Slashdot Mirror
Getting Company Owners To Follow Their Own Rules?
techmage writes "Recently we had an issue at our small company that resulted in the loss of a lot of important data. To prevent it from happening again, we created a company-wide policy that all computers would return to IT to have their contents backed up, and the computers would be formatted and reloaded for the next user. Consistently the owners of the company break this and other policies we set up to prevent data loss, theft, etc. How do I get through to the bosses that when they break with the policies, they are potentially shooting the company in the foot?"
Explain the risks, if they choose to ignore it document that they have not returned the laptop to be backed up so that they can't try and blame you if it goes wrong and data loss does occur.
I'd ask anyone who routinely overrides your authority in the data-protection sphere to sign a form indicating something to the effect that they've been informed of these policies and the potential risks and if it all comes crashing down because they don't listen to you, it's not your fault.
The World Wide Web is dying. Soon, we shall have only the Internet.
If they do -- shut up and work around it.
So you're going to take my laptop, back it up, reload it and give it to the next guy? I in turn will get someone else's formatted laptop?
Or are you just trying to say, "we lost a lot of data when someone's laptop failed without proper backup processes in place. So we've decided that everyone needs to regularly connect to the company network and back up their laptop. The owner's of the company never back up their laptop"?
Quite simply, you don't. I've worked at large banks that do not follow their own rules. IT cannot drive policy if C level executives do not want to follow the policy. If you can get auditors or examiners to force the policy to be followed, then it can work. Otherwise, IT cannot do anything. They will only be seen as chicken little and IT will lose what little standing they have at the company already.
They who have the gold make the rule.
Your responsibility is to recommend and record your recommendation, and do your job as you can.
In the end, it is "their" company, not yours. It's the way of capitalism. You don't like that? Change your job.
For what it's worth, I didn't mean any of this in sarcastic/offensive way. I am being sincere.
Flip it around and see how you would see things if you were the owner.
Fuck systemd. Fuck Redhat. Fuck Soylent, too. Wait, scratch the last one.
See if you can assign a value to the data already lost because of their failure to follow the rules. We did a variation of this at Xerox ASD in the 70's and locked Charles Simonyi (yes, that Charles) out of "his" own source code.
It's funny, every year we prepare for auditors, and all we have to do is show them that we have a policy, not that we actually follow the policy. It's really quite hilarious and yet sad at the same time. For instance, we have to show them that we are doing scans of our network looking for vulnerabilities, but all they want is a log with someones name and a date on it. They don't care what was found or that anything was done with the information that we found. They could care less. The sad thing is, the company doing the audit is a very large company. The truth is that most management could care less about policies. Password complexity? Sure, just don't assign it to the management. Screensaver locks after 10 minutes? There better be an exceptions group for the CEO and her secretary. It's really quite sickening really. It's amazing what you can get people to do for you when you're the network admin's boss' boss' boss.
Use the admin account (and shares; $C, $D, etc...) to map their hard drive remotely to a computer in the networking office. Then, use RSYNC (or SyncToy) to mirror the drive remotely. Once the initial backup is complete, daily or weekly jobs will progress quickly.
You really have to find a way to work around the guys who are in charge.
If you want to be a bit more nefarious, start the backup jobs first thing in the morning. When the boss complains his system is slow, do a backup/format/reinstall on his system. Now his system is magically fast again...
I'd rather you do it wrong, than for me to have to do it at all.
You've created a policy and don't have the owner-level execs onboard?
That's failure #1 right there. Good policy making for security purposes isn't "And IT saith THUS!". Operating in this kind of vacuum gets your enforcement NO PLACE. Fast!
You have to involve these people pretty much from the get-go. This way they understand why the policy is in place and have less self-provided incentive to circumvent it.
And yes, as others have said, a small amount of "horror story" can go a long way too. But only DURING the policy creation process. Afterwards, they look at it as simple justification of an arbitrary policy.
Right now you guys haven't got a leg to stand on.
Chas - The one, the only.
THANK GOD!!!
I mean you can't make the owners do anything. They own it, it is theirs to do with as they please. They could close up shop tomorrow for no reason if they wanted. So you can't force them to do as they should. Likewise, nagging them could be a bad career move. So the best thing is a CYA. Have something that says they understand the risks of not following the policy more or less. Then, if shit does break you should be covered. They'll either realize that they made a mistake and be fine, or they'll come looking to blame you and you can pull out the document and say "We made sure to inform you of the risks and you signed off saying you understood them and that it was up to you if you chose not to follow them."
That's the best you can do.
What makes you think the owner's information should be available to you in the IT department?
It has been shown (I can't google the study right now) that people in senior management have a much higher incidence of sociopathic and psychopathic behavior than the general population. If your management insists on rules for others that they don't follow themselves, and consciously flout, they may fall into that group. In that case, keep your resume and interview skills up-to-date.
1) Thank you for trying to save me money. Your recommendations are welcome as I'm paying you for your expertise and opinions.
2) If you're going to try to have me sign something like that I'm going to have a talk with you about bureaucracy and how we can't afford a BS cover your ass mentality in a small company. You may rest assured that if I don't back up and there's a crash there are two possible results: If I'm a bad manager I'm going to come back at you and no little piece of paper will stop me from firing you (though I'd expect you would receive unemployment as it's not really for cause). If I'm a good manager I'm going to write the check to cover the damages, feel foolish and accept your recommendation going forward.
3) If it's a dumbass relative that thinks they can ignore the rules because they're family working in a family business (and they don't sign the checks) then I expect to see their name (and possibly mine if I'm doing it too) on the report of IT security scofflaws that you periodically (though infrequently) prepare for me.
