Slashdot Mirror
Guerrilla IT, Embracing the Superuser?
snydeq writes "First it's letting users manage their own PCs and now it's sanctioning the shadow IT projects they do on the down low: 'You probably know them. They're the ones who installed their own Wi-Fi network in the break room and distribute homemade number-crunching apps to their coworkers on e-mail. They're hacking their iPhones right now to work with your company's mail servers. In short, they're walking, talking IT governance nightmares. But they could be your biggest assets, if you use them wisely. The reason superusers go rogue is usually frustration, says Marquis. "It's a symptom of the IT organization being unable to meet or even understand the needs of its customers," he says. "Otherwise, it wouldn't be happening." The solution? Put them to work.'"
In which case they should toe the god damn line, because they're fucking shit up for other people.
Yes, enterprise IT can be frustrating. But your cheeky little wifi hack maybe just took down three buildings of network, resulting in thousands of dollars of lost productivity. Actually happened, in my org - 100% true story.
I don't like meaningless limitations any more than the next guy, but these know alls who think they're 'superusers' because they can set up a wifi network need to lay off - they don't have the big picture, they just think they're being clever. Guerilla? Arse-scratching chimp, more like.
I don't think that's true. Lots of people just want to screw around with things and get an ego boost out of flouting authority or trying to show-up the IT staff. You know, there's always going to be that guy who wants to install games on his PC, and figure out how to tunnel past the porn filter. Maybe it's because he wants those things, but also it's because he gets a kick out subverting the rules. Either way, it doesn't mean the IT staff isn't doing their jobs.
Please tell me people don't really talk like that. "Grew the solution"? "Drive business value"? These people need to get a hold on themselves and listen to the feces streaming out of their mouths.
hahaha, let the users have admin rights?
does the author have **any** experience of the commercial environment?
Remind me why we even have an IT dept. again?
Depends on the company but generally because they were told to have one, not because the department itself operates well. Honestly, while I could fully be a "rogue superuser" I prefer to let them do most of their work because I just don't get paid to do what they get paid to do.
Will I install applications, use applications and write applications as necessary to get *my own* job done? Yes. Will I go out of my way to do it so that others can do their job better? No. I am the first to tell someone who sends me an IM that asks, "Bill, can you come down and help with foo?" to go and submit an IT work order and wait it out. But I'm certainly not going to wait for them to come and fix my machine when I know full well I can do it myself without watching work backup for minutes, hours or days.
I've been on both ends of the IT/user divide. I've administered networks of several hundred machines and am well aware of what some people will try to do with them. In my current position, however, I'm just a regular user. So when people in the department start talking about doing something that IT wouldn't approve of, I can usually explain to them in their terms why it wouldn't be such a good idea. OTOH, there have also been times where I've been called in by my boss to take care of a situation that IT hasn't been able to resolve, but that I've figured out because I face the problem daily. In those instances, I don't mind making a quick lap around the department and tweaking the machines a bit, because I know that it's exactly what IT would be doing anyways if they could be bothered to figure it out. And before someone says anything, I've contacted IT before to explain the problem and the fix. It's just that it's usually such an esoteric issue that they can't even begin to get their heads around it (e.g., font caching issues involving using certain programs in a certain sequence).
This guy's the limit!
My last employer had firewalls that only allowed traffic through ports 80, 443, and an unusual port for VPN. I heard they also sniffed unencrypted packets, mostly to watch for viruses and breakins. Some of my coworkers wanted to use IM, although it was banned on the network. So I set up an encrypted squid proxy through my work desktop and home server. My whole team had IM and was able to communicate more efficiently.
One day I got called into the boss's office. He says, "I hear you've installed IM on everyone's desktop." So immediately I think I'm in trouble. Then he says, "Would you mind setting it up for me? How did you get it on the network?" He realized it increased productivity and any personal use wasn't seriously inhibiting work.
The point is don't hinder technology for a whole company only because you're afraid one ignorant user will bring in a virus. If power users want something, it's typically because it'll make them better at their job. Figure out a way to let them have it.
