The IT Skeptic - Comments for "Whining about the IT department"

Stand firm

skeptic — Thu, 15 Mar 2012 19:48:47 +0000

As I said in the post we

don't know if this is excessive lockdown or not. We can't know without seeing the governance directives given to that IT department by their Board in terms of risk appetite... If IT's reaction is excessive in the context of that organisation, this is not entirely a failure of IT. It takes two to tango. This is at least equally a failure of the organisation's corporate governance of IT to provide proper direction, monitoring and evaluation.

The same applies to every organisation. Such blocking is not automatically wrong. And a wide open, loving, sharing, sunny IT policy is not automatically right. People aren't all stupid.

Re: Enterprise Security and other things

Visitor — Thu, 15 Mar 2012 15:56:14 +0000

Let me state that I work for a Forbes 500 company, as an IT person. I'm not a contractor, I'm actually an employee of that company, and so I see the IT situation from the inside. Having said that, the company does a lot of the actions that the Forbes article lists, and a few others that they don't. For example, iPhones are no longer being considered as a standard for company use. iPads are allowed for company business, but the can't be hooked into the company network. Personal equipment is not to be used on the network, nor is personal equipment to be used form home for company work. The list goes on for a little while here, you get the gist.

But at the same time, you have to consider that we maintain company data, but government data (many governments, to be honest), along with in some cases competitor data. You can't be lax about this stuff, and there's always an active push to protect the data. This of course, flies in the face of the Avenade survey, as the company I work for would never move in those directions suggested.

Admittedly, the company I work for may be more of an outlier here, but it wouldn't be the first time.

Over their heads

RichPem — Mon, 20 Feb 2012 12:22:42 +0000

Financial models can help, but charging policy is only one way of managing such demand, of course. In the specific example I wonder if there was a technical solution to prevent streaming services that might have been deployed, for example. But back to charging, even a by-usage charging policy might not change perceptions of IT - they just become an expensive necessary evil rather than one the company used to pay for. It might influence some decisions, but it might make IT's life all the harder and more costly. We're back to strategy alignment and governance really.

In truth, even if the Exec was charged he's an overhead as well, it's wooden dollars and would he care? I suspect not.

Of course it doesn't help when the business leaders don't lead by example. At a former client, the MD refused to be treated any differently to anyone else - went through the IT processes, waited for lead times; this made it all the easier to help him when he needed something unusual, because it was exceptional and IT recognised that fact. More importantly it gave the mandate to IT to manage their support services properly, which led to better service quality, response times, etc. If only all were like this.

People like Dave will never get it because they blur the lines between business and personal enablement too far. Everything IT does that isn't personally convenient makes IT the devil. So quotaing of his email or storage would be wrong because 'disks are cheap', restrictions on international data roaming would damage his ability to get the football scores, etc etc.

But Dave isn't the guy who needs convincing - he's an end user with a chip on his shoulder. C-level people will be convinced only by the cost-effective delivery of their strategy, and where IT enables that IT needs to make sure it's visible. That is to say, ultimately it's a question of visible value.

Rich Pemberton

Budget or Billing - I know which I prefer!

Mark O'Loughlin — Mon, 20 Feb 2012 09:53:21 +0000

But if IT was in a position to bill that exec for his usage - where is the problem then? That is the place IT should be going to - like Cary has mentioned, Away from being an overhead.

(IT) Budgets create limitations while the business is requiring more flexibility. Going back to basics - if you demand more of something you should pay for it. That exec demanded a new toy and used it a lot (he was responsible for its use as long as he had it) and should have been charged for the usage or his department charged. Until then the business will demand this of IT and expect IT to pay from their budgets.

What happened here, dealing with business demand IT has now made an enemy. That is what happens but until change of behaviours cone - what else can be expected?

front lines

skeptic — Mon, 20 Feb 2012 07:28:28 +0000

Thanks for dispatches from the front lines.
There are real reasons why IT have evolved the controls we have.

But get this from the trenches

Ripleys situation — Sun, 19 Feb 2012 23:21:46 +0000

We had a business exec demand that they take their shiny new iPAD roaming with them on an o/s vacation so they could "keep in touch". (given out because the exec was envy when they attended a board meeting and was the only one who didn't have one)

They ran up $25,000 in telco bills whilst away within just a couple of weeks. That's real dollars - Aussie ones. This person was given a laminated cheat-sheet to keep consumption down (log in, send/receive your email then disconnect and work away).

Then had the gall to blame IT for not locking down the device - it turns out that their snot-nosed teenage spawn was a big NBA & NFL fan and was streaming game after game. No, we hadn't blacklisted any non-work sites, as our definition of keeping in touch was based on common sense.

Initially refused to pay the bill and this got escalated up high enough for IT to have a new enemy.

Well-timed rebuttal

hazyitsm — Sat, 18 Feb 2012 18:54:06 +0000

Consumerization: The view from IT you may not like but need to hear

http://www.infoworld.com/d/consumerization-of-it/consumerization-the-vie...

