Slashdot Mirror

← Back to Stories (view on slashdot.org)

Ask Slashdot: Do I Give IT a Login On Our Dept. Server?

Posted by CmdrTaco on from the would-they-give-one-to-you dept.

jddorian writes "I am head of a clinical division at an academic hospital (not Radiology, but similarly tech oriented). My fellow faculty (a dozen or so) want to switch from a paper calendar to electronic (night and weekend on-call schedule). Most have an iPhone or similar, so I envisaged a CalDAV server. The Hospital IT department doesn't offer any iPhone compatible calendar tool, so I bought (with my cash) a tiny server, installed BSD and OpenLDAP for accounts, and installed and configured DAViCal. After I tested it out, I emailed IT to ask to allow port 8443 through the hospital firewall to this server. The tech (after asking what port 8443 was for), said he would unblock the port after I provide him with a login account on the machine (though 'I don't need root access'). I was taken aback, and after considering it, I am still leaning toward opposing this request, possibly taking this up the chain. I'm happy to allow any scan, to ensure it has no security issues, but I'd rather not let anyone else have a login account. What do the readers of Slashdot think? Should I give IT a login account on a server that is not owned or managed by them?"

104 of 1,307 comments (clear)

  1. In my corporate environment.... by Anonymous Coward · · Score: 5, Insightful

    .... you'd be breaking network and security policies up the wazoo by plugging your own server into the network, much less having a machine that IT couldn't manage and audit.

    1. Re:In my corporate environment.... by Ferzerp · · Score: 5, Insightful

      I think the real question should be should IT shut down any network port they see your rogue equipment connected to.

      Hint: the answer is yes

    2. Re:In my corporate environment.... by Zyrkyr · · Score: 3, Insightful

      Right. You aren't required to give them a user account on your machine, but they're not required to open a firewall port for you either...

    3. Re:In my corporate environment.... by Anonymous Coward · · Score: 2, Informative

      I agree - I've been an IT person from NOCs all the way down to the local admin level - it is an absurd request for a user to want to plug their machine into you're network without access to the thing on some level - let alone to open up a port on the firewall for it. Just opening the firewall port and the organization in question should buy a machine for the role - especially if it is for some internal productivity tool like the one you are using - it absolutely should be controlled by the admins, and for that matter you shouldn't have a root account to it. You're essentially talking about placing a big gaping hole in the security that is required to safeguard HIPAA records - even for if only for you're own safety as you could personally be found in breach of some pretty big privacy issues along with the IT people for letting you do it if that machine somehow becomes compromised without your knowledge.

    4. Re:In my corporate environment.... by postbigbang · · Score: 5, Informative

      Depending on the poster's country, there may be a lot of regulatory, compliance, legal, and other issues at play here. This appears to be a rogue server as you cite. If I were the head of IT, I'd have it outta-there in a heartbeat and write up whomever deployed it-- on the surface and without other information, this is a problem.

      WIthout more information, it sounds to me like a convenience issue for the department head, but it's a legal nightmare looking for a spot marked X-- that server, for starters.

      --
      ---- Teach Peace. It's Cheaper Than War.
    5. Re:In my corporate environment.... by PFI_Optix · · Score: 5, Informative

      Some questions not answered:

      Did the OP ask the IT department what sort of services they are capable of providing? Hospital IT departments are usually in the habit of trying to provide departments with what they need, as department heads and doctors generally win the battle for "I want ________" when it goes up the chain.

      Did he inform IT of his plans prior to executing it, or just bring in a server and set it up, then start asking for access? If he did the former, they might have worked with him, providing him with rackspace, security, and expert administration so that his workload was limited to application administration. if he did the latter, he's lucky they haven't made an issue out of it and gotten him written up.

      Did he make sure he's not violating any federal regulations regarding patient data security? A rogue server on the network is a MAJOR security threat, no matter how competent the administrator is (or believes himself to be).

      Did he think about the precedent this sets? If every department decides to go running their own servers on their own terms, IT can't support them and the whole hospital steps back about 20 years in how their network functions.

      Did he consider the idea that maybe the service he's setting up for his own department might be useful to scale to the entire hospital at a later date? it sounds like he's found a service he considers worth putting a lot of effort into providing...for just his department. If it's good for radiology, it's likely good for lots of others. But HIS server probably can't accommodate that scale. HIS server isn't centralized. HIS server...well, is his.

      --
      120 characters for a sig? That's bloody useless.
    6. Re:In my corporate environment.... by nschubach · · Score: 2

      Yeah, what the worlds needs is some disgruntled employee putting a computer in their office that will dump client data out a particular port without IT knowing what is going on.

      --
      Every time I start to have faith in humanity, I ruin it by driving to work between 7 and 8 am.
    7. Re:In my corporate environment.... by perotbot · · Score: 2

      Give IT their login and pray it doesn't go farther.......in my HOSPITAL environment you'd pretty much be hauled in front of the CIO, HR, and your dept chair to have a career education session.... 1. Most Likely, your hospital has an email system 2. Most Likely your hospital has a web portal to said email system 3. Most Likely, your email system has a calendar available on the portal 4. Most Likely, you over engineered this.... Tacobell programing...aka don't reinvent the wheel to do everything

      --
      ~corporate tool, but employed~
    8. Re:In my corporate environment.... by bogibear · · Score: 2

      ... Not to mention, potential HIPAA issues.

      Working in IT for 25+ years now, I know working with IT can sometimes be difficult. When I get requests like this, my first reaction is to work with the customer to establish need, ROI, and other requirements. Most likely, your IT department probably has the resources to make this work without much expense at all (i.e., small VM) and could look at your situation and apply a solution that benefits your entire organization rather than just one or two people. Frankly, I would make you take it off the network and provide a solution that IT controlled. Regardless of what you say is on the box, how do I know that you aren't running some warez or porn farm or hosting some video game server? Your job is to head your clinical division within your organization, not implement solutions on the same shared network that everyone in your organization would use.

      The IT Tech is giving you a bigger break than I would give. Running it up the chain to his management would likely result in a big fat NO from the CIO.

    9. Re:In my corporate environment.... by synthesizerpatel · · Score: 4, Insightful

      A good IT manager would mosey over and have a sit-down to explain the IT policy concerning servers, lay out all the reasons why IT is responsible for them - backups, security scans, keeping antivirus up to date, tracking hardware assets, etc.

      By the end of the conversation, the owner of said rogue device would be thinking 'Wow, I really should hand this over, this guy is much more capable than I am at maintaining a server.. and why would I _want_ to maintain a server anyway?'

      No need for threats or derision for being ignorant. (note: ignorance isn't a bad trait as long as it isn't willful and repeat, it just means you don't know)

    10. Re:In my corporate environment.... by Ferzerp · · Score: 2

      You see this type of thing a lot in healthcare actually (not usually so egregious). IT has a requirement to follow policy and legal regulations, (HIPAA, SOX, HITECH, etc). Due to this, some of the shinies that individuals may want are not allowed. Instead of recognizing the reasons, people do what the submitter did and try to do an end run around the whole process ignoring the fact that what IT is doing by not allowing these things is protecting the company in a legally mandated way.

      Occasionally with extra resources, the request could be handled in a way compliant with the regulations, but that still doesn't mean it is feasible for your organization as it would require extra employees that just are not in the budget.

      Neither scenario is an excuse to try circumvent the policies, no matter how much you want your iToy.

