Vendors Say Data Protection Software Too Complicated To Use

Alot of Enterprise Software is "too complicated" by Anonymous Coward · 2011-05-04 11:16 · Score: 1

In other words, alot of enterprise software is poorly designed.

Well designed software is easy to use.

Hire me. by Anonymous Coward · 2011-05-04 11:18 · Score: 0

They should hire me to help them fix it.

Re:Hire me. by Anonymous Coward · 2011-05-04 11:46 · Score: 0

They can only find you or me if there is a data leak. You failed your first test.

Hire better people? by 24-bit+Voxel · 2011-05-04 11:18 · Score: 4, Insightful

Am I the only one who read this as: It's too complicated for the entry level IT guys we hire to use....

Re:Hire better people? by Anonymous Coward · 2011-05-04 11:22 · Score: 0

I read this as "too time consuming for people to bother" or "it's annoying to configure stuff properly"
Why do you think Vista was such a downer? The UAC is a good security feature - it has prevented at least 1 virus from actually installing on one machine here as the user didn't allow an unknown program privilege escalation. But people don't use it because it was "annoying" in spite of the problems that XP had.
Re:Hire better people? by dwarfsoft · 2011-05-04 11:23 · Score: 3, Interesting

Absolutely. Too hard for monkeys to randomly press things and get things set up perfectly. Solution: Hire more monkeys...
They don't realise that paying a bit more for a few Good people would save them money in the long run, instead of flooding the ranks with monkeys.

--
Cheers, Chris
Re:Hire better people? by olsmeister · 2011-05-04 11:25 · Score: 3, Insightful

At some point, someone will have to determine what's costlier: a little extra money up front to recruit knowledgeable and capable people to safeguard the company's and customers' valuable information ... or a public relations disaster such as Sony is experiencing.
Re:Hire better people? by clang_jangle · 2011-05-04 11:39 · Score: 2

They don't realise that paying a bit more for a few Good people would save them money in the long run, instead of flooding the ranks with monkeys.
Bingo. Companies are less willing to pay what a job is worth, so they end up with people who don't have the skills or experience to do the job properly. Of course, sometimes they are paying well but the company just has a crappy culture of doing things half-assed. I can think of at least one tech giant that meets that description...

--
Caveat Utilitor
Re:Hire better people? by pkinetics · 2011-05-04 11:47 · Score: 3, Insightful
Actually I read it as:
- Little buy in from upper management. Without this getting people to meet and discuss and prioritize is futile.
- No return on investment. Securing data is not glorious until after you've been compromised.
- Risk versus reward.
- Software setup is not overly hard. Integration with existing systems is.
Re:Hire better people? by ShakaUVM · 2011-05-04 11:49 · Score: 1

>>At some point, someone will have to determine what's costlier: a little extra money up front to recruit knowledgeable and capable people to safeguard the company's and customers' valuable information ... or a public relations disaster such as Sony is experiencing.
That was my thought on the matter. How expensive would it have been to have hired one of these data protection firm's people to work for Sony part-time? Or, hell, full time?
How much money did Sony lose from not only getting hacked, having the PSN network taken down, but also from the fact that people have found out that they didn't even go to the trivial effort of using crypt() on the passwords, and held it all in plaintext?
I had some friends over last weekend and we were going to buy a game on the PSN to play and oh wait. Sorry, Sony, no sale for you. Hope the $100k or so you saved was worth it.
Re:Hire better people? by BoogeyOfTheMan · 2011-05-04 12:00 · Score: 4, Informative

They did not store the passwords in cleartext, from the PSN Blog:
"One other point to clarify is from this weekend’s press conference. While the passwords that were stored were not “encrypted,” they were transformed using a cryptographic hash function. There is a difference between these two types of security measures which is why we said the passwords had not been encrypted. But I want to be very clear that the passwords were not stored in our database in cleartext form. For a description of the difference between encryption and hashing, follow this link."
http://blog.us.playstation.com/2011/05/02/playstation-network-security-update/
Re:Hire better people? by Charliemopps · 2011-05-04 12:03 · Score: 1

I think you mean: "Too complicated for the customer service reps we promoted to IT positions with absolutely no training to use"

In my experience there's usually 1 or 2 people at a company that has a clue when it comes to the network. Their time is spent almost exclusively doing things that contribute to profitable projects. Protecting the network is an expense. If you spend your time doing things that are considered expenses rather than doing things that are considered profitable, you will soon find yourself on the wrong side of the next company "re-org" spreadsheet.

Businesses will never prepare for breaches like these until they are required to by law. Incidents in which a breach really costs the company are few and far between. Everyone up and down Sony's management chain are currently busying themselves blaming the "Hackers" and consoling themselves with statements like "It was a very sophisticated attack" and "No matter how much protection you have, they'll always find away" None of which is true of course. This sort of data simple should not have been available to anyone outside Sony's corporate headquarters and the only people with access to it there should have been developers. The fact that the hackers could get to it meant that any low level employee in the company could have walked off with it. In fact, it's more likely that an employee was involved than anyone at Anonymous, and just used the DDoS attack as a smokescreen.
Re:Hire better people? by starfishsystems · 2011-05-04 12:04 · Score: 2

Could be. But it's also because the senior people (eg CIO, CSO) are often operating at a vague, sloppy level of abstraction.

Whether they're acting on their own initiative, or on the advice of technical management - who are themselves often more informed by marketing materials than knowledge of security principles - I'm not surprised to see money being spent on security products without much or any attention to security processes. It's been that way for a long time, though folks like Bruce Schneier will be the first to tell you that's putting the cart before the horse.

What does one of these wonderful "Data Loss Protection" systems actually do? Well, I don't know. It depends. I can tell you what they won't do, and that's do your thinking for you. That's right. Sorry about that. Guess I lost a sale there.

Here we have an industry publication explaining that there is "a whole category of security software designed to keep information from doing things it's not supposed to even inside the firewall." Let me get this straight, because this is the opening sentence of the article. Information does things? It's burning CPU cycles, waiting to break loose and cause havoc? Because I think we're off to a bad start here. I don't think there should be the slightest suggestion that information, which Claude Shannon elegantly defined for us over fifty years ago, does anything at all except exist. Even an algorithm only exists. Some machine ultimately has to do the work which the algorithm specifies, otherwise no work is done.

A more meaningful thing to say is there is data, and data may have structure. Also, there are consumers and producers of data, and they may have structure. In both cases such structure may be divisible above and below a given level of descriptive granularity. (This is an important property to keep in mind, because without it we have no means of analysis.) If we want to talk about a general data management model, that's about all we can say.

Supposing that we want to talk about something more specific, like providing access to some data to some consumers and not others, we have to impose some definitions on both. This is what the CIOs and CSOs actually want. And it's where most of the work lies. Implementation might be hard too, in its own way, in the sense of being laborious and dealing with a lot of inconvenient details of the real workd, but we can't even begin to assess that until we're clear about what we actually want to do. That's the bit that seems to have been forgotten.

The fact is, no product will do your thinking for you. Security is a process. Start by defining what you want to secure, and who are the players. If you haven't done that, there's no point in spending money on security systems.

--
Parity: What to do when the weekend comes.
Re:Hire better people? by amicusNYCL · 2011-05-04 12:09 · Score: 1

Am I the only one who read this as: It's too complicated for the entry level IT guys we hire to use....
Probably not, but at least you're not the only one who is wrong.
The end users are not quoted in this article. The security vendors are the ones who are quoted about the entire process being to complicated for companies to actually implement it.

DLP is the "most disappointing" portion of the security market primarily because of the amount of time it takes companies to identify the data they want to protect, create profiles and taxonomies to categorize it and put in place the software that will protect it, John Vecchi, head of global product marketing for security vendor Check Point told a Register reporter at the company's annual conference today. ...
That "boil the ocean" approach doesn't deliver much benefit until all the pieces are in place, which makes even companies enthusiastic about automating their data protection shy away from the work of actually doing it.
That's a problem for companies like his that develop the software, CheckPoint CEO Gil Schwed said in his keynote.
It sounds like you know better than all those drooling morons though, so there's your niche where you can make your millions.

--
"Our two-party system is like a bowl of shit looking at itself in a mirror." - Lewis Black
Re:Hire better people? by kangsterizer · 2011-05-04 12:19 · Score: 1

good specialized people cost a lot
as long as they dont have a breahc they dont wanna afford it (of course, affording ONE of these guys would be cheaper over 50 years than ONE single breach but hey!)
Re:Hire better people? by ShakaUVM · 2011-05-04 12:26 · Score: 2

Hmm, well that makes me feel vaguely better about the whole thing. Do you know if the passwords stolen were easily guessed ones, or if PSN used a weak hashing algorithm which allowed recovery of the passwords? I heard reports that people's WoW accounts were being hacked via their PSN passwords.
Re:Hire better people? by Darinbob · 2011-05-04 12:28 · Score: 1

But even reading the article it's not that it's "complicated" per se, it's that it's expensive. Companies do complicated stuff all the time. It's just that normally if they perceive something complicated as important they will devote resources to getting it done. Such as hiring experts who understand the complexity, replacing project managers who aren't making any traction, etc. Nothing in the article claims that there's a shortage of qualified or trainable people.
Re:Hire better people? by Anonymous Coward · 2011-05-04 12:47 · Score: 2, Informative

This sort of data simple should not have been available to anyone outside Sony's corporate headquarters and the only people with access to it there should have been developers.
This is false. Developers should not have access to production data, especially not highly-sensitive production data! Only system operators should remotely have access to this kind of data. I do not understand how Sony never got audited for this kind of thing. Normally, investors want some kind of insurance from an audit that stuff is at least partially secure. Most password change restrictions come from this kind of audit.
Re:Hire better people? by Nos. · 2011-05-04 13:02 · Score: 1

