Slashdot Mirror


Ask Slashdot: Are Companies Under-Investing in IT?

Long-time Slashdot reader johnpagenola writes: In the middle 1970's I had to choose between focusing on programming or accounting. I chose accounting because organizations were willing to pay for good accounting but not for good IT.

Forty years later the situation does not appear to have changed. Target, Equifax, ransomware, etc. show pathetically bad IT design and operation. Why does this pattern of underinvestment in and under-appreciation of IT continue?

Long-time Slashdot reader dheltzel argues that the problem is actually bad hiring practices, which over time leads to lower-quality employees. But it seems like Slashdot's readership should have their own perspective on the current state of the modern workplace.

So share your own thoughts and experiences in the comments. Are companies under-investing in IT?

203 of 325 comments (clear)

  1. Because greed. by Gravis+Zero · · Score: 5, Insightful

    The problem is always the same: how to scrape by paying the minimum amount for labor and supplies. It's literally called cutting corners. It's not a new problem and it only really gets solved through the application of regulation.

    This isn't rocket science, people!

    --
    Anons need not reply. Questions end with a question mark.
    1. Re:Because greed. by PolygamousRanchKid+ · · Score: 5, Insightful

      Well . . . people can be greedy, too . . . not just organizations.

      I got into programming because I like to do it . . . not because I expected to make a lot of money doing it. I started in high school back in the 70's . . . with Fortran on punch cards.

      I find that people who get into IT for the money will be frustrated, because they are not getting rich fast.

      I'm not rich, but I'm not poor either. But enjoying my work is most important to me.

      --
      Schroedinger's Brexit: The UK is both in and out of the EU at the same time!
    2. Re:Because greed. by Anonymous Coward · · Score: 5, Insightful

      This. American businesses have become all about how to maximize short term profits with little or no regard for long term viability of the business. I think in large part due to the stock market mentality. It doesn't matter if your business is actually healthy, it just has to look attractive to short term investors to push up your stock price until your next quarterly report.

      And I think that is strongly related to the fact that so few stocks pay dividends now. Stocks used to be (mostly) about investing in a company you believed in and waiting until your faith started to pay off in the form of dividends. The modern stock market has made it all into a "greater fool" scenario where it's all about getting an even bigger sucker than you to pay more than you did.

      So that mentality has infected/trickled into even smaller businesses and gov't/non-profit orgs because people think that is "normal" for business now.

      BTW, I'll add that this "greater fool" mentality is pretty much what is driving the cryptocurrency craze too.

    3. Re:Because greed. by Bing+Tsher+E · · Score: 1, Funny

      Assembly Language programmers are like that, too. Always thinking about the accumulator.

      It's a good thing they exist, though, so people like you can press colored buttons in your Visual Basic derivatives and make shiney things happen.

    4. Re: Because greed. by Anonymous Coward · · Score: 1

      American stock market that is. Look at Europe where stock markets exist but they pay dividends only once a year. That helps with longer term thinking, at least a year not just the next quarter. France even goes a step further and applies horrendous fees on buying (not sure about selling, haven't done that yet) stocks. I've kept my investment in Sanofi although it went down hard some time ago. They still seem viable long term though and pay dividends.

    5. Re:Because greed. by currently_awake · · Score: 2

      The biggest problem is most companies consider training employees to be a waste of money. They want them pre-trained. H1B, because you're fine with other countries having a good training and education system.

    6. Re: Because greed. by TimMD909 · · Score: 1

      Is it more like rocket surgery or brain science?

    7. Re:Because greed. by gweihir · · Score: 1

      I agree on the regulations, unfortunately. Things will change only if people that make the bad decisions become a massive liability. The only way to get there without seeing too many companies fold is by regulation, the affected organizations are simply incapable of the strategic planning needed unless forced to.

      --
      Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
    8. Re: Because greed. by cyber-vandal · · Score: 4, Insightful

      You refuse to pay the market rate and then complain you can't find good people.?

    9. Re:Because greed. by pete6677 · · Score: 1

      I've never heard of an ERP/SAP/Peoplesoft implementation that was anything other than a horrendous clusterfuck. Why companies keep buying this shit is beyond me.

    10. Re:Because greed. by wwphx · · Score: 5, Interesting

      Warren Buffet (IIRC) had an excellent suggestion to encourage long-term thinking in companies: tax the C-levels 100% on their stocks if they sell them while they're in the company or their first year out. It then goes down 10-20% every year afterwards. It would eliminate pump & dump, might even kill off vultures like Bain.

      It'll never happen, but I think it's a lovely thought.

      --
      When you sympathize with stupidity, you start thinking like an idiot.
    11. Re:Because greed. by Darinbob · · Score: 1

      IT in many companies is not a revenue generator, they're just the support staff. R&D gets the money instead. So stop saying "IT" when you describe what you do and say "developer" instead and maybe the connection will be made that many of the skills overlap.

    12. Re:Because greed. by R3d+M3rcury · · Score: 1

      [...] with Fortran on punch cards.

      You had punch cards? Luxury.

    13. Re:Because greed. by gtall · · Score: 2

      Companies keep buying because the vendors sell to upper management offering baubles, trinkets, and pink unicorns...all will be theirs if they install the magic software. Management goes to their IT department, which pisses all over the idea explaining all that will go wrong and what a waste of money the magic software is. Management goes back to the vendors and explains why they won't be using the magic software. The vendors respond with, "well, they would say that because our magic software will put them out of job, and it doesn't take vacations or require medical insurance." Management, now suspicious of the IT professionals they themselves have hired, reason that if they hit a home run by buying the magic software, they'll be able to retire early and the golf links will be all theirs. Case closed, software bought, hell ensues.

    14. Re:Because greed. by bobby · · Score: 1

      Hmmm, so you're saying I could not build a hardware high-level code interpreter? Maybe BASIC just for simplicity?

      In all fairness, I've done assembly, but being equally a hardware engineer, I think it could be done.

    15. Re:Because greed. by bobby · · Score: 1

      Some amazing wisdom here (for a change). Thanks!

      We (USA) need to create a CFO of USA, or something similar for Warren Buffet. I wonder if Trump would ever hire him as some kind of national economic / financial adviser / controller.

      Better yet, get Congress to listen to Buffet and do what he says.

    16. Re:Because greed. by nehumanuscrede · · Score: 1

      The fun part is companies haven't figured out what happens when you take a square and cut off enough corners.

      You end up with a circle.

      If you work anyplace long enough, you see that the old become new again once enough time passes. :|

    17. Re:Because greed. by wwphx · · Score: 1

      Problem is, Warren isn't a young man and I don't think he'd put up with the BS in Washington. He needs to be appointed Dictator for 4 years and then let him retire in peace. Drumpf doesn't have the smarts to hire someone like him.

      --
      When you sympathize with stupidity, you start thinking like an idiot.
    18. Re:Because greed. by bobby · · Score: 1

      You apparently have a really good wire-wrap gun. Or I suppose a LOT of diodes and perfboard.

      Looking back, it's a bit odd but I've never wire-wrapped. But you have me chuckling trying to imagine that many diodes. No, I'm thinking gate-array time.

    19. Re: Because greed. by orlanz · · Score: 1

      None of that is true.

      -There are more stocks paying dividends than not.
      -Dividends not paid roll into the stock price and similarly a paid dividend cuts against it.
      -There are tax benefits to both, but in general they lean toward long term holdings of stock gains. Meaning you get to keep more of that gain.
      -The majority of the market and the majority of the stocks are not a "greater fool" game.

      If you want to know why companies appear to be thinking short term, look at the incentive structure for their executives. Additionally a company that thinks long term against shortterm thinking competition... usually falls pretty far behind in the shortest term. The competition might not be there in the long term but the company will be long gone before then.

    20. Re:Because greed. by Rande · · Score: 2

      I asked for $100 in manuals so that I could learn new framework in an orderly fashion.
      "Can't you just look it up on the internet?"
      "Yes, but the online tutorials are usually low quality and I'd like to learn it properly before getting hints and help from the net. It'll probably take me 5 weeks to learn instead of 2 with the manual."
      "I'll get you the manuals once we've firmly decided that we're going with that framework."
      "When will that be?"
      "When you've got a working demo that I can show the CEO".
      "...so AFTER I've already learned the framework."

    21. Re:Because greed. by FirstNoel · · Score: 1

      Most initial implementations do suck. They're trying to fit the round peg in the square hole. How do you make a software package work for almost any business? make it complicated.

      And elevator company, a book publisher, a construction tool manufacturer and a candy company all use the same ERP, just to use a few examples. To do that, it has to be complicated. And it ain't gonna be easy installing. Especially if the company wants to do it on the cheap.

      But building a system from scratch, in house, that has the capability of an ERP isn't possible for most companies. Their core business is not software, so they just want something that works. Once the implementation is over, maintaining a vanilla system isn't too bad.

      --
      "Hmm. I am to metaphor cheese as metaphor cheese is to transitive verb crackers!"
    22. Re:Because greed. by FirstNoel · · Score: 1

      You are so right. In a previous job, we were considered "STRUCO" or Structured costs, like maintenance or utilities bills. We didn't add direct value to the bottom line. We were a productivity enhancer or cost reducer. But we never "made them money".

      Kind of depressing to think about. When you are view like that, it makes you expendable.

      --
      "Hmm. I am to metaphor cheese as metaphor cheese is to transitive verb crackers!"
    23. Re:Because greed. by datavirtue · · Score: 1

      Wow. Is that a Dilbert comic?

      --
      I object to power without constructive purpose. --Spock
    24. Re:Because greed. by datavirtue · · Score: 1

      Because it FEELS safe. No. Other. Reason.

      --
      I object to power without constructive purpose. --Spock
    25. Re:Because greed. by cthulhu11 · · Score: 1

      I'd vote for that, though might adjusting the vesting schedule accomplish something similar? The SEC already does restrict executive stock transactions.

    26. Re:Because greed. by cthulhu11 · · Score: 1

      The Cheeto would ignore him even if he did, unless his advice was to exempt the NRA and the Klan (wonder how much overlap they have) from all taxes.

    27. Re:Because greed. by Darinbob · · Score: 1

      Also note that several million people in the world have the same IT skills that the company wants. That makes it very hard to make yourself indispensible and keep the salary up. When all you have to show to get the job is a paid-for certificate from Microsoft, then don't be surprised when someone cheaper gets the job. The trick I think is to turn it around and prove that you're more than just a replaceable cog, by doing more than the minimum 9 to 5 grunt stuff.

    28. Re: Because greed. by tigersha · · Score: 1

      Show me a hardware high level language interpreter. Really, I would love t see 9ne.

      --
      The dangers of excessive individualism are nothing compared to the oppressiveness of excessive collectivism
  2. IT is costly by quonset · · Score: 5, Insightful

    To the average person, the only reason IT people exist is to make sure they can check in on Facebook every 30 seconds while at work and replace their keyboard when they spill coffee or soda on it.

    Aside from that, IT has no useful purpose and thus is seen as a debilitating cost. Why spend money on something which provides no value?

    1. Re:IT is costly by geekmux · · Score: 5, Informative

      To the average person, the only reason IT people exist is to make sure they can check in on Facebook every 30 seconds while at work and replace their keyboard when they spill coffee or soda on it.

      Aside from that, IT has no useful purpose and thus is seen as a debilitating cost. Why spend money on something which provides no value?

      So, employees wouldn't dream of taking their own garbage out, taking turns cleaning the bathrooms at work, or working in an environment that wasn't equipped with a well-functioning heat and A/C system, so maintenance and cleaning staff is fully justified in their minds.

      But the trained professionals who maintain the services that feed their social media and internet addiction, along with maintaining the systems that tend to help generate the revenue that feeds paychecks is somehow something that "provides no value"?

      If this kind of ignorant mentality exists in an organization, then the fucking hiring problem isn't in IT. I say let the "average person" flounder like a fish out of water the next time the internet goes down, or ransomware hits their system.

    2. Re: IT is costly by Anonymous Coward · · Score: 1

      Ask Google what their bus model is. Then ask the current botch of leaders what the heck they mean by "digitalization". Chances are they have no idea they're smoked by the tech giants and are now failing by trying to buy their catch up. With current leadership practices there's no incentive to "provide value", unless you get shares in a startup and willing/able/included.

    3. Re:IT is costly by Pig+Hogger · · Score: 4, Interesting

      Why spend money on something which provides no value?

      30 years ago, I was in charge of IT for a medium company (150-200 employees). We had some PCs running 1-2-3 in the planning departments and a UNIX box with about 12 users on serial terminals.

      Back them, 1-2-3 skills were not prevalent as Excel skils are expected to be, and upper management was always glad I could pull out “complex” reports in a few hours. What was impressive was the complete trust upper management had in my young squirtness of the time. They litterally gave me the keys to their company (I could have brought it down anytime) without any questions asked.

      Familiarity breeds contempt, and as computers became more and more widespread, it only got downhill from there, to the point I got out of IT as a primary carreer goal and pursued work in other directions, only to come back to IT once in a while and getting more and more disgusted each time.

      Then I pause to think that, had I had gone to work for the railroad as I had seriously envisioned 35 years ago, I would have had my pension for a long time now. Not so with IT.

    4. Re:IT is costly by l0n3s0m3phr34k · · Score: 2

      Exactly this. Average employees have ZERO comprehension of what goes on backend-wise. We have about 1,000 employees; we leverage Mimecast, blade servers, load balancers, a separate disaster recovery site, HA firewalls, a complex Exchange / Skype environment, etc. On top of all of that we are required to be 800-171 CUI compliant, which adds in a whole new level of complexity we are still working on hitting.