    11. Re:In my corporate environment.... by haruchai · · Score: 4, Informative

      I've worked in healthcare - if there's a chance of leaking patient records, then the Information Security officer would have to sign off on any server after a full assessment.

      --
      Pain is merely failure leaving the body
    12. Re:In my corporate environment.... by nschubach · · Score: 4, Insightful

      Give them a user account with no privileges. They can look at the command prompt all day if it makes them happy.

      Besides, it shouldn't kill them to white list your server on one freaking port.

      I certainly hope IT would hire someone smart enough to realize that you gave them no access. In fact, I'd hope they were smart enough to place that machine on it's own VLAN or outside the firewall so that you (the employee) couldn't grab whatever data was available on the internal network and broadcast it on whatever port you were given.

      --
      Every time I start to have faith in humanity, I ruin it by driving to work between 7 and 8 am.
    13. Re:In my corporate environment.... by ZenDragon · · Score: 4, Insightful

      Same here... I work for a bank. Anybody caught setting up a server that was not explicitly sanctioned by IT would be fired on the spot. Period, no questions asked and no quarter. For compliance, all communication in and out must be logged. This is FEDERALLY mandated, and not just IT being nazi's. I worked for a company prevously that provided call center and info management services for a medical provider and we didnt even allow people on the floor with cell phones. Is it abnormal that, as a IT professional, that this post almosts makes me angry?? lol

    14. Re:In my corporate environment.... by Stargoat · · Score: 5, Insightful

      That machine on the network without IT approval is a violation of HIPAA Security Rule. Frankly, the fact that your ISO hasn't written you up means he is too nice of a guy. Yeah, you need to give IT access, and then thank them for not written you up and turning your name over to the BoD.

      --
      Hoist Number One and Number Six.
    15. Re:In my corporate environment.... by Moryath · · Score: 4, Insightful

      Welcome to HIPAA requirements.

      You're precisely right. There is a REASON that there are policies - in this case, federal law that can turn into massive, multi-million-dollar lawsuits.

      I always am amused when someone kludges something together behind IT's back because "it's easier" than actually following protocol to get a function. If you need a function, we'll work with you to get it done, provided we can legally do so. If we can't do it, we will tell you why.

      Going around behind IT's back is asking for trouble. Worse than that, it ensures that IT looks at you askance from that point forward. There are users we work with and have no problem with, and then there are the assholes who do something behind our backs and cause trouble when we have to chase down their mistakes. Guess who gets first priority on the list of new feature/function requests?

    16. Re:In my corporate environment.... by NeverVotedBush · · Score: 3, Insightful

      While I agree there is no need for threats, the OP mentioned that he was inclined to "take it up the chain" because the IT person wanted an account.

      Not aimed at the IT person directly, but the OP certainly seems willing to make threats on his own.

      The OP is an ass and should have a severe talking to by management. If I was the IT person, I would see the OPs threat to take it up the chain and raise him a discussion of plugging unauthorized equipment into the network, busting HIPAA regulations, and potentially exposing the organization to security breach, bad publicity, legal liability, and fines -- and have that discussion in front of management when the OP took his case "up the chain".

    17. Re:In my corporate environment.... by spun · · Score: 2

      A good IT manager would get their users what they need so that they don't have to attempt to do it themselves.

      It shouldn't be hard to get some shared calendar services running on an extra box somewhere...so I think we have already determined that this hospital does not have a "good IT manager"

      No, we have determined nothing of the sort. For example, "The Division Head is an obstreperous ass" is an equally likely explanation. Note that he did not say that IT refused his request, just that they did not currently offer such a service. Likely scenario, PHB thinks he knows more than IT, sets up own server without asking them, then takes umbrage at a request for a login because he is the Division Head and a Certified Genius at All Things.

      --
      - None can love freedom heartily, but good men; the rest love not freedom, but license. -- John Milton
    18. Re:In my corporate environment.... by imgumbydamnit · · Score: 2

      Amen. And when you depart for another job, do you leave the hardware behind, or do you it with you, along with the data.

      --
      To err is human. To arr is pirate.
    19. Re:In my corporate environment.... by Moryath · · Score: 4, Informative

      Highly irregular that the first thing IT heard about it would be an 'open this port on a firewall request'; which is basically taboo for anything storing security sensitive info anyways -- proper security design is a major factor, including requirements such as server administrators at arms length from devs of the application and from auditors/security team.

      Actually, that's usually how this crap happens.
      "I want project X set up yesterday so me and my fellow tenured people can do it immediately." - IT response, "Give us some time to look into it and ensure we can come up with a solution that meets regulations.

      A week later: "IT is too slow. I want it yesterday. I'll just go kludge something together (or have my incompetent Indian grad student do it) and plug it into the network."

      Happens all the time, especially when you have douchenozzles with tenure running around. IT can only "see" the device once it's plugged into the network jack, and even then if they're monitoring a ton of machines, they won't know it from an iPhone or Blackberry or iPad until it either (a) pops up as unscannable, (b) they get the "open a port for my kludge project" request, or (c) it attempts to send some data packet that triggers an alarm.

    20. Re:In my corporate environment.... by spun · · Score: 2

      Who says we have a bad reputation? I'd say PHB tenured Division Heads of teaching hospitals have a worse reputation on Slashdot. Don't get me wrong, I've seen good IT and bad, but your experience probably says more about you than it does about IT as a profession.

      And, just a friendly reminder, this is a technology site catering to IT professionals, you most likely won't get a lot of sympathy for your anti-IT bitch-fest here.

      --
      - None can love freedom heartily, but good men; the rest love not freedom, but license. -- John Milton
    21. Re:In my corporate environment.... by alc6379 · · Score: 3, Insightful

      Yeah, what the worlds needs is some disgruntled employee putting a computer in their office that will dump client data out a particular port without IT knowing what is going on.

      ...snip...

      Besides, it shouldn't kill them to white list your server on one freaking port.

      No... It can kill them. You're running an application that isn't approved, and they haven't weighed the vulnerabilities. An open port is always a target for exploitation, which is why the IT department needs to be able to audit the machine and ensure what software is installed, so they can mitigate those vulnerabilities.

      I'm going to guess that if this person set up a server just say, in their office, this machine is on a network segment that may not be as firewalled-off as a data center may be. That means if something malicious does happen to this server, there's a greater chance of infection elsewhere, as well as some risk of productivity loss. Besides, the machine itself doesn't have to be the target of attack-- it can just be the jumping-off point for something bigger, once they've installed tools to probe the network.

      Especially when you're in a healthcare setting, privacy is a big issue. You could conceivably have someone post patient data in a calendar appointment, even. If that connection isn't TLS encrypted, and the devices not properly managed, it just takes one theft of a device sitting in a coffee shop to result in a serious breach of privacy and patient trust, even if the thief doesn't access the data that might be contained on the device.

      --
      I don't moderate anymore. Karma penalty for 90% fair mods? Can I mod that unfair?
    22. Re:In my corporate environment.... by dave562 · · Score: 3, Insightful

      Exactly. Setting up a calendaring server for a single department is a lot different from getting the entire facility to sign off on funding for it. The down side of IT in a large organization is that you cannot do things piecemeal. What the division head should be doing is selling the idea to his peers at the same level in other departments. If his department needs it, maybe he should find room in his budget to make it a reality for the entire hospital. IT is always short on funding, so he could build some bridges to IT, and other departments, and get EVERYONE a good calendaring solution.