Yup... we're in the beginning stages of trying to roll out DLP at work. Its not as simple as installing some software and configuring a few policies. There's a heck of a lot more to it than that. Where is data stored? Who is allowed to access it? How can they access it? Are they allowed to read/copy/edit/delete/etc? What data needs to be protected at what level? What needs to be encrypted? What doesn't need to be encrypted?
And that's just a start to the questions you need to ask.
This isn't something that gets setup in a matter of weeks in any reasonably sized organization. Data classification itself can take years. On top of all that, you've got to incorporate other things like PCI, HIPA (for us in Saskatchewan), PIPEDA (Canadian), and other various certifications, act, and legislation. Sorting through all that, comparing your data to each and determining what applies and what doesn't takes time.
Re:Hire better people? by 24-bit+Voxel · 2011-05-04 13:05 · Score: 3, Insightful

Back in the late 90s, these companies actually trained their employees and gave raises that matched performance.
It was really amazing. Nowadays companies don't train their employees, and it shows.
It's funny to read the article and not think about training budgets being a thing of the past. It's the software's fault, not managements for sucking away the training dollars.
Re:Hire better people? by Super+Dave+Osbourne · 2011-05-04 13:14 · Score: 1

Its really sad to read this type of article, in fact companies have now completely commoditized the human element of the business. Get the economy in such a dire strait allowing companies and the people they 'employ' to gladly accept the Orwellian aspects of today's employment options. Its a win win win. Government loves it because the average intelligence level of employment is dwindling, less intelligence where daily (yes, meant this way, a job is just a day away from being unemployment checks), employer loves it because they can get rid of dodos without much resistance making for a 'dynamic' business model and finally the employee loves it otherwise they'd be out on the street where they belong due to lack of education or ability. See, it does work well in America. The downsizing and sell off of America to the lowest bidder via the free system, unregulated and open to competition is now in full swing.
Re:Hire better people? by lgw · 2011-05-04 13:23 · Score: 1

The particular manager who's buget would have taken the hit for doing data protection right for Sony is probably unknown to the managers who will shoulder the blame for the problems - especially as he's likely already moved on to a better position after demonstrating his ability to run a cheap shop.

--
Socialism: a lie told by totalitarians and believed by fools.
Re:Hire better people? by CodeBuster · 2011-05-04 13:58 · Score: 2

If you are so convinced that your business ideas are right and everyone else is doing it wrong, why not prove that by getting out there, founding a company and making a mint? Try your hand at being an entrepreneur or starting your own company before criticizing businesses for giving employees a raw deal. Anyone can be an employee after all, but it takes hard work, courage, skill and yes even a bit of luck to be an entrepreneur who creates new jobs and new wealth. Always remember that fortune favors the bold, not the timid.
Re:Hire better people? by 24-bit+Voxel · 2011-05-04 14:23 · Score: 1

I wonder which employees find the process to be "to complicated" ...
I wonder which employees need to identify the data, create profiles and taxonomies, and put software into place...
Am I going too fast for you? Are we not making the connection here?
I never said I knew better than these drooling morons, but now I'm saying I know better than you.
Re:Hire better people? by Anonymous Coward · 2011-05-04 14:50 · Score: 0

Have you ever heard the expression "leave a dollar in the other mans pocket"?
Just because you can stomp your workers into a mudhole, and it's profitable, doesn't mean you must.
Re:Hire better people? by donaldm · 2011-05-04 15:21 · Score: 1

As for the Sony crackers (lets get this right) would only get passwords in encrypted format and these would only be stolen from the database information not from the OS such as /etc/passwd and /etc/shadow or from a Linux/Unix trusted database (TCB) which would only show encrypted passwords anyway. Even if you had root privileges I would be surprised if users had their information in standard login files. Even in MS Windows you need to be the "administrator" to get the encrypted passwords and one would hope that server user names did not have admin privileges.

To allow PSN access Sony would most likely use LDAP or something equivalent which would check the users "rsh" (assumed) encrypted password with that encrypted password in the user database. It is not really that catastrophic to get a user's login password but getting their credit card and account details is since the later can be used for identity fraud which can be much more serious.

--
There ain't no such thing as proprietary standards only proprietary formats. Standards are by definition open.
Re:Hire better people? by grcumb · 2011-05-04 15:38 · Score: 3, Interesting

At some point, someone will have to determine what's costlier: a little extra money up front to recruit knowledgeable and capable people to safeguard the company's and customers' valuable information ... or a public relations disaster such as Sony is experiencing.
You're assuming that massive data theft is a disaster to the company. If experience is any guide, that's not true:

It seems that in the esoteric world of noughts and ones, belief matters far more than empirical truth, making a true Data Disaster literally inconceivable.
There can’t be a Data Disaster today, because we can’t imagine what one would look like. Likewise, there won’t be a Data Disaster until we become capable of realising that they’re all around us, happening every day.

--
Crumb's Corollary: Never bring a knife to a bun fight.
Re:Hire better people? by jvillain · 2011-05-04 15:41 · Score: 1

That and companies only want generalists. When the job add asks for some one that knows DOS, Window, Exchange, AD, IIS, MSSQL, Linux, Apache, Solaris, Oracle, VMS, IRIX, AIX,Mac, Cisco, Juniper, EMC, Netapp and can program in PHP, Java, C++, .NET and assembler you know the only skill the applicant really has is the ability to hit the speed dial button for the vendor. Pay now or pay later. It's the age old question, and I bet Sony is wishing they had picked the other option about now.
Re:Hire better people? by poetmatt · 2011-05-04 16:11 · Score: 1

yes, and/or equally like "we don't want to do what would be a best practice, we'd rather make good short term decisions than long term ones".
Re:Hire better people? by CodeBuster · 2011-05-04 16:30 · Score: 1

I compete to win and so should you. Own your failures (and learn from them), take your winnings and make no apologies; that's my motto. If you can't or won't compete, there are many hungry Indians and Chinese who would jump at the chance to take your place.
Re:Hire better people? by Undead+Waffle · 2011-05-04 16:35 · Score: 1

They did not store the passwords in cleartext, from the PSN Blog:
"One other point to clarify is from this weekend’s press conference. While the passwords that were stored were not “encrypted,” they were transformed using a cryptographic hash function. There is a difference between these two types of security measures which is why we said the passwords had not been encrypted. But I want to be very clear that the passwords were not stored in our database in cleartext form. For a description of the difference between encryption and hashing, follow this link."
http://blog.us.playstation.com/2011/05/02/playstation-network-security-update/
From the link in the blog you linked:

Hash - a special form of encryption often used for passwords, that uses a one-way algorithm that when provided with a variable length unique input (message) will always provide a unique fixed length unique output called hash, or message digest.
So they're saying the passwords weren't encrypted, they were stored as hashes. And to explain the difference they link a page that defines a hash as a form of encryption...
Re:Hire better people? by Anonymous Coward · 2011-05-04 16:41 · Score: 1

I'm developer who works on systems like the one that was cracked (except for small clients). None of our clients have the budget, but it's an interesting thought experiment to think about how an attack like this could have been prevented.
Encrypting data is easy, but there needs to be some way to decrypt the database so it's contents can be used. Trying to figure out a way to decrypt without also allowing a hacker to decrypt it is very difficult. This is why DVD encryption has never succeeded, despite all their efforts.
My answer in the end: you need to stop people from hacking into the database server in the first place. That's really the only viable solution for most businesses.
They should have used more reliable software and/or they should have had it locked down tighter. And they should have had staff watching around the clock, and hopefully notice the attack before the *whole freaking database* could be dropped.
Think of it this way: if you want to stop shoplifters, then a perfect solution is to build a 10 meter thick concrete wall, floor and ceiling around your shop. With no windows or doors. How do the employees and customers get in and out you ask? I don't know, that's the hard part. Preventing shoplifters is hard, but preventing someone from walking out with *everything on the shelves* can be done.
Re:Hire better people? by sjames · 2011-05-04 17:13 · Score: 1

What is considered an expense and what is profit has little to do with the value of various functions. The people who actually make a product are called an "expense", but ales and management are regarded as "profit". They argue that sales brings money in, so it's profit. Management attracts investment, so it's profit. Never mind that without a product there's nothing to sell and the investors will go away.
What really costs is having blinkered idiots for management, but for some reason management keeps overlooking that potential saving...
Re:Hire better people? by Anonymous Coward · 2011-05-04 17:17 · Score: 0

I wouldn't be surprised if all these security breaches are by disgruntled ex-IT and software engineers whose jobs were shipped to India or given to entry level workers.
More power to them... hack The Man!
Re:Hire better people? by Zenin · 2011-05-04 17:31 · Score: 1

What hash algorithm, specifically?
Using something like MD5 is very common...and very dumb. It might as well be cleartext for all the real world protection it offers. You can brute force tens of thousands of password attempts a second on modest hardware, and that's before we even talk about reverse lookup databases.

--
My /. uid is better then your /. uid
Re:Hire better people? by rmstar · 2011-05-04 17:40 · Score: 1

My answer in the end: you need to stop people from hacking into the database server in the first place. That's really the only viable solution for most businesses.
They should have used more reliable software and/or they should have had it locked down tighter. And they should have had staff watching around the clock, and hopefully notice the attack before the *whole freaking database* could be dropped.
With that last one, you hit quite another nail on the head, albeit tangentially. The question is: why one database? The problem is probably technological monoculture more than anything. If you can't afford having an accident or making a mistake, you are in trouble, because you are in the wrong planet, and you are the wrong species (human).
If you think about it, the situation is so desperate that it is comical. You have a relatively standard IT department guarding an extremely juicy target. Oh so absolutely, ridiculously juicy. That just can't go well!
Re:Hire better people? by Anonymous Coward · 2011-05-04 18:11 · Score: 0

I read it as, "It's too expensive because we couldn't hire $15/hr hacks off craiglist." or alternatively "We can't outsource it to India because it's too complicated to script."
Re:Hire better people? by Anonymous Coward · 2011-05-04 19:11 · Score: 0

While I am just a bystander, I can say with confidence that a lot of the stolen passwords were easily guessed ones.
Any check across a larger number of passwords from different people so far has shown it to be so.
That's just the human element at work, so don't expect any change
Re:Hire better people? by gl4ss · 2011-05-04 20:17 · Score: 1

it's complicated, because if the data is accessible at all it can be compromised, and usually the data could just as well be in a safe if it doesn't need to be accessed at all.

