Pleasing Google's Tech-Savvy Staff

An anonymous reader writes "Douglas Merrill, Google Inc.'s chief information officer, is charged with answering that question. His job is to give Google workers the technology they need, and to keep them safe — without imposing too many restrictions on how they do their job. So the 37-year-old has taken an unorthodox approach. Unlike many IT departments that try to control the technology their workers use, Mr. Merrill's group lets Google employees download software on their own, choose between several types of computers and operating systems, and use internal software built by the company's engineers. Lately, he has also spent time evangelizing to outside clients about Google's own enterprise-software products — such as Google Apps, an enterprise version of Google's Web-based services including e-mail, word processing and a calendar."

Comments

I wish our IT was like this.

[dangerz]

With all the restrictions on tools and languages, it seems like our IT holds us back more often than pushing us forward.

I recently built an application for my group that started off in PHP/MySQL. The customers were using it and loving it, but IT said they're not interested in supporting PHP and we weren't allowed to stand up a server. After months of talk with them and compromising, it was rewritten into JSP/Oracle. Then they said we're not allowed to do that either, so we agreed on C#.net/MS SQL. I rewrote it to that and after a month, they again came back and said no way. Getting ever more frustrated (I now had the same program in several languages), I ended up in C# Desktop Application instead of web/MySQL. They've been complaining again, but we have more leverage there in that my entire group was stood up to build desktop apps. I'll probably have to switch it to Oracle, but that shouldn't be a big hit.

We wasted lots of time and money rewriting what was already done all because of politics. I always thought IT was meant to *support* rather than hinder.

Re:All Credit to Him

[zappepcs]

It always applies to other companies. The thought process it takes to create software services is what I believe should be the approach to network services. If each little group of employees is walled off the basic network, and their access outside that playpen restricted to what they need, any major error inside the playpen is less likely to corrupt the whole network. Much like a city's services are configured. Everyone needs water, electric, sewage, trash service, roads etc. If you trip the breaker in your office, the next office building is unaffected just as they are normally unaffected if your toilet overflows. In that way each can do pretty much whatever they like and all remain unharmed. I'm not saying that your hobby of cultivating anthrax is going to fly for very long, but short of that... well, you can (more or less) grow what you want in your window-box garden. You can walk down the street to the park, just not through everyone's backyards.

The idea is not to restrict people, but restrict damaging elements from hopping around your network.

Mostly fluff

[orclevegam]

Not much to this article but there are a few interesting tidbits. A lot is in the summary, so not much need to go to the actual article, but something interesting not in the summary is when he talks about googles security environment, and why it's not really a security risk to let people install whatever they want. What it boils down to, is that the old style security of locking down the endpoints (that is, peoples workstations) makes people sleep better, but doesn't actually provide much in the way of security. Instead they focused on securing the infrastructure, such as running AV software on the mail server, and intrusion detection software that monitors the networks and servers, plus one would assume properly configured firewalls. He also mentions that being a search company they already had really tight security in place and that few people had access to customer data, so adding security to support outside enterprise data wasn't a big leap.

Re:How?

[orclevegam]

Okay... Sounds interesting, but how exactly security and proper licensing is maintained? Could other companies emulate it? Maybe. Depends a lot on the company I imagine. Part of the reason it flies at google is because of something mentioned in the article. Almost everyone is an engineer of some type, and they all have security training. The security bit isn't as important, but as far as licenses go, most of them should understand you can't for instance bring your copy of MS Word in from home and install it on your company system. At companies with less technically inclined individuals, they may not see the problem with installing whatever software they can find on their company systems (talking from a purely licensing standpoint here, not talking about security). Essentially if Google got raided by the BSA they'd probably fair pretty well, but some other non-IT centric company might not fair as well with a similar IT policy. Of course, there's no reason for any company not to implement a similar policy for all their technical users at least.

Last Adopter

[salesgeek]

IT departments are typically the last adopters of anything. They typically roll up to the CIO, who typically is not a real C level executive. The CIO typically works for the CFO and is an advisory member of the executive committee in most companies. Information Technology generally has two crucial corporate functions: automating accounting functions and managing corporate communication platforms like phones and email. Everything else that happens on a computer - i.e. productivity applications, intranets, etc... are side effects of putting general purpose computers on desks and are secondary functionality. IT Departments have generally claimed fiefdoms over all things computerized so they can have bigger budgets, more resources and are harder to fire and outsource. It's ugly. But true. Most IT innovation starts in some department, and goes like this:

• Kid in sales writes really cool web app that sells product automagically on MySpace.
• IT finds out about it, can't integrate it with accounting, tries to kill it.
• Kid freaks out because someone who is three managers over him is calling him asking what he's doing.
• Kid's boss freaks out because CIO is calling his employee.
• Project is killed when Bosses Boss finds out about it because it doesn't make sense to him OR - Bosses Boss intervenes and tells IT to stuff it, and counts money from sales from web app.
• IT is forced to support web app because CFO now needs to book revenues for month or quarter.
• Kid is transfered from sales to IT and leaves company one year later to start company that sells MySpace widgets and goes on to become millionaire.