      It does not sound like the guy is a department head. He sounds like a pompous ass hat who wants to do things his way. He reminds me of a VP I knew once who decided he didn't like the way the database system worked, so he did everything for his department in Access. Despite being warned repeatedly about what a piece of crap Access is, he plowed on. 18 months later, Access took a crap on him and he lost everything. The shitty thing about it is that the data loss fell on IT. Senior management decided that IT should have been more forceful in nipping the Access adventure in the bud, even though they failed to back up IT when IT first raised the issue.

      I'm sure there are similar dynamics at work in the hospital. Who is going to fix the server when the application takes a big dump and nobody can get their schedules? I bet you it sure as hell won't be Mr. Department Head guy. He'll be too busy doing his real job, and that's how it should be. Let IT handle the computers and software.

    23. Re:In my corporate environment.... by haruchai · · Score: 3, Insightful

      I've had to deal with more than a few doctors who'd tried to have everything their way. They are some amazing smart guys but don't consider all the problems these one-offs create. I appreciate them trying to move things forward - I do the same myself - but their "I walk on water so you should do what I say" attitude does more harm than good and wastes scarce resources either fighting them or changing things to suit.

      --
      Pain is merely failure leaving the body
    24. Re:In my corporate environment.... by jddorian · · Score: 2

      Okay - original poster here. To clear up some issues: 1. I assure you - I'm not a troll - though the name is obviously fake. Real honest question. 2. Having servers on the network is not unprecedented. It is a medical school. Several labs have UNIX (even old Solaris machines) in their lab, that they have websites on. A simple email request to IT allowed port 80 and 443 to be unblocked. 3. HIPAA - very important. But no patient information will be on this machine. Only "May 7-8: on-call Dr X" 4. I'm perplexed by the paradox of half the people being up in arms about HIPAA, but many posters simply advocating Google calendars. Make up your mind - it could be super-sensitive but we should let it be on the cloud?

    25. Re:In my corporate environment.... by LO0G · · Score: 3, Insightful

      And then pray that none of the users of the server ever put any patient data on the server. This means that the calendar data can't include patient names (they're personally identifiable).

      Good luck booking appointments without knowing the name of the person who has the appointment.

    26. Re:In my corporate environment.... by _0xd0ad · · Score: 2

      It is not a matter of patient information getting out through the calendar itself. You'll have to rely to a certain extent on the users not to leak sensitive information, same as you rely on them not to write sensitive patient information on sticky notes and accidentally drop them in the parking lot.

      Suppose you are 100% certain that the information stored in your calendar is not sensitive (e.g. "May 7-8: on-call Dr X"). So if you had to give some random guy physical access to that server, where would you want the server to be? Outside the hospital's network, obviously. Sure, your calendar is compromised, but at least then the rest of the network isn't, and the attacker hasn't gained a doorway into your network. For all you know there could be an unpatched vulnerability in whatever server you're running that can be exploited to give an attacker root, and then the attacker might as well have physical access to the server.

      If it's theoretically possible that someone with a thumb-drive and physical access to your server could access files stored elsewhere on the network and compromise private patient data, then the IT department should take a very dim view of the request to open a port from the outside world into the network to your server until they're very certain that the server can't be exploited through that port. It's that simple.

      Not to mention the fact that the hospital shouldn't be relying on equipment that is owned by one of the employees. If the employee leaves and takes the equipment, they're left in the lurch to get something else to replace it. Sure, you don't think it will happen, but ignore that possibility and sooner or later it will bite you.

    27. Re:In my corporate environment.... by Score+Whore · · Score: 2

      No, getting a job as an administrator doesn't make one competent, keeping a job as an administrator makes you competent. Having been there for several years means you know something about the environment. Being responsible for a slice of IT operations and dealing with all the different applications and services utilizing your slice of responsibility day after day makes you competent.

      It doesn't I understand that the enterprise hard drive might have a better mtbf than a consumer drive, but I can tell you that the cheapest crappiest consumer drive is still more a more reliable backup device than the absolute best enterprise drive that you don't have.

      And this is my point. It's not a matter of mtbf, it's a matter of gigabytes:IOPS ratios. Having 2 TB on one spindle is like having a 500,000 square foot warehouse with one loading dock. You just can't get to your stuff. We spread your data across sixty drives because 7500 IOPS is way more than 100 IOPS. We'll backup your data in an hour instead of fourteen. When a drive fails the rebuild time won't be twenty hours.

      The IT guy is not being an asshole, developers are not dumb, and that users are not reasonable. It's that people are not grasping the fact that the business is large enough that it requires specialized disciplines in order to support the infrastructure necessary for the business to function. The different groups in the IT department just cannot support hundreds of one off solutions. It is not feasible.

      You're right that most people are not at 1,500 seat shops. Sure most will be in smaller shops, but their budgets will be correspondingly smaller, their staffing will be correspondingly smaller, they'll have less access to premium support contracts and lower quality data centers. And they still won't be able to support one off solutions.

  2. I dunno by EvanED · · Score: 5, Insightful

    But instead of asking "should I give IT a login account on a server that is not owned or managed by them?" perhaps you should ask "should I give IT a login account on a server that is on their network?"

    It becomes a lot less clear in that formulation, huh?

    1. Re:I dunno by Vlado · · Score: 5, Interesting

      I heard such stories about hospitals over and over again.

      Essentially what it boils down to is that hospital IT departments have almost no chance of establishing good environments, because every doctor that has 5 seconds of free time feels like they have both the authority and obligation to directly interfere with how IT does things.

      Situations can vary from either the I've-been-working-for-50-years-without-a-computer-and-I'm-not-gonna-learn-how-to-use-one-now to what we have here where someone know how to make things better by themselves and simply bypasses the whole system with an application that is not supported or endorsed by the IT. And for sure does not integrate with other data-flow activities that are going on in the hospital.

      In the end IT guys run for cover anytime when some local "god" decides that their way is best and things will run how they seem fit, because they just bought a new iPhone and want to have EVERYTHING interact with it. Screw the company-issued smartphones!

      I'm aware that there might be bureaucratic red tape involved in getting things done. But if you go outside of system in the end you just make sure that nothing works for anyone instead of having a list of services that are stable and continue growing at a steady pace, based on a good input from everyone.

      In any case, at the end of the day, why does a service like that even need to be hosted from within a hospital? Plug the server in at home and you avoid any problems if the calendar in iPhone is such a big deal for you. /Disclaimer: iPhone is just an example here. Enter your preferred/hated brand instead

    2. Re:I dunno by drakaan · · Score: 5, Insightful

      Actually, you're giving IT access to a server for a service that they were not required to provide, and probably would have to a lot of asking for.

      Seriously, people...a hospital stores confidential, privileged data about patients and medical conditions that is supposed to have certain safeguards applied to it in order to protect that confidentiality.

      As has been repeated here already (and will be plenty more), placing an piece of personal network equipment on a medical network is bad enough. Asking for no oversight, giving your good word that everything will be OK, and requesting a port in the firewall be opened up to the public internet is lunacy.

      Even if you're well-intentioned, capable, and reasonable about what you're asking for, this isn't a home server and family pictures you're providing access to.

      The most disturbing thing to me about this story and question is that someone in the IT department was willing to open the port and allow the machine to stay connected without having root access, intimate knowledge of all installed versions of software and packages, and without relocating the server to an access-controlled datacenter. If I'm the head of IT, first I unplug and remove the box, then I talk to legal to see what needs to be done (audits, interviews, scans, etc), and then I reprimand the person in IT who said it could be done.