I came across this article shortly after finding the insane Forbes article. It's the perfect antidote.

decisions

skeptic — Fri, 17 Feb 2012 19:03:35 +0000

I worked in a hospital long ago where the management (read: administration department) decided they couldn't pay the outsourced (but wholy owned) IT service provider for 24x7 support. so the service desk staff were on an unpaid roster to provide emergency support out of business hours.
Even the head of clinical services didn't know this until I told her. Heck she didnt even know we weren't there 24x7. I was with her to explain why non-critical things weren't being fixed until next day. When I told her that she and her staff were in fact calling us at home in the middle of the night she was horrified. Initially she was abusing me because she thought it was the service provider's idea not to have anyone there at night.

So your point about governors and executive communicating and visibly supporting decisions is a key one.

Poor old Dave, IT just

RichPem — Fri, 17 Feb 2012 11:26:31 +0000

Poor old Dave, IT just aren't giving him what he wants (for his is a protestation on personal constraints not business risk).

If that list is true in its entirety I think it's fair to say the business - in partnership with IT - recognises data and information as critical to their business. Port 25 was clamped down upon in my last client organisation by the anti-virus solution, to help prevent the malware bring SMTP servers into effect throughout the organisation. An earlier client had no external devices - USB, DVD, etc - permitted whatsoever. Another regularly told IT to 'throw disk space at the capacity problem because storage is cheap' - well it might be, but the cost [to IT and the business] of managing storage in that way...

It's growing pains though. IT is beginning to mature in its management of risk, and now more regularly defers to the board's risk appetite in its plans rather than take the 'computer says no' stance. I wonder how clearly the board are communicating that it's a business decision rather than an IT decision to restrict USB access?

I use USB access specifically because very recently I was involved in an information security project where this became a very hot topic indeed. What made sure it happened was that the management board visibly owned the decision, they communicated it to all through a board-appointed Infosec Officer and supported it with a clear statement on how circumvention would be handled.

I think the prime key to its success though was that a solution was offered, in that pre-prepared [by IT] secure USBs were made freely available to anyone who asked. Thus IT were positioned - and communicated - to be providing a solution, not just the constraint.

Dave Gardner doesn't mention what alternative solutions were available, but I've experienced them in every one of his bullet points. Quick examples:
- Facebook/Skype/home email: availability of unrestricted internet PCs in communal areas
- BYOD: guest internet access to web-published services
- No chat: Lync, Cisco WebEx connect are increasingly provided.

I think Dave's lost sight of the fact that as a consultant he might have a greater personal business need to access services outside of his client - but this isn't his client's responsibility, it's that of his own business. Conversely if he spots a need in his client, such as responding to the email-centric nature of a business by equipping employees with Blackberries, he can influence or make a proposal - perhaps it's not as cheap to run as he thinks from the outside.

It's gusto from someone so ill-informed and self-involved as to make it almost irrelevant. It will stoke those who think grown-up business will enable its departments to do their own thing rather than come in line with the business and IT strategies, of course, but I dunno - sounds to me like someone's taken the jam out of Dave's doughnut very recently. Anyone who's had to deal with a security breach with real business impact won't give him the time of day.

Rich Pemberton

Stop turning the blame and responsibility back onto IT

skeptic — Fri, 17 Feb 2012 07:10:48 +0000

Cary,

I think you've been on the frontline too long :) Victims of violence can end up blaming themselves for it. Stop turning the blame and responsibility back onto IT. How about the Boards that have never taken the time to understand their obligations and accountability with regards to IT? How about the Executives who have found it convenient to let IT take the rap for their own failure to understand that aspect of their business, or to resource it properly? How about all the staff who think that because they can plug in a router and install antivirus, IT must be easy? All the people who think they should be able to have anything they want regardless of the broader implications for their employer?

This isn't IT's fault. Oh sure we have to accept a component of the blame. But I'm sick of being told to take all of it. I'm proud of what we achieve as an industry, and those who want to see us all as The IT Crowd can go mono-procreate. It's time we redirected some of the crap back.

Champagne Dreams on a beer budget

CaryKing — Fri, 17 Feb 2012 01:33:36 +0000

I conceive that as long as IT is an overhead department for which the company gives x (5%) of the total revenue to receive unlimited services (or to many that's the perception) and IT remains the "bad guy" gatekeepers, this is going to continue.

When IT decides that they want to build investment-based budgets, collect costs for services, make those costs tranparent to business management, base those costs upon business-describable levels of service - then this unfortunate cycle of unlimited expectations and budget constraints will continue.

IT can build trust with the "rest of the business" by making the services and their costs transparent - or not.

IT can have regular discussions about business risks, IT capabilities to respond to them, and the costs involved - or not.

IT can shift the management of the budget to the "rest of the business" to get their collaboration with controlling costs - or not.

As I see it now, IT's customers (the rest of the business) is being marketed to by all sorts of "Cloud" and outsourcing providers - the biggest disintermediation play in history. IT can either step up and start acting like a Prime Contractor that provides services and demonstrates value - or the can watch as pieces of their portfolio are picked up by suppliers and their influence wanes. Soon IT will be left with the legacy app dogs.

IT can act as trusted advisor and expert management of services, or it can act as the overhead IT department.

IT Management and Business Management can openly discuss the risks (pros and cons) of thes different technologies only when IT gains the trust of business to have these discussions and can do so by combining the price of choices into the discussion. Few IT organizations can do that.