      Even the executives think that a "purchased product" is the end of whatever; and have little idea the time and effort it takes to actually go from purchase to correctly configured install. Due to time constraints, usually the install process isn't properly documented, so if there is employee turnover it's "back to the start" on many projects. Part of my job is to force everyone to document their processes, but they are "learning as they go" so half the time we don't really know what needs to actually go into the documentation. There is also resistance from IT to document processes, because they think "no documented process" = "job security".

      This is why companies get breached. IT only has the time to get a system up and running, and then it's pulled into production before it's ever locked down. Patches aren't applied because they "might break a 3rd party app" or something that has gained wide use. The original employees that did the setup were just a vendor team, who wanted more $$$ to "finish up on the security part"; or the employee team had a new project to do and never got around to going back in and finalizing the security lock-down. I also run into the problem of "well, this application is in constant 24/7 use so there is no window to shut it down and update it" so it becomes a forgotten security hole.

    5. Re:IT is costly by geekmux · · Score: 1

      So, employees wouldn't dream of taking their own garbage out, taking turns cleaning the bathrooms at work, or working in an environment that wasn't equipped with a well-functioning heat and A/C system, so maintenance and cleaning staff is fully justified in their minds.

      Have you seen how much the cleaning staff is paid? In the country where I live, it has all been outsourced and the people make barely above minimum legal and the company employing them avoids all extra costs (no one gets hired working more than 40% of the legal work week (40 hours), because at 50% the company has to pay for vacation, for instance). It's greed, as others said above. No one wants to pay more than barely minimum for anything. And in my case, it shows in the results. The toilets are dirty, the offices aren't clean and so on...

      I was primarily addressing the parents point that the average person feels that IT is something that "provides no value". No matter how cheap your company tries to be with hiring cleaning staff, they STILL do not categorize it as something that "provides no value", or is an optional expense. Neither is a maintenance department.

      As I said before, let the average person flounder when ransomware hits. After all, I'm sure they're only carrying around ALL of their personal and/or work data on a single local hard drive because doing regular backups is just another pointless activity that the worthless IT staff told them to do...

    6. Re:IT is costly by Kjella · · Score: 2

      To the average person, the only reason IT people exist is to make sure they can check in on Facebook every 30 seconds while at work and replace their keyboard when they spill coffee or soda on it. Aside from that, IT has no useful purpose and thus is seen as a debilitating cost. Why spend money on something which provides no value?

      That was a common sentiment back in the days where the PC was the individual's tool and IT the support monkeys trying to keep it running. These days though many employees can't get any work done if you pull the network cable, most businesses depend on core IT systems being up and running so honestly I can't say I've heard that attitude in a long time. Heck, in many cases your customers are directly the victim because your self-service systems don't work. My impression is that there's absolutely money there for server operation and high uptime systems. The problem is more how do you measure security in development or an SLA.

      A coworker was telling me a story about that Friday from a former employee, it was about a security practice they had which nobody really could point out the source to or exact reason for but like everybody assumed it was good for something. And then they hired in some really high end black hat turned white hat hackers and it was like WTF why would you do that, how's that going to help you and there's a round of "uhm..." around the table. It's not security theater, because that would imply you know it's for show with little practical effect. It's that there's very few with the operational experience to say what really works and fewer still who can tell if it's comprehensive or if you got a double bolted steel door and an open window.

      --
      Live today, because you never know what tomorrow brings
    7. Re:IT is costly by i.r.id10t · · Score: 1

      Indeed. Physical plant stuff (building maintenance, grounds, janitorial, etc) is seen as part of infrastructure. But most of IT (except telephones I would guess) is seen as a cost center, when it should be considered core infrastructure just like your physical buildings.

      I work in education with online and reduced seat time classes. I pointed out to the Provost that with the number of "seats" and sections we offer, and the number of employees we have, the licensing and support costs of the software we use, we break even on all costs due to $10/credit "distance learning fee" (on the other hand, we can't charge lab fees, etc - it works out about the same). To build a building to house a similar number of students/enrollments/courses/sections/etc would run about $5mil plus annual maintenance costs, electric/water usage, more folks for janitorial services, etc.

      --
      Don't blame me, I voted for Kodos
    8. Re: IT is costly by Wycliffe · · Score: 1

      The problem is that ransomware is extremely rare. If the trash isn't taken out for two weeks, everyone notices. If backups aren't done for two years noone notices until the day they all wake up without a job.

    9. Re:IT is costly by aaarrrgggh · · Score: 2

      There is much more to it than that.

      • 80/20 rule. 20% of the investment gets you 80% of the outcome.
      • Hidden inefficiency. Opportunities for improvement are masked by corporate process or culture.
      • Cloud services such as Salesforce provide a quick solution for management without the IT hassles. (But at price points significantly higher than doing it internally.)
      • IT's hands are tied by their vendors.
      • People don't understand just how much time some things take, especially on one-off things.
      • Crapware like Skype for Business is "good enough" and "free" (included), choking out other projects

      Management is out of touch with where the IT opportunities are for improving systems. Without an advocate, it just looks like throwing money in a hole.

    10. Re: IT is costly by geekmux · · Score: 1

      The problem is that ransomware is extremely rare. If the trash isn't taken out for two weeks, everyone notices. If backups aren't done for two years noone notices until the day they all wake up without a job.

      Ransomware is "rare"?! Hardly. Ransomware has grown into a multi-billion dollar business. It has been a significant threat (if not THE significant threat) for the last two years in business. The trash not being taken out doesn't result in decades of data loss for an organization who is unprepared, along with legal issues, fines, and bankruptcy.

      I stand by my statements regarding ignorant business owners who don't value IT.

    11. Re: IT is costly by Wycliffe · · Score: 1

      Ransomware is "rare"?! Hardly. Ransomware has grown into a multi-billion dollar business. It has been a significant threat (if not THE significant threat) for the last two years in business.

      Do you know anyone personally who has been affected by it? Yes, it's a multibillion dollar business but the odds of it happening to any one business is still extremely rare. I know lots of people who have died in a car accident. I know lots of people who have had to pay fines because their taxes weren't done correctly. I know lots of people who have had speeding tickets, parking tickets, etc... I even know lots of people who have had account credentials stolen from phishing as well as people who have had credit card numbers stolen. But other than hearing it on the news, ransomware is still something that happens to someone else. And I'm my extended family's tech support of last resort so I get calls all the time when hard drives crash, malware starts creating popups, etc...but I've yet to get a call about ransomware. Just like home invasions or school shootings, it's still mostly something abstract that happens to someone else and therefore isn't taken seriously by most.

    12. Re:IT is costly by wwphx · · Score: 1

      Pity you posted as AC as you may or may not see this. I came across an excellent article on in-house vs out-sourced cleaning and what it meant to some people. In the case of the former Eastman Kodak, a woman of color rose to become an executive in the company, compared to people, as you say, lucky to make $15 an hour and frequently working two jobs to make ends meet. https://www.nytimes.com/2017/0...

      --
      When you sympathize with stupidity, you start thinking like an idiot.
    13. Re: IT is costly by wwphx · · Score: 2

      Heh. I did about 15 hours work over two days at a local medical practice last year that got slammed with one or two different ransomewares. Running Windows Server 2008, based on the rest of the practice it was probably RTM. ISP-provided router, no firewall. And they balked at me charging them $30 an hour! (I was giving them a break while I checked out how bad the situation was) And they bought a Cisco enterprise-grade firewall, I wonder if it's still in the box as I don't know anyone locally, including me, who can configure that beast.

      No backups, naturally. Their client practice software had some, but their internet connection was so bottlenecked that they weren't reliable.

      --
      When you sympathize with stupidity, you start thinking like an idiot.
    14. Re:IT is costly by JaredOfEuropa · · Score: 1

      80/20 rule. 20% of the investment gets you 80% of the outcome.

      Yeah, I tried explaining that to the contractor building my house when I wanted a discount. He just laughed...

      Maybe the problem is that management thinks they are getting 80% of the outcome where they might be getting something between 10-40%, counting critical failures and lost opportunities.

      --
      If construction was anything like programming, an incorrectly fitted lock would bring down the entire building...
    15. Re: IT is costly by Wycliffe · · Score: 1

      And no we didn't pay, we just lost the files.

      They should make it illegal to pay. It is and should be considered "Providing material support for terrorism" and anyone caught paying for ransomware should be fined and thrown in prison. Not that I want victims to suffer twice but it should hopefully put a stop to this nonsense. I really don't understand why anyone pays anyways. I wonder how often they pay and still don't get their files. My guess is even after paying the odds of getting your files back are pretty low.

    16. Re: IT is costly by Wycliffe · · Score: 2

      For those saying I should have checked the permissions when I was hired, I tried, but security was not a priority at the time. Funny enough, as soon as this happened I was able to check permissions and change permissions and access to folders to mitigate it from happening as bad as last time.

      Something similar happened at my work. I was never allowed to implement 2FA until the day that our CEO fell for a phishing email. The very next day I was allowed to activate companywide 2FA with a 2 week grace period for everyone to get it activated. So sometimes it's not even about the funding but about giving IT the authority to implement security measures that might inconvenience the users.

    17. Re: IT is costly by nnull · · Score: 1

      This isn't just computers in general, this is any tech industry right now. You'd be surprised how many complaints I put in with my vendors regarding quality or delays. When I go down there to investigate, I find the operators these companies hire for their equipment do not know what they're doing. Tension controls, measurements, simple engineering concepts, quality control procedures, all beyond their capability. The managers, maintenance, no idea what I'm talking about. All they know is how to crack the whip on these low paid workers and hope a product comes out.

      Even when I offer help to improve the situation and not cutting them off, it's still beyond them. They will never hire better qualified people, even when I offer them luxurious contracts. They want the high margins with minimum wage workers. Usually I get an ear full of how full of shit I am about their quality issues.

    18. Re:IT is costly by tflf · · Score: 1

      The issue is not what the average person thinks. The reality is the primary driver in business is profit, right now. Employees of all types, from janitors to production to executives, are seen as drags on the bottom line. Gravis zero got it right: employees are expensive, and cutting staff is great for the balance sheet. IT is just one example of the short-sighted approach so popular in today's world: employees, resources, operations, customer service,quality control, safety, maintenance, etc. are all drags on the bottom line. The cheapest option that barely works is good enough as long share value in the next quarter are not negatively affected.

    19. Re: IT is costly by Miser · · Score: 1

      My anti-virus console logs tend to disagree with you.

    20. Re: IT is costly by datavirtue · · Score: 1

      Everyone pays because they are completely bent over--and they typically get their files back. The "hackers" are not in to playing games. When they return the data to people it pretty much ensures that they will be quiet after the incident. Very embarrassing and often a violation for those governed by certain regulatory bodies--they just want to forget it happened. Don't forget that the price is often way less than actually securing the data.

      --
      I object to power without constructive purpose. --Spock
    21. Re: IT is costly by datavirtue · · Score: 1

      Yes. Real security gets batted down constantly. Hardly anyone has the stomach for the inconvenience, price, continual overhead, and adjustments to the culture that are required to get it right. Real security is hard.

      --
      I object to power without constructive purpose. --Spock
    22. Re: IT is costly by datavirtue · · Score: 1

      Wow. I charge $200 an hour just to land onsite--two hour minimum. Tends to filter out the assholes and idiots.

      --
      I object to power without constructive purpose. --Spock
  3. Different outcome if you screw up by klingens · · Score: 5, Interesting

    If you skimp on accounting, there is a lot of case law where you end up in jail.
    When you have an IT disaster you never go to jail so far. Target, Equifax, etc. certainly haven't.

    With both, if you skimp too much you might end up bankrupt. E.g. if you don't know your invoices and who owes what to whom, you go bankrupt. If that ransomware disrupts your business too long you also go bankrupt. So there is a certain needed minimum standard in both, but thanks to centuries of experience with it, accounting has much better laws, standards and especially case law than IT, raising the needed minimum bar much higher.

    1. Re: Different outcome if you screw up by Anonymous Coward · · Score: 2, Insightful

      Exactly.

      But, accounting is stable, definable, and well understood.

      If anything, computing is changing faster today than 10, 20, and 30 years, ago.

      It's costs, benefits, and weakness are indefinable. Some best practices today will be worst practices in 5 years.

      Invest a year early and you could gain an advantage, but it's equally likely you will overpay for technology that is obsolete on delivery.

      Our tax structure severely punishes maintaining software.

      Until computer hardware and software stablelize, the law can't catch up.

    2. Re: Different outcome if you screw up by q_e_t · · Score: 1

      In the first decade of computers we went from nothing to COBOL and LEO. In the last decade c!oud has increased penetration, and there are new web frameworks, but I don't see the same revolutionary level of change.

    3. Re: Different outcome if you screw up by BronsCon · · Score: 1

      COBOL most often ran on someone else's computer, not your local terminal. The cloud hasn't increased penetration, we're just back to running stuff on someone else's computer rather than our local terminals.

      --
      APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
    4. Re:Different outcome if you screw up by thsths · · Score: 1

      Exactly, and that is strange, isn't it?

      Because

      > Target, Equifax, etc.

      have obviously been criminally negligent with customer and financial data. You would think there is a law for that (I am sure there is), and it would be applied (maybe not?).