      --
      "Murphy was an optimist" - O'Toole's commentary on Murphy's Law
  3. Obvious question from their perspective by tomalpha · · Score: 5, Insightful

    Why does a server that is not owned or managed by the IT department exist inside the firewall?

    In my workplace that's a sacking offence.

    1. Re:Obvious question from their perspective by shentino · · Score: 4, Insightful

      Also, this is a hospital.

      Wouldn't this also be a HIPAA violation?

    2. Re:Obvious question from their perspective by jafiwam · · Score: 3, Interesting

      It's probably also AGAINST THE LAW. Christ. Submitter is an unmitigated moron. People are going to jail for HIPPA violations and you want to dump any old crap on the hospital network for a CALENDAR? Just use an external web based thing ya moron. Try Google Apps.

      I'd have gone right to the pres and required you be fired immediately OP. Arrogant doctors are not to be let loose on the network without training wheels.

    3. Re:Obvious question from their perspective by MaerD · · Score: 5, Insightful

      Indeed. Be happy they haven't fired you for violating acceptable use and/or purchasing policies. Don't expect to take this server with you when you leave, either.

      IT not supporting the application is one thing, YOU buying unknown, unsupportable hardware, plugging it into their network and then being arrogant enough to decide they shouldn't even have a log in? You seem to be running a bit short on common sense here.

      Also, this is not a random user requesting access, it is your information technology people who A) should know what they are doing and B) are on the hook for what happens on the network security-wise.

      --
      I put on my robe and wizard hat..
    4. Re:Obvious question from their perspective by Attila+Dimedici · · Score: 4, Insightful

      And when the government regulators ask the IT Department how they know that private health information isn't being disseminated over this server, their answer would be...?

      --
      The truth is that all men having power ought to be mistrusted. James Madison
    5. Re:Obvious question from their perspective by Anonymous Coward · · Score: 2, Informative

      Exactly which part

      The part where a rouge system gets owned through a firewall hole and compromises the rest of the network.

    6. Re:Obvious question from their perspective by Siberwulf · · Score: 3, Insightful

      Thanks for the heads up.

      *Drops Mrs. Lattimer from her plan*

      Sincerely,
      -Blue Cross Blue Shield of Texas

    7. Re:Obvious question from their perspective by morcego · · Score: 2

      The part where the server is connected to the same network as the ones with private health information, thus lowering the overall security ?

      --
      morcego
    8. Re:Obvious question from their perspective by 93+Escort+Wagon · · Score: 2

      Indeed. Be happy they haven't fired you for violating acceptable use and/or purchasing policies. Don't expect to take this server with you when you leave, either.

      The guy asking this question is an academic, and as head of his group is probably tenured - he's not in danger of being sacked. And at the risk of painting with too broad a brush... in my experience, a lot of faculty are used to doing whatever they want, and tend to let others worry about the less important stuff (like HIPAA compliance, if there's actually money in the budget to make a purchase, or generally cleaning up messes caused by aforementioned faculty not thinking things through).

      Anyway, I think a better approach would've been to tell IT what was wanted and why, and if/when they said "we simply don't have money" then offer to pay for it. Heck, the guy could still do that. His IT group seems rather accommodating. I'm really surprised they're letting a rogue server inside their network.

      --
      #DeleteChrome
    9. Re:Obvious question from their perspective by gstoddart · · Score: 2

      Exactly which part of a "night and weekend on-call schedule" do you think will contain private health information?

      What part of "opening up a firewall port so this department can run a server they aren't willing to let IT have access to but is still on the network" doesn't strike you as completely bypassing security protocols?

      Are we to assume this guys is 100% competent and hasn't inadvertently done something monumentally stupid? If this machine is compromised from outside, and used to access private health information ... who do you think will be held responsible? The IT department, that's who.

      Asking for a hole in the firewall, and a machine which you more or less say "trust me" about is kind of bordering on the insane. If they can't verify and monitor that you've not created a new potential security risk, the prudent thing is to tell you "no".

      I can completely see how HIPAA issues would have to be considered before you start punching holes in your firewall on the say so of a department head.

      How many of us could walk down the hall to IT and get a port opened up through our firewall so a server we'd ginned up in our department could be accessed from outside? I can say that in almost every organization I've worked in, you would be laughed out of the room unless you could provide a pretty good business case, and demonstrate that you've been through a proper security audit.

      There's usually a pretty high-standard to get firewall ports opened up ... and in a lot of places, such a server would need to be in the DMZ with absolutely no access back into the secured parts of the network. Hell, I've sat in meetings with 15 different people to try to explain, justify, and document such a change. There are reasons for such things.

      --
      Lost at C:>. Found at C.
    10. Re:Obvious question from their perspective by PCM2 · · Score: 2

      Exactly which part of a "night and weekend on-call schedule" do you think will contain private health information?

      Aside from the other responses about lowering the overall level of security (which are correct), how about the part where the schedule involves treating patients? If ever so much as a patient's name appears in a doctor's schedule, that's privileged information.

      --
      Breakfast served all day!
    11. Re:Obvious question from their perspective by dave562 · · Score: 2

      He may not be a moron, but he's socially incompetent. He wants what he wants and he's going to do whatever he wants to do to make it happen, IT be damned. Maybe he should spend less time learning to install Linux and more time learning to work cooperatively with those who he needs help from. Whose fault is it going to be when some automated script finds a hole in his "free as in beer" calendaring solution, roots his box, and then uses it as a launching point to own the rest of the network?

      The original NEED is for on-call schedules. The ISSUE is that some idiot plugged his own server into the network and wants to allow access to it from the outside world.

    12. Re:Obvious question from their perspective by Lumpy · · Score: 5, Insightful

      "He's a doctor, a faculty member (professor), and a division head (administration/management). I promise you he's not a moron."

      I have met professors with multiple PHD's that are in fact morons.
      I have a Sister in Law with 3 Masters degrees that cant keep a car on it's tires, she has flipped 6 cars in 4 years.

      Education does not eliminate you from the moron pool.

      --
      Do not look at laser with remaining good eye.
    13. Re:Obvious question from their perspective by sribe · · Score: 2

      It's still a violation of HIPAA because it's not a centrally managed server WITHIN a managed network.

      Bullshit. Before you rebut, be prepared to quote the specific part of the reg that it would violate.

    14. Re:Obvious question from their perspective by AK+Marc · · Score: 2

      The only successful HIPAA case was because people didn't release documents when required to. There has never been a single fine for leaking patient records, and likely will never be.

      --
      Learn to love Alaska
  4. Ask? by gazbo · · Score: 2, Insightful

    Have you asked him why he wants a shell? If not, why the hell not? And if so, why haven't you told us?

  5. Doing it wrong by dzr0001 · · Score: 5, Insightful

    You shouldn't be deploying rogue hardware that is not company owned at any place of business let alone a hospital. Have you even considered the compliance ramifications?

    1. Re:Doing it wrong by wkk2 · · Score: 2

      At a minimum I would request that the box be placed on a separate VLAN that has no other access to the LAN. Internal access should go through the firewall rules like you would for an external server with all the appropriate logs and auditing. I would also transfer ownership by giving them the hardware.

  6. Wait, what? by 0100010001010011 · · Score: 5, Insightful

    You're asking them to open ports and you're "taken aback" for them asking for an account? They ARE the IT department.... did you even bother asking them if they had the capability of doing what you wanted before you reinvented the wheel?