Developers: We can use your help.
Exactly. I'll generally deal with my own machine (up to a point) and will take full responsibility for any issues that might arise due to my actions. That said, if I encounter a problem, I'll do what I can to take care of it within the rights limits of what IT has given me. When I go beyond that I know that I'm on my own and can't particularly expect IT to fix it if I screw something up.
This guy's the limit!
I think most good IT departments are okay with allowing a certain amount of freedom. Where I work we don't give out admin logons, but we do allow some users to admin their local machine, and we do allow some users the privileges to do basic crap on other people's machines. If you have a guy who is willing and capable of doing annoying little changes for people and taking some of the headache off of the IT staff, more power to 'em.
But that stuff should always come with a "screw it up, and you're going to have to fix it yourself" caveat. If you pick your people well, then they should be okay with that in the first place.
ad logicam Claiming a proposition is false because it was presented as the conclusion of a fallacious argument.
And while you're creating this community, your network is busily being infested with malware, unlicensed software and pirated music.
As much as we love to believe that everyone would be an ideal user with just a little education, most people simply do not care about computers outside of the fact that they have to use them for checking their emails and inputting data into "Application X". I admit that I work in the NHS, so there's an abnormally high percentage of IT illiterate users, but I see very few users with an actual interest in learning.
It really depends on the organization. There may be some overriding legal or safety reasons why you don't want to let anyone out of the sandbox: end user apps may not place nice with air traffic control or nuclear plants. ;)
On the other hand, some IT departments fully live up to the Dilbert character, Mordac, Preventer of Information Services. My IT department happens to be one of those, and the main consequence of my supervisor's blanket refusal to do anything that bothers him is that everyone, including his boss, comes to me to get things done. And that's okay with my boss, because his real objection is to doing anything unfamiliar, not the fact that it's being done somewhere.
But that's obviously a dysfunctional situation. The problem is that our IT department -- and presumably many others, including some of the snitty, arrogant posters in this thread -- isn't doing its job. By definition, if the IT department is either preventing necessary work from being done, failing to help get it done, or imposing arbitrary obstacles to get out of doing work in the first place, the solution is not necessarily giving end users IT responsibilities; the solution is for upper management to kick ass and, if necessary, hire IT people willing to do their jobs.
Contrary to some of the polarized views I've seen here, IT isn't always the problem, nor are end-users always the problem. Most often, it's a failure of both to work constructively and flexibly together and a failure of upper management to insist that they do.
Of course, if the dysfunctionality in your company isn't going anywhere anytime soon, you may have to look for workarounds, and the solution proposed by the original poster might work in some situations.
Proud member of the Weirdo-American community.
Well your caveat only works to a point. How long would your department let him spin his wheels while work is not getting done? Who then gets blamed for the downtime? The power user or IT?
We did this at my employer, one of the departments decided they wanted to maintain their own desktops as a group. As no self-respecting admin actually enjoys taking care of desktops, we let them do it.
It wasn't a total break, they're still subject to the site's security policies and their home directories still mount from an nfs server we maintain, but no one in our group has had to install a machine or fix a dead hard drive in 5 years. They understand their needs far better than I ever could, so it really was a win-win situation.
It's worked surprisingly well, the admins are all volunteers from within the group, and they even maintain a batch system that all the workstations use for running jobs.
If any company has a group of people willing to take on that kind of responsibility, I'd say it deserves serious consideration.
...and even I think this is a BAD idea. You want to mess with your own PC, okay - there's some merit there for some people. Mess with the network - hell no. There are too many things that need to get done, and the ability for one person - even an otherwise knowledgeable person - outside of IT to screw things up is just too much of an unknown.
I'm not usually one to chime in on the side of IT, as they often throw out the baby with the bath water, but letting people who's primary function is something other than keeping the network up mess with the network is just a massively bad idea. Screw up a workstation and one guy is dead for a day. Screw up the network and the whole company can go toes up.
Is it just my observation, or are there way too many stupid people in the world?