  4. Nerds by Anonymous Coward · · Score: 2, Insightful

    Why does this pattern of underinvestment in and under-appreciation of IT continue?

    Because people don't like the stinky nerds, and don't care about "nerd things".

    1. Re:Nerds by geekmux · · Score: 4, Insightful

      Why does this pattern of underinvestment in and under-appreciation of IT continue?

      Because people don't like the stinky nerds, and don't care about "nerd things".

      The reference is hilarious, but the irony of this mentality in the real world is a shitload of people are employed by some of the richest nerds in the universe, who started their multi-billion dollar mega-corps doing "nerd things".

  5. IT Workers by ViXiV · · Score: 5, Insightful

    Its because students get out of college and think they're the shit and know it all which comes down to Dunning Kruger syndrome. Companies and Corporations aren't willing to invest in self taught life long IT professionals and hackers who have dedicated their entire life to learning security and technologies, but instead want the unskilled grads who have the paper without the experience!

    1. Re:IT Workers by Pig+Hogger · · Score: 4, Insightful
      Amen. 55+ here with more than 35 years of full-time professional experience.

      Experience is worth shit nowadays. Companies want young squirts that know the bare minimum so they will do what they are told without question, in stead of having seasoned veterans that can smell bullshit from a mile away.

    2. Re:IT Workers by kalieaire · · Score: 1

      This.

      IT is incredibly complex which requires a world (or high level) view of the situation before solutions can be chosen.  From that point, really technical implementers have to deploy solutions and subsequently administrators for day to day work of maintaining the systems and solutions themselves.

      The blame falls squarely on management for hiring people who don't have the skill, strategic vision, and political capital wherewithal to carry out that vision.

    3. Re: IT Workers by mapkinase · · Score: 1

      I wanted to say something sceptical abouy Dunning Kruger effect, but I am afraid I will be categorized as a subject of Dunning Kruger effect.

      I also never argue with both of psychoanalysts.

      --
      I do not believe in karma. "Funny"=-6. Do good and forbid evil. Yours, Oft-Offtopic Flamebaiting Troll.
    4. Re: IT Workers by nnull · · Score: 2

      Because they're more willing to work for nothing. No training and really little experience gained in the environment they're put in. They have no mentors at these companies other than the big boss yelling at them. It's probably why I'm getting more and more supposedly 10 year experienced employees who really don't know anything.

    5. Re:IT Workers by datavirtue · · Score: 1

      Me: Do you know anything about IIS?
      Prod Support: What's that...starts laughing.
      Me: The thing that runs our business that you are supposed to be supporting.

      --
      I object to power without constructive purpose. --Spock
    6. Re: IT Workers by datavirtue · · Score: 1

      I think you are on to something. I came back into the corporate IT world about four years ago after working on my own and basically slinking off for a decade on Slashdot. In the course of my work I was running into ten year veterans (people who had been in the trenches for a decade while I was sitting at home hacking and smoking weed) who could not answer basic questions about the technology they were trying to implement. In the time I was away from corporate shit-hell I was able to research and develop in any language I wanted and work on any technology I was interested in, and spent a lot of time doing just that. Those extensive exercises gave as much or more knowledge and experience as these high and mighty architects who had been "working" for ten years or more. In short order I was asked to join the ranks of the high and mighty architects where I have been since. Having never built an enterprise system I was still able to fix their massive mistakes, document the real root cause of those mistakes, and help pave the way toward building things that worked without falling on their face when they hit prod. I make more than all of them now--way more.

      --
      I object to power without constructive purpose. --Spock
  6. I still blame the bean counters. by BlacKSacrificE · · Score: 5, Insightful

    My experience reflects a very reactionary industry;

    - Don't buy disks till current storage is redlining.
    - Don't buy LAN till the current one is swamped.
    - Don't patch till someone else (if you're lucky) gets raped.
    - Don't train till you you get bitten by a big knowledge gap, likely a result of the aforementioned rape.
    - Don't spend till someone bigger than you tells you to, even if a condition exists that leaves you vulnerable to any of the above points.

    If accounting operated like the IT industry, accounting as we know it would not exist. A server is recoverable, an empty ban account due to negligent or facetious handling, is not.

    I would however suggest the problem is not poor quality employee's but, as it turns out, poor quality accounting by the broader organisation. Time and time again I have seen projects and upgrades get bumped from capex to cpex till something happens that resonates high enough up the food chain for someone to open the loot box, no matter how hard the guys on the ground are petitioning for it. Perhaps it is accounting that has the poor quality employees?

    --
    [Sorry, this signature is unavailable in your country/region]
    1. Re:I still blame the bean counters. by Anonymous Coward · · Score: 1

      While all your points do have merit , I wouldn't specifically blame the bean counters. Instead this constant "IT is a cost center" mentality from CXO level who actually are only looking at the bean counters reports to base company spending decisions. Myself, going on 20 years in the industry, this seems to be the latest trend these last few years and it is not improving. Seeing this on a daily basis as currently (for the past 6 years) I'm at one of the major vendors in engineering support who deal only with fortune 100 companies specifically when shit hits the fan (hence anon post).

      Not only is there downright negligence with the infrastructure, its also lacking a qualified workforce to maintain it. Generally these top corps offshore their entire operations to mostly , but not limited to a +91 operation and in turn, buy the most expensive enterprise-premium contract with respective vendors as an insurance policy. This in turn ensures they can keep their own SLA's while cutting costs in every corner, when something goes down. I can tell you which banks , airlines and car manufactures have the best or worst infrastructures, its seriously amazing and appalling at the same time. Given this insight into so many companies' IT operations, for myself I'm seriously selective in what products I buy and companies I support with my wallet.

      It seems today with most of these corps everything is about the dollar, euro or whatever index they're on. When was the last time a high tech company was run by an actual engineer making the decisions. Today its generally some sales, mba, political, or whoever has some connection and not an engineer. IMHO this mentality and practice is grinding the industry to slowly to a halt. There is no true innovation anymore, most startups are either out to make a few quick dollars only to be bought up by one of the larger vendors. Large vendors cut cost in R&D and buy externally, then integrate that product into their product base which creates a bunch of quality issues. The whole industry is at this stage is a game of monopoly that has already being going on for some time and it is a bit late to get in the game unless you are constantly landing on free parking. Some streets have hotels and some have houses.

      Its frustrating when you know you have another 20 some plus or minus years until retirement,reflecting on the current situation.

    2. Re:I still blame the bean counters. by Anonymous Coward · · Score: 1

      Well, I can offer one data point from my company to see how accurate this is:

      Don't buy disks till current storage is redlining.

      We don't even buy then. It is the users fault the storage is redlined. We no longer support hot-fixes on software that's over 6 months old because we simply do not have the storage to hold records that long.

      Don't buy LAN till the current one is swamped.

      Strange.. when this started happening, the response was not to upgrade the lan infrastructure, but to INCREASE the demand by requiring more VM's to be implemented. *(At the same time, reducing the VM hardware by 50%)

      Don't patch till someone else (if you're lucky) gets raped.

      Accurate for sure. *(Was us)

      Don't train till you you get bitten by a big knowledge gap, likely a result of the aforementioned rape.

      No training even after. No intelligence after either, For example, last week our public-web server was compromised by hackers over the internet. In response - IT has fire walled ALL internal computers from communicating with each other. *(Connecting to/fron internet is OK. To talk to other machines right next to us, we have to use an internet proxy.)

      Don't spend till someone bigger than you tells you to, even if a condition exists that leaves you vulnerable to any of the above points.

      Hmmm... True, mostly. But it always seems to get worse when the spending happens.

    3. Re:I still blame the bean counters. by kalieaire · · Score: 1

      Ironically, the banking industry operates in a different way.  They're quite happy to throw money at consultants/contractors to get jobs done as well as invest money in the best of breed technical solutions and controls to save the backend environment.  Though likewise ironic, the front end that the consumers see are still easily compromised due to the complexities of enabling MFA and other security solutions.  But to their credit, they were the first to employ anti-phishing features like login messages, personalized login images, etc.  Unfortunately, that's only half of the equation and only a few banks and financial institutions have implemented MFA.

    4. Re:I still blame the bean counters. by jezwel · · Score: 1

      We're moving (slowly) towards managed service delivery where usage is costed direct from the service provider. You want TBs of storage? No problem, its x$/GB/month, you can chose how much to store and pay for. You want PCs? Here's a virtual desktop, just $10/day per instance. Don't forget to logout when you're done! You want software? It's a monthly subscription, put in your cost centre here.

    5. Re:I still blame the bean counters. by thsths · · Score: 1

      To be honest, PC to PC connectivity is usually not required, and it is a prime vector for malware. PCs usually communicate via servers, and as long as you can secure those, damage is limited.

      Of course if the servers are compromised, that is pretty much it.

    6. Re:I still blame the bean counters. by datavirtue · · Score: 1

      "But it always seems to get worse when the spending happens."

      That is the fucked-up truth. Sometimes you are relieved when a disaster strikes and you think the time is now to get things fixed. Then you find out someone is about to throw money at it in the wrong direction. It has come to the point where we cannot communicate openly about the state of our systems and software. No one wants to hear it--ever. Yo have to figure out with the other engineers how to hijack new initiatives (coming from the top) to purchase needed products or carve out time to fix something under the guise of a project line item implementation. It is seriously cloak-and-dagger to get shit done.

      --
      I object to power without constructive purpose. --Spock
    7. Re:I still blame the bean counters. by datavirtue · · Score: 1

      This happened because someone jokingly suggested it in a all-hands emergency meeting. Never would you do such a thing but Barry from InfoSec mentioned it and management latched on to him and prodded for more information. Before he could tell them it was a stupid idea they were praising him for being a genius. You don't pass up gold like that in the corporate world.

      --
      I object to power without constructive purpose. --Spock
  7. Security is hard by phantomfive · · Score: 3, Interesting

    Security is hard, and there is no one who knows how to have perfect security. That's an unsolved problem.

    There are a lot of things you can do, easy things, but there aren't enough people who know how to do them. For example, not letting someone log in with an empty password. That is a solved problem, it should never happen. But even if every company tried to hire good people, there aren't enough good people to fill every company. So they hire not good people. Unfortunate.

    --
    "First they came for the slanderers and i said nothing."
    1. Re:Security is hard by Pig+Hogger · · Score: 1

      That's an unsolved problem.

      There are very few security problems that can’t be solved with a good, healthy air gap.

    2. Re:Security is hard by phantomfive · · Score: 1

      There are very few security problems that can't be solved with a good, powerful sledgehammer, but that's not going to fit most use cases.

      --
      "First they came for the slanderers and i said nothing."
    3. Re:Security is hard by l0n3s0m3phr34k · · Score: 2

      It's an UNSOLVABLE problem, looking at it from the viewpoint of "fixed and done". It's a continual process,due to a huge army of APTs who are constantly pushing the envelope. Executives need to realize modern ITSEC is an unending war; one in which everything with electricity is a potential target. Every company and user is a target of various criminal groups and state-level actors; often there is quite a bit of overlap between those groups. It's no longer acceptable to believe that "law enforcement" is capable of handling any "computer hacking" that might happen; it should be a criminal offense to cover up breaches.

    4. Re:Security is hard by phantomfive · · Score: 1

      ok, so suppose an 'enlightened' CEO comes to you and asks you what he should do about security. What would you tell him? Hire a red team? Because that actually doesn't work.

      --
      "First they came for the slanderers and i said nothing."
    5. Re:Security is hard by Bing+Tsher+E · · Score: 1

      Why did you escalate to violent rhetoric? Does the idea of not being able to connect to Facebook from any keyboard you sit down to at work make you fretful?

    6. Re:Security is hard by Bing+Tsher+E · · Score: 1

      I'd tell him to take critical machines off-line. Set up a form employees need to fill out where they enter websites that need to be whitelisted for them to be able to visit from their desktop workstations. If more access is needed for some reason, perhaps several pool machines in the common area of each department that have full Internet access but are not connected to any other work resource.

    7. Re:Security is hard by phantomfive · · Score: 1

      Air gaps prevent you from doing a lot of useful things. It prevents people from doing things they reasonably should be able to do with a computer. For example, I notice you don't have an air gap while posting to Slashdot.

      --
      "First they came for the slanderers and i said nothing."
    8. Re:Security is hard by phantomfive · · Score: 1

      ok, so he has a company website, which needs to be accessible by the world. What then?

      --
      "First they came for the slanderers and i said nothing."
    9. Re:Security is hard by nine-times · · Score: 2

      Security is hard, and there is no one who knows how to have perfect security. That's an unsolved problem.

      Well I wouldn't say it's an unsolved problem. I'm not sure the best way to put it, but "perfect security" is basically a false concept. It's not just that we haven't figured out how to do it or even that it's not realistically possible. It's more that... if you're thinking about "perfect security", then you're misunderstanding the concept of "security".

      To think of it outside of the realm of computers, think about trying to make a "perfectly secure" house, where no uninvited guests can come in and you can't be harmed while in your house. There are some pretty obvious difficulties, like how do you make windows (and walls) that can't be broken or locks that can't be picked. And that's what people think of when they think about the difficulties with "perfect security".

      But there are bigger and more fundamental problems. Thinking of the "locks that can't be picked", what happens if you lose your keys? People lose their keys all the time, and they want to be able to call a locksmith to let them back in. If the lock can't be picked, then the locksmith can't help you. If a window can't be broken, then you can't get back in that way. If the walls can't be knocked down, then you can't even demolish the house and start over. In a sense, by making your house impossible to break into, you're creating a big source of insecurity. If you mess up and lock yourself out, you've lost your house and everything in it. The effect is the same as if someone had broken in and stolen or destroyed everything you own.