    You may not think that IT owns or manages your server, but they do own or manage the network. Imagine if some guy from IT came down to you and wanted to start looking through radiology records. I'm sure you'd ask him if it was ok to look over his shoulder every now and again before you gave him full access.

    1. Re:Wait, what? by hb253 · · Score: 2

      It gets even more interesting. Very often, doctors are not employed by the hospital. If that is true in this case, it would be a non-employee setting up rogue hardware.

      --
      Self awareness - try it!
  7. Yes by geek · · Score: 3, Insightful

    If you're hit by a car tomorrow and die you want someone else to be able to pick up the work and go forward. Once upon a time I had a VP I worked for at an ISP put me and the other head of the IT department on a plane with him to LA. The three of us were the only ones with access to the entire companies systems. I mentioned to him, if the plane went down, the company would probably be dead within a week. He just laughed it off.

    That said, your IT department are the best ones to handle this. I doubt the hospital is paying you to play tech nerd, I'm sure you have other work you should be doing. The IT guys are PAID to do this and are screened carefully (at least I hope so) by management to be trustworthy in doing it.

    It sounds to me more like you're looking for job security by being the only one with keys to the castle.

  8. Hmm by jav1231 · · Score: 2

    Let me tell you how this goes down in most corporations. If you don't, their security dept. simply won't give you what you want. They're likely to shut you out anyway. If you take it up the chain then you're calling attention to the fact that you have a non-hospital entity on the company network. This is/was a bad career move. You might get away with it and many do for some time. Given that you're running BSD is a plus as you're not as likely to propagate a virus. Unfortunately for you, IT already knows. So if you choose not to give them a login you might find yourself without an IP address. Or worse, without a job.

  9. Not a dumb question by $RANDOMLUSER · · Score: 2

    Asking what port 8443 is for wasn't a stupid question - if it's not in /etc/services, it's not a standard port number. As for giving him an account, look up "chroot jail". Problem solved.

    --
    No folly is more costly than the folly of intolerant idealism. - Winston Churchill
  10. Their business, their rules. by rotide · · Score: 4, Insightful

    You are operating a server, behind the firewall, on their infrastructure, in their facility. You, (un)fortunately, don't make the rules. What you're doing sounds great and the lengths you've gone to make it happen are commendable. But I can't imagine any decent business being run while allowing any employee to run any server they want behind their firewalls without at least some oversight. You're going to have to follow their rules, sorry.

  11. Why does he want access? by codegen · · Score: 2

    You say he doesn't want root access, only an account. Maybe he has an iPhone and is also stymied by the IT department's lack of support for CalDAV.

    --
    Atlas stands on the earth and carries the celestial sphere on his shoulders.
  12. RTFP (Read the Foolish Policies) by cbelt3 · · Score: 5, Interesting

    What you've done would cause any professional IT group to get out the hot tar, feathers, and rail. Or at least come into your office and ask you politely to remove the damn server from their facility. And never do this again. You must have missed all the security briefings, the issues with HIPPA, and whatnot when you were looking at systems. What you've done is to create a 'rogue system'.

    Imagine one of your kids sets up a server in your house. You don't understand it, you don't know if it's happily sniffing network traffic to steal passwords so pizza can be ordered using your credit cards, serving up pr0n, or just running minecraft. Would you willy nilly allow the kids to open a port on your firewall without the ability to audit what they're doing ?

    Of course not.

    Personally I'm amazed that they only asked for an account on your little server. I would have gone over and watched while you removed it from the facility and put in in your car.

    1. Re:RTFP (Read the Foolish Policies) by Anonymous Coward · · Score: 4, Funny

      If my parents need a port to be opened, they have to come down to the basement and ask me.

    2. Re:RTFP (Read the Foolish Policies) by SecurityGuy · · Score: 2

      You both seemed to miss the "head of department" bit. I've worked in an environment like that, and can assure you putting an unauthorized device on the network won't get you marched out the door unless it happens to be attached to the mouldering body of Jimmy Hoffa. Even then, it's iffy. Most likely, IT would be directed to deodorize Jimmy and "make it work somehow". There would be a nonzero chance that the uppity little tech who thought he was going to tell a department head what to do would be looking for a new job. Small, but not zero.

      OP, there's two problems. No institution can function security when every employee or even every department decides what can go on the network. YOU may be diligent and knowledgeable (or not), but I promise you from experience, others with similar authority will not be, and will do dumber things than you can possibly imagine. So yeah, it's reasonable for them to want to give this box a VERY serious once over if you're asking for a hole in the firewall. It's reasonable for them to require sudo and periodic audits, for that matter. It's reasonable for them to say no altogether.

      The second problem, again having worked in such an environment, is that getting central IT to build this for you will cost a mountain of money and months of time. Those of us who think central control is a GOOD thing need to understand that responsive is a requirement if you're going to get people to play along. If users can build the thing they need in a weekend for $400, you're going to face stiff resistance when you want to write up a business case, etc, etc, etc and take 4 months doing the work, then bill them $80,000. That's just as bad as rogue devices, just in a different way.

  13. Have you read your acceptable use policy? by ekimminau · · Score: 2

    Does it sit on an IT managed network? Connected to IT managed switches? Does it use IT managed/owned internet access? Did you get approval from IT to connect a server to their managed network and deploy an unapproved service from them before plugging it into the IT managed network?

    Im willing to bet the answer to all of the above is "no". You should be prepared for the WWE type smackdown. You should also re-read the Acceptable use policy for your enterprise/organization and you should very politely offer them watever access they desire to allow your unauthorized service on their managed network.

    My ,02.

    --
    Armaments, 2-9-21 And Saint Attila raised the hand grenade up on high, saying, 'O Lord, bless this Thy hand grenade' N
  14. There is a bigger problem by GlennC · · Score: 3, Insightful

    If you are able to put a server on the hospital's network and have it working without IT approval (apparently), then I'd say the hospital has a bigger problem.

    Never mind the fact that IT is unable or unwilling to support the tools that you and your team need to do their jobs.

    --
    Go on, citizen, stamp the vote card. R or D, your choice.
  15. Re:Fuck no by h4rr4r · · Score: 4, Insightful

    They can also not provide it a network port. When the server gets pwned it will be IT people blame.

  16. Yes. Here's why. by wcrowe · · Score: 2

    ..."Should I give IT a login account on a server that is not owned or managed by them?"...

    You mean not owned and managed by them right now. However, someday down the road, when you are gone, IT will have to manage the damn thing. The company I work for made a mistake many years ago by allowing every user to have Microsoft Access installed on their machines. A lot of power users went wild creating Access databases for their own purposes. Naturally, over time, two things happened: 1) The databases grew in size and complexity. 2) The company began to depend on them and link the information in them to each other. Very quickly, all these databases became IT's responsibility to manage, especially when the pinheads who designed them got promoted to their particular level of incompetence, or left the company. It has been very tedious getting the data away from these god-awful Access databases, and re-designed and normalized into proper SQL Server or DB2 databases.

    Yes, IT should have access to your server. They'll have to manage it eventually anyway.

    --
    Proverbs 21:19
  17. Re:Tell them to reimburse you by h4rr4r · · Score: 4, Insightful

    Sounds great. He can have access to the network switch port and the firewall opened up as soon as that transaction is complete. The Hospital IT should have switched off the network port the second they heard of this machine. Well really the network ports should just not all be on to begin with.

  18. Re:No way by mikkelm · · Score: 2

    Of course they want "power and control." If you were held responsible and accountable for a system, reasonably or not, then you would want "power and control" over it as well.

  19. Re:No by $RANDOMLUSER · · Score: 2

    Meaning that you're from the only kind of IT department in the world that allows any clueless asshole (students) to connect to your network. Meanwhile this guy works at a hospital where stuff like HIPPA means that if IT policies aren't carried out properly, IT people lose their jobs.

    --
    No folly is more costly than the folly of intolerant idealism. - Winston Churchill
  20. Re:they may want to remote admin it aka WSUS / AV by michrech · · Score: 2

    WSUS / etc won't do much good for a Linux server...

    --
    bork bork bork!
  21. The request is reasonable by Zontar_Thing_From_Ve · · Score: 2

    jddorian - I'm going to bottom line this for you. It's really quite simple.

    The request to have a non-root account on a box plugged into a network managed by IT could not be more reasonable. If you have problems with this request then you have bigger issues my friend than we could possibly deal with here on Slashdot. It might be interesting to know exactly why you are opposed to this request. If you can't live with it then take you box and go home with it.

  22. Re:Fuck no by Chanc_Gorkon · · Score: 2

    Sorry dude. IT departments would take it in the ass if that server violated HIPPA laws. You JUST don't DO this now. PERIOD.

    --

    Gorkman

  23. CYA most likely by Merenth · · Score: 2

    I would insist on the same if I were in that person's shoes. The network is managed by IT, and they need to know exactly what is running on it. It would be negligence to allow an unmonitored/uncontrolled server inside of the firewall. Also, anything related to IT stands a strong chance of being inherited by IT in the future. Someone sets up a system, and then they leave and IT is left to reverse-engineer the whole thing because they weren't involved.

  24. Re:Fuck no by degeneratemonkey · · Score: 2

    Exactly. Unless you're willing to take full responsibility for any damages incurred on the organization as a result of your potentially insecure server providing a crack in the network (which could most likely be huge damages), you're out of your mind to suggest that IT shouldn't be allowed to manage the server. If it's so important to you, host it on an external network like you would host any other independently operated service.

  25. Re:No by mikkelm · · Score: 2

    As a person interviewing for an IT position at a large U.S. university, I'm thrilled to hear that the hassle of maintaining sane network policies won't be part of the job.

  26. Re:Fuck no by $RANDOMLUSER · · Score: 2

    Hahahaha you must work in marketing. Ask Vanna if you can buy a clue.

    --
    No folly is more costly than the folly of intolerant idealism. - Winston Churchill
  27. Take your personal server home by eison · · Score: 3, Insightful

    At the large company I worked for, hooking up personal computers to the network was a terminable offense. So no, you don't give them a login - you don't set this up at all.

    The chief reason appeared to be fear of viruses and hackers, but there are many, many more. The hacker front can be a bit obscure: What if your CEO read the article about RSA getting hacked by an excel file with an embedded flash object, and the CIO assures the board that all computers will have flash removed and tasks IT with identifying and removing flash everywhere? How are they going to look having to explain 'well, we got everything, except for the personal computers that we don't have access to'?

    Lets say people start relying on the service you are providing with a personal computer under your desk. What if it goes down? Helpdesk will get called, and need to know what to tell the caller so they don't appear incompetent, and need to be able to address the problem. What if IT is required to certify that all of their computers have X patch applied as part of a compliance audit for certification? What if a corporate policy goes out that no computer can run unecnrypted ftp regardless of port # they run it on? What if your company is obligated to ensure that terminated employees can't log in to servers? What if a lawsuit is served and your company is required to provide copies of all records pertaining to meetings with client xyz, and your calendar server has meeting info on it but your IT department doesn't even know it exists? None of these things are unreasonable, but none of them can be done easily if you're allowed to set up whatever box you want doing whatever.

    Sure, it makes your job harder if you have to go through official channels to get the things you need to get your job done. But your company needs to be able to get their job done too, and a bunch of random whatever-somebody-set-up-under-their-desk systems makes that really hard.

    --
    is competition good, or is duplication of effort bad?
  28. Re:Tell them to reimburse you by Bakasama · · Score: 2

    Tell them that the second they reimburse you for the server they can not only get a login, but they can become responsible for its maintenance and security and they had better be sure it has a solid uptime. That only seems reasonable. :-)

    Nope, I'd just quietly get the MAC and blacklist it. No network traffic for you. If I'm asked to buy a CalDAV server, I'll buy real server hardware and run it in a real server room. Not under some guy's desk where the custodial staff can kick the cable.

    If you're feeling REALLY confident about your value to the hospital, feel free to bet on your clout. But if that's the case, Management probably would have paid for the server if you asked.

  29. Give them access to a VM by Crudely_Indecent · · Score: 2

    1. install vmware server, configure a barebones virtual machine
    2. configure local ssh to listen to an alternate port number.
    3. configure port forwarding on your local machine to direct port 22 to the virtual machine.
    4. give them access to the VM

    Best of both worlds.
    They think you've given them access, and you have...just not to the machine they think they're accessing.

    If you decide to give them an account on the actual machine, configure an external location to backup your logfiles, even remote logging. When they attempt to do something bad on your machine (and they will) you'll have the proof you need to make someone regret their actions.

    --


    "Lame" - Galaxar
    1. Re:Give them access to a VM by _0xd0ad · · Score: 2

      5. ???
      6. Get fired.

      Seriously, I think you forgot those steps. What you wrote sounds exactly like a handbook on how to get fired.

  30. Head of the division, you say? by spun · · Score: 5, Insightful

    That explains a lot. Guess what, Head of the Division: just because you are smart, and well trained in YOUR field, does not make you a computer or network expert. As the head of a division at an academic hospital, you have a responsibility to not only follow HIPPA (or your country's equivalent) requirements yourself, but to set an example for the medical professionals training at your facility.

    Do you simply not understand that plugging unauthorized and unaudited equipment into a hospital's network is not only a very bad idea, but against the law in most places? As the head of a division, you should understand that.

    The fact that you were "taken aback" by a request to follow policy indicates that you most likely view this as a dick waving contest. It is not. Your dick will not shrink if you allow the computer professionals to audit your work and comply with hospital policy and the law. No one expects you to be a network expert, that is your hobby, not your profession.

    In short, stop being a condescending ass and let the professionals do their job. If I knew an untrained "division head' was setting up unauthorized networking equipment, I would avoid that hospital like the plague, as I don't want hacked equipment broadcasting my medical history to the world, understand?

    --
    - None can love freedom heartily, but good men; the rest love not freedom, but license. -- John Milton
    1. Re:Head of the division, you say? by Moryath · · Score: 2

      In short, stop being a condescending ass and let the professionals do their job. If I knew an untrained "division head' was setting up unauthorized networking equipment, I would avoid that hospital like the plague, as I don't want hacked equipment broadcasting my medical history to the world, understand?

      We had a thread similar a while back - I explained that there are reasons IT does things. It has nothing to do with wanting to "spite" the users. It has plenty to do with ignorant users thinking that the crap they can pull and plug in to their house does not work in an enterprise-level environment with any sane security policy, even before you get to federal privacy laws like FERPA and HIPAA.

      The questioner obviously has some grasp of technology. That should make him reasonably understanding of why the IT department, in a situation where data breaches = potential multimillion-dollar lawsuits, has to be extremely fucking careful about what is allowed on the network and what is allowed to see the outside world (and in turn be seen). He should have started from the beginning talking to them about what would help make things work, rather than going behind their backs.

      "I am head of a clinical division at an academic hospital

      Oh fuck. No wonder this is happening. He's "taken aback" because he's a douchenozzle with tenure. Oh yeah, and now IT has to deal not only with HIPAA but also FERPA data privacy regulations with the server he's kludged together without any care for security.

    2. Re:Head of the division, you say? by eepok · · Score: 2

      You seem to have read the request for input as condescending, pompous, and arrogant.

      I did not see it as that.

      I read it as, "Hey guys, I know what I'm doing (computer-wise), but I'm not sure if IT should have constant access to it. What do you think?"

      Yet instead of giving the guy a normal answer ("This may not be HIPPA compliant... as much as you may hate it, you have to follow IT's rules on their network...") , you felt the need to attack him. Why? Because he's not a system administrator by employ?

      Of all things, *your* post came off as pompous, arrogant, and condescending.

    3. Re:Head of the division, you say? by spun · · Score: 5, Insightful

      Doing our jobs and complying with Federal regulations does not make us dickwads, it makes us professionals.

      --
      - None can love freedom heartily, but good men; the rest love not freedom, but license. -- John Milton
    4. Re:Head of the division, you say? by spun · · Score: 2

      Let me put it this way: I'm "taken aback" that he would be taken aback by a request to comply with hospital policy and federal law.

      --
      - None can love freedom heartily, but good men; the rest love not freedom, but license. -- John Milton
    5. Re:Head of the division, you say? by spun · · Score: 3, Insightful

      Mr. jddorian ignores (in the sense that he doesn't know about it) HIPAA and IT had not mentioned it at any time. Since IT didn't help and didn't explain why, he goes on to solve his problem. When he finally does it, he requests something that on his perspective seems trivial: access to his solution.

      Mr. jddorian is a division head at a teaching hospital. If Mr. jddorian does not know about HIPAA then Mr. jddorian needs to be let go from his position immediately.

      --
      - None can love freedom heartily, but good men; the rest love not freedom, but license. -- John Milton
    6. Re:Head of the division, you say? by eepok · · Score: 2

      True, but being dickwads makes you dickwads. Try tact, understanding, facilitation, and education instead of insulting, berating, and denigrating people simply because they don't have as high an understanding of your specialty.

      You make this much harder on yourself than it needs to be.

  31. All for a stupid calendar for a dozen people? by Kral_Blbec · · Score: 2

    Is it really that hard to load into your smartphone a few weeks schedule occasionally? Even if everyone in the department is a techie, there is no need to try and get fancy. Sometimes the old fashioned really is better.
    If you were talking a department of 100+, I can see some benefit. For a dozen freaking people though, you're just creating needless drama.

  32. So, if the IT guys watch Grey's Anatomy??? by Kamiza+Ikioi · · Score: 5, Informative

    More than that, who says you are a qualified systems admin? You say "I am head of a clinical division at an academic hospital (not Radiology, but similarly tech oriented)." And I take it that you installed BSD and OpenLDAP. My question is... so what? Who is to say what you really know? You are operating in a hospital. You have medical records. The IT staff there MUST make sure ALL systems there comply with HIPPA and industry security standards.

    Hey, the IT guy watches Grey's Anatomy. Can he perform medical tests in your hospital? No? So what makes you think you are comparable to IT? They respect your job, how about you respect their's.

    I'm sorry, but there is no way in hell I would let you on such a network without root. Not an account, but root. And if I were a patient, I would be screaming bloody hell if I found out non-IT staff got to run their own servers on the hospital network. The fact that they let you run at all is mind boggling to me. Probably because they can't fire a department head or you have tenure or something similar.

    But you are on the most sensitive type of network and balking at the most basic request. "Should I give IT a login account on a server that is not owned or managed by them?""

    Should they allow you host a server on a network that is not owned or managed by you? Honestly, if you did this all without first passing it by my IT department, I'd do my best to have you fired. Don't wanna give access to your precious box... geez, you really think THAT is the big deal in all this. Unbelievable, foolish, and arrogant to say the least!

    --
    I8-D
    1. Re:So, if the IT guys watch Grey's Anatomy??? by Kamiza+Ikioi · · Score: 3, Insightful

      You don't have to take it aggressively...The question is genuine...What part offended you?

      The part where I am an IT administrator who knows better than to play doctor, and the part where the poster is an (I assume) doctor who doesn't know better than to play IT. I know what I'm doing after years of training and experience. Yeah, I could read the manual and run an XRay machine, but how incredibly stupid and irresponsible would it be for me to do that.

      I don't care if it's a doctor, lawyer, or plumber... but if they think just cause they play with OSS at home that they are a l337 hax0r who will post to /. for sympathy against "The Man" is SORELY mistaken.

      We do things for a reason, especially when it comes to security. When you are dealing with military or hospital systems, someone could die if IT screws up. And we sure as hell don't need cock sure users pulling the IT equivilant of "Don't worry, I play a Dr. on TV," on our networks.

      Am I aggressive? Yes, because this potentially puts patients at risk. I'm just as aggressive if I were to post on a doctor forum, "Hey, I brought in my home sewing kit to do stitches. I watch House and I'm pretty good when I practice on dolls at home. Why does the floor director refuse to let me help out?"

      --
      I8-D
  33. Re:This entire post is stupid by 1u3hr · · Score: 2

    The post is so stupid and bound to generate comments to that effect that I suspect that like many of the "Ask Slashdots" it's entirely fictional. Any hospital admin who is aware of Slashdot would know the reaction he would get here. It's just some twat trolling us. Or possibly the editor spicing up a slow news day.

  34. Medical advice by ElMiguel · · Score: 5, Funny

    The fact that you were "taken aback" by a request to follow policy indicates that you most likely view this as a dick waving contest. It is not. Your dick will not shrink if you allow the computer professionals to audit your work and comply with hospital policy and the law.

    Now who's the doctor here?

    1. Re:Medical advice by silverglade00 · · Score: 2

      I wouldn't touche it if I were you. It might be catchy.

  35. Sysadmins VS Lusers, lets get ready to rumble! by spun · · Score: 5, Insightful

    Hilarious. This story has polarized Slashdot into the "I actually work in IT in a systems administration capacity" camp and the "I tinker with computers as a hobby" camp. The tinkerers are actually taking offense that the "so called experts" won't immediately recognize their superior genius. The experts, for their part, seem used to this crap. Here's the deal, tinkerers: we will respect your mad skillz only after you have demonstrated them several times and jumped through all the proper hoops. Until then, you are just like any other Little User. No insult intended, but this is our job, and our butts on the line, not yours.

    --
    - None can love freedom heartily, but good men; the rest love not freedom, but license. -- John Milton
    1. Re:Sysadmins VS Lusers, lets get ready to rumble! by Capt.+Skinny · · Score: 4, Insightful

      Hilarious. This story has polarized Slashdot into the "I work in IT as a sysadmin and managing tech is my job" camp and the "I don't work in IT and need tech to do my job" camp. The sysadmins are actually taking offense that the non-IT folks won't immediately recognize their superior policies and procedures. The non-IT folks, for their part, seem used to this crap. Here's the deal, IT: we will respect your mad skillz only after you have demonstrated that that your hoops are justifiable and not unduly burdensome. Until then, you are just like the PHBs. No insult intended, but this is our job, and our butts on the line, not yours.

