Slashdot Mirror
Getting Company Owners To Follow Their Own Rules?
techmage writes "Recently we had an issue at our small company that resulted in the loss of a lot of important data. To prevent it from happening again, we created a company-wide policy that all computers would return to IT to have their contents backed up, and the computers would be formatted and reloaded for the next user. Consistently the owners of the company break this and other policies we set up to prevent data loss, theft, etc. How do I get through to the bosses that when they break with the policies, they are potentially shooting the company in the foot?"
Explain the risks, if they choose to ignore it document that they have not returned the laptop to be backed up so that they can't try and blame you if it goes wrong and data loss does occur.
I'd ask anyone who routinely overrides your authority in the data-protection sphere to sign a form indicating something to the effect that they've been informed of these policies and the potential risks and if it all comes crashing down because they don't listen to you, it's not your fault.
The World Wide Web is dying. Soon, we shall have only the Internet.
If they do -- shut up and work around it.
Quite simply, you don't. I've worked at large banks that do not follow their own rules. IT cannot drive policy if C level executives do not want to follow the policy. If you can get auditors or examiners to force the policy to be followed, then it can work. Otherwise, IT cannot do anything. They will only be seen as chicken little and IT will lose what little standing they have at the company already.
They who have the gold make the rule.
Your responsibility is to recommend and record your recommendation, and do your job as you can.
In the end, it is "their" company, not yours. It's the way of capitalism. You don't like that? Change your job.
For what it's worth, I didn't mean any of this in sarcastic/offensive way. I am being sincere.
Flip it around and see how you would see things if you were the owner.
Fuck systemd. Fuck Redhat. Fuck Soylent, too. Wait, scratch the last one.
It's funny, every year we prepare for auditors, and all we have to do is show them that we have a policy, not that we actually follow the policy. It's really quite hilarious and yet sad at the same time. For instance, we have to show them that we are doing scans of our network looking for vulnerabilities, but all they want is a log with someones name and a date on it. They don't care what was found or that anything was done with the information that we found. They could care less. The sad thing is, the company doing the audit is a very large company. The truth is that most management could care less about policies. Password complexity? Sure, just don't assign it to the management. Screensaver locks after 10 minutes? There better be an exceptions group for the CEO and her secretary. It's really quite sickening really. It's amazing what you can get people to do for you when you're the network admin's boss' boss' boss.
You've created a policy and don't have the owner-level execs onboard?
That's failure #1 right there. Good policy making for security purposes isn't "And IT saith THUS!". Operating in this kind of vacuum gets your enforcement NO PLACE. Fast!
You have to involve these people pretty much from the get-go. This way they understand why the policy is in place and have less self-provided incentive to circumvent it.
And yes, as others have said, a small amount of "horror story" can go a long way too. But only DURING the policy creation process. Afterwards, they look at it as simple justification of an arbitrary policy.
Right now you guys haven't got a leg to stand on.
Chas - The one, the only.
THANK GOD!!!
I mean you can't make the owners do anything. They own it, it is theirs to do with as they please. They could close up shop tomorrow for no reason if they wanted. So you can't force them to do as they should. Likewise, nagging them could be a bad career move. So the best thing is a CYA. Have something that says they understand the risks of not following the policy more or less. Then, if shit does break you should be covered. They'll either realize that they made a mistake and be fine, or they'll come looking to blame you and you can pull out the document and say "We made sure to inform you of the risks and you signed off saying you understood them and that it was up to you if you chose not to follow them."
That's the best you can do.
What makes you think the owner's information should be available to you in the IT department?
It has been shown (I can't google the study right now) that people in senior management have a much higher incidence of sociopathic and psychopathic behavior than the general population. If your management insists on rules for others that they don't follow themselves, and consciously flout, they may fall into that group. In that case, keep your resume and interview skills up-to-date.
1) Thank you for trying to save me money. Your recommendations are welcome as I'm paying you for your expertise and opinions.