I can relate to this issue. My co-workers often come to me to fix their email and various other apps that have been screwed up by an incompetent IT staff. I try, I really do try to get my coworkers to call IT if their is a problem, but sadly, they often don't trust them. I have been accused of all sorts of things by various IT employees and none of it true or even provable if it was. The truth is mine is the only computer they are _not_ regularly fixing (or screwing up) here in my office.
It's like antivirus programs. I have no problems with having it installed on my computer, but I DO have a problem with it kicking off in the middle of the danged day when I am trying to work. The problem with some of the power tripping IT staff (hey I am in IT) is that they don't think....what time of day should these run?? They accept all defasults.....and that sucks.
Gorkman
It's not hard to teach people the basics of networking. When you hold people's hands, you make it so they won't have to learn, so they don't. Require them to learn how to fish and they'll be providing for themselves. I know you'll say it's crazy, it's impossible, no normal person could ever learn responsible computer use... but get off your high horse. People routinely learn much more difficult things than using computers - and if they have a motivation to learn how to do things, they will.
In fact, you've proven this. You say people will figure out how to "infest" your network with unlicensed software, but that's assuming individuals will figure out how to do this. You're probablly certain they will - and why? Because it's probably already happened. You spend your time fighting against your tricky users, who find all the holes in your policies and install skype, or limewire, or whatever the unauthorized flavor of the month is.
IT creates an oppositional environment where users are pitted against systems administrators. Is it a surprise that people find ways around the IT department's rules? Imagine if these energies were placed towards helping the system, helping the network, helping resolve instead of circumvent. Sure, not everyone may be willing to expend effort, but there'll be enough people who will take responsibility for themsleves and share with others.
Most IT departments think that they know everything there is to know about computers and the network. The problem is that they don't know half of the shit they think they do. In particular they usually know nothing about what their users need in order to be productive. Instead most IT departments focus exclusively on control, control, control. While control is great you must have an idea of what you need to control and why and that is where IT departments are out to lunch. Security is not the only responcibility of IT, usability is just as important. If I can't use my computer I might as well not even have it. Its just a waste of space and money if it is locked down so tight that I can't get my job done. Time and time again it has been shown that with physical access to a system you can gain control over it.
Stop being a disabler and start being an enabler. Show people how to user their computers effectively while keeping them safe through education.
First of all, it depends on the context whether this is a good idea or not. In some environments, the IT group is the one and only IT wizard. In others (esp. in companies where IT development and IT research are the core business), the official IT group often is not at all capable of even understanding what the engineers are doing and supposed to do.
I've always worked (nearly 18 years now) in the latter situation. Once upon a time, I was one of those superusers in that I was had an IT degree, but worked in engineering (research, actually) where most of my collegues were non-IT engineers. They were very IT savy at a personal level, but generally missed the wider scope. So far so good. The not so good thing, was that the IT department had no clue whatsoever of what the real business needs in terms of IT were (and neither had the company's management). The consequence was an ever worsening war between IT and IT users, amongst other things resulting in ever more shadow systems. We solved this by establishing a working group that took care ensuring there regular was bidirectional communication between parties (I was one of the founding fathers and later on was the chairman for many years). This worked wonders. (Note: It worked so well, that when I finally left the company, the IT group tried to convince me to stay by proposing that I might join them in quite senior positions.)
Part of the whole concept was to do exactly what TFA says: the real superusers were identified; they earned the trust/respect they deserved; and then gained the appropriate - for our context - access to specific systems. (I personally managed the whole repository of OSS as well as some commercial soft we had installed centrally on UNIX. No, I did not have root, as I designed the complete setup such that I did not need it, but it will also be clear that with that level of access I potentially could access a lot of data and that capturing root would not have been difficult had I wanted. Some superusers can be trusted afterall.) Many succesful applications were developed in the same way: some superuser developed - with the knowledge of IT - a prototype that was taken into production for a larger audience after review by the working group and possibly some clean up by IT.