      There, fixed that for you. At the risk of being modded "-1 Disagree" to oblivion.

    2. Re:Sysadmins VS Lusers, lets get ready to rumble! by spun · · Score: 3, Insightful

      Oh my fucking GOD, read up on HIPAA, this is not some heavy handed IT decision, this is a fucking Federal Regulation with HUGE penalties for non-compliance, but then, why should I expect you to understand that? You aren't in IT, and it is not your job to understand those things.

      Given that we have already been vetted by your company's HR, and by other IT staff at your place of employment, the default assumption should be that we know our craft. Would you take offense if I simply assumed that you are unqualified to do the job you were hired to do?

      Actually, I will assume you are unqualified at your job, as you see fit to complain about your tools (computers) and we all know, it is a poor workman who blames his tools. I'm guessing YOU are the reason you have difficulty with your job, not your IT department.

      --
      - None can love freedom heartily, but good men; the rest love not freedom, but license. -- John Milton
    3. Re:Sysadmins VS Lusers, lets get ready to rumble! by spun · · Score: 2

      Nothing in the article indicates IT not doing their job. Nowhere does Mr. PHB Division Head say he asked IT first. No, he has used Ubuntu once and therefore he is an expert on computers and networking and does not need the help of the obviously untrained buffoons in IT, I mean, do THEY have a PhD.? No! He says they don't offer any iPhone compatible tool, which probably means they DO offer a tool, just not one that integrates into his iPhone the way he'd like, and he is willing to go around IT's back and install an unauthorized server, violating HIPAA and risking multi-million dollar fines and lawsuits.

      --
      - None can love freedom heartily, but good men; the rest love not freedom, but license. -- John Milton
    4. Re:Sysadmins VS Lusers, lets get ready to rumble! by RyuuzakiTetsuya · · Score: 2

      I blame management.

      I used to work at a shop that had at first, pretty loose and easy IT regulations then got an IT manager that cracked down hard.

      My ass was on the line when I couldn't be flexible enough to kiss some middle manager's ass and get some feature implemented NOW NOW NOW, because we were that flexible 8 months ago, despite me telling them that 4 months ago, IT cracked down and we have real change management procedures.

      I understand why IT ops tend to have buttholes tighter than a snare drum, because there is quite a lot on the line. I can understand why developers and users hate it, and that's because business needs(Well, management's whims) move faster than IT's policy and procedures dictate.

      --
      Non impediti ratione cogitationus.
    5. Re:Sysadmins VS Lusers, lets get ready to rumble! by fudoniten · · Score: 2

      Actually, I will assume you are unqualified at your job, as you see fit to complain about your tools (computers) and we all know, it is a poor workman who blames his tools. I'm guessing YOU are the reason you have difficulty with your job, not your IT department.

      Haha, neat, you can use that argument against anybody who ever complains about you, since your job is to make sure they have decent tools. If they complain, they must be incompetent, since they are ipso facto complaining about tools!

      But seriously, I understand your POV, but I identify more with the OP. Maybe the healthcare world is different, but I've seen more cases where the problem is some useless bunch of MCSEs running a patched-together network, not really sure how it works, and afraid to touch a thing (or open a port) lest it all come crashing down. Invariably, they call everybody else incompetent and a security risk.

    6. Re:Sysadmins VS Lusers, lets get ready to rumble! by spun · · Score: 2

      Not entirely accurate, the sysadmins are on the side of following HIPAA regulations and not being personally liable for million dollar lawsuits, fines, and criminal charges, while the lusers are on the side of venting their frustrations with people who they feel should be like a McDonalds clerk, subserviently taking and delivering their orders.

      --
      - None can love freedom heartily, but good men; the rest love not freedom, but license. -- John Milton
    7. Re:Sysadmins VS Lusers, lets get ready to rumble! by ryanov · · Score: 2

      I work in IT. While I agree with your opinion, and /I/ will work with someone if they're up front, often times I am told by my superiors NOT to work with people... and then what happens is that people pull this kind of stuff instead. It is not a given that working together with IT will get you anywhere.

  36. Why a server? Going Rogue by jwhitener · · Score: 2

    Why even bother setting up a server with all the excellent online calendar applications? For instance, many schools use Google apps for education or MS Live.

    That aside, going rogue, not talking to IT, and making a custom solution just for your one area, is one of the things that makes working in IT so frustrating at times. Among the many, many problems that implementing your own solution can create, just think about one: what happens if you change jobs? I can personally attest to getting calls from random new department heads saying "Joe Smith (former department head) set up system xyz to do abc for us and now he's gone, I expect IT to now support system xyz".

    This scenario is especially prevalent in academia. Academic freedom is important, but all too often it spills over into areas that it really doesn't belong.

  37. Troll. by pz · · Score: 4, Informative

    The OP is a troll.

    The user ID "jddorian" is a fictional character on the US TV program Scrubs.

    No head of department at any hospital or university I have been associated with would have had the time in their career to be more than passingly conversant on computer IT issues, forget know about ports. Heads of departments get to those positions only because they do nothing else with their lives.

    A head of department would know better than to set up something themselves. They wouldn't also have the time to do something like that. They would be familiar with the idea that the hospital IT infrastructure is far more highly managed than normal corporate IT structures.

    And, unless this is a seriously podunk hospital, they likely already run Microsoft Exchange for email, and so have electronic calenders.

    Troll. It's a troll.

    --

    Put my fist through my alarm clock with its ding-dong death inside my ear. - The Blackjacks.
    1. Re:Troll. by sidebrok · · Score: 2

      I concur, mod parent up. Rgds, Bob Kelso

  38. From a CIO's perspective by The+Bringer · · Score: 2

    I am the CIO/CTO of a major medical organization. Had you plugged that server in on my network without authorization from IT, without a security audit performed, and without any compliance auditing performed - you'd be looking for a new job. That being said, I completely understand the desire for tinkering and providing a good solution to your colleagues and peers. But, to do that without consulting the IT department is very inconsiderate. They are working their asses off to make sure that everything is working as it should, while managing user complaints, hardware failures, asset tracking, data retention policies, and a myriad of other odds and ends. By plugging in that server, you've just undermined everything that they are doing. You're putting an untested application onto a network that you're not familiar with and hoping it doesn't break anything - without any consideration of the port mapping schema, or IP addressing schema that is in place. The next time you're feeling technically savvy, my recommendation would be to consult your IT department beforehand. At the very least, you should be severely reprimanded for your actions. You are jeopardizing the reliability and security of hospital systems with your little project.

  39. You Screwed Up by echusarcana · · Score: 2
    Sorry, I know you meant well, but you screwed up big time. You'd be facing discipline at most companies. In a health-care situation with the privacy concerns, doubly so. I'd be pulling the plug on this and be grateful that you still have a job. The fact that you may have the support of some doctors may not protect you. You are definitely in the wrong.

    Remind yourself: You may be technical but you don't work in IT. You job responsibility is not IT.

    1. Re:You Screwed Up by JSBiff · · Score: 2

      I could maybe see a doctor doing something in coordination with IT, but what's alarming to me is this guy went ahead and did all this, then connected it to the hospital network, and only THEN decided to contact IT. WTH. If you get *permission*, fine (although I doubt in most hospitals, or businesses generally, you could get permission, because a box on the network that they don't administer could be an unintentional back door into a secure network).