2) If you're going to try to have me sign something like that I'm going to have a talk with you about bureaucracy and how we can't afford a BS cover your ass mentality in a small company. You may rest assured that if I don't back up and there's a crash there are two possible results: If I'm a bad manager I'm going to come back at you and no little piece of paper will stop me from firing you (though I'd expect you would receive unemployment as it's not really for cause). If I'm a good manager I'm going to write the check to cover the damages, feel foolish and accept your recommendation going forward.
3) If it's a dumbass relative that thinks they can ignore the rules because they're family working in a family business (and they don't sign the checks) then I expect to see their name (and possibly mine if I'm doing it too) on the report of IT security scofflaws that you periodically (though infrequently) prepare for me.
In a company controlled by a single or few owners it is reasonable to recommend, cajole, suggest or encourage proper owner behavior, but if you dictate it and attempt to threaten (for instance by saying in a confrontational manner 'ok, but I'm not taking responsibility then') you are writing checks that your expertise may not be able to cash. As an owner it's important that my IT works right, but it's absolutely imperative that I don't lose control of the company. Don't make me think that you're trying to take it away from me or lord your technical expertise over me unless you have a VERY secure position.
"How do I get through to the bosses..."
Talk boss language to them.
Wait until one costs the company something through a computer failure and failure to follow the policy.
Fix the problem and present the machine back to them with a bill for the repair. Make sure to boost the price to cover any ancillaries such as your training, their training, their retraining, lost time to the company due to their down time, and any similar costs you can dream up. Keep copies.
Request a general meeting with the bossships. Present the data from the above repair, anonymized to protect the guilty. Compare the cost presented with the cost of following policy. Make sure to point out that they too stand to lose financially (ie not make even more money) if they or others cost the company money. Suggest that in order to protect the company they adopt the policy that such unnecessary costs be charged to the individual in the future.
For theft, adjust scenario as necessary as well as costs. For concominant data theft, do the same, as well as figure in cost to the company.
Or put together a 'what if' report based on a previous loss and present that at such a meeting, rather than wait until it actually happens. Feel free to pretend it did at the start of your presentation (with knowledge of at least one boss). Done this way you could make it look like the company was sunk and scare the bejeezus out of them.
"I may be synthetic, but I'm not stupid." -- Bishop 341-B
You know the knobs driving around your city right now with one hand on the wheel and a cellphone in the other? Imagine them in the air...
Reboot macht Frei.
"The owners may want to do that if the computers were used for storing some confidential information. Such a backup cannot be stored on your shelf among books and other assorted DVDs. If the owners know what they are doing, they perform backup of those computers themselves, and keep the media at home"
That's a very good point, it's quite likely that the owners know exactly what they are doing and why they are doing it. You won't get far in business by blindly trusting everyone who works for you.
And did you exchange a walk on part in the war for a lead role in a cage? - Pink Floyd.
My advice: Find a new job.
It's done wonders for my stress levels.
No sig for you!!
I am with you as far as the confusion. You they asking all the laptop users to hand their laptops over at certain intervals to be backed up, reformatted, and reallocated? That sounds like the definition of fail, and if I was in charge I would not put up with it.
Here are my simple tips for discussing backup with people who are generally "too busy" to bother with backups.
Advise them to keep all their data on the server. When they are working in the office, this should be easy. Word, Excel, or whatever should have the default save to directory be the directory they would save things to on the network. They might say that the data is too important to share with anyone. Create them a network share that only they (and the account used for backing stuff up) can access. When they work away from the Office, ask them just to copy the stuff they did over to the network. They will probably do it anyway after they get sick of having data in two places. Note that this is for the people who are typically in the office.
For people who are out of office/in satellite offices, create a system that is simple and doesn't require much effort on their part. I bought western digital passport drives and set up their software to automatically backup/sync whenever it is plugged in. I had a talk with these guys and told them to keep in on their desk and plug it in every monday morning if possible. They didn't believe me that their stuff was backed up that easily. You can do this for internal users who refuse to use the network, as well.