--
world was created 5 seconds before this post as it is.
Re:Hire better people? by Tasha26 · 2011-05-04 21:29 · Score: 1

Not all graduates specialise in Network and Computer security (let alone those who already work in an IT company and whose mind have melted into complacency & delegation). Comp/Net security is a daunting field, especially when the lecturer thinks "you will only be the sh*t after you can replicate his complicated crypto maths skill." I took an online certificate course from Stanford, it was complete b.s. and doubt very much that I'm an "Advanced Computer Security" person/professional. Oh well, good thing i can lie.
Re:Hire better people? by sco08y · 2011-05-04 22:35 · Score: 1
Actually I read it as:
- Little buy in from upper management. Without this getting people to meet and discuss and prioritize is futile.
- No return on investment. Securing data is not glorious until after you've been compromised.
- Risk versus reward.
- Software setup is not overly hard. Integration with existing systems is.
I think you're right. You can have very capable IT people, but real security requires more than just IT. A lot of people have to be trained, processes have to be set up, etc., so if management doesn't "get it", it doesn't actually happen.
The attitude that IT will do all the work to make stuff secure, and all everyone else has to do is memorize a few passwords is pretty poisonous.
Re:Hire better people? by Anonymous Coward · 2011-05-05 00:00 · Score: 0

That is correct. They are un-willing to pay for top tier talent so therefore it is to difficult for the average entry level IT guys to use.
Re:Hire better people? by Anonymous Coward · 2011-05-05 00:49 · Score: 0

Yes, and I hope they eat your selfish fat ass.
Re:Hire better people? by Anonymous Coward · 2011-05-05 01:37 · Score: 0

I can't be the only person thinking that there needs to be an IT Workers Union.
Re:Hire better people? by Anonymous Coward · 2011-05-05 01:37 · Score: 0

I'd say there should be 1 or 2 highly-placed developers who should be able to access production, but ONLY after being called on by the sysops. Chain of command, etc. Sysops should have enough training to do some troubleshooting on prod and to know when to call in a senior dev.
Main thing to hire for sysops IMHO is troubleshooting skills and ability to think on their feet. At my last company we had a production issue that was screwing up out app server. The system support guys were about to take us down and revert to last known good copy of the MOSS database Little old me, not a dev or a sysop, quickly figured out we didn't need to, and the problem was solved within about 5 minutes. The support guys said they would have never thought of what I reasoned to be a very obvious solution, given the symptoms. So there's that as well.
Re:Hire better people? by tehcyder · 2011-05-05 01:49 · Score: 1

I heard reports that people's WoW accounts were being hacked via their PSN passwords.
And why would it be Sony's fault that its customers used the same easily guessed password for other accounts too?

--
To have a right to do a thing is not at all the same as to be right in doing it
Re:Hire better people? by Anonymous Coward · 2011-05-05 02:00 · Score: 0

Eh, ales are usually considered an operational expense, since beer's only really a rental.
Re:Hire better people? by stewbacca · 2011-05-05 02:06 · Score: 1

Yes, because you are only successful in life by beating everyone else. And yes, there are many hungry people from other societies. What makes you so entitled to success over them?
And people wonder why America has such a large wealth disparity.
Re:Hire better people? by Time+Ed · 2011-05-05 02:54 · Score: 1

This exactly - specifically the first point. We've tested two DLP solutions including Checkpoints. They are not hard to use, especially if there's little encryption in your environment. Point it to your file servers and away it goes. It identifies everything - and similar to an IDS, you have to tell it what's valuable and what's not, and where those things should be. There's mountains of data that need to be sorted and cleared out, and getting anyone in upper management to decide what's "valuable" is a real trick.
Re:Hire better people? by Anonymous Coward · 2011-05-05 12:17 · Score: 0

I heard reports that people's WoW accounts were being hacked via their PSN passwords.
If their WoW accounts are being hacked via their PSN passwords, then that suggests they are using the same password for both. Yet another security mistake! Come on, people, at least change one character! Don't make it so easy!
Re:Hire better people? by CodeBuster · 2011-05-05 15:33 · Score: 1

What makes you so entitled to success over them?
Nobody is entitled to success. That was and remains my point. Success must be earned through competition and competition produces winners and losers. That is reality. I am successful in no small part due to my winning attitude. Losers make excuses, but winners make their own success.

And people wonder why America has such a large wealth disparity.
There will always be wealth disparity in a free society. That is neither surprising nor unexpected. For those who support freedom there is no other way. Indeed, greater equality through authoritarian enforcement leads only to an equal share of misery. The late Nobel Prize winning economist, Milton Friedman, said it best, "A society that puts equality before freedom will get neither. A society that puts freedom before equality will get a high degree of both."
Re:Hire better people? by stewbacca · 2011-05-06 00:37 · Score: 1

One can be highly successful without competition. Success is not measured by being better than somebody else.
And save your anti-hippy Friedman stuff, as I'm not advocating anything of the sort. I'm merely stating that one is not successful at the expense of somebody else...both can be successful independently of each others' successes and failures.
You telling everyone else they should "compete to win" is about as anti-freedom of an example as I could ever come with on my own. "You should do whatever the hell you want" is freedom. I'm not even a Libertarian but I can understand that simple premise.

It's another security buzzword product by MrEricSir · 2011-05-04 11:21 · Score: 4, Insightful

These things come and go in the security market faster than you can believe. The problem isn't the lack of need, it's that the security software market is a "me too" market filled with companies cranking out software that has the latest buzzwords. In the security industry, everyone just copies everyone's fad else instead of innovating and trying to find a more elegant solution to the underlying problem.

But it doesn't matter anyway, since these companies all target the suits instead of the IT folks. The suits will just buy whatever product sounds nice without consulting the people who will use or administer it. There's effectively no interaction between the vendors and their user-base. /rant

--
There's no -1 for "I don't get it."

Re:It's another security buzzword product by sco08y · 2011-05-04 22:45 · Score: 1

But it doesn't matter anyway, since these companies all target the suits instead of the IT folks. The suits will just buy whatever product sounds nice without consulting the people who will use or administer it. There's effectively no interaction between the vendors and their user-base. /rant
Yeah, I had to evaluate a security product, and the marketing material was definitely not meant for consumption by anyone with a remotely technical background. The hype was unbelievable, everything it did was totally game changing, and their acceleration hardware made things 60 times or 700 times or even 3500 times faster. They even claimed that their stuff was somehow better for the environment! After I started digging into it, they actually had a fairly promising product. But the hype made me think they were total scammers.

Average IT person is too simple by sdguero · 2011-05-04 11:23 · Score: 2

The quality of IT people I have worked with over the last 12 years has slowly degraded over time. We are at the point now where "sysadmins" have the skills that a helpdesk person had 10 years ago. I think there is just so much demand that you have to pay more than companies are willing to spend to get a quality sysadmin or network admin type of IT guy.

Re:Average IT person is too simple by DigiShaman · 2011-05-04 11:38 · Score: 1

That's half the problem. The other half is installing software and having it either break, or being too open ended of a solution. I'm speaking specifically of backup software and security (Backup Exec and McAfee come to mind). No, I'm not here to debug your shit. As an IT admin in a not-so-unreasonable world, my job is *supposed* to be about finding the right business solution and implementing it with technology to better serve said business. Yes, routine maintenance and checking backups is part of the role. But why should we be constantly subjected to shit products and solutions out there only to be blamed for when they don't work? Even after they're properly setup and configured. That other half is the vendors peddling their shit!

--
Life is not for the lazy.
Re:Average IT person is too simple by Anonymous Coward · 2011-05-04 11:41 · Score: 0

Perhaps it is simply because the skills one needs to perform system administration tasks has become far easier than in years before.
I haven't researched or read anything in advance of any Microsoft released product. I know how an AD works from the MCSE I had 10+ years ago. I haven't bothered to renew for several reasons. My customers don't require it and my job tasks don't require it.
I'm not defending lower quality staff but many tasks have become easier. I have not run into anything where I needed a certified individual. There's plenty of help on the web, plenty of documentation and if things go to shit too far, Microsoft support can help out with their undocumented fixes.
I will say that we recommend putting into place some security measures to our clients. They refuse on the basis of cost or inconvenience. That's it.
Our customers could blame us that it is "too complicated" but it is simply because it is for the user. Encrypted email isn't difficult but it is complicated when you have to do something more than clicking "send".
Re:Average IT person is too simple by theshowmecanuck · 2011-05-04 11:44 · Score: 1

Here is a theory: Economic times get tough. The best and most experienced (longest time in) IT people you have are paid the most. The suits decide that they need to trim the bottom line since business is down. They get rid of all those high priced IT guys and keep the low priced guys. Surprise IT is more complicated than the suits think and even though they are bright and well intentioned, the less experienced guys end up having to reinvent the wheel all the time since the bosses got rid of the wheel makers. Things ain't what they used to be...

--
-- I ignore anonymous replies to my comments and postings.
Re:Average IT person is too simple by jtownatpunk.net · 2011-05-04 11:46 · Score: 2

And the new trend from above seems to be shifting from Design, Test, Deploy to Imagine, Deploy, Damage Control.
Re:Average IT person is too simple by sdguero · 2011-05-04 11:47 · Score: 2

"I'm not defending lower quality staff but many tasks have become easier"

I think thats a big part of the problem. The initial barriers to get an IT job are lower than they used to be because things are easier. But now we have all these people that have no idea whats going on under the hood.
Re:Average IT person is too simple by jtownatpunk.net · 2011-05-04 12:04 · Score: 1

It's not just IT. I've watched my company gut every department except legal and accounting over the last few years. When I started here, a significant number of employees had been here for 10 years or more. At least a third of the staff. Some over 20 years. I was genuinely shocked to see that in this day and age. Not any more. I'm now considered an old-timer because I've been here longer than at least 80% of the employees.
Re:Average IT person is too simple by arth1 · 2011-05-04 12:16 · Score: 3, Insightful

And the new trend from above seems to be shifting from Design, Test, Deploy to Imagine, Deploy, Damage Control.
Imagine? Hardly. More like Purchase design, Outsource development, Purchase damage control.
Also, there is a shift away from understanding to knowing, and in this industry, knowledge is worthless. There's a man page for that. Understanding what really happens and why is what you need. Someone who knows why SElinux won't allow you to do something, and not just how to (far too common) turn off SElinux or (taking slightly more skills but no more brains) create rules to allow every complaint SElinux has.
There's also a management belief that security is a product you can implement after the fact. That's as futile as buying a kevlar vest to protect yourself from heart attack. To turn existing insecure infrastructure secure takes months or years of hard and continuous work - sometimes more than redesigning from scratch would do.
Re:Average IT person is too simple by Dhalka226 · 2011-05-04 14:48 · Score: 1

That's not a problem.
The problem is when people don't realize (or don't care) that entry level IT is often going to get you entry-level capability. A little server that does nothing but NAT, you can probably hire that teenager one of your co-workers knows and be fine. Low-level help desk stuff, no problem. Simplistic networking, sure. But if you're, say, Sony with tens of millions of users and tens of millions of credit cards stored on your system, you had damn well better find people much more qualified to the particular tasks you need accomplished.
In other words, there's no issue with the barriers to entry for IT; there's an issue with people being unable to comprehend or unwilling to pay for the appropriate people for a job.
Re:Average IT person is too simple by Hognoxious · 2011-05-05 06:41 · Score: 1

Is this taken from a SAT/GMAT question? If so, the answer is "impossible to say".
Without knowing how long you've been there, "I've been here longer than at least 80% of the employees." is pretty meaningless.

--
Confucius say, "Find worm in apple - bad. Find half a worm - worse."

Re:Alot of Enterprise Software is "too complicated by CohibaVancouver · 2011-05-04 11:26 · Score: 2

Well designed software is easy to use.

Did you RTFA? This isn't Donkey Kong Jr. we're talking about here. DLP software, while extremely sophisticated, isn't that hard to use - What's difficult is the requirement for a company to create business policies that define what data is critical and what isn't. If you turn the alerts up too high, end-users and IT security are bombarded by noise and warnings, making the system useless. If you turn the alerts down too low, then you run the risk of data leakage.

Consumer Protection by Anonymous Coward · 2011-05-04 11:27 · Score: 0

I can't just say SOX compliance is too complicated and not adhere to it. Isn't there a consumer privacy or protection law being violated?

Clippy by feedayeen · 2011-05-04 11:27 · Score: 2

Hello, I see that you are trying to encrypt and backup your customer data....

Re:Alot of Enterprise Software is "too complicated by Fluffeh · 2011-05-04 11:31 · Score: 3, Insightful

No, what it means is that a lot of responsibility that IT managers (and higher) are given, such as ensuring that confidential data is kept confidential, is either too hard for them, takes too much time or they are simply incompetent to fulful that role. I don't mean technically - it isn't just an IT managers role to tick the right boxes in a menu, I mean if THEIR managers are unwilling to spend the time, money and effort on their own, then it falls to the person to convince them of the need to do so.

--
Moved to http://soylentnews.org/. You are invited to join us too!

Re:Alot of Enterprise Software is "too complicated by jtownatpunk.net · 2011-05-04 11:32 · Score: 1

And enterprise users are dumb. It's a bad combination.

Too "complicated"?? by mailinator2 · 2011-05-04 11:41 · Score: 0

lol... i remember when a friend called me telling me avira-or-whats-its-called for windows was taking 11hours already to check his 500GB harddrive...

the next day he called me telling me avira-or-whats-its-called for windows had just finished checking his 500GB harddrive... it found nothing but his system was still broken...

i told him to give up repairing windows and just reinstall it... hours later he called me again and asked me if i would download avira-or-whats-its-called for windows for him so he can reinstall it..

i'd just hang up because such people make me sad for some reason... and i turned to my linux system and did some serious work... you know... that lame operating system luckily nobody cares about...

the end

Re:Too "complicated"?? by mailinator2 · 2011-05-04 11:46 · Score: 1

my email is bklibvhugzu@bobmail.info btw... slashdot is such a failure these days... i create content here out of pity... :D
Re:Too "complicated"?? by scdeimos · 2011-05-04 11:59 · Score: 0

I hate to break it to you, but linux isn't the solution to everything.
I use linux (I'm forced to use Windows at work), but when the IDS detected an attempted breach at my previous company a few years ago the source wasn't a Windows machine - it was an employee's linux machine at home that had its security config was royally screwed^H^H^H^H^H^H^H open and unfortunately had VPN access to the corporate network.
Re:Too "complicated"?? by DarwinSurvivor · 2011-05-04 13:22 · Score: 1

And how would a Windows or Apple (or anything else for that matter) computer have been any better in that situation?
Re:Too "complicated"?? by Anonymous Coward · 2011-05-04 13:25 · Score: 0

agree, and want to make up. Linux, Windows, different, we need to make use of the two, not always trying to kill one.
Re:Too "complicated"?? by smash · 2011-05-04 13:43 · Score: 2

that wasn't the point. the point is the gp was acting all smug like running linux instantly makes him more secure/suprior.
In the past decade i've dealt with many hacked machines, and they haven't all been windows. An idiotic enough user will result in any system being compromised. Which was the GP's point.

--
I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.

Mature market? by ToasterMonkey · 2011-05-04 11:42 · Score: 1

"can take two years to fully implement, he said."

"It's a mature market - please turn it on." John Vecchi

Well if it's mature already, maybe it just sucks?
Two years to implement a system that is 100% overhead, no services rendered! Fuck, that, shit. You're doing it wrong.

When will it catch on with software publishers & independent developers, that no matter how narrow your niche, there are very few excuses for utterly ignoring ease of use.

Free? : No.
Expensive? : No.
Really Expensive! : What are you smoking?
It's just hard work? : DUH, that's why you set out to make a tool for it right, it doesn't have to be a GD requirement.

Re:Mature market? by Darinbob · 2011-05-04 12:30 · Score: 2

I have never seen enterprise software that is easy to use. Almost all of it requires consultants of professional services to get it set up. That's because every corporation is unique with unique requirements and the software requires customization and integration.
Re:Mature market? by Anonymous Coward · 2011-05-04 12:36 · Score: 0

You might want to go back and read the article again. Your first quote was referring to DLP, which can indeed take two years to implement. The second quote was regarding IDS/IPS, which is very much a mature market.
There is one glaring reason that DLP is such a pain in the ass to use and that people leave their IPS devices in monitor mode: the environment they're deployed in is unmanageable. Organizations often have no IT security policy, or if they do, it is not enforced (or is written is such a way as to be unenforceable). Then they hire Skippy the A+ Certified d00d to run their security, give him no budget, no staff, and no authority and wonder why some script kiddie from Russia made off with 30 million credit card numbers.
There is no Easy Button for IT security.
Re:Mature market? by lgw · 2011-05-04 13:35 · Score: 1

That process of customization and integration? Yeah, that's what software is supposed to make easy for you. But it costs a software vedore money to provide usability, and they make money on professional services, so as long as the customers keep bending over for it, nothing will change.

--
Socialism: a lie told by totalitarians and believed by fools.
Re:Mature market? by Anonymous Coward · 2011-05-04 14:30 · Score: 0

"It's a mature market – please turn it on," Vecchi told TheReg.
Fooey.

Blah by Anonymous Coward · 2011-05-04 11:45 · Score: 0

blah! so then what is the need and we did because it must.

Also, by MrEricSir · 2011-05-04 11:46 · Score: 1

a lot of people think "alot" is a word.

--
There's no -1 for "I don't get it."

Re:Also, by icebraining · 2011-05-04 14:14 · Score: 2

http://hyperboleandahalf.blogspot.com/2010/04/alot-is-better-than-you-at-everything.html

--
Dilbert RSS feed

Re:Alot of Enterprise Software is "too complicated by xploraiswakco · 2011-05-04 11:46 · Score: 1

I've said this before, ease of use and security do not go hand in hand. In short they are generally not compatible.

The hard part is finding the right balance between them.

To complicated since its your personal data by magictongue · 2011-05-04 11:54 · Score: 1

Ever wonder why crackers only get consumer data and not highly embarrassing confidential data strategic to companies. Like to see the what the top brass really gets payed including entertainment, where does that corporate jet really go, and what is the companies 5 year plan. Notice how its only your data - your credit card information - that is cracked but not the CEO's bank account information or their personal information. Guess companies can figure it out when it really matters.

Re:To complicated since its your personal data by tqk · 2011-05-04 12:27 · Score: 1

Ever wonder why crackers only get consumer data and not highly embarrassing confidential data strategic to companies.
Air gap between between executive offices' LAN and the Production network. The former is easier to secure being much smaller, and less likely to be doing much beyond MS Office stuff, unlike Prod. where damned near everything has to communicate with everything else, and is connected to the net.