Actually, all this is nothing new. Strategic alignment between business and IT is a core part of IT governance. So is making sure that IT governance is not a buzzword hidden in a bi-monthly meeting between the CTO and CIO, both of whom generally do not understand the issues, but that it is something that is built into the whole system at all levels. And yes, this includes the superusers (at least the capable ones).
Concluding remark: I've since obtained an MBA. As part of the IT course, I wrote a paper describing the complete history of IT management & governance at my previous employer detailing the above story at length. That paper made a very happy professor, as he considered that I was absolutely spot on. Afterwards he started using me as an in-class assistant for the remainder of his course.
Linux user since early January 1992.
Remind me why we even have an IT dept. again?
Because for every one of you, we have a hundred people who can barely manage to get around in MS Office, and most dangerous of all, three or four people who think they know computers (yet strangely manage to cause more restore-from-backup sessions that all other users combined).
That said, if I didn't work in IT, I sure as hell wouldn't do the same work unrelated to my job description. Dealing with helpless coworkers without having it go into my pay or performance reviews? Not bloody likely!
Are you seriously saying that the company you work for would support you NOT helping an employee recover his system just because he broke it himself?No, seriously, the company supports that position for you?Again, and the company supports that position?That's a LOT different from what you've been saying.
We only support our standard configuration. Yet if a machine breaks, whether from an employee's actions or not, we still repair/recover as much as we can.
I'm fascinated that you seem to be claiming to work for a company that values your self-esteem over actual customer contracts.
We work in a healthcare organization and having people develop applications on our servers can potentially cause huge issues.
...their applications can't cross security lines... Then there's the support issues - who fixes their business critical application when they've left or are on vacation?
And why exactly would dev's get to touch production? This is the reason why change control , documentation and good service topography is so vital. Your dev system should be a snapshot of production minus personal data. Your infrastructure should support that all the way back to the dev shop. Anything less is laziness. Most of which is probably way outside of your control. I gave management the options and rationale and they make poor choices. Don't lose too much sleep over it.
While it's possible to create little sandbox areas for them, it's an administrative hassle
In theory, that's your job. You and I both know in practice, the reality is much uglier, but this gets back to having an appropriate test environment.
Get out of the blame-shifing game. Make the issue sknown and go on with your day. If management doesn't want to spend the money and time to manage contingencies well, then it's their fault not yours.
Comments like this are my #1 pet peeve. Get in front of these issues by communicating well and if nothing changes it's a no-win situation where blame default shifts to IT. Move on. There are greener pastures.
http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html
[i]says Marquis. "It's a symptom of the IT organization being unable to meet or even understand the needs of its customers," he says. "Otherwise, it wouldn't be happening." [/i]
Actually in short...the reason is because IT are often understaffed, are required to follow ridiculous internal legislation, and many times are under-funded, and required to maintain a certain level of security...the latter of which is often BREACHED by these so-called power-users...which are nothing more than people wanting control over everything they do...
Here's a news flash...employees are there to WORK FOR their employer...not themselves.
"Just Smile and Nod." --Huck
Yes this is the main problem with the concept of "embracing super users"
At several companies people outside IT have floated the idea that there should be a departmental super user who people within the department can go to with issues. The idea being that a highly technical member of their department would understand their specific departmental tasks/duties/needs and be able to support them on "little or common" it requests.
The reality is that this effectively makes that person a member of IT - and the sad fact is that typically they are not in a position to have proper access to all systems/passwords etc to solve issues.
Aside from specific application support, its generally not a good idea to rely on Super Users to work on general IT issues.
What really needs to be addressed is properly staffing helpdesks with the APPROPRIATE resource.
This starts getting at the core of the problem within IT - Costs...
99% of IT departments are not *embraced themselves* by execs - who only see a bottom line problem; IT departments spend money. Lots of it.
Funding the correct resource in a department can be hard for small to mid size companies because they dont think a helpdesk person should cost them anything north of 50K, but the reality is that a quality baseline of skills is required in helpdesk.