In a company controlled by a single or few owners it is reasonable to recommend, cajole, suggest or encourage proper owner behavior, but if you dictate it and attempt to threaten (for instance by saying in a confrontational manner 'ok, but I'm not taking responsibility then') you are writing checks that your expertise may not be able to cash. As an owner it's important that my IT works right, but it's absolutely imperative that I don't lose control of the company. Don't make me think that you're trying to take it away from me or lord your technical expertise over me unless you have a VERY secure position.
"The owners may want to do that if the computers were used for storing some confidential information. Such a backup cannot be stored on your shelf among books and other assorted DVDs. If the owners know what they are doing, they perform backup of those computers themselves, and keep the media at home"
That's a very good point, it's quite likely that the owners know exactly what they are doing and why they are doing it. You won't get far in business by blindly trusting everyone who works for you.
And did you exchange a walk on part in the war for a lead role in a cage? - Pink Floyd.
I mean ya, if the owners are major assholes they could fire you anyhow, however such a thing can be useful. First, it may make them change their behaviour and if it doesn't it can help protect you. Reason is they are then presented with evidence that they were informed and indicated that fact. If not, it is easy for ego to interfere with memory and them to say "You never told me this would be a problem!" However with a document they are more likely to say "Ya, I screwed up, now what do we do to make sure this isn't a problem in the future?"
In any company, there is no 100% protection from being fired no matter what. However having good documentation can go a long way. People do not have perfect memories and often we remember things the way we wish they had been, not how they really were. Documentation can help prevent that.
Also you don't present it as a "This is just for you because you are assholes" document. Rather, it is a policy exception document. If someone wants to not need to back up their data, you have them sign a doc that says they know the risks, and perhaps have it countersigned and ok'd by a boss. In the case of the bosses, they just sign it themselves.
I fully agree. Employers don't generally win unemployment compensation hearings, even when they are correct. In many cases, the employer has a policy to appeal ANY unemployment claim, just to set up a few additional hoops for the employee to jump through. Most of the time, the employers don't even show up for the hearing. As a result, the state labor department deals with a LOT of junk appeals. Even when the employer shows up, the burden of proof is upon THEM and most of the time, they aren't up to the task.
I know of a guy who was thrown out during some kind of bizarre purge. The company had a change in management and this guy was clearly not part of the plan. So the company tried to cobble together some sort of justification. However, their schedule for firing him did not allow for collecting enough excuses. The purge worked in such a way that the guy's boss had already been let go, so actual facts of the employee's performance were in short supply. What little they had was wrong.
So of course, the employer appeals the unemployment claim. The hearing is held and the employer is absent. After losing by default, THEN the employer appeals to re-open the case. The employee's witnesses are subpoenaed and the day of the second hearing arrives. By this time, the employer has engaged some kind of unemployment compensation management firm to try and win the case. Upon seeing the employee's counter claim and witness list, the consultant tells the judge, "Upon review, this case does not rise to the standard necessary to establish termination for cause. We withdraw our appeal."
Considering how routine these shenanigans are, is it any wonder the employers usually lose?
So I was working at a large defense company, and they had been dinged by the gov't for high-level management fraud. So part of the penalty was all employees that weren't managers had to take a mandatory Ethics class, run by... the managers.
Add in that the class included a Dilbert Ethics Game-- an actual, licensed Dilbert[TM] board game with little Dilbert characters and cartoons in it, where you had to move around and then answer ethics questions.
Oh, and it turns out you could win the game without correctly answering the questions, as my team figured out victory was based on position on the board, not score. And the only team that could have beat us took the high road, and when faced with one ethic question said "We know you want to hear answer A, but really, we would do answer B, as would any reasonable person."
I'm still not sure what lessons we learned.
A.
Seems reasonable to me. I can quit anytime I want; why can't they fire me anytime they want? I'm selling them my labor. They're free to buy labor from whomever they want, and I'm free to sell to whomever I want.
On the face of it, it seems a reasonable argument and in fact IS the argument used by the 43 states that don't offer any kind of employee protection whatsoever. However, if you activate your critical thinking skills, you'll see that reciprocity (which is what you're trying to define) doesn't exist. If, for example, I decided to just not show up to work anymore my company will go on just fine without me even though I do work in a fairly critical position. It might mean other members of my team will have to work a bit harder for a few weeks to fill the void, but there will be no overwhelming financial impact to the company whatsoever.
On the other hand, if my company decides to fire me because I wore white after Labor Day (a stupid reason, yes, but a legal one nonetheless in all but 7 states), then I am subject to severe financial disruption, not to mention the loss of medical benefits for myself and family. In all but a few states, being fired makes you ineligible for unemployment (you need to be laid off with the potential for recall to be eligible), so you're on your own regardless of there being a valid reason or not. Beyond that, whenever you interview going forward, you have to explain why you were terminated BUT you're not allowed to speak negatively of a former employer in an interview...so keep it positive! Even if you do, the myth of "they're not allowed to say anything negative about you in a reference" is a meme that should've died a long time ago. They can say whatever they want when giving a reference, legally it just has to be true. However, as you're an unemployed schlub with no income...good luck finding a lawyer who will take your case on a contingency if they lie.
We can try and spin it any way we like, the fact is the deck is stacked 100% against you. Is it likely you'll be fired for wearing white after Labor Day? Is it likely, however, that you'll be fired for another equally stupid reason? In this economy, anything's possible.
Which is more painful? Going to work or gouging your eye out with a spoon? Find out!
http://www.workorspoon.com