--
"Tongue tied and twisted, just an Earth bound misfit ..." -- Pink Floyd.
Re:To complicated since its your personal data by MysteriousPreacher · 2011-05-04 23:06 · Score: 1

Ever wonder why armed robbers only rob convenience store clerks and not CEOs? Like to see the what convenience store corporations are doing to protect their CEOs from being ordered at gunpoint to empty the register while allowing its clerks to assaulted and robbed. Notice how it's only clerks that are robbed at gunpoint, not the directors. Guess companies can figure it out when it really matters.
It's down to roles and exposure. There's less of a need to expose certain types of data, such as payroll and executive renumeration, to the world while customer data will have to be more exposed for it to be of any use. It doesn't excuse sloppy security for which anyone holding personal data should be held liable.

--
-- Using the preview button since 2005

Re:Alot of Enterprise Software is "too complicated by Anonymous Coward · 2011-05-04 11:56 · Score: 0

Vendors Say Data Protection Software Too Complicated To Use

I have no problem at all using my data protection software of choice:)

Can't protect broken systems by scdeimos · 2011-05-04 12:02 · Score: 4, Insightful

You can't just pile software on top of a broken system/design and magically have everything secure.

What surprises me in all this is that the banks are *not* jumping all over these companies for exposing consumer credit card information - whatever happened to PCI Compliance?

Re:Can't protect broken systems by ToasterMonkey · 2011-05-04 13:19 · Score: 1

whatever happened to PCI Compliance
"Will you be compromised in the next twelve months?" is not part of a PCI audit.
Besides, PCI-DSS is 99.9% common sense - codified. It's not a magic barrier.
Re:Can't protect broken systems by Anonymous Coward · 2011-05-04 14:04 · Score: 0

This is a perfect example of how well industry self-policing works.
Re:Can't protect broken systems by Anonymous Coward · 2011-05-04 15:01 · Score: 1

Also, when you get down to it PCI is a junk regulation with backwards rules, impossible requirements (100% compliance 100% of the time required to get benefits from it - think about that in the context of six nines not being good enough to comply...) and an enforcement set up that is insanely corrupt (company that does 80% of the assessments has former executives on the standards council and is hired by the banks to enforce the regulation...)
TLDR: PCI is a crap regulation designed to keep the suits in congress from regulating the credit card industry, not designed for keeping anything secure other than fat corporate wallets.
Re:Can't protect broken systems by hibiki_r · 2011-05-04 16:07 · Score: 2

Split control/dual knowledge is pretty decent protection,,, if it's actually implemented properly, that is. If PCI has a problem, is that, with the right auditor, you can bypass this by adding compensating controls that really don't compensate for anything.
If your own people can't get the encryption key, and your decryption services flash in pretty colors when unexpected levels of usage happen, PCI is better than a kick in the teeth.
Re:Can't protect broken systems by SpanglerIsAGod · 2011-05-05 04:15 · Score: 1

PCI isn't the Banks its the networks, VISA and Mastercard.

--
War doesn't show who is right - just who is left.

Re:Alot of Enterprise Software is "too complicated by ToasterMonkey · 2011-05-04 12:04 · Score: 2

Did you RTFA? This isn't Donkey Kong Jr. we're talking about here. DLP software, while extremely sophisticated, isn't that hard to use - What's difficult is the requirement for a company to create business policies that define what data is critical and what isn't. If you turn the alerts up too high, end-users and IT security are bombarded by noise and warnings, making the system useless. If you turn the alerts down too low, then you run the risk of data leakage.

WOW, that's funny how it suddenly becomes a business problem when this software shows up! A sane person would reason, if the software invented this problem, the software should fix it!

Christ, we're supposed to be SOLVING problems with computers!
This reminds me of enterprise backup implementations and shaking down non-IT organizations for data retention policies. Like it's their job to analyze the risks of [not] having snapshots of their data from arbitrary points in time other than YESTERDAY.

These both clearly map to the real world and are not entirely an invention of IT folks right??

idiots by Anonymous Coward · 2011-05-04 12:16 · Score: 0

fucking idiots. And the worst part is they reproduce.

Re:idiots by Noodlenoggin · 2011-05-04 12:43 · Score: 3, Funny

fucking idiots. And the worst part is they reproduce.
I know what you mean. Then they eventually browse their way to /. and make comments as an AC.

Re:Alot of Enterprise Software is "too complicated by sortius_nod · 2011-05-04 12:18 · Score: 1

The problem is that you have IT managers that are trained to manage not understand IT, IT admins that are trained in only MS software, and users who aren't trained at all on how to use software effectively.

I've seen this happen a lot in business, the bigger they are, the less emphasis there is on positive IT policies or employing IT professionals who actually know what they are doing. The main emphasis in big business is to climb the corporate ladder, buy stuff from vendors you get kickbacks from, and employ people who are cheap or friends of managers.

The IT side of business is not getting any better, we're seeing data breeches, hacked sites, and takedowns happening on some of the largest corporations in the world. These kind of things would not have happened if IT managers, admins, and users were trained properly or employed for the right reasons.

Re:Alot of Enterprise Software is "too complicated by c0lo · 2011-05-04 12:23 · Score: 2

In other words, alot of enterprise software is poorly designed.

Well designed software is easy to use.

I would't call ERP software (like SAP or Oracle financials) poorly designed, however setting up an installation up also takes years.

Looking into the specific differences between an ERP and DLP system may offer some explanation how come configuring an ERP is budgeted/paid for by the company while a DLP isn't.

1. Without an ERP, the guys that have the final say in approving a budget cannot work (CFO is blind): the impact is immediate and obvious. Without DLP, not so.

2. Even more, a ill-configured DLP (or even a well-configured one) is restrictive for all the users - sociopathic managers included - do I need to say more?.

3. Moreover, even if both of the system are in the "support for the process" category (not inherently on the direct line that gets income to the company), the ERP is "operational cost" (need it every day) while a DLP is a "risk prevention cost" (money someone will pay for "just in case").
Risk management is more specialized, more complicated and requiring more imagination than financial management: the difference between "how and what can go wrong in various and possibly obscure points of my business? Who would benefit of something going wrong for me; who's the possible attacker?" and "How much was spend and what revenue you think you'll get in the next FQ or FY from this-and-that well-known market segments"?

One on top of the other, the CEO/CFO and the minions will need to leave their mental-warm-and-comfy-place to understand the need for a well-configured DLP and approve/pay-for a 1-2 years contract with a specialized team of contractors to set the security systems (DLP included) in place. Its akin requesting an accountant to show imagination - an almost oxymoronic concept.
That until something extremely bad happens (think Sony)...

--
Questions raise, answers kill. Raise questions to stay alive.

Bullshit Excuse by Anonymous Coward · 2011-05-04 12:27 · Score: 0

DLP is the "most disappointing" portion of the security market primarily because of the amount of time it takes companies to identify the data they want to protect, create profiles and taxonomies to categorize it and put in place the software that will protect it, John Vecchi, head of global product marketing for security vendor Check Point told a Register reporter at the company's annual conference today. Impressively sophisticated applications that can differentiate top-secret plans for next year's product from ho-hum plans for one from five years ago – and apply security policies that don't allow secrets to be copied or carried out of a secure networks, for example – can take two years to fully implement, he said.

Sorry but DLP didn't have to be universally deployed throughout Sony for it to be effective in protecting a couple of customer databases and their various associated processes and dataflows. I've done it more times I can count, it's not that difficult for a company with the resources Sony has. Given the fact Sony doesn't even have a process for ensuring updates are applied properly across various inter-dependant components I doubt they even investigated using DLP let alone decided it was just "too complicated".

Contrary to the headline, it's "vendor", singular by joeflies · 2011-05-04 12:28 · Score: 4, Informative

The article is about a quote from a marketing mouth from a single vendor, Check Point, who made a sound bite about how hard DLP is to use. And, just by coincidence, they're announcing a security product that is easy to use!

Alternative reading by artor3 · 2011-05-04 12:29 · Score: 1

It takes thirty hours of training to use the product, and our IT guys are simply too busy putting out fires to get the training.

Re:Alternative reading by swb · 2011-05-04 12:45 · Score: 1

That's what I read into it.
And it's not a question of hiring "better" people -- sure, there are plenty of shops carrying a certain amount of dead weight, but I don't think that spending the same money for fewer, better people will necessarily be the solution.
I think you need a combination of more people and a way to improve your better people by providing access to more training.
Where I work, we're constantly bombarded with requests to obtain certifications or "get up to speed" on products yet no manager EVER makes a point to send someone to training to learn how to use a product correctly.
So we "figure it out on our own" -- usually we get it right, but I also see a ton of features that nobody has a strong enough grasp or enough time to learn on their own.
Re:Alternative reading by Archangel+Michael · 2011-05-04 15:56 · Score: 1

This is a sign of HUGE problems. Even if you're not experiencing them yet. If your IT guys are running around putting out fires then there are not enough fire suppression systems in place.
The problem is, that the people with the purse strings aren't in the IT department, don't care about IT, unless it affects them directly. In which case, you let the fires burn.
Good IT takes money, skill and guts. Money to get the products that work, skill to implement it, and the guts to tell people to mind their own business and stay out of IT decisions unless they are in IT. Where else does the Marketing Department get to tell Accounting how to count ? Why do other departments get to tell IT how to do IT?

--
Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.

Now! Now! by Anonymous Coward · 2011-05-04 12:41 · Score: 0

Don't try to say that knowing how to encrypt data with specialty tools should be a pay-raise. We've all sent encrypted messages in childhood to bypass detection by others, so what is the difference? Encryption is practically all over elementary fiction novels, so why not in the workplace?

Re:Contrary to the headline, it's "vendor", singul by Toam · 2011-05-04 12:43 · Score: 5, Funny

It's weird that this article shows up - I've got the "Ads Disabled" option checked...

Re:Alot of Enterprise Software is "too complicated by mt1955 · 2011-05-04 13:04 · Score: 1

Did you RTFA?

This is slashdot, right?