While I ahve exceptional people on my staff, often times they are underpaid given their skill set. I think a rockstar helpdesk person can be worth around 80K per year. But as their skills grow even furtehr they are likely to go and want to become sys ads and sr sys ads. These guys range between 80 and 110 / yr depending on specifics.
Companies think helpdesk should be a lowly intern or some 45-50K person...
This results in mediocre skills and more importantly -- MOTIVATION. Thus the hole of "IT departments unable to meet or understand..."
budgeting for STAFF in IT should be spread as a cost to all departments. Each department should carry an expense for a portion of funding the pay of IT. Just in the same way they (typically, if budgeting is done correctly) share the load in the cost of capital projects.
Well, this rogue moron has to install stuff on his own, because our IT support department treats the development teams as if we don't know what we're doing, and applies the same policies for business users to us.
How can I be expected to do my work, if I can't even install an IDE, because it doesn't fit the standard image they have?
Anyway, it's more a problem in the structure I have here than anything else. I just wanted to state the point of view from a rogue moron.
Live forever, or die trying.
Here I always thought it was the servers, data infrastructure, advanced developmental work, and systems design and implementation.
Workstation management for all the companies I have worked for has been a PITA for us 'business users' who need to get things done.
I think in general they take a much to hands on approach which ties our hands and takes their time. I am glad that they are finally recognizing that people can take care of themselves a little bit.
Now if only we could have our own coffee pots.
In short, if you see these people as nightmares, chances are there's a good reason they're taking things into their own hands and you should get off your ass and find out what's going on, and find a way to fix it so they don't have to. You shouldn't have to do their job and they shouldn't have to do yours.
"When information is power, privacy is freedom" - Jah-Wren Ryel
Maybe the guy who wrote this article works in a building full of programmers or something, because short of that this is the dumbest idea I've ever heard. If I let my users have control of anything the PC's would be full of yahoo toolbars, itunes and some random spyware app that "automatically switches their desktops".
I know plenty of these self proclaimed techies. They go home, they watch tech TV, they read all the latest computer magazines and they can recite what the best video card is down to the chipset revision number... The things they don't know are the most important though, and its info you wouldn't be privi to unless you knew the system, like say a sys admin or desktop support tech would. You know like program dependencies... drive mappings, registry hacks. I honestly don't know one out of the box solution that we use at our company. Every one of our apps, including the mainstream ones, have been customized to work with our environment.
I wish these dumb assholes would learn that not all PC's are your home PC. Just because you can add and remove programs sufficiently at home bears no indication that you can do anything useful in a production corporate environment. Your windows XP home edition bears little to no resemblence to the system we've put in your office. Leave it alone. We QA and test every image that goes into production, your app may not jive with our app... There are reasons to have specialists in every area. People just want to be know-it-all assholes. I don't pretend to be a cosmologist because I watch Discovery Space.
People just have no respect for IT and because of that everyone always has a better solution. people should concentrate on their jobs and stop worrying about how to get rid of the IT department, we're here, we're not going anywhere. If your IT department is lazy or can't provide solutions for you, get rid of the certificate junkies and get some real techs in place. If you give a roadmap of what you need we can make unicorns appear, at least my IT department can.
So basically what you're saying is that at every major place you've worked at, you've had an idiot. You know what, we've all had a few of those, and for some of us, some of those idiots were in the IT department.
You ask why I should be treated differently? I am under the assumption that they hired me for my specialty, and that I have a base knowledge of what I'm doing. If the IT department fails to give me to tools I need, how am I suppose to be effective?
I'm advocating tiered access. You can't just blanket a development shop with a business area and hope everyone will be happy. We have different needs and technical expertise. What is a development shop supposed to do with a base installation? You can't develop things using a text editor. And you definitely can't develop web applications if you can't setup a web server somewhere. Nor can you submit change requests to IT everytime a small setting needs to be changed.
IT department can't just lock things up and say, "Well, we did our job, the system is locked up tight, nothing will go wrong."
All they've really done is lock up the place, and prevent any legitimate work from taking place. Granted, your job is done, but at the expense of everyone else's job.
