Then they said we're not allowed to do that either, so we agreed on C#.net/MS SQL. I rewrote it to that and after a month, they again came back and said no way. Getting ever more frustrated (I now had the same program in several languages), I ended up in C# Desktop Application instead of web/MySQL. They've been complaining again, but we have more leverage there in that my entire group was stood up to build desktop apps. I'll probably have to switch it to Oracle, but that shouldn't be a big hit.
We wasted lots of time and money rewriting what was already done all because of politics. I always thought IT was meant to *support* rather than hinder.
The greatest experience we can have is the mysterious.
- Albert Einstein
It always applies to other companies. The thought process it takes to create software services is what I believe should be the approach to network services. If each little group of employees is walled off the basic network, and their access outside that playpen restricted to what they need, any major error inside the playpen is less likely to corrupt the whole network. Much like a city's services are configured. Everyone needs water, electric, sewage, trash service, roads etc. If you trip the breaker in your office, the next office building is unaffected just as they are normally unaffected if your toilet overflows. In that way each can do pretty much whatever they like and all remain unharmed. I'm not saying that your hobby of cultivating anthrax is going to fly for very long, but short of that... well, you can (more or less) grow what you want in your window-box garden. You can walk down the street to the park, just not through everyone's backyards.
The idea is not to restrict people, but restrict damaging elements from hopping around your network.
Support NYCountryLawyer RIAA vs People
Okay... Sounds interesting, but how exactly security and proper licensing is maintained? Could other companies emulate it?
Not much to this article but there are a few interesting tidbits. A lot is in the summary, so not much need to go to the actual article, but something interesting not in the summary is when he talks about googles security environment, and why it's not really a security risk to let people install whatever they want. What it boils down to, is that the old style security of locking down the endpoints (that is, peoples workstations) makes people sleep better, but doesn't actually provide much in the way of security. Instead they focused on securing the infrastructure, such as running AV software on the mail server, and intrusion detection software that monitors the networks and servers, plus one would assume properly configured firewalls. He also mentions that being a search company they already had really tight security in place and that few people had access to customer data, so adding security to support outside enterprise data wasn't a big leap.
Curiosity was framed, Ignorance killed the cat.
That's fine if the walls are 100%.
If you allow some employees access through those walls to other networks, and a hacker manages to get their credentials it can start to get quite nasty.
Even if the isolation between networks is good there's also the possibility of _work_ being secretly tampered with. I'm sure there are hacker who would want to tamper with GMail or Google Desktop.
Or confidential information leaking out.
I also worked at a very big company which let us do this. Not company-wide, just the couple of thousand people that worked where I did, which was probably very similar to Google in terms of the sort of people who would work there. We were considered to be bright enough to stand on our own two feet. We weren't the sort to bother tech support unless it was a problem with, say, networking - applications we'd installed were our problem, and besides that we'd be more likely to know what we were doing with those applications than the average techie. It meant that if we needed a particular piece of software or equipment, we didn't have to wait weeks to get sign-off from God Himself - we went and downloaded it and our manager found the money for it if it had to be paid for. We were trusted not to buy stuff we didn't need, and by and large it worked. Treat people like adults and they'll behave like adults, mostly.
More than once I got hold of an oldish spare computer and installed Gentoo Linux on it, and the only justification I had for doing so was that Windows got on my nerves. Not much of a business case, but as far as they were concerned I was a big boy and could look after myself, and it was no skin off their nose as long as it didn't take up tech support's time.
The only thing that made us different from the tied-down masses elsewhere in the company was our level of knowledge about what we were working with. I maintain that the best security system is user education. Obviously that's not to suggest that you should throw caution to the wind, but clued-up people generally won't get you in trouble. So clue them up.
Right now I'm in a much more locked-down environment and it's incredibly frustrating. Something as simple as connecting to a printer is a nightmare because I have to go through some tech support clown who invariably knows a lot less than I do and bumbles around randomly prodding things till it works. I don't have admin rights to my own machine, and useful things like the command line are blocked. It drives me mad, and it holds me back in my work, but hey, some IT goon has an easier life because of it, so it's all fair enough, right?
Google is full of smart people, and the people in charge are clearly smart enough to treat them as such. I wish more companies would follow this example.
The reason this works is because he's a sensible fellow who knows standards-compliance. both in network protocols and data formats, is more important than the mere name of the OS or application issuing them.
~Tim
--
Rushing on down to the circle of the turn
-- $G