Re:Alot of Enterprise Software is "too complicated by lgw · 2011-05-04 13:17 · Score: 2

It's not that enterprise users are dumb, it's that they care about their actual job, not some crappy software (OK, some of them are also dumb).

--
Socialism: a lie told by totalitarians and believed by fools.

Re:Alot of Enterprise Software is "too complicated by lgw · 2011-05-04 13:19 · Score: 1

I would't call ERP software (like SAP or Oracle financials) poorly designed, however setting up an installation up also takes years.

So, they're well designed as a jobs program for consultants, but they're pretty damn craptastic at being ERP software.

--
Socialism: a lie told by totalitarians and believed by fools.

Re:Alot of Enterprise Software is "too complicated by Anonymous Coward · 2011-05-04 13:27 · Score: 2, Funny

The main emphasis in big business is to climb the corporate ladder, buy stuff from vendors you get kickbacks from,

So which vendors are these? I'm apparently doing it wrong....

in other news by smash · 2011-05-04 13:35 · Score: 1

... my job is hard, i don't want to do it. but pay me any way. cheers.

--
I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.

Re:Alot of Enterprise Software is "too complicated by cavreader · 2011-05-04 13:44 · Score: 2

Over the past 23 years I have also seen how large corporations manage their IT departments and I have seen quite a few competent IT managers that have actual development experience in their backgrounds. I have also not seen any evidence of kickbacks from vendors being SOP as you stated. Contrary to popular belief there are some corporations that do support and manage their IT departments policy, intelligent hiring practices, and well thought out procedures. Trying to reconcile the IT data handling requirements with the business data requirements can be difficult. Just like the parent in this thread said it can be a fine line between securing data while also providing access.

Re:Alot of Enterprise Software is "too complicated by donaldm · 2011-05-04 14:14 · Score: 2

Saying software is "Too complicated" is usually a cop-out by the users and the managers that are involved in purchase and/or use of that software. Most backup software while sophisticated is fairly user friendly however many managers don't really know (or care?) what is really required to set-up a backup and recovery solution.

On of the problems with setting up a reliable IT disaster recovery solution (I will stick to backup and recovery here) is for management to decide on the requirements. The most common solutions are basic spot and full recovery which could include multi petabytes of data and what could called base metal recovery in that only the basic OS is recovered after a system disk failure. Yes many companies still don't mirror their system disks although system disk or even data disk mirroring does not prevent deliberate or accidental corruption. Both of these backup and recovery techniques may require different software and this needs to be taken into account.

Another aspect of backup and recovery is on-site, near-site and off-site storage of backup media with costs varying from a few hundred dollars to millions of dollars.

Even after careful backup and recovery design you still need to test the recovery otherwise the company may be extremely embarrassed when a failure occurs. I have actually seen backup software that was configured to back up all the database infrastructure but failed to actually backup the database so that when the hard disk containing the data failed the company lost all its database which proved to be very costly. The person concerned with implementing the backup never tested a recovery which would have immediately shown that he had failed to include the database data in his backup software. I am quite sure many people here can come up with more horror stories of this nature.

--
There ain't no such thing as proprietary standards only proprietary formats. Standards are by definition open.

Re:Alot of Enterprise Software is "too complicated by AK+Marc · 2011-05-04 14:19 · Score: 5, Insightful

We just finished royally screwing up a database project. The database is mostly worthless because it assumes a set of non-existent processes. The business unit demanding the new database wanted better processes in place. But wouldn't define them. So the programmers had to put something in, and programmers who don't know what our business is have now defined our business processes (and poorly, of course) because the people demanding the magical database be built that fixes all their problems couldn't even be arsed to define what their problems were.

It's like having recipe software which you put recipes in, along with cooking instructions, and a robot makes the item. Then, once you have all the ingredients in, you realize you didn't have any cooking instructions. So you complain that the software doesn't have default cooking instructions programmed in that would just magically make cookies or cupcakes without you having to do all that extra work.

The problem isn't the software. It couldn't be any more user friendly. Just tell it what you want, and poof, it will pop right out. The problem is that the users can't be bothered figuring out what they want, so the software is at fault.

--
Learn to love Alaska

Re:Alot of Enterprise Software is "too complicated by donaldm · 2011-05-04 14:27 · Score: 3, Interesting

And enterprise users are dumb. It's a bad combination.

No, many users only do what they are told and in the majority of cases the blame rests firmly with the managers. In the enterprise managers like to "de-skill" users (Management 101) by placing them into restricted rolls. Some Managers hate professional people since these people are usually multi-skilled and leave if they are forced down a narrow skill path. The consequence of de-skilling is you end up with people who are poorly trained, but of course Management covers itself by stating that the users are not skilled enough and more training is needed so after that training those people who are a little smarter leave for better pay and conditions and so the circle repeats itself.

--
There ain't no such thing as proprietary standards only proprietary formats. Standards are by definition open.

Re:Alot of Enterprise Software is "too complicated by AK+Marc · 2011-05-04 14:28 · Score: 1

Trying to reconcile the IT data handling requirements with the business data requirements can be difficult. Just like the parent in this thread said it can be a fine line between securing data while also providing access.

There should be little, if any, push back from IT to well defined business requirements. What I find is the "fine line" where IT recognizes bad business requirements and those in charge of defining business requirements don't (such as giving every administrative assistant in the company full permissions to every file because their bosses can't be bothered to actually do their jobs and the admin assistants back each other up so when one is out sick, any of the others in the entire company may be taking their place that day).

Yes, I've seen more than one database where the administrator of the database in IT had lower permissions than almost everyone who used it (though they could instantly elevate them, if necessary), despite working with it in a much greater capacity, and often then fixing screwups that would have been fixed if permissions were set according to reasonable business requirements.

But a business where the managers wanting a secure but usable database and are willing to define both of those terms almost always get what they want without any interference from IT, and no balancing act/reconciliation is necessary. It's only when they demand a "secure" database, but every manager and secretary in the company must have full access to the database (even what they'd never need or use) because they are management or support management, where I see there being a problem between IT and others. And it's not IT's fault, other than not being able to explain their points clearly enough to the people involved so that they understand what the issues are.

--
Learn to love Alaska

Re:Alot of Enterprise Software is "too complicated by donaldm · 2011-05-04 14:57 · Score: 1

I would't call ERP software (like SAP or Oracle financials) poorly designed, however setting up an installation up also takes years.

The software you mentioned only includes backup methods to backup software. By themselves any backups are crude.

Setting up a backup solution for SAP or Oracle Financials should at the most take a few days although that is assuming your backup hardware and software is inplace. Even a recovery should if you have the appropriate backup hardware take a few hours in a worst case scenario. I won't de-nigh that the set-up of an enterprise database with appropriate computers, storage, backup hardware and software can take a while (a few months) but a few years? I would love to be on that type of project I could do with an extra mansion :) With SAP we have a 2, 5, 7 proportion that being "2" for the hardware, "5" for the software and "7" for the consulting and we will tell you when you can close your cheque book ;)

One big problem I have found in the enterprise is security. With Oracle the DBA's don't like security software (example: SElinux) turned on since they need to arrange for ports to be opened and in the majority of cases this falls into the "too hard" category.

Actually with regard to Sony does anyone know what OS they were using with their database and what that database was? For crackers to get database information this would not really reflect on the OS since the blame in the majority of cases would fall on the DBA's.

--
There ain't no such thing as proprietary standards only proprietary formats. Standards are by definition open.

Re:Alot of Enterprise Software is "too complicated by Anonymous Coward · 2011-05-04 14:59 · Score: 0

then it falls to the person to convince them of the need to do so.

It falls to the manager to hire someone competent and then listen to what they have to say. If a manager wants to know why and what data security he needs he should take a class. If he wants to be a manager he should manager. Responsibility should flow up the chain of command not down.

Re:Alot of Enterprise Software is "too complicated by c0lo · 2011-05-04 15:22 · Score: 1

I would't call ERP software (like SAP or Oracle financials) poorly designed, however setting up an installation up also takes years.

... can take a while (a few months) but a few years? I would love to be on that type of project I could do with an extra mansion :) With SAP we have a 2, 5, 7 proportion that being "2" for the hardware, "5" for the software and "7" for the consulting and we will tell you when you can close your cheque book

As TFA says: installing and configuring a DLP is not very hard in itself, but

DLP is the "most disappointing" portion of the security market primarily because of the amount of time it takes companies to identify the data they want to protect, create profiles and taxonomies to categorize it .

I imagine that is where most of the time (and consulting paychecks) go into.

--
Questions raise, answers kill. Raise questions to stay alive.

Re:Alot of Enterprise Software is "too complicated by grcumb · 2011-05-04 15:24 · Score: 1

I don't mean technically - it isn't just an IT managers role to tick the right boxes in a menu, I mean if THEIR managers are unwilling to spend the time, money and effort on their own, then it falls to the person to convince them of the need to do so.

You know, there used to be these things called ethics (mostly honesty, trust and integrity) that all the good workers brought to the office every day. But that was way back in a time when companies actually invested in their staff, looked after them for the better part of their career and in return expected them to protect the company's interests.

This good conduct was policed with a degree of strictness and care by managers, who were held responsible for the materials under their control.

Now, however, we have Data Protection Software. Oh Brave New World, that has such applications in it!

--
Crumb's Corollary: Never bring a knife to a bun fight.

Re:Alot of Enterprise Software is "too complicated by cavreader · 2011-05-04 15:37 · Score: 1

I have also seen things like admin accounts being used by a group of people. Especially developers. The worst is when the developer hard codes the DB sign in information in the app config file they are working on and sometimes forgetting to remove the hard coded account when the app leaves the development department.

Maybe its because...it doesn't exist by Anonymous Coward · 2011-05-04 16:28 · Score: 0

There is no such thing as software that prevents data theft. Once you accept that, you can finally get down to doing real security.