Sure, I wouldn't want an IT guy changing the development I'm working on, but at the same time, I wouldn't release an application to a client with the system locked and unable to accomplish what it was initially intended to do.
Live forever, or die trying.
It all really biols down to the company, its history, the type of industry it's in, its size, its management, etc.
/.ers, they have to fill out forms in triplicate just to talk to someone in IT. In our company, you simply go talk to the guys in IT. If you need a printer or an app installed, we do it in a few minutes.
There are companies and situations where superusers can be a great value, and others not so much.
Personally, I'm in a company of about 200 people. We have a fairly defined and rigid set of IT policies. It's well communicated and well known that you don't install any apps or programs without IT's permission. If users have requests or need software, we'll install it for them after testing it first. That being said, there's very little deviance on behalf of the users, and overall, we have very few problems with rogue users or PCs.
It really just depends on the company. At minimum, you need to have a coherent, plain language IT acceptable use policy that all employees need to be familiar with.
Then, there's something to be said about why superusers deviate. From the sounds of alot of
But again, there's so many factors that come into play, you have to take it piece by piece.
Most "powerusers" go by the creed "Tis better to beg for forgiveness, than to ask for permission." Case in point, my team runs a Fortune 100 company's storage environment. We're running about 1.2PB of EMC DMX and NetApp storage (not including VTL). If a department needs NAS for some project we have a easy webpage for them to go to, they fill it out with the sharename they'd like, and we automatically find them a filer and create a 100GB CIFS/NFS share for them. Already integrated with active directory and NIS. End user can specify who can see it by specifying a group such as .group and everyone in their dept can have read/write access to it. Or you could just specify a list of users.
Sounds pretty easy. It's backed up, regular hourly snapshots are taken. It's backed up to tape, firmware upgraded and when the lease on the filer is up, *WE* migrate all the data to another filer off hours and you continue on with your life. Anyhow...
Some PowerUser user decided he wanted to 'play IT'. And decided he wanted his own storage that he could limit who accessed. While we would have been more than happy to allocate him 100GB of storage. He proceeded to go out and build some linux box under his desk with some home-office grade disk enclosure. He then demanded that *WE* back it up to tape, and *WE* integrate it in with NIS/active directory. It should also be known that the few outlets in the cubes are not spec'd to have servers/arrays plugged into them but laptop/dock and monitor type equipment.
Long story short. Someone came along and walked off with the homeoffice disk array and all the data on it. I got to go to all the meetings and watch this asshat explain why he lost customer data.
Hey powerusers... how much privs do you need? You say you want to install whatever you want on your PC. Which btw you didn't purchase. You say you want to pick our the exact model of server your app runs on, but you don't want to be the one to stock the 97.56GB drives as replacements, nor do you want to carry a duty pager to swap out parts when they break at 2am.
Why stop there? Why not just ask for the admin password on the core routers. I'm sure your expansive knowledge of networking (and installing dd-wrt on your linksys does not make a BGP expert out of you) could provide invaluable when the DWDM gear is malfunctioning. We're upgrading to AIX6 shortly, maybe your vast experience in managing/installing mysql at home will help us optimize a 10TB DB/2 database. Please help us out, since you installed parallels on your mac, you can lend us some of your expertise in VMs when we consolidate two z990s into a z10.
You say you manage a 5TB nfs server at home? Please show us the wisdom of your ways as we try to consolidate 50 EMC DMX arrays so we can save on power and cooling.
When we fuck-up, an entire company and its' customers feel the pain. When you fuck up, you prevent us from doing our job as we clean up your mess.
Users should be given just enough privileges to do their job. This is why you do not have root on your server, you download pre-packaged software from the intranet, you do not have admin on the core routers, physical access to the datacenter and why we don't "tinker." You want to tinker, go work in your garage where you can tell your wife that you built a jumpstart server for the two linux boxes in your home media center and thump your chest. We support hundreds, thousands of users whom would rather spend their days focusing on doing their job.