I personally will send out E-Mail messages every two months or so asking those with laptops to "Make sure they have plugged in their backup drives" and "Do a quick check to see if your Antivirus says it is up to date" because there is a virus coming around that could be very deadly. Sometimes it is a little white lie. Sometimes it is the truth. Whatever. The fear of a possible virus seems like a scarier and more immediate threat than a random hard drive crash so they take action. I usually get a response from most of them that gives me an overview "I plugged in my drive last Monday and my virus definitions say they are from today....I'm safe, right?"
In summary, just do what you can to automate the process and make it simple for users. Don't make them hand over their laptops for several precious hours/days of business. The less effort they have to put forth, the more likely they are to do it.
So you are hired to perform a professional service, and your brilliant sugestion is not to do the work properly but to follow the money?
What kind of "professional" are you? Not one I would want on a sensitive environment, since obviously you would not have the presence of mind to stick to security procedures.
There is certainly a problem if you don't bring on board of your suggestions the owners of your place of employment, but that is a problem of presentation. Part of the skill set of a Systems Administrator is to be able to convince people about why something is necessary and to ensure people will abide by what has been agreed.
Obviously you may have more problems enforcing the rules with people with political power in the firm, but that does not leave you of the hook from a moral, professional and most importantly, legal point of view when legality is relevant.
I have worked for big corps, and I am telling you in no uncertain terms that the CEO or majority shareholders, who earn millions per year, will not access my systems without following the procedures in place. This is actually a very easy case to make, since it would be for their own legal protection.
If you can't make a convincing case for your policies then you have to rethink them and to present them in a way that is attractive to the people that is being disruptive (i.e.: your ass will not go to jail)....
IANAL but write like a drunk one.
Every so often reiterate the policy in writing to them and when they ignore it, they ignore it. It's their funeral.
the major advances in civilization are processes which all but wreck the societies in which they occur - A.N. White
It's not so much about being able to fire or quit on the spot, it's about giving both the employer and the employee time to make alternative arrangements.
It means that the company has a month or whatever your leave period is to find a replacement so that they're not inconvenienced and hence don't have their business dealings interrupted and it's about ensuring the employee has time to find another job, so that they're not a drain on the state either because they end up claiming unemployment benefits, or because they have no money and end up resorting to crime, or simply end up losing their house and end up on the street.
I should note that you can still just walk out of your job here tommorrow if you choose, you don't have to work your notice period, however if you do then you just wont get paid any remaining holiday leave you haven't used up and are owed for example that's all. Similarly companies can just sack you tommorrow if they want too, but they have to have justification to do it without giving you a bit of notice and hence time to find another job.
Effectively, we have the same freedoms in terms of firing and quitting, just that we have additional safeguards to ensure it's done in a way that minimises problems for both the employee and the employer and makes the transition between employees and jobs as smooth as possible.
Truth be told, if you're an American worker, you are expendable. You can be outsourced or replaced faster than you realize. Sure, the company might have some serious issues (of if you're a really bad IT guy, come crashing down because you took all the keys to the fortress that the company didn't even know existed). Generally, life goes on without you in that company.
You're best bet is to understand the reasons why your policies aren't working and rewrite them to work. If you can't get them to give you their machines for backup, write scripts to back them up when connected to the network (there are solutions out there that can do this for you, too).
If they don't want to spend the money or allow you to bog down their machines, negotiate other solutions. Sure, you're not going to get an ideal-for-you resolution. I'm not sure if you realize this, but the world doesn't revolve around IT. If something bad happens, it's never just one persons fault. Everyone is at risk. It's no different with automobiles, homes or the food supply for that matter.
CYA is only one necessary reaction when dealing with these types of situations.
Getting creative and working with the staff ensures you continue to have a job. It will also teach you about what types of questions your should be asking before declaring policies and that policies are really only guidelines when it comes to owners and high level managers.
If all else fails, it's time to move on. Do so before it gets ugly so you can get some good references. Everyone dies on a burning bridge.
Parmasean Cheese. It's what's for dinner.