There are still stupid site operators.... by QuietLagoon · 2011-05-04 16:43 · Score: 1

... for example a major site, dslreports.com, recently had an intrusion. Its customers' info was stolen, yet the admins of the site try to pass off the intrusion as something that just happens. Never mind that the admins have chosen (and still seem to not realize the problems with) two-way password 'encryption'..

Until site operators decide to properly secure the back-end data on their sites, no amount of front-end security will stop the insecurity designed into their sites.

Re:Alot of Enterprise Software is "too complicated by d6 · 2011-05-04 17:27 · Score: 3, Insightful

"If you don't give me a spec, whatever I give you meets spec."

say it, mean it and give em a lot of shit when they balk at the end result. Next time, they find time for the non coding parts of the SDLC.

Whoosh! by sjames · 2011-05-04 17:39 · Score: 1

Don't blame IT staff for this one, blame reality. Big surprise, they are unable to configure the magic beans to intelligently and proactively read and understand all outbound data and decide if it should or should not go out based on best practices and corporate policy! All without accidentally telling the CEO no even if he's sending porn to his golf buddies.

Since AI doesn't work that well on this type of problem yet, especially in real-time, we just expect them to work out every scenario in advance so it can quickly look it up in a table. I'm sure that can't be hard, but we'll be generous and allocate 12 man hours for that.

But just in case it turns out to be too easy, we'll store our most sensitive data on other people's servers.

Of course it's too complicated to use. That's because it doesn't (and can't for years to come) have the necessary AI capability in the first place.

Meanwhile, we apparently can't get people to apply their own natural intelligence to the same problem in the form of not sending that stuff out of the LAN in the first place.

Re:Whoosh! by SpanglerIsAGod · 2011-05-05 04:20 · Score: 1

Indeed.

--
War doesn't show who is right - just who is left.

Dealing with a breach is even more complicated. by Animats · 2011-05-04 18:22 · Score: 5, Informative

Read "What To Do if Compromised", the official instructions for merchants who accept VISA cards. Sony is clearly doing some of the things VISA requires: "Do not access or alter compromised systems, i.e. don't log on at all to the compromised systems. ... Do not turn systems off. Isolate compromised systems from the network ..." Then they have to call the VISA Incident Response Manager, and the full list of compromised cards has to go to VISA, which parcels it out to the issuing banks for card cancellations and reissues.

VISA has the contractual right to send in a forensics team. VISA will assess fines up to $500,000 if VISA's security requirements haven't been met. If compromised data includes PIN numbers for debit cards, or CVV2 data for credit cards, which merchants aren't supposed to store at all, VISA sends in a Qualified Security Assessor. They check that the systems are no longer storing that data, and that all historical data of that type has been erased, before they go back on line.

Now it's clear why Sony is off line. Their actions look like what happens when a major debit card breach occurs and VISA sends in the forensics and security teams.

So there's your answer when management doesn't want to have proper security on credit card data. VISA can and will shut temporarily down your ability to accept payments. You'll have law enforcement, forensic auditors, and security experts questioning your management. Your company may have to pay sizable fines to VISA. Your CEO may have to explain the screwup to reporters.

And that's the good case. The bad case is when VISA decides you don't get to accept credit or debit cards any more, permanently. This happens routinely to screwed-up small businesses.

Re:Dealing with a breach is even more complicated. by Agripa · 2011-05-05 06:56 · Score: 1

If compromised data includes PIN numbers for debit cards, or CVV2 data for credit cards, which merchants aren't supposed to store at all, VISA sends in a Qualified Security Assessor.
How do recurring payments work without PINs or CVV2s? Is there some type of continuing authorization which assumes that the price does not change?

All software is way too complicated. by CondeZer0 · 2011-05-04 18:50 · Score: 1

Enterprisey software is specially bad, but the Unix principles of KISS and "do one thing and do it well" have long been forgotten by the software industry (or corrupted into "lets treat the lusers as if they are completely retarded, and lets hide all complexity under the carpet, where it can ferment until it explodes in a mass of bloated detritus and bugs").

--
"When in doubt, use brute force." Ken Thompson

Re:Alot of Enterprise Software is "too complicated by RogerWilco · 2011-05-04 18:57 · Score: 1

while a DLP is a "risk prevention cost" (money someone will pay for "just in case").
Risk management is more specialized, more complicated and requiring more imagination than financial management: the difference between "how and what can go wrong in various and possibly obscure points of my business? Who would benefit of something going wrong for me; who's the possible attacker?" and "How much was spend and what revenue you think you'll get in the next FQ or FY from this-and-that well-known market segments"?

I think that in general the banking crisis has shown us that even companies that should be experts at risk assessment often mess it up. I think that's where the general problem lies:
Managing and calculating risks is a hard thing. People tend to downplay or ignore risks, especially less obvious ones, even in nuclear plants or New Orleans.
One of the reasons of course is, that it's planning for the unknown. Often you don't have all the information and know all the threats.

--
RogerWilco the Adventurous Janitor

Yawn. Here we go again. by cheros · 2011-05-04 20:16 · Score: 1

Let me see if I get this right. You can save it as a template.

1 - problems occur with Data Loss
2 - every vendor jumps on it with a "solution" product
3 - execs buy such product to make it appear they have done something
4 - nobody bothers to look at the actual problem, processes and possible alternative approaches
5 - the software doesn't deliver, a discovery made after spending a fortune on consulting to fit an essentially square peg in a hole that was actually round to start with (but nobody bothered to check that upfront).
6 - because the "solution" isn't, return to 1

Did I miss anything?

--
Insert .sig here. Send no money now. Owner may sue, contents will settle. Batteries not included.

McAfee DLP==FAIL by Anonymous Coward · 2011-05-04 20:41 · Score: 0

My company spent over $1M and more than a year later the system doesn't work, but management is too embarrassed or too clueless to pull the plug and demand compensation.

Ipad 2 64gb + wifi + 3G : 330 USD by addtostock3 · 2011-05-04 21:26 · Score: 0

welcome to our website: ========== http://www.addtostock.com/ =======

Good news to tell you: Yes , Trust your eyes! it's really!!! , 100% original , come withinternational warranty! free shipping ,P A Y P A L accepted! Fast and door to door delivery!

Macbook pro laptops i7 $280- 520 U S D

Apple iPhone 4G 32GB $260 USD

Ipad 2 64gb + wifi + 3G $330 USD

New Ipod touch 64gb$120 USD

Dell Alienware M17x laptops: $700

Dell Alienware M15x $500

MacBook Pro MC024 LL/A $510

MacBook Pro MC373 LL/A $485

BlackBerry Pearl 3G 9105$350

Nikon F 6 - SLR camera - 35mm$685

Nikon D3000 (with 18mm-55mm and 55mm-200mm lens)$315

Nikon D3X SLR Cameras$985

Canon EOS 5D Mark$565

Playstation 3 PS3 Metal Gear Solid 4$220

Free shipping , P A Y P A L accepted! Fast and door to door delivery!

Re:Alot of Enterprise Software is "too complicated by Kamiza+Ikioi · 2011-05-05 00:22 · Score: 1

The problem I often face is similar. Except that I like digging in to such software, making it work. The problem is that companies want dumbed down programs, so that my job is easier to fill should I up and leave. I completely understand their position. But it is very limiting, especially considering I work in mixed win/osx/nix environment, so the job won't be filled by some guy off the street anyways.

--
I8-D

Re:Alot of Enterprise Software is "too complicated by MrMarket · 2011-05-05 00:43 · Score: 1

But, it starts with policy and process. Our organization had a breach and they jumped right to the technology before making sure they had the policy right and getting technology to enable that policy. So, instead of having a tiered risk model for information, they carpet-bombed the enterprise and locked everything down. Productivity has probably taken a 40% hit.

Re:Yawn. Here we go again. by neo-mkrey · 2011-05-05 01:16 · Score: 1

3b - Profit??

Re:Alot of Enterprise Software is "too complicated by stewbacca · 2011-05-05 01:32 · Score: 1

...the bigger they are, the less emphasis there is on positive IT policies or employing IT professionals who actually know what they are doing.

Wait, I thought the bigger they are, the more likely it is they work in IT? I kid, I kid...

To be fair to the IT guys, this is true throughout the entire organization. Granted IT guys' personal, err, shall we say, quirks, only amplify the problem.

Re:Alot of Enterprise Software is "too complicated by stewbacca · 2011-05-05 01:36 · Score: 1

"If you don't give me a spec, whatever I give you meets spec."

Yeah, let's skip the whole, maybe-I-should-ask-the-customer-what-it-is-they-want business and just jump right in!

say it, mean it and give em a lot of shit when they balk at the end result. Next time, they find time for the non coding parts of the SDLC.

Next time they hire somebody else.

Re:Alot of Enterprise Software is "too complicated by stewbacca · 2011-05-05 01:39 · Score: 2

Saying software is "Too complicated" is usually a cop-out by the users and the managers that are involved in purchase and/or use of that software.

Yeah, god forbid you'd ever want to take the end-user's opinion into account. Or wait, maybe that's the cause of bad software--devs write to what they want and not what the users want.

I'm a software trainer. We spend probably 25% of our time collectively laughing at bad software practices and wondering out loud who on Earth thought that widgetX was a good idea. The cop-out is on the developer's side, not the user. If something doesn't work well or is overly cumbersome and there's a better way to do it, the user isn't copping out, the developer (or the Program Manager, or the SE, or whoever made the decision not to make the software better) copped out.

Re:Alot of Enterprise Software is "too complicated by tehcyder · 2011-05-05 01:41 · Score: 1

Did you RTFA?

This is slashdot, right?

I assumed GP was going for a +11 funny

--
To have a right to do a thing is not at all the same as to be right in doing it

Re:Alot of Enterprise Software is "too complicated by stewbacca · 2011-05-05 01:46 · Score: 1

Well said. I think most users' frustration comes from the fact that most (anecdotal) companies err too far on the side of security. Example being my current prime contractor requires us to send emails encrypted, even the most mundane, yet seemingly every other day somebody's cert is out of date, incompatible, broken, whatever. It makes it impossible to do work. Instead, I pick up my unencrypted telephone and talk to the person.