      In fact, there are always some kinds of trade-offs. The more you do to make it harder for an unauthorized person or object to enter your house, the more likely you'll also introduce a scenario where you will have difficulty accessing your house, or you'll prevent yourself from bringing in a person or object that you'd want in your house. Or, to approach the idea from another direction, if you want to be able to bring a friend home, you're also creating an opportunity for a "friend" with ill intent to enter your home. If you want to be able to bring a gun into your home to protect yourself, you're also bringing a weapon into your home that can be used against you.

      But let's assume that you're content to have your home fully empty, and never bring a guest home. Now what happens if you wake up in the middle of the night having a heart attack? You can't get help. You call for an ambulance, but the EMT can't come in. Disallowing entrance to an uninvited EMT actually makes you less safe. You might respond, "Well, I'd come up with some security measure to allow a medical professional to enter my house," but then, how would you protect yourself from an EMT with ill intent? Or how do you prevent someone else from exploiting the system for allowing EMTs? How do you prevent a well-intentioned EMT from allowing something dangerous to enter your house?

      I could go on, but the point is that this isn't a technical challenge of establishing "perfect security", this is a fundamental problem with the concept of "perfect security". The measures you take to make unauthorized access difficult will have the side effect of making authorized access more difficult. Trying to make unauthorized access impossible will eventually make authorized access impossible. Because of this, real security is not a single act of making unauthorized access possible, but rather an ongoing process of making unauthorized access difficult and risky.

      Also, good security is not about making unauthorized access as difficult as possible, but about balancing the need to make unauthorized access difficult agains the need to make authorized access easy. If you require a complex procedure to unlock every door, then a lot of people will start leaving doors unlocked.

    10. Re: Security is hard by Monster_user · · Score: 1

      Are we talking Facebook, or a Facebook page?
      Everybody needs a website, but not everybody needs a website with a database of private information that is accessible to the public.

    11. Re: Security is hard by phantomfive · · Score: 1

      Most large companies have a team of programmers maintaining their web page. It's more than just an Etsy shop page. That's where security really starts getting tough.

      --
      "First they came for the slanderers and i said nothing."
    12. Re:Security is hard by phantomfive · · Score: 1

      Alright, so how do you define good security?

      --
      "First they came for the slanderers and i said nothing."
    13. Re:Security is hard by drinkypoo · · Score: 1

      For example, I notice you don't have an air gap while posting to Slashdot.

      He clearly has a cranially-centered air gap, or he wouldn't have blathered about violent rhetoric.

      --
      "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
    14. Re:Security is hard by chispito · · Score: 1

      But even if every company tried to hire good people, there aren't enough good people to fill every company. So they hire not good people. Unfortunate.

      Seems like they hire nobody. There are no entry level security positions and few mid-level. The vast majority of job postings are senior level, or what should be senior level based on the ridiculous requirements. And that's where the shortage is so of course they end up with nobody at all.

      --
      The Daddy casts sleep on the Baby. The Baby resists!
    15. Re: Security is hard by cyber-vandal · · Score: 1

      What if you need access to the internet to do your job.

    16. Re:Security is hard by Lodragandraoidh · · Score: 1

      Even an air-gap is imperfect. If you want your servers to really be secure, you could dump them overboard in the Marianas Trench as well. Not only would you not be able to communicate with them, no one would be able to gain physical access either.

      Of course, these extreme forms of addressing the problem negate the value of having connected systems in the first place - which is really a non-starter.

      Someone said it before, but it bares repeating: as long as the risks and costs of breaches are less than the costs of ensuring a secure infrastructure, publicly traded companies will continue to choose the cheap way out to maximize profits. Corporate law and regulatory changes could change this equation.

      As consumers, we can also impact this by abandoning companies that do not have our interests at heart (which is basically all publicly traded companies with rare exception) - which has the effect of raising the cost of not addressing security.

      Finally, people who design and build systems (and this is not just the programmers and architects - this includes anyone impacting the choices regarding the design - including bean counters, project managers, marketing/sales people etc) need to recognize what mechanical engineers and architects learned in the last century - our creations can injure and kill people if care is not taken, and standards established for the deployment of these systems in the real world.

      --

      Lodragan Draoidh
      The more you explain it, the more I don't understand it. - Mark Twain
    17. Re:Security is hard by pete6677 · · Score: 1

      That would have been a cumbersome security policy even in 2001. In 2018 it's a non-starter. Any admin who was incapable of providing reasonable security in a less draconian way would be replaced with someone competent.

    18. Re: Security is hard by Monster_user · · Score: 1

      "Most large companies" seems like a high estimate.

      I think the market a company is in determines the complexities and therefore security needs of its website.

      YouTube for instance would seem to require less in the way of security than say Aflac or Equifax. YouTube is not trying to protect most of the data it contains, as most of it is publicly available through the site itself, especially before it began officially housing licensed content (music videos). Much of YouTube's data has little value outside of YouTube. While Equifax contains and serves a significant amount of sensitive data to businesses over the Internet everyday. Everything that Equifax collects has to be made available to some questionable third party for decision making purposes.

      Other large businesses, ones that make money on commission, and/or in-person transactions, have little incentive to provide a self-service interface for their clientele.

    19. Re:Security is hard by nine-times · · Score: 1

      Well I did say:

      good security is not about making unauthorized access as difficult as possible, but about balancing the need to make unauthorized access difficult agains the need to make authorized access easy.

      Good security is an ongoing process of evaluating your assets that may be a target of attack, as well as the likely attackers and then likely methods of attack, and then putting defenses in place that appropriately balance making authorized access easy and unauthorized access difficult. The "appropriate balance" should take into account things like the value of the target, the value of making authorized access easy, the likeliness of an attack, the sophistication of the likely attackers.

      So for example, there's a lot of things that are considered "good" security that make both authorized and unauthorized access more difficult. However, you may have an asset that there's high value in making authorized access easy, while the asset is of little value to potential attackers and an attack is unlikely-- and even if there were a security breach, little would be lost. In such a case, those "good" security practices are actually bad because they're inappropriate for the context.

      And actually, it's not just making unauthorized access "difficult", it's making also making it risky, unlikely to pay off, and making it more likely that a breach will be detected. Part of preventing a breach is to make the target unappealing.

    20. Re: Security is hard by phantomfive · · Score: 1

      No, the way you are talking is like a cya consultant writing a bunch of disclaimers because he knows something will go wrong. You can do better.

      --
      "First they came for the slanderers and i said nothing."
    21. Re: Security is hard by phantomfive · · Score: 1

      See, you are wrong already. Because YouTube accounts can provide access to gmail, they can provide passwords to many people's bank accounts. As soon as you start thinking "we don't need to be so secure" you're going to screw it up.

      --
      "First they came for the slanderers and i said nothing."
    22. Re: Security is hard by Bing+Tsher+E · · Score: 1

      Then your computer probably has the websites on 'the internet' that you need to do your job whitelisted.

      It probably doesn't include slashdot, linked-in, facebook, or reddit.

    23. Re: Security is hard by nine-times · · Score: 1

      No, the way that I'm talking is based on having a basic understanding of how security really works.

      I've seen a situation where, to improve security, a company installed a keypad and began rotating the pass code on a regular basis (I think it was once a month). The employees kept forgetting the latest password, and would get locked out. It was particularly annoying because the door was just another entrance to the office, didn't provide direct access to anything that needed high security, and you still had to pass though a heavily populated area to get deeper into the building. Out of frustration, they started propping the door open with a doorstop, and management didn't do anything about it because "it wasn't that big a deal anyway".

      In another instance, a company tried to crack down on bad passwords by using what I believe was Microsoft's recommended practice at the time: Using Group Policies to enforce strong passwords, at least 8 characters long, including upper-case, lower-case, a number, and a symbol, forcing people to change the password every 45 days, and prohibiting reusing any of your last 14 passwords.

      The employees were extremely frustrated until someone thought of a solution. They made their password "P@ssw0rd1". When they were prompted to change their password, they changed it to "P@ssw0rd2", then "P@ssw0rd3", going up to "P@ssw0rd14" before starting over. Whoever it was that thought to do that was so proud of their ingenuity that they told some of their coworkers, and before you knew it, half the people in the company were using the same convention, literally using "P@ssw0rd" each time. A couple of the IT guys even thought that was fine, since it met the technical requirements and must therefore be a "strong password".

      To give another example I've seen more recently, a company wanted to safeguard their files by restricting sharing on their Dropbox accounts. They made it so you absolutely could not share documents with anyone outside of the company. Unfortunately, the reason they were using Dropbox in the first place was that they frequently needed to share files with people outside of the company. There was a lot of frustration and productivity loss among this company's employees, as well as some client relations mishaps, because they needed to share files but had no way to do it. It didn't take long for someone to come up with a solution: people started moving company files to their personal Dropbox accounts so they could share them.

      All of these cases are simple, easy to understand examples of a phenomenon most amateurs ignore: Making your security "stronger" can weaken your security. If you make things too frustrating, people will find a way to bypass your restrictions. And even if they don't, even if you're successful in enforcing security, you end up with low morale and decreased productivity, the cost of which may be greater than the potential losses of a minor security breach.

    24. Re: Security is hard by datavirtue · · Score: 1

      Exactly. It is all about culture. The entire company takes it cues from management. If they scoff at security or do not talk about it a lot it isn't a priority.

      --
      I object to power without constructive purpose. --Spock
    25. Re: Security is hard by datavirtue · · Score: 1

      "The employees were extremely frustrated until someone thought of a solution. They made their password "P@ssw0rd1". When they were prompted to change their password, they changed it to "P@ssw0rd2", then "P@ssw0rd3", going up to "P@ssw0rd14" before starting over. Whoever it was that thought to do that was so proud of their ingenuity that they told some of their coworkers, and before you knew it, half the people in the company were using the same convention, literally using "P@ssw0rd" each time. A couple of the IT guys even thought that was fine, since it met the technical requirements and must therefore be a "strong password"."

      This is the very definition of modern InfoSec.

      --
      I object to power without constructive purpose. --Spock
    26. Re:Security is hard by datavirtue · · Score: 1

      Often, the people qualified to run in InfoSec have better things to do with their career than watching a dashboard and reading logs. IT security in a modern corporation is a fucking joke.

      --
      I object to power without constructive purpose. --Spock
    27. Re: Security is hard by phantomfive · · Score: 1

      You keep saying what good security is not. Often times, we can have perfect security. For example, you can avoid all SQL injections. Every single one of them. We know how to do it.

      --
      "First they came for the slanderers and i said nothing."
    28. Re: Security is hard by nine-times · · Score: 1

      That's not "perfect security", that's preventing one attack vector. Can you set up a SQL database so that it's absolutely impossible for there to be any security breach whatsoever?

    29. Re: Security is hard by cyber-vandal · · Score: 1

      No it really doesn't since useful answers can be found from just about anywhere. Whitelisting all the sites I look at in a month would be very time consuming and inconvenient.

    30. Re: Security is hard by phantomfive · · Score: 1

      You keep saying "it's impossible" without defining security, and your writing is just a bunch of excuses.

      For an SQL database, there are basically three levels of security:

      1) You are vulnerable to random, driveby attacks. The sorts of things when you leave the default password on, or haven't patched your system for years.
      2) You are vulnerable to targeted attacks. (We could grade this level by how much effort they have to put in: script-kiddy level or state actor level?)
      3) The best level of security. When it's easier for even the state actor to attempt to use a physical attack (or bribe an employee) than to hack it remotely.

      Can I secure an SQL database to level 3? Oh yes, I can.

      --
      "First they came for the slanderers and i said nothing."
    31. Re: Security is hard by nine-times · · Score: 1

      You keep saying "it's impossible" without defining security, and your writing is just a bunch of excuses.

      And you keep showing that you just don't understand security. I've offered a couple definitions with different levels of detail, but I'll try to rephrase: There is no such thing as "perfect security", not even theoretically, not even conceptually. What people are looking for when they're looking for "perfect security" is something that cannot be breached through any attack vector.

      No, you can't provide perfect security for a SQL database. Your argument shows a stunning lack of insight. What's the perfect version of SQL that you'll be running that has no vulnerabilities? What perfect OS will it be running on? What perfect users will be using it, who are completely honest and have perfect judgement, not subject to social engineering? It's not possible to configure a SQL database in such a way that the data in it will not ever be accessed by any unauthorized people.

      And the fact that you think you are able to configure a SQL database so that no one can compromise it through technical means leads me to think that you specifically are ill suited to try. Yeah, sure, I'm sure you can follow some best practices for setting up a database and install some OS patches, preventing a lot of obvious known attack vectors. You might be a fairly competent sysadmin. But clearly you have a poor understanding of security, and shouldn't be assuming that you understand what goes into providing real security to a whole system..

    32. Re: Security is hard by phantomfive · · Score: 1

      . I've offered a couple definitions with different levels of detail, but I'll try to rephrase: There is no such thing as "perfect security", not even theoretically, not even conceptually. What people are looking for when they're looking for "perfect security" is something that cannot be breached through any attack vector.

      This is not a definition. You said what security is not, you failed to say what it is.

