6

So I took over as senior IT manager at a small company a couple months ago. Up to now, there was no "IT department" as such, just another guy who "did computers". To this point: things are running off a Windows workgroup with no users, everything is on a single LAN subnet (no DMZ, no WiFi controls, no VoIP priority), and the "file server" and "backup" were Win7 machines, one of which had a RAID card in it and the whole thing worked over broadcast WINS.

Since taking over, I have set up a real fileserver, some basic network segmentation, VoIP forwarding and other basic stuff. Users seem happy phones sound better and their files are backed up and served faster. Now comes the hard part.

I have set up a domain controller (and SDC), and silently migrated everyone to using DNS resolution for internal lookup - now I'm at the step of getting them all on the domain. The benefits seem obvious to me (centralized control, user management, etc.). I have set up a couple of "shared" desktops and showed users how to log in, but gotten some pushback about it being harder/different than it used to be (it used to be that there was one Windows admin account with auto-login. Anyone who wanted to use any computer just sat down. No mind if someone else is logged into their email or clearly doing something). When ask WHY I am doing this, I have given the following answers and gotten the following responses:

  • What if you don't have a password on your computer? Someone could just send a nasty email from your account

    Why would someone do that?

  • Do you want someone messing with all your settings?

    I don't have a password now and no one does that

  • I need to know who you are so I know you are supposed to have access to these files

    I work here, of course I'm supposed to have access!

  • If I do this, then it becomes my fault if we get a virus and you get to blame me
    • Well we haven't gotten a virus so far. Our network must be secure.
    • It might be my fault but you know how to fix it so I'm not worried.

Having done some company-wide rollouts in my time, I expected this, and am proceeding undeterred. I think people get the value of this (permissions on directories), even if they don't like it. I have also taken to doing some temptation pairing: as users are migrated to the domain, they get access to the slack channel and an updated version of MS Office, which they seem to like.

At the end of the day, I think people see this step as a minor annoyance and are going to pretty much go along with me no matter what I do, but I do worry that if the users see me as doing things they don't like or taking things away from them, they will stop coming to me when they find issues or try to "find ways around me" to do what they want. How can I get some buy-in from users that these sort of changes are what they are looking for?

Quick edit for P.S. - Yes, I did dogfood and test my DC - my intern and I were using it for ~2 months before any users were even aware it existed. - Apologies if this is slightly off-topic - suggestions for edits are welcome.

Improve this question

2 Answers 2

Reset to default
4

You aren't going to be able to "win" this per se, most people have an adversarial attitude towards technology at best. They got their current understanding mostly through guess-work, trial-and-error, and a healthy dollop of luck, and they know it. Any change means going through that all over again.

That being said, most of the objections you are getting are completely non-sensical (again, the real objection is "I don't want to go through the painful process of learning a new workflow"). I would respond with "if no one had ever broken into your car/house, would you still lock the door?" or "you mean you completely trust every single person that ever worked here and ever will to impersonate you professionally?" etc. etc.

On to the real objection.

Technology has finally answered the age-old comedic question "just how dumb are people anyways?" definitively and in multiple ways on multiple levels (yes, including us!). Merely adding a login screen is enough to stymie some users, which is why computer training sessions go over mind-numbingly obvious (to certain people) things. Depending on the size of your org you are either going to need to offer training sessions or (if possible) have you/your staff sit down with users 1-on-1 to go over the new procedures.

Even that certainly won't make people happy, but will probably get you over the hump of adoption.

Improve this answer
7
  • 2
    I suspect you are, regretfully, correct. I have been doing one-on-one and one-on-three training with users, and they go along with it, so I guess I am winning relative to what could be happening. I tired the "you have a password on your house and lock your door in the morning" idea too, but basically got back that they care more about their TV/dog/nudes than the data they create and use at work.
    – agentroadkill
    Mar 8, 2019 at 16:23
  • 1
    @agentroadkill in that case, tell them some appropriately diplomatic version of tough $@%# the company cares about it and they pay you so now you care about it. But yeah, it sounds like your making out about as well as is possible in the circumstances.
    – Jared Smith
    Mar 8, 2019 at 16:27
  • 1
    @agentroadkill, it's easy to secure your house. If people had to change their locks every 3 months, and weren't allowed to throw the old keys away for weeks (the same way I can't forget my last password after a password reset), they'd get frustrated with locking their doors, too, and would probably hide the current key under a rock the way they stick their password to the bottom of their keyboard. I like this answer, because it touches on the idea that people don't have logical reasons for avoiding security; it's about comfort. If we make security easy, users will do it.
    – Ghedipunk
    Mar 8, 2019 at 17:04
  • 1
    @agentroadkill, I'd suggest getting familiar with the NIST guidelines: pages.nist.gov/800-63-3/sp800-63b.html -- In short, keep password rotation and complexity turned off, so that users can be comfortable using longer passwords without jumping through hoops. I would also encourage use of password managers and 2nd factors like Google Authenticator or (even more secure and easier, but $20 per person) U2F USB dongles.
    – Ghedipunk
    Mar 8, 2019 at 17:16
  • 1
    @Ghedipunk getting there. I already enforce 2FA for VPN access, but there was no VPN before so that’s another “just the way things are”. I worry that giving YubiKeys to some 60-year-old manufacturing techs will have them all leaving their keys in a USB hub they stick on top of the workstation.
    – agentroadkill
    Mar 8, 2019 at 17:23
1