Another anecdote would be the ridiculous 15 character, two upper, two lower, two numbers, two special character password requirement just because ONE of our customers (not one I work with) is military and that is the military requirement. It changes every 45 days and can't be the same on any one of the three networks I use. Yeah, right, of course I'm not gonna write down any of the three 15 character passwords anywhere in any of my notepads anywhere.

Re:Alot of Enterprise Software is "too complicated by Dog-Cow · 2011-05-05 01:57 · Score: 0

Your reading comprehension falls below zero. You must be on the business side of things, not IT.

Trolling... by otaku244 · 2011-05-05 03:16 · Score: 1

Ok, I know this isn't FTA, but the headline just made me angry. I have friends in the medical and banking industries and I hear stories from them all the time about how much work it takes for them to make sure that information is kept private. I work for a government contractor and I spend almost my entire day making sure our systems are secure. Truth be told, it isn't cheap to keep people's information secure... BUT WE DO IT!!! What is the result? You rarely hear of a data breach on these industries that involves a good hack. Breaches are usually limited unless it's an inside job. Now, there isn't a vendor of any good I know who has decided that information security is something worth paying a dime for. I hear everyone from lawyers to corner-store shop-keepers tell me it's too complicated and expensive to implement basic security (like putting a password on their WAP) or even a decent backup system (like an external HDD and some backup software). In the end, WHEN these businesses have their data leaked and WHEN they lose their DATA, WE ARE ALL PAYING FOR IT!!! If you are a vendor and you are reading this, remember this: if you tell me (or possibly any IT person) these excuses, all we hear is that you are CHEAP and LAZY.

--
Mod me down, I shall become more off-topic than you could possibly imagine.

Re:Alot of Enterprise Software is "too complicated by CCarrot · 2011-05-05 04:05 · Score: 1

I'm a software trainer. We spend probably 25% of our time collectively laughing at bad software practices and wondering out loud who on Earth thought that widgetX was a good idea.

So...I take it you get a lot of business from companies who insist on forcing their employees to use Bloatus Goats, er, I mean Lotus Notes?

Yet another example where the devs are big fans because 'it can do so much more than just email!', but the actual user is left in a mess of pain trying to use the end result for what they need it to do...which is, 90% of the time, just frigging email...

--
"I love animals! Some are cute, others are tasty, what's not to like?" - Betsy Schroeder, Jeopardy contestant

Re:Alot of Enterprise Software is "too complicated by jtownatpunk.net · 2011-05-05 04:13 · Score: 1

If part of their job involves working with sensitive data, protecting that data IS part of their job. Understanding how to use the tools necessary to provide that protection IS part of their job. But many people think that learning such things is beneath them and that it's IT's job to figure out how to design a system that doesn't require thought or comprehension.

Re:Alot of Enterprise Software is "too complicated by cdrguru · 2011-05-05 05:11 · Score: 1

I used to work for a company that built the absolute #1 MVS security product. It was great because through it and its very flexible rules specification you could ensure that users only had access to files and resources they were actually supposed to have access to. Sounds wonderful, right?

Except for one little problem. It was incredibly difficult to set up. Let's take your average medium-size company. How many individual files do you think there might be on on-line media? Millions is probably not an exaggeration. Can you imagine crafting a rule for each file? How about imagining crafting a generic set of rules for files in specific places in a heirarchy but having to deal with exceptions that nobody thinks of until the user is blocked?

Just to get that MVS security system up and running at all generally took a year for most users. I would expect nothing less for what is being described here because it is pretty much the same thing. The result is that this is the sort of project that never gets finished and keeps getting put on the back burner.

It has nothing to with the complexity of the software but everything to do with the complexity of what is needed. Trying to define roles of users and the access to resources they should have after the fact is very, very time consuming and will result in a lot of failures. A failure means disruption and can mean failure to comply with some regulation which results in a fine. Can you imagine that this isn't something real popular with upper management, even when they mandate the implementation?

Re:Alot of Enterprise Software is "too complicated by stewbacca · 2011-05-05 06:02 · Score: 1

Yes, I see. Your lack of people skills is what is prohibiting my comprehension, evidently. Care to elaborate on my reading skills further?

You said, without specs, you'll just go off and make whatever you want and then the customer has to accept that, which is a horrible practice, and not at all how business works between a supplier and the customer. You should never start a single line of code until the requirements are hammered out, in place and agreed upon by all parties. Best case you might provide some nice ideas they like and accept, worst case is you do a bunch of work that you won't get paid for. And with your attitude, they won't hire you back either.

Re:Alot of Enterprise Software is "too complicated by ToasterMonkey · 2011-05-05 12:51 · Score: 1

So you complain that the software doesn't have default cooking instructions programmed in that would just magically make cookies or cupcakes without you having to do all that extra work.

Yah actually, that is what I'm complaining about. I want a cupcake, I'll settle for the recipe, but just the ingredients? Thanks for nothing.

Example: LDAP, Kerberos, DNS vs.
Active Directory

Sure, you _could_ use the above technologies to accomplish what AD does, with a ton of time, and still not get to the point where ISVs can even dream of integrating with it. There are an infinite number of ways to implement an authentication/delegation/identity/system management/configuration management/service advertising solution etc., and then there is Active Directory. The cupcake won.

The problem is that the users can't be bothered figuring out what they want, so the software is at fault.

See, that's your problem right there. You can't just ask the users what they want.
Steve Jobs was right when he said this "You can't just ask customers what they want and then try to give that to them. By the time you get it built, they'll want something new."
My favorite illustration of this mistake is the Homer Car http://simpsons.wikia.com/wiki/The_Homer
That is the wrong way to design _anything_, including software.

If you can't figure out how to turn your pile of crap ingredients into a cupcake, then what chance do your customers have? That is what "box of ingredients" software tells me, the authors have no idea what to do with it.

Re:Alot of Enterprise Software is "too complicated by AK+Marc · 2011-05-05 13:41 · Score: 1

Yah actually, that is what I'm complaining about. I want a cupcake, I'll settle for the recipe, but just the ingredients? Thanks for nothing.

All you have to do is tell it the recipe (ingredients plus instructions) and it will give you a cupcake. But the users want to just say "cupcake" and have one magically appear. Sure, they could have defaulted the software to make everything a cupcake, but then the guy that wants banana bread will complain that he got a cupcake instead. He could have checked the box for "bread" rather than accept the defaults and complain about them, but that's what he did.

What you are proposing isn't a development project to explicit requirements. What you are proposing is a psychological experiment trying to predict what people will want 2 years after the project is over. That's fine and dandy. People do that. But that isn't software development. It's stupid to do so for a development project. When you get it done and the person who commissioned it says "I requested it do XXX" and you respond "I heard you, but I know you are an idiot user, so I excluded that feature because you'd really rather have YYY instead." I'd expect employees following your advice to be fired, and consultants following it to be sued.

If you can't figure out how to turn your pile of crap ingredients into a cupcake, then what chance do your customers have?

The customers don't even know they want a cupcake, and if they did, wouldn't be able to tell you what one is, just that what you gave them wasn't it. You aren't advocating sound development processes. You are advocating Development By Ouija. Whether that works for Apple is irrelevant to the question of whether that's an acceptable practice for software development. And it's most certainly not an acceptable practice for software development.

--
Learn to love Alaska

Re:Alot of Enterprise Software is "too complicated by ToasterMonkey · 2011-05-05 14:59 · Score: 1

We can argue the theory until we are blue in the face, but we can't ignore all the good software out there and the reality of what separates winners from losers.

There is a clear trend, "Let me show you how you should be doing that." and general ease of use.

We wouldn't be having this discussion if Data Protection Software wasn't a PITA to use. You can blame the customer and we'll be back here a few years having the same argument over why people still aren't using it correctly, or at all. Or, someone will figure out how to bake Data Protection Pie and steal everyone's lunch. /food

Re:Alot of Enterprise Software is "too complicated by Anonymous Coward · 2011-05-05 15:49 · Score: 0

The posts you reply to are by two different authors.

Clearly, you haven't read the thread. I see your generally negative posts all over. Trying to bump your karma count so you can use this account to moderate your other accounts? You smell like a troll to me.

Re:Alot of Enterprise Software is "too complicated by AK+Marc · 2011-05-05 16:22 · Score: 1

All QoS software is a PITA to use. Why? Because QoS, as a concept, is hard. When the concept is hard, it is necessary that all implementations that are powerful must necessarily be as hard to use as the concept behind them. Making it more simple is possible, but necessarily removes capabilities.

Your argument is that Mathematica is bad software because math is hard. Or that if I can't make an accurate flowchart in some software program that the fault is that of the software maker because they should have help that guides me to the correct answers. GIGO. And if the developers aren't smarter than every user combined, then the software must either be extensible in some way (and thus "hard" since you asserted that requiring any useful input from the users makes it necessarily poor software), or the users are a bunch of morons better suited to crayon and colored paper (and maybe some safety scissors, but I'm not so sure about that, you can still cut yourself with those if you really try).

--
Learn to love Alaska

Security Becomes a Way of Life by PennMan · 2011-05-08 05:11 · Score: 1

As a member of the Department of Defense community, security becomes a way of life. In a fast-paced, highly classified operation "too complicated to use" is an unacceptable excuse. So, a built-in, systems approach is used, including hardware, software, and human, i.e., physical. The organization does need a security officer or administrator for surety. All that leaves you to deal with is your mission critical stuff, physical security and document protection. Thus "operating" data protection software never is an issue. A piece of cake? Never!

Slashdot Mirror

Vendors Say Data Protection Software Too Complicated To Use

153 comments