      --
      "First they came for the slanderers and i said nothing."
  8. Priorities by brian.stinar · · Score: 4, Interesting

    As someone that owns a software company, I am constantly attempting to push my customers towards proactive, forward thinking maintenance. It's not like CTOs, executives, and decision makes are dumb. Many times organizations are aware of systemic problems, and they would prefer to be in a break-fix model than a preventative maintenance model. Decision makers have to balance allocation of resources to different projects, and if something is presently working, why spend the resources to ensure that it continues to work? This is one approach. Additionally, I've seen IT professionals scoff at anyone with technical skills AND an ability to get their ideas into motion, and move money towards their ideas ("sales" / "suits.")

    Another approach is taken by companies with successful products, big teams, very cheap costs of capital, that are sitting on tons of cash. Those companies are able to invest tremendously into forward thinking projects, and have redundancy at all levels of their organization, and can afford to fail proactively rather than reactively. My friend at Google said for every code change he makes, two other engineers have to sign off on his code, and it has to run through a battery of automated tests before it is (carefully, and reversibly) integrated into production. I think this is the other extreme from my experience in developing, and supporting, software in New Mexico.

    I don't think it makes sense to sit on an armchair, and discuss what "companies" should, and shouldn't do - unless you are employed by such a company either as a contractor, an employee, or own a fraction of that company and you have voting rights. I'm often times able to convince people to invest more into proactive solutions, especially after a predicted disaster that has been warned about repeatedly. Even without such a motivating disaster, I'm usually able to convince people to take some proactive steps, even if they're not willing to spend as much as I'd like to convince them to, or move as fast as I'd like.

    Try convincing someone, (or yourself!) to go to the gym and you'll see what I mean with the difficulties in convincing organizations to spend money maintenance.

    1. Re:Priorities by Anonymous Coward · · Score: 1

      Try convincing someone, (or yourself!) to go to the gym and you'll see what I mean with the difficulties in convincing organizations to spend money maintenance.

      I vividly remember the moment I saw myself grow old, fat, and unhealthy in the mirror and decided I didn't want that. Yet I'm very lazy and have no staying power. What to do? I changed my eating habits and started to do seven minutes of calisthenics every morning. That's not a full gym regime, but effective enough to get down to reasonable weight and enough fitness for a 30 second sprint to catch a bus or something. For me this is a fine balance of investment vs. yield.

      Anyway, the problem with IT is that it's a shitshow of FOMO and "getting with the times", with new buzzwords every week, when it really is a side-show to the real revolution. IT is neither necessary nor sufficient for, but it can help a lot with, getting the right information in the right place at the right time. At which point that information might be used somehow, individually or in organisations or what-have-you. The term for this is "management".

      So "investing in IT" is missing the point entirely. What you need, and what we really don't have enough yet, is clear ideas of what we want to achieve. We're still coasting on a lot of accidental infrastructure, that's hopelessly insecure and brittle to boot. When we have the ideas, we can start to actually architect some things, then build them. It's no surprise that the world-wide web, or any large corporation's "application" park, looks like a shanty town. But what fancy shanties!

      This problem goes rather deep, including OSes and even the hardware in the peecee-"ecosystem". In IT you can always stack another layer on top, but it's not a given that it's a good idea. We do pretend a lot, though.

    2. Re: Priorities by Monster_user · · Score: 1

      What we're trying to accomplish in I.T. Is to make data available and accessible to those making the decisions, this includes the maintenance of keeping the servers secure and operational.

      The C-Levels provide the vision, the next level down researches the cost and proposes solutions to achieve the vision, and then the monkeys at the bottom do what can be done with whatever resources have been allocated.

      It really helps if there is some communication all the way up and down the chain as to how well a solution has panned out, and/or whether adjustments need to be made, or speeches need to be made.

      It also helps if the C-Levels either understand technology and the trends in technology, or trust the opinion of their high level I.T. Department, in order to better formulate what needs to be included in the vision for the companies future.

    3. Re: Priorities by brian.stinar · · Score: 1

      It also helps if the C-Levels either understand technology and the trends in technology, or trust the opinion of their high level I.T. Department, in order to better formulate what needs to be included in the vision for the companies future.

      I agree with that statement, and I think it's half of the picture.

      I also believe it's important for the technologists to try and understand business considerations, and trends in business, and for these things to be discussed with technologists, so that it's possible to understand why a manager might be asking someone to do something down and dirty. Or to trust the opinion of their higher level manager if not. When I ask my guys to do something terrible (such as iframing in WordPress content to designer mock-ups that are sort of working HTML, like I did today, unfortunately) I try and explain to them WHY we are not taking a good approach (because an unreasonable customer already started a marketing campaign, for tomorrow, and didn't tell me until four days ago so we cannot actually build out these pages even with a full team press.)

      What I tend to see is that anyone with specialized knowledge generally believe that it's not possible to explain technical trade-offs to people without that knowledge, and people with specialized business knowledge generally believe that's it's not possible to explain the business trade-offs to people without that knowledge.

      I always felt way less bad doing something down and dirty when my manager would:
      1.) Explain why
      2.) Explain how we'd spend the time to do it right afterward
      3.) ... and then we would actually spend the time to do it right afterward...

      So that's what I try and do with my guys.

    4. Re:Priorities by datavirtue · · Score: 1

      Yeah, the CIO doesn't want to go to a management meeting to talk about things that could happen and please give us more money to spend. How much? $400k. Everyone loses interest--if they had any to begin with. Just not condusive to helping the CIOs career and standing in the group. Now talking about a current blow up, everybody hangs on his every word and are glad he is there. Money is no object, he is a hero. Approved!

      --
      I object to power without constructive purpose. --Spock
  9. H1-B Competition by Anonymous Coward · · Score: 1, Interesting

    I had to give up a career in IT in favor of the military for a while and then legal practice. That's because IT is an unlicensed profession and employers can say they cannot find American talent, and can apply for far cheaper foreign IT workers.

  10. it's not the hiring practices by Cederic · · Score: 1

    Aside from cronyism/nepotism, nobody intentionally hires crap people.

    It's the difficulty of finding the balance between IT investment, where to invest and retaining profitability as a company.

    IT is as expensive as it is important. People don't make shit decisions on purpose, this really is a bloody difficult area for business leaders.

    1. Re:it's not the hiring practices by Anonymous Coward · · Score: 3, Informative

      Nobody intentionally hires crap people... I'll agree there. We just came off a situation where a 6 person team was reduced to 2 because IT was "too expensive" in the CEOs eyes. We got approval to fill 1 of those lost positions but were only given funding to get an entry level person. We hired the best candidate we could find in a reasonable time in the price range, but that "savings" came with a lot of training , hand-holding,and slow delivery. Some would call that a crap hire because we couldn't replace with equivalent skill of the person they replaced. The hiring practice was fine but the constraints imposed led to ineffective hiring for the real needs of the company.

      Funny ending... that person lasted under 90 days. We get to do it all again.

    2. Re:it's not the hiring practices by Pig+Hogger · · Score: 1

      nobody intentionally hires crap people.

      But they intentionally hire cheap people who will definitely not rock the boat and know rule #1.

    3. Re:it's not the hiring practices by gweihir · · Score: 1

      IMO hiring cheap people is the same as hiring crap people. Sure, hiring expensive people does not at all assure you get good people, but it leaves the possibility. When hiring cheap, there is an assured outcome, no matter how much many in "leadership" positions are lying to themselves about it.

      --
      Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
    4. Re:it's not the hiring practices by drinkypoo · · Score: 1

      Aside from cronyism/nepotism, nobody intentionally hires crap people.

      If your goal is to break up a company and sell off its assets, why would you not sabotage the hiring process in order to make it fail faster? Doing so is also cheaper than hiring good people, so you save more money.

      --
      "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
  11. Peter principle by Anne+Thwacks · · Score: 3, Funny
    People at the top are people that have been promoted beyond their abilities. The longer a company has been in existence, and the larger it is, the truer this is.

    There is a simple solution: randomly promote people to arbitrary jobs each year. It cannot possibly be worse than the present situation. And look: we can solve inequality and "pay gaps" by paying people arbitrary salaries too.

    OK, its true, I need another coffee.

    --
    Sent from my ASR33 using ASCII
  12. FTFY Ask Slashdot by jmccue · · Score: 1

    Do companies care more about stock holders (or the board) then _________ (fill in the blank)

  13. So long as significant security issues continue... by QuietLagoon · · Score: 1

    ... it is evident that companies are under-investing in IT.

  14. Subjective by jbmartin6 · · Score: 1

    Under-invest is subjective, just like under- or over-fund. If the company chooses to invest one cent in IT, that is exactly the correct amount. Assuming they made that decision with a correct understanding of the consequences. "under" fund or invest can only exist with a defined objective. We might ask "is IT underfunded if companies want to acheive X or Y?" but to ask generically if something is underfunded is a nonsensical question.

    --
    This posting is provided 'AS IS' without warranty of any kind, implied or otherwise.
    1. Re:Subjective by drinkypoo · · Score: 1

      We might ask "is IT underfunded if companies want to acheive X or Y?" but to ask generically if something is underfunded is a nonsensical question.

      Only if you ignore context. Companies want to achieve profit. Is IT underfunded for companies which want to achieve profit? This question unpacks to "Could most companies make more profit by giving more funding to IT?" I hope this brief English lesson is of some value to you.

      --
      "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
    2. Re:Subjective by Comrade+Ogilvy · · Score: 1

      Assuming they made that decision with a correct understanding of the consequences.

      Well, yes. But that assumption is impossible to agree (or disagree) with without a discussion about context. Consequences are a thing that can happen over short, medium, long, and very long time scales. Spending to improve weak accounting practices is something that can protect you from disaster over the medium term. Spending to improve IT pays over the long and very long time scales. In any given quarter, shortchanging IT makes sense if all you care about is the next couple quarters. Yet, it was absolutely inevitable that one day a very professional set of hackers would target Equifax; Equifax made the wrong bet.

  15. Yes, under-investing... by hcs_$reboot · · Score: 1

    ...in IT people.

    --
    Slashdot, fix the reply notifications... You won't get away with it...
  16. Because of extreme ignorance by Futurepower(R) · · Score: 4, Interesting

    How to pay "the minimum amount for labor and supplies."

    Yes, but it appears to me that is not the main problem. The main problem is the EXTREME lack of knowledge and lack of interest in technology by most people in upper levels of management. They didn't have computers in their childhoods. They don't want to learn now, partly because they are overly busy, working 50 hours a week and having 4 children.

    That will change. Recently I was in a library when a man approached the checkout desk with his son. His little girl went to the self-checkout computer, pulled a stool from underneath the counter, stood on the stool, and started the computer checkout process. I laughed and asked the man about that. He said his little girl is 2 years old and his children are "almost like a different species".

    1. Re:Because of extreme ignorance by plopez · · Score: 2

      I don't expect a manager to be a tech expert. I do expect a manager to know how to listen to Sr. staff and organize the efforts of the employees. Most managers are barely competent, other flat out scarily incompetent. The few really good ones I have met I tried to learn from.

      --
      putting the 'B' in LGBTQ+
    2. Re:Because of extreme ignorance by WorBlux · · Score: 1

      50 hours a week for upper management? Sounds great, where do I sign up? (SRSLY 50 is the low end, the 4 kids is getting towards the high end anymore)

    3. Re:Because of extreme ignorance by thsths · · Score: 1

      Not that I am terribly surprised, but this is shocking. To me, it also is evidence of terrible *HR* departments at these places, if they let a manager continue to operate like that. (And there are much fewer excuses for HR departments to be bad at their job.)

    4. Re:Because of extreme ignorance by datavirtue · · Score: 1

      Yeah...but literally anyone can do that with the average competency witnessed in everyday life. If they do not involve themselves in technical matters whatsoever and merely remove barriers for the engineers then the relationship is approved. If they start trying to make technical decisions and back away from things because of their ignorance then I have no use for them. They are just another thing I have to work around and manage myself. In either case, don't be surprised when the engineers make more than the manager. IT management is usually a bad career move. Your tech chops immediately decline and your skills are very cheap/easy to replace with another willing, yet unskilled, people pleaser.
       

      --
      I object to power without constructive purpose. --Spock
    5. Re:Because of extreme ignorance by datavirtue · · Score: 1

      Where have you been? HR just keeps their head down. The last thing they want is to be involved with the messy, sticky issues pointed out by the OP.

      --
      I object to power without constructive purpose. --Spock
  17. Dilbert cartoons by Futurepower(R) · · Score: 4, Interesting

    Dilbert cartoons often show a lack of knowledge of technology by top management. The cartoons are somewhat exaggerated but usually have a strong element of truth.

    For example, "We have only bad data...."

    1. Re:Dilbert cartoons by Anonymous Coward · · Score: 4, Interesting

      Dilbert cartoons are not exaggerated at all. If anything they're too tame.

      One of my (thankfully) former employers banned dilbert cartoons. They were far too close to reality.

    2. Re:Dilbert cartoons by plopez · · Score: 5, Informative

      In a foreword to one of his books Scott Adams said he would come up with the most outrageous cartoon he could think of. Only to have people email in recounting how they went through a similar but even more outrageous situation. Dilbert just scratches the surface.

      --
      putting the 'B' in LGBTQ+
    3. Re:Dilbert cartoons by Lodragandraoidh · · Score: 1

      Dilbert cartoons plaster my cubical - all of which reflect something I've had to actually deal with.

      This is my favorite

      --

      Lodragan Draoidh
      The more you explain it, the more I don't understand it. - Mark Twain
    4. Re:Dilbert cartoons by kantier · · Score: 1

      You have a cubicle? You lucky bastard...

    5. Re:Dilbert cartoons by datavirtue · · Score: 1

      I paste Dilbert comics on my carbuncle.

      --
      I object to power without constructive purpose. --Spock
  18. My experience in health care IT by puck01 · · Score: 3, Informative

    It is underinvested, poorly organized with focus on maximizing income streams for health care systems rather than improving health care outcome.

    I've seen enough at this point in my career in several organizations - some are hospital systems, some a health IT vendors - to be confident about this. Much of the developed systems were overseen by people with little to no real world healthcare experience. They made decisions directed to satisfy hospital system leadership which has had no serious vested interest in improving outcomes until the last few years. Most hospital systems leader have no background taking care of patients or whatever experience they have is seriously limited.

    Because I've practiced medicine (and still do) it is been appalling to me to see who is making the decisions and why.

    Now that I work for a large healthcare IT vendor and I have quite a bit of autonomy directing our resources to create content and tools that are more useful to the actual health care providers, the problem is we are understaffed to provide these products as thoroughly with as high a quality as they should be. One reason is because we have to undo much of the legacy crap - 20+ years of having non-clinical people doing this has led to frankly incorrect data and logic. If we could start with a fresh plate it would be much easier. Another is, no one wants to pay for clinically experienced people who know how to review scientific data to actually research the problems or the clinical literature to make fully informed decisions.

    1. Re:My experience in health care IT by rnturn · · Score: 1

      My experience in this area was inheriting a data center with a series of healthcare applications/systems that were purchased by people with no idea of what was going on and were connected together in a variety of hodge-podge solutions that wound up requiring a full-time effort by one member of the IT team designing software interfaces to allow the systems to talk to each other. One pair of systems were connected--I kid you not--through a pair of terminal servers with rs-232 cables strung between them. Apparently, the genius behind this solution thought it was an excellent way to connect eight users on system A so that they could connect with the application running on system B but nobody knew for certain. And, of course, that Rube Goldberg interface was completely undocumented. We never knew what those terminal servers were for until, one day, our network lead, thinking that they were no longer needed (hell,,, none of us thought otherwise), powered off one of the terminal servers and the help desk lines lit up.

      When the big project to build a data warehouse of patient treatment outcomes was being put together, of course the consultants included a line item for the cost of cleaning up the data that had been entered into the motley assortment of healthcare applications that had been installed in the previous decade. The word that came back to the IT group following the presentation was that, minutes into the presentation, upper management turned to the last page, saw the cost of the data cleanup task and had already made up their minds to cancel the project before the presentation was even finished. Nobody cared whether the planned system would have been good for the company (it would have been in the long run) or to the patients (you know, the people that came to us for healthcare after seeing our commercials). Following that, a good two-thirds of the IT team drifted off to other companies over about a six month period. It would not surprise me to find that some of those barely-documented systems had been kept in service long, long after the HW and SW support had sunsetted.

      I learned that there are a number of new people in upper reaches of their management nowadays. Perhaps they're smarter about the systems that the business relies on than their predecessors were.

      At another company, ancient HP-1000 systems (complete with 9-track tapes drive and removable disk packs) were still in use in the data center when I started. (My jaw actually dropped when I first saw them---at that time I hadn't seen any of those in use for at least 15 years. (And they were considered dinosaurs back then.) Any time a problem cropped up on either the hardware or the applications, they had to call a retired, former employee who knew how to fix the software or which used equipment vendors could be contacted that might have spare parts. For some reason this was seen as saving the company money by not replacing outdated systems. (IMHO, it was "if it ain't broke, then don't fix it" taken to insane extremes.) The group that owned the applications on those system kept them around for about another year after I joined. If Y2K hadn't rolled around, I'd bet that group would have insisted on keeping them around for even longer.

      --
      CUR ALLOC 20195.....5804M
  19. The simplest explanation... by zarmanto · · Score: 1

    As the old saying goes, the simplest explanation is usually the right one. So, just think for a brief moment: who do you go to, to find out how to save the money? Thatâ(TM)s right: accountants. But what does IT tell you that they desperately need, whenever you go to them? Thatâ(TM)s right: more money. And so, since people generally tend to listen more intently to (and spend more money on) someone who is already telling them what they want to hear, and nobody really wants to hear from the guy who is always costing them money, it shouldnâ(TM)t be a mystery when corporate funds are increasingly diverted to accounting, and away from IT.

    1. Re:The simplest explanation... by drinkypoo · · Score: 1

      So, just think for a brief moment: who do you go to, to find out how to save the money? ThatÃ(TM)s right: accountants.

      Wrong! You talk to everyone, all the way down. You ask everyone how you can save money. You have to engage with your employees to get the information that they have.

      And so, since people generally tend to listen more intently to (and spend more money on) someone who is already telling them what they want to hear, and nobody really wants to hear from the guy who is always costing them money, it shouldnÃ(TM)t be a mystery when corporate funds are increasingly diverted to accounting, and away from IT.

      If they're too dumb to listen to the entire sentence and find out that spending more on IT will actually save them money and help them make more money at the same time, they deserve to fail. Problem is, they take their employees' livelihoods with them.

      --
      "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
    2. Re:The simplest explanation... by zarmanto · · Score: 1

      You're describing an idyllic world, in which I would love to live and work. I've been around long enough, that experience tells me that I'm describing an all too common reality. Unfortunately.

  20. The problems have been long documented (since 1971 by bfwebster · · Score: 4, Interesting

    I teach CS 428 ("Software Engineering") at BYU. The three texts my students read are:

    -- The Mythical Man-Month, Fred Brooks (originally published in 1975, anniversary edition in 1995)
    -- Peopleware by DeMarco and Lister (first published in 1987, currently in its 3rd edition)
    -- Facts and Fallacies of Software Engineering by Robert Glass (published in 2002)

    I also recommend to them (but don't require) The Psychology of Computer Programming by Gerry Weinberg (first published in 1971)

    I tell my students if they read those first three books, they will be in the 1% (or less) of people in the IT industry who have. Yet they clearly lay out all of the foundational issues in IT, including bad hiring, bad management, bad environments, lack of understanding (by management) of how to build teams and nurture talent, and so on. They explain why we have such crappy software and why we lose $50B or so each year in failed IT projects.

    My other work is as an expert witness in litigation involving IT. About 50% of my cases are failed/disputed IT projects. My job is made easy -- though I am often depressed -- by how common and well-documented the root causes are. You'd think we'd learn. You'd be wrong. ..bruce..

    --
    Bruce F. Webster (brucefwebster.com)
  21. Simple by Ol+Olsoc · · Score: 1
    Accountants show companies creative accounting practices that while they might be illegal, the make money. Companies understand that.

    IT people don't do that. And since there is no real punishment for giving away your customer's credit cards and other data, it is pretty simple accounting. that an accountant is a better investment for profit than an IT security person.

    --
    The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
  22. Re:IT doesnâ(TM)t understand business by geekmux · · Score: 1

    We completely fail to understand the business and therefore canâ(TM)t provide adequate information for business leaders to make good decisions...Chances are we could make the business solution better and more affordable if we looked at the end goal and presented an alternative.

    We completely fail to understand the business? What bullshit.

    Forget about the FUD tactics of selling decent Security for a minute, if an IT manager does NOT know how to gather the requirements (a.k.a the "end goal"), present multiple solutions (a.k.a. the "alternatives"), and then create a proper SLA (which includes budget for adequate support agreements and staffing up front to perpetually support a service), then they have no place in IT or business.

    And yes, I've been in IT long enough to understand those are still challenges we face today, but it's still not an excuse for doing the common sense legwork. IT doesn't need to understand "business" beyond maintaining the systems and services that keep a business alive, which is why you don't find CPAs or MBAs in IT. If management is too stupid and ignorant to understand the value of IT for their business and help define the very SLAs that keep IT systems functioning properly, then they tend to get what they deserve.

    And it's not hard to define an SLA. Walk over to the server and turn it off. Then ask management how long they can do without it. After they stop jumping around like monkeys, you'll get an answer to create a budget with.

  23. Management's Perception Problem by siege72 · · Score: 1

    IT is perceived as a combination of the worst parts of HR (intrusive security and rules) and building maintenance (it's easy so anyone could do it).

    Management wants to consider everyone as being replaceable _and_ cut costs, making outsourcing, cloud, and SaaS appealing. The devil is in the details: the companies providing these services will be very well protected by their contracts and SLAs. The result is that the outsourcing company will bear little risk for breaches, while the paying company (and it's customers) will bear the full brunt of outages or security gaffes.

    I'm sure there are anecdotes about this in personal or professional work. I've seen a major SaaS player - who guarantees uptime and data retention - email businesses effectively stating "We lost your data. Feel free to choose another provider if you don't like it."

    1. Re:Management's Perception Problem by drinkypoo · · Score: 1

      IT is perceived as a combination of the worst parts of HR (intrusive security and rules) and building maintenance (it's easy so anyone could do it).

      Building maintenance is another thing most people don't understand. It's not all that easy, and it's one of the most dangerous jobs in America. There's lots of opportunities to fall to one's death, or get electrocuted, and one tends to be exposed to lots of hazardous chemicals, rat turds, etc.

      --
      "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
    2. Re:Management's Perception Problem by datavirtue · · Score: 1

      This sounds like a technique for getting the business to officially wave off the data loss before thinking things through. Someone knows how corporate legal departments work.

      --
      I object to power without constructive purpose. --Spock
    3. Re:Management's Perception Problem by datavirtue · · Score: 1

      Everybody else's job is easy.....comeon'

      --
      I object to power without constructive purpose. --Spock
  24. Because Managers Understand Accounting by MrLizard · · Score: 1

    What's an MBA? Basically, an accounting degree.

    Managers understand accounting. They understand how to judge accountants. They understand how to determine if they're hiring the right people and they're doing the right things. They can tell if an accountant is BSing them or not. This lets them make, more or less, reasonable judgements.

    They don't understand computers, even though they use them. This is not unusual. I don't understand my car, my microwave, or my dryer, beyond knowing which buttons to push.

    So they can't judge what's good and what's bad when it comes to IT spending. They can't tell if someone is BSing them when they ask for more money. They do know if they spend too much money, they'll get yelled at by their boss, but if they spend too little, it's the IT department that will get blamed. So, without a good sense of what is "too much" or "too little", they'll lowball it. No one ever gets fired for spending too little money, right? (Well, not if they know how to shift blame and kick someone else under the bus, and if you don't know that, you don't get to be in the position were you're making these kinds of decisions.)

    1. Re:Because Managers Understand Accounting by drinkypoo · · Score: 1

      I don't understand my car, my microwave, or my dryer, beyond knowing which buttons to push.

      You don't? I don't understand my microwave too well, because I'm not that great with physics, but cars are quite simple to grok and dryers are even simpler. If you can understand a complicated piece of computer software, you can understand a car if you're armed with the factory documentation.

      --
      "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
  25. Profit vs Risk by rbeezo · · Score: 1

    IT: We want to prevent problems before they happen! Accounting: How much will that cost? IT: Less than paying for a security breach + fines Accounting: What if a breach never happens? What would we have to get in that scensario? IT: Well. . . Accounting: I'll allocate you the money to pretend it will never happen. Good luck!

  26. "Pollution" in the senior ranks by Spinlock_1977 · · Score: 1

    Back when I started in IT in 1982, the most senior IT person in most organizations had risen through the ranks as a developer, then analyst, then team leader, etc. These days, you need little more than a project management designation to get in the door, and with a little hard work, you can soon be leading teams of developers and making important IT decisions. So in essence, the senior ranks of IT have become "polluted" with non-IT folks who lack the experience (and resulting vision) to make high quality long-term decisions.

    --
    - The Kessel run is for nerf herders. I can circumnavigate the entire Central Finite Curve in a lot less than 12 parse
    1. Re:"Pollution" in the senior ranks by gweihir · · Score: 1

      Indeed. And in most large organizations, this is heading for a really big catastrophe that will take multiple decades to clean up. That is in the organizations that can survive their long-term extreme mismanagement of their IT.

      --
      Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
  27. Re:The problems have been long documented (since 1 by Sesostris+III · · Score: 1

    Thanks. I'll make a note of these (some I've heard mention before), and at some point I'm going to have a thorough read.

    (I work mainly in support, so once I get exposure to a system, it's already written. However I do get curious as to how some of the stuff that we support actually get developed!)

    --
    You never know what is enough unless you know what is more than enough. - Blake
  28. It's All Google's Fault by tgeek · · Score: 1

    Seriously.

    In IT more so than any other industry I've seen, people believe google searches are an acceptable substitute for training, talent and experience. Sure, an internet search can extremely helpful in finding the missing piece to a puzzle ("what was that command line option I needed to make this work?"). But so many people base their entire work efforts around google results ("how do I do --fill in the project/task--?"). While this may work in some short-term cases, in the long run it always shows in projects that are riddled with security flaws, unscalable and impossible to maintain (just to name a few).

    Yet, the IT industry still hires such people. I suppose we're lucky this is fairly unique to IT. Would you want a brain surgeon who had to pause an operation while he checked something in google? Or a paramedic who had to search for CPR instructions? Or an airline pilot who had to dig thru pages of search results on emergency landing procedures?

    1. Re:It's All Google's Fault by angel'o'sphere · · Score: 1

      But so many people base their entire work efforts around google results
      You must be very unlucky. I never worked in an environment where it was remotely possible that you could find the solution of a business requirement via google or stackoverflow.
      Technical questions you can google, solutions for business requirements usually not.

      --
      Cost free eBook I read (by iBook/Kobo/Amazon/ObookO/Gutenberg etc.): "The Green Odyssey" by Philip Jose Farmer.
    2. Re:It's All Google's Fault by datavirtue · · Score: 1

      "Would you want a brain surgeon who had to pause an operation while he checked something in google?"

      Already happening. I watched a brain surgeon back out of a procedure because he could not make a decision after opening the patient and having fished a probe into her brain. He was clamoring for AI to make the decision for him. He decided to back out and risk attempting the procedure again after talking with the patient...but he was really dismayed by the fact that we have the data to create the AI that could have helped him make a better decision but that we just are not there yet (regulatory concerns over data, etc..).

      --
      I object to power without constructive purpose. --Spock
  29. If you can't recognize a good IT engineer... by archer,+the · · Score: 1

    how do you hire the good engineers so you can have good IT infrastructure?

  30. Pay peanuts, get monkeys by gweihir · · Score: 1

    I see that in action at a Fortune-500 company every day. They have "developers" and "system administrators" that are completely clueless and cannot even do the most simple things. Of course, not all of them are like that, but when you (rarely) run into somebody that actually knows their stuff, you soon after find out they are leaving or they are waiting for retirement or they are external consultants.

    --
    Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
  31. Re:The problems have been long documented (since 1 by gweihir · · Score: 1

    The Mythical Man-Month is still very accurate in its analysis and recommendations, yet not only is it ignored today, it is often completely unknown. That is staggering, but it explains why so much IT is managed in a completely clueless fashion, despite all the major issues actually having been known for a long, long time. I have to admit I did not read the other two though, probably should fix that.

    --
    Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
  32. Almost no one in IT appreciates security by Pinky's+Brain · · Score: 1

    Look at how rabid the defense can get for BYOD or programming in C. THERE IS NO ALTERNATIVE to standard practices in IT, the inevitable failure modes are argued to be a case of imperfect humans ... to which everyone here is the supposed exception to the rule.

    IT is fucked, money doesn't help. You need to genocide the IT industry and start over.

    1. Re:Almost no one in IT appreciates security by Junta · · Score: 1

      Defense for BYOD generally comes down as a business mandate, to avoid the company spending money on devices when the employees can spend their own. Even bad IT would prefer not to permit BYOD, as their jobs are unambiguously easier if they control the devices (even when they do a poor job at it, at least they feel in control).

      I don't know how much bad IT can be attributed to IT depts coding in C, I rarely see an IT department do that, good or bad.

      --
      XML is like violence. If it doesn't solve the problem, use more.
    2. Re:Almost no one in IT appreciates security by Pinky's+Brain · · Score: 1

      The attack surface from OS's and applications written in C for the average IT department is huge though. They buy/use that utter trash created by decades of overconfident programmers.

  33. Ill-thought out enhancements by bnemer · · Score: 2

    In my experience, at least in the last 20 years or so, most IT decisions are driven by sales people who need new and fancy enhances to the application(s) because their client's are demanding it and they say, "We need it yesterday!" What usually happens though, there's not that many client's who want the new addition(s) to justify the cost, nor are the specs very clear, and what ends up being released is buggy and ill-thought out enhancements. And what's usually driving this frenetic release, is an Excel spreadsheet. The programmer usually gets blamed for all the bugs in the new release making him/her sinking lower and lower in the eyes of the people upstairs. JMOHO

  34. Some Companies by sdinfoserv · · Score: 2

    Some companies view technology as an expense. Those companies are short sighted, seldom successful and have weak IT leadership. It is the job of IT leadership (the CIO, IT Director, etc.) to educate the entity at the "C" risks and rewards of technology. Also as employee, it is your job to protect yourself and your family by working for those organizations that reward you. As someone who has run IT shops for many years now, I have been the highest paid of all my peer management. My job is risk mitigation and education. If my insights and experiences fall on deaf ears, it's my duty to myself and my family to go else where.

  35. Differnce between good and half-assed IT... by Junta · · Score: 4, Insightful

    Broadly speaking, business leaders are largely unable to discern the difference in effectiveness of half-assed IT and good IT. Except for two facets:
    -You become the next equifax
    -Good IT costs more

    Of course, even if they want good IT, they can't tell the difference, so they my try to invest to get "good IT" and still get bad IT and have expectations calibrated that there is no good or bad IT, only cheap and expensive.

    One sign of bad IT is your employees complaining about how bad the systems are. From a business perspective the answer is to tell your employees to suck it up, perceive them as whiners. They can't imagine better. The tools selected come from big reputable companies with reassuring salespeople talking it up and how it has improved other customers, while the pitiable users are comparatively less well equipped to precisely explain how or why the system sucks. In the meantime, often this phenomenon is offset by the users by "shadow IT", peer support to give each other what they need to get their jobs, without telling official IT about it (because the relationship between IT and people gets adversarial). This is a strong indication IT has picked the wrong tools for the job, but it also tends to create invisible business critical systems with 'admin' as the password.

    Note that sometimes it's what bad IT does to otherwise well made software, imposing maddening workflows that make no sense on software that was designed for a sane world.

    --
    XML is like violence. If it doesn't solve the problem, use more.
  36. IT is a cost and has greedy vendors by swb · · Score: 1

    IT is seen as an overhead expense and it results in a lot of pressure to keep costs down.

    I think an unseen contributor to this is that IT vendors (hardware, software, etc) too often label needless churn as innovation in order to collect more revenue, resulting in a lot of business process redesign to manage the changes imposed on them by vendors.

    How much will it cost business to adapt to Windows 10? New rollout and patching processes and systems, software compatibility testing and possibly even software changes to work with it, employee training, and so on. All because Microsoft wants to up their licensing revenue or jump on the touch screen bandwagon?

    At the end of the day it doesn't surprise me that non-technology business leaders are reluctant to spend on IT. They know they're being taken for a ride by their vendors from a business perspective. Many wind up pinching too many pennies, but a lot of times it looks to me not like a spending problem but just not being able to chase the tail of IT "innovation" fast enough.

  37. Re:You want NoOps; IT is a cost center by pete6677 · · Score: 1

    That's a great way to run a company if you are only interested in cutting costs, and care nothing about the future viability of your company.

  38. I blame MBAs, regulators, the markets and Informat by Tangential · · Score: 1

    I blame this on the perfect storm of Financial management taking over the business leadership role combined with the âoeour current quarterâ(TM)s results matter more than anything elseâ approach of business today. Technology played an important role in enabling Accountants/Financial folks to hold the reins. With tools like spreadsheets and data warehouses we have given the, the keys to the kingdom. The problem is that most of them are MBAs and they are trained to 1) believe it unquestionably once itâ(TM)s in a spreadsheet and 2) to be totally disconnected from both the innovation and human impact of the business. Why innovate? Will it help the current quarter?nope? No can do. All of those folks losing their jobs to improve the (non GAAP) results for the current quarter are just numbers, etc.and besides, itâ(TM)s my job to reduce expenses (since that is the easy way to improve earnings.)

    At the same time, in todayâ(TM)s business environment the markets only care about the current quarterâ(TM)s results and the regulators really only care about prior quarters. Thereâ(TM)s definitely no motivation to look ahead. It doesnâ(TM)t matter if what you are doing will destroy the company in a few quarters, only this quarter matters. I used to have a boss whoâ(TM)s background was as a C-level at lots of tech companies and his favorite saying was âoethis is the most important quarter in the history of the company.â

    As long as the comp plans of management continue to reward them primarily for the current quarter and the markets and the regulators agree with that approach, this isnâ(TM)t going to change. Right now success in business is defined as growth in revenues and (in a few industries) earnings. That means that non productive actions like mergers that combine existing revenues and reduce expenses are defined as success.

    We need to rethink the whole way we define and reward success in a business.

    --
    Suppose you were an idiot. And suppose you were a member of congress. But then I repeat myself. -- Mark Twain
  39. Means to an End by rbrandis · · Score: 1

    As workers in the information technology field, we sometimes lose site of the fact that information technology is a means to an end. Businesses invest accordingly.

  40. The right question for /. by nospam007 · · Score: 1

    Just as if you asked bakers if it's good for you if you eat more bread.

    1. Re:The right question for /. by Lodragandraoidh · · Score: 1

      It's not as simple as that. Read this post (below in the thread) ...I'm not going to type all of that out again for you.

      --

      Lodragan Draoidh
      The more you explain it, the more I don't understand it. - Mark Twain
  41. Because paying for IT is like paying taxes. by hicitusficitus · · Score: 1

    For most companies IT is like taxes, it's a drag on your bottom line but it's unavoidable so you try to take as many shortcuts as possible. From a business administration point of view, IT doesn't generate revenue so investing in it isn't attractive even if the company is vulnerable without proper IT.

  42. Key Problem: Publicly Traded Corporations by Lodragandraoidh · · Score: 1

    Corporations who's stocks are publicly traded on the stock exchange are evaluated by the market for one thing - and one thing only: profitability. The constant refrain of CEO and bean counters is they have a fiduciary responsibility to their shareholders to increase profits and grow dividends. Whatever responsibility they have to customers is secondary and largely defined by law and regulation - with a thin veneer of social responsibility thrown in when customers hackles are raised on a subject. As corporate lawyers are quick to point out, a corporation is not guided by ethical or moral considerations, but by whether an action is legal or not at the end of the day.

    As long as the risks and costs of breaches are less than the costs of ensuring a secure infrastructure, publicly traded companies will continue to choose the cheap way out to maximize profits. Corporate law and regulatory changes could change this equation to make it more costly not to address security, but in the current climate, unlikely to happen.

    As consumers, we can also impact this by abandoning companies that do not have our interests at heart (which is basically all publicly traded companies with rare exception). This has the effect of raising the cost of not addressing security through loss of revenue, and therefore loss of profit. Consumers also need to realize that we really don't get anything for free. There are hidden costs that we will pay sooner or later, and we need to decide if it would be better to pay upfront for guarantees, or pay later in terms of injury or death in the worst cases (and by injury and death I'm not only talking about physical, but also other areas of our lives including our economic, social, and civic lives).

    Finally, people who design and build systems (and this is not just the programmers and architects - this includes anyone impacting the choices regarding the design - including bean counters, project managers, marketing/sales people etc) need to recognize what mechanical engineers and architects learned in the last century: our creations can injure and kill people if care is not taken, and standards established for the deployment of these systems in the real world. Companies need to be held liable if they do not take care and build safe systems. Technologists need to band together, and share that message at every opportunity on every project. If the company isn't going to take responsibility, then who is going to be left holding the bag when things go really bad?

    --

    Lodragan Draoidh
    The more you explain it, the more I don't understand it. - Mark Twain
  43. Re:You want NoOps; IT is a cost center by Lodragandraoidh · · Score: 1

    There are two components missing from this concept: quality and consumers. As we move into a world where quality matters, offshore vendors will not cut the mustard. Time and time again from my own experience, and that of others we have seen vendors fail to deliver quality systems that meet security standards. If all companies slim down to the size you define - then there would be no employees - and therefore no consumers to generate the economic demand for the services they sell.

    That's why any company trying to go to this extreme will fail.

    --

    Lodragan Draoidh
    The more you explain it, the more I don't understand it. - Mark Twain
  44. Are you sure accounting is paid better than IT? by abies · · Score: 1

    I'm not sure from where the idea that accounting is paid better than IT comes from. Unless by 'accounting' you mean CFO of big company, I don't think this is the case.

    It is bit hard to qualify what you mean by 'good accounting' and 'good IT', but let's try.

    First anecdotal evidence - average IT guy in my area (Central Europe, medium sized city) earns 2-3 times more than average accounting guy.

    Then let's look at some official stats for US.
    https://www.glassdoor.com/Sala...
    https://www.glassdoor.com/Sala...

    Accountant - 55k average, 40-74 range. Programmer - 66k average, 50-90k range.

    Let's switch to 'good'. Large company, 15+ years experience.
    Accountant - 59k average. Programmer - 84k average.

    Not only IT is paid considerably better, but also their experience is better rewarded (while with accounting job, it seems that you will move from 48k to 59k in 15 years of experience).

  45. If you are an MBA you hate IT and hate Engineers by EmperorOfCanada · · Score: 3, Insightful

    I have rarely met an MBA who had the time of day for an Engineering type. You tell MBAs that such and such needs to be encrypted moved, backed up, or whatever critical thing for $10,000 and you won't get the budget. Then an interior designer comes in and redoes the front lobby for the 3rd time in 5 years for a cost of $250k.

    Then there are the pay scales. In any large not obviously IT company (many of which delude themselves into thinking they aren't nearly all IT like banks) you get an MBA with 5 years in getting $120k and the Engineers getting $70k. Then they wonder why they can't keep the talent.

    The MBAs even treat the accountants like trash.

    What I see are people of near zero talent who are genuinely scared of those with it. The more talent you have outside of their MBA world the more scared they are. You realize that you can save the company $10 million a year through something you found in the data and you get a pat on the back. Some MBA does a stupid deal worth $10 million (worth, not makes) and they get a rockin' bonus larger than the Engineer's salary.

    Then, hidden among the corporate world are the companies that are pretty much just Engineering people some of whom are good at sales and business. Those companies attract the top talent and often run circles around the old guard. An old guard who realize that they need to up their IT game so they outsource to India and lay off half of their employees.

    I have a simple formula. If a company has a large number of H1Bs in its staff then it will gain a short term advantage as it reduces costs and rides on its earlier momentum. In the long term it will start to find the ride bumpy, and then it will sink into oblivion. Think Yahoo, SUN, Compaq, etc. These companies were taken over by their MBAs who thought that Engineering was a commodity business.

    So to answer the original question. Crappy companies that are not going to be competitive in the long term are not investing in IT. The companies that are kicking ass and taking names are.

  46. Re:My experience _ Right on, brother. by az-saguaro · · Score: 1

    I too work in health care. I am now employed by a giant corporation that has bought up many local hospitals, a la 1980's style mergers and acquisition, for no benefit to the hospitals or the community or the patients they serve. The depth of stupidity and moral corruption defies belief, yet the system gets away with it because the board is no longer the fiduciaries of the community or sponsoring organization, rather appointed by the corporate heads.

    Diatribe aside, IT is a mess. In reading the many comments in this thread, they all ring true as to the ineffectiveness or ineptness of IT in this organization. I am not an IT insider, but I am tech savvy enough to smell the BS. Not to sound overly cynical, but the IT department seems to survive and thrive by NOT solving problems, or by making problems which they then must "fix". I acknowledge that they do something useful in keeping workaday nurses, doctors, and other staff "up and running" at each computer station, but the number of times that systems crash would not be tolerated in reputable companies. My corporate email account is a giant spam bucket filled mostly with messages from IT alerting us to the almost daily crashes or hacks and then congratulating themselves for fixing it.

    Everything you said either has the ring of truth, or is readily recognized as the truth by others like ourselves who must live and function within these abortions and evil corruptions of the once honorable and reputable system of hospitals and healthcare in this country. I will however take issue with one statement, ". . . hospital system leadership which has had no serious vested interest in improving outcomes until the last few years." From where I stand, I see nothing now or on the horizon to imply any "interest in improving outcomes". It all seems to be getting worse. Things run in cycles, and maybe in 20 years or 50 years things will flip back to reason, ration, and righteous motivations, but for now, where I am, I see nothing promising.

    Where I am, IT and computer infrastructure are only partly a tool to get the job done. Remember, just a few years ago, we got the job done without the IT, and it was done just as well or better. When the products and services and day to day operations are better without the technology, then the technology is more of an indulgent toy rather than a productive tool. The whole IT department then becomes a burdensome expense operating in parallel to the core business of the organization, sometimes at odds with it. And because management seems clueless, IT gets away with insane and expensive projects like periodically replacing all computers and monitors, even though the old ones worked just fine to run low bandwidth low-res text based apps that have the distinctive earmarks of having been first coded with Windows 3.1 or Win 95 era tools.

    Aside, I see that several posts have been made here about "the Peter Principle". That principle was published in 1969 in a book by professor Laurence J. Peter, stating that employees in organizations are promoted to their level of incompetence. It is sadly ironic then that my organization is run by a guy named Peter. It is the true and total embodiment of the principle.

  47. Why would you ask? by Darkness+Of+Course · · Score: 1

    This is normal. Nothing has changed.

    IT is a significant foundation block of the modern corporation, even down to lowly small businesses. Nobody, and I mean nobody wants to pay for it. Even if they claim they will, they don't.

    This is aggravated by the tendency of VPs in charge having a non-IT background. Which also includes executives coming from a different background, non-sales for a sales focused company.

  48. yes by mapkinase · · Score: 1

    Moreover, they are underinvesting in anything that can pay me vast sums of money

    --
    I do not believe in karma. "Funny"=-6. Do good and forbid evil. Yours, Oft-Offtopic Flamebaiting Troll.
  49. IT is becoming a silly term by TJHook3r · · Score: 2

    IT is enormous. Imagine if 'building' covered civil engineering, structural engineering, groundworks, bricklaying, plastering, painting... The only difference is that we have been doing the above for a long time - 'IT', not so much. It's difficult for companies to work out what they need when every guru out there is peddling a new world-class information technology *cough* blockchain *cough*... and the layman has to call it all IT.

  50. Re:My experience _ Right on, brother. by puck01 · · Score: 1

    The reason I said hospital system leadership today has some interest in improving outcomes is only because of standards and policies the government is imposing. It is not because any of them really care in action (most don't). It is because CMS will withhold reimbursements if a system is deemed to have bad care over a limited set of metrics.

    They sort of care only because they don't want to lose money. That is all. I have been part of projects to improve the results of these metrics. The only reason the support for the project existed was these policies. Whether or not solving to the metrics really improves meaningful outcomes is a whole other issue.

  51. Comment removed by account_deleted · · Score: 1

    Comment removed based on user account deletion

  52. Who says how much is the "right" amount? by Tony+Isaac · · Score: 1

    It's survival of the fittest when it comes to business.

    How does one measure the appropriateness of investment in IT?

    Programmers and tech people tend to think businesses spend too little, because they can see all the flaws up close. But flawed systems can often be sufficient to keep a company going, even thriving.

    IT is not an end in itself, it is a means to an end. If the company is thriving, that's a good sign that they are spending the right amount, at least in the short term.

    If they spend too little, they will eventually fail to keep up with the competition. This is, in the long run, a good thing. It's a self-correcting system.

  53. It can't be under investing by Casandro · · Score: 1

    I mean most companies just waste money in IT. Usually companies just follow dogmas which have little to do with reality. That's why they spend lots of money on worthless security products... or software products claiming to improve productivity, but wasting more for most people.

  54. No by skovnymfe · · Score: 1

    Companies are not under-investing, they're just investing in wrong and unimportant and unproductive endeavours because they don't let the IT people decide what's important.

  55. Ego = Greed. by jellomizer · · Score: 2

    The biggest problem I see is Ego. Most companies need a workforce of much lower skilled employees.
    For retail, clerks, stockers, etc...
    Even Hospitals, Doctors do not make the majority of the staff, but a large amounts of people just needing some trade schooling, and high school education to get in.
    Then they have the IT Staff. Most of the company leaders don't know what to do with a set of staff who is often highly educated, Has their own vision on how to do things, and doesn't take orders literally. Their job often needs to span the scope of the company, so they know what everyone else is doing at a particular level. The solutions they create become what is needed to follow. So as a boss these IT guys as a threat to their Ego, as the Boss they are suppose to be the Smart ones, the successful one, the guy who knows what is going on. The IT guys are smart, to be competitive the Boss needs to pay a decent salary, and they know what is going on too, and to make it worse, an IT Requirement could override a business decision.
    These guys know how to manage Underlings, but not Professionals.
    For most jobs if you do your job correctly every day is the same as the previous. For IT if every day is the same, then you are doing it wrong, because that same job should be automated batter. And every day is about finding new problems to fix or improve. That sounds good, but difficult to manage. Because the IT workers needs to less like machines then much of the other workforce.

    --
    If something is so important that you feel the need to post it on the internet... It probably isn't that important.
  56. yes by sad_ · · Score: 1

    but it is our own fault.

    --
    On a long enough timeline, the survival rate for everyone drops to zero.
  57. Perspective by DarthVain · · Score: 1

    Businesses spend money on what they think is their "core-business". All businesses are in the "core-business" or making money, hence the reason why folks in accounting will always have a job.

    I once had a job competition cancelled on me because it wasn't considered "core-business". When I said without the systems I support you won't have any business, I was only left with silence and dead stares.

    If you want a job forever, get into financial systems, which having a accounting background would probably be an asset. They have all sorts of very strict rules, are huge and complex, and every business needs them nor can they get rid of them easily.

  58. Bad hiring isn't the issue by shaitand · · Score: 1

    The issue is UNDER hiring. The perception that it is difficult to find qualified talent and the needing someone instantly who is an exact fit for a tech fingerprint are all symptoms of what should be overlapping and split duties across dozens of people being collapsed and folded under one "supergeek" over and over and over again... round after round. It should be no big deal if anyone in IT leaves and it takes 2 years to teach a high schooler to replace them.

    You can lay off hundreds of thousands of tech workers a year, claiming there is a shortage of "talent" to fill the handful of heavily specialized job you replace them with. But those positions you just invented aren't hard to fill because of lack of experts in the world... they are hard to fill because they didn't exist before you just made them up. This isn't some new field or type of education people are missing, it is technology fingerprint unique the company and the handful of people they collapsed those jobs down to... who naturally don't stick around long. At that point you should either not do that in the first place or start paying them seven figures to stick around because you've boxed yourself in a corner. Worse, you've done it in a way that probably will take years to crash your fortune 500 ship.

    Actually hiring correctly with modern technology means armies of tech workers who frankly fill most of their days learning and playing with tech or even watching a movie. You have hot spares and redundant data in your raid arrays... what idiot thought it was a good long term strategy to pull them all and sell them on ebay? That's what has been done across the board with the "hot spares" and redundancy in tech knowledge and the "talent shortage" is nothing more than complaining about the remaining drives not being able to cope as well under the extra wear and tear.

  59. Re:My experience _ Right on, brother. by bakwoodz · · Score: 1

    IT gets away with insane and expensive projects like periodically replacing all computers and monitors, even though the old ones worked just fine to run low bandwidth low-res text based apps that have the distinctive earmarks of having been first coded with Windows 3.1 or Win 95 era tools.

    You know I used to work for a vendor who sold a software package to pharmacies. I asked why the tools look as dated as they do. The response was that they were originally developed and got HIPPA certified during the DOS era. Since they would have to get re-certified to update the interface, it's just much cheaper to keep intermittently fixing the original code.

  60. Re:You want NoOps; IT is a cost center by datavirtue · · Score: 1

    In my experience it takes a team of people on-shore to micromanage the offshore. Stress is high, progress is slow, and you end up with MORE people involved. A perfect recipe for IT disaster.

    --
    I object to power without constructive purpose. --Spock
  61. Percent of Sales 2.2%? by tmjva · · Score: 1

    I just watched a mandatory company video that stated company IT investment should be 2.2% of Sales Income (didn't say whether it was Net or Gross).  If course it did not cite a source for that paradigm, it only stated it as fact.  YMMV.

    --
    Tracy Johnson
    Old fashioned text games hosted below:
    http://empire.openmpe.com/
    BT
  62. Re:My recent experience, by ahodgson · · Score: 1

    root cause: proton decay

  63. Re:The problems have been long documented (since 1 by ahodgson · · Score: 1

    The biggest problem in IT is that we refuse to learn from experience, even when documented as amazingly as people like Brooks have done. If it's not a buzzword it's not real.

  64. Re:As a DC tech.... by datavirtue · · Score: 1

    "So to answer the question: Companies are not under-investing, they mostly do not really know shit about their infrastructure and the few managers that get to talk about it, they mostly lie about it and the ones that can really speak about it, can not (as they will loose their job/career when they do)."

    Seen this go down many times.

    --
    I object to power without constructive purpose. --Spock
  65. Re:Introverts vs Extroverts by datavirtue · · Score: 1

    "Leadership likes to be sold on things. "
    One of the most insightful things anyone has said so far.

    --
    I object to power without constructive purpose. --Spock
  66. Re:My experience _ Right on, brother. by datavirtue · · Score: 1

    "or by making problems which they then must "fix""

    I have seen people propel themselves to stardom and recognition by fixing the disasters they directly created. It was not until I was a technical lead in a major "bet the company" project that I understood how important failed projects are to boosting the careers of people, not just in IT.

    No one gets recognized adequately for a project that gets implemented without disrupting anything. It is when the projects blow up in the whole company's face that the people who caused it (and those who help fix it) are rewarded with promotions, raises, and stardom. People in IT think logically. Smooth project == good for my career. Yes, in some cases. If you really want to jump a few ranks in pay and title get on a big project that is doomed to fail.

    --
    I object to power without constructive purpose. --Spock
  67. Re:My experience _ Right on, brother. by datavirtue · · Score: 1

    It almost like all health care are government agencies now. The acumen is generally horrible on all fronts. Some of them have good customer service if they have to service white people with good insurance that have choices. The rest of society is signaled quite clearly how much they are valued when engaging medical services.

    --
    I object to power without constructive purpose. --Spock
  68. Re:My experience _ Right on, brother. by az-saguaro · · Score: 1

    Well said. But, if you are a fan of Futurama, you might remember an episode that explained the conundrum best. (If you are not a Futurama fan, it is futuristic cartoon series, with one of the key characters being Bender, an irreverent and cynical robot.) In one episode, he is flung to the far reaches of the universe where he meets a non-corporeal entity that might or might not be God. They have a conversation, at the peak of which the entity explains:

    "Bender, being God isn't easy. If you do too much, people get dependent on you. And if you do nothing, they lose hope. You have to use a light touch . . . When you do things right, people won't be sure you've done anything at all.

    It is sad that in corporate America, doing things right such that they are hardly noticed merits no reward, whereas screw ups win. The big Golden Parachutes that go to CEO's that bankrupt their companies are the most extreme examples.

  69. Re:You want NoOps; IT is a cost center by Peil · · Score: 1

    That's where EY are going, they've already shifted their devs to Tata and are moving their Ops people next, now they offshored everything they could.

  70. Re:You want NoOps; IT is a cost center by Hognoxious · · Score: 1

    Same with IT. If you need help, call Infosys or Deloitte or get someone who is world class to do things right.

    DTNFY,RIYHOD

    --
    Confucius say, "Find worm in apple - bad. Find half a worm - worse."