Rather than winning an argument of logic, appeal to higher "security best practices" regarding PHI/PII. If anyone takes credit cards within your company, you must adhere to some level of PCI compliance.

I would leverage this "other authority" sort of approach and explain that the company can be fined for not having passwords, or that someone could easily break in at night, steal computers, and have whoever's emails, information, etc.

If it were me (and I've been there) I used a mix of "if we want to grow into a bigger, more legitimate, more polished environment, this is how we do it," as well as "PCI compliance requires X, Y and Z." Be careful with this second approach because sometimes it's beneficial to have a "higher authority" to appeal to, but also don't sell your own decision-making short either and unintentionally abdicate your own authority.

I would also think a little more like a hacker and risk mitigator. Maybe consider rephrasing some of your questions:

What if you don't have a password on your computer? Someone could just send a nasty email from your account

What if someone breaks in and steals the computers, and now they have every email you've sent from your computer with nearly infinite power to continue emailing others? Think of someone emailing their spouse and asking for the routing/acct numbers from the actual email address belonging to them....

Do you want someone messing with all your settings?

Do you want someone to set up a keylogger?

I need to know who you are so I know you are supposed to have access to these files

I need to know that if there's a breach, the adversary obtained the fewest amount of files possible. Moreover, the "least privilege" principle is fairly self-evident here.

If I do this, then it becomes my fault if we get a virus and you get to blame me.

"Blame" is never a good thing in an organization (we all make mistakes) but if they are seriously concerned with blame for doing something wrong, it has been my experience management has been unreasonable to them in the past. Blame is usually a sign of distrustful relationships within an org, but that's a different story altogether. However, since you are the IT manager, you are automatically responsible for any viruses anyway, so yes, that's a risk/decision within your domain and you do have the right to make that call - up to and including forcibly which is always the last option.... but still an option.

Improve this answer
5
  • Neglectfully, I didn't detail every answer I've given, I tried the "breakin" scenario but someone made the point that we have way more valuable, small objects on premises (we are a manufacturing company). The blame idea was more a joke to try to get them onside with a smile. I did try making it relatable as well "you lock your door and have a password on your phone", but that basically got a shrug.
    – agentroadkill
    Mar 8, 2019 at 16:20
  • Remember that these are users, they don't know or care what a keylogger or "least privilege" is. The also probably lack the patience for complex hypotheticals (my org's security training does this and it's painfully contrived). Good point about blame though.
    – Jared Smith
    Mar 8, 2019 at 16:29
  • Fair points, all around. Although @agentroadkill if your peers believe that small valuable objects are more valuable than a computer, that might be worth exploring. The "right" computer is almost always the most valuable piece of equipment in any organization because of what it can contain and what one can do with it. I understand manufacturing can have very expensive specialty parts, but I don't want to undervalue the price of trade secrets and business intel, either.
    – SomeGuy
    Mar 8, 2019 at 16:59
  • @SomeGuy agreed - I brought this up to a couple manufacturing leads, and they seemed to not value “company intel”. That’s probably another culture thing I’m going to have to fight down the road
    – agentroadkill
    Mar 8, 2019 at 17:10
  • 1
    Yes, many service industries are laggards in technology adoption. I fought this battle quite a bit with a landscaping company some years ago. It took an expensive breach before the company began to take it seriously. It's unfortunate because that's not the time to say "I told you so," but as a professional I was frustrated beyond measure that a few thousand dollars in very basic defenses in advance could have saved a few hundred thousand later. It's even worse because a breach makes you, the IT manager, look incompetent - regardless of the fact that you've been advocating strongly for reform.
    – SomeGuy
    Mar 8, 2019 at 17:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .