IT Departments

[TheStu]

Not entirely sure if this is the correct forum, but it isn't entirely off topic.

So, here at work I use my boss' laptop to get my job done. I cannot get onto the desktop here since I don't have my ID card yet (systems require a SmartCard to log in), so I am stuck using his laptop.

It is a relatively new Dell Latitude D630. It has PCMCIA instead of ExpressCard, but other than that it is pretty good. Core 2 Duo @ 2.2GHz, 2GB RAM... not a slouch.

It is running Windows XP Pro.. which whatever. The thing came with Vista, but I can understand that the company would want to put XP on it (it is easier to set all newer systems to XP than all the older systems to Vista). However, my big bug is this... it doesn't have SP3 or anything better than IE6. And I am not saying that they should drop Firefox onto this thing, because honestly what it gets used for IE7 or 8 would be more than adequate.

My understanding was that IE7 and 8 were orders of magnitude more secure than IE6 (and they have TABS!) and that SP3 was more secure than SP2. So why does it take a company's IT department so long to upgrade these things? We are only getting Office 07 next week or something.

It was the same at my last job. All the systems had XP Pro SP2 with IE6. At least until our local IT team lost the image that they used and instead put IE7 and SP3 onto all the new machines (mine included, that was a welcome upgrade. P4 -> Core 2 Duo, 512MB -> 2GB, CRT -> LCD)

So, why does it take so long for IT departments to vett these things? Any IT guys want to chime in?

 

[GeekDrew]

In my office, the #1 reason we haven't deployed XP SP3 and Office 2007 domain-wide is because of compatibility issues with other products that we run (products that are extremely expensive to replace, and aren't going anywhere, any time soon). That, and budget/management. We'd rather keep downgrading everyone to XP + Office 2003 until the vast majority of our systems (both hardware and software) can support Windows 7 + Office 2007. Or, failing that, at least a building or campus at a time.

 

[F1shF4t]

Where I work our machines were just updated to service pack 2, 6 months ago :Q

I bring my own laptop and work off it when ever I can. I get a few confused looks from people asking why I have two comps on my desk

 

[Bateluer]

Compatibility and testing.

 

[n0cmonkey]

Originally posted by: Dark Cupcake
Where I work our machines were just updated to service pack 2, 6 months ago :Q

I bring my own laptop and work off it when ever I can. I get a few confused looks from people asking why I have two comps on my desk

3 is normal here.

 

[Genx87]

The patching issue is usually compatability. There is at least one major annoying problem with SP3 and Sql Server 05. Basically you have to installed Sql Server 05 manager before installing SP3.

IE6 may be due to some legacy web application.

In big enterprises it isnt uncommon to have a Win98 or Win3.1 machine running in the corner for some old ass legacy app. Shit I have an old workstation that is running some flavor of unix 1.0 and runs a paint database. The machine was built about 1992 and runs a 486DX.

These legacy issues stem from some hotshot CIO coming in wanting to make a name for himself and launching some ill fated project to convert a business process into his favorite database application. The problem happens when the hotshot leaves before the project is completed and a new hotshot comes in and does the same on a different process. Now you have all of these processes on different systems that need to be supported by your IT dept. And half the time the IT staff lacks the funding\training to get qualified people into positions to move the legacy applications to a unified system or even give basic support in general.

 

[TheStu]

I know that compatibility is oft quoted as the root cause of it, and I can understand that. However, from a security standpoint... they are way behind the curve and that is what gets me.

 

[Genx87]

Originally posted by: TheStu
I know that compatibility is oft quoted as the root cause of it, and I can understand that. However, from a security standpoint... they are way behind the curve and that is what gets me.

I understand and it is annoying from our perspective as well. A lot of it is out of our control. I have a system in house that wont let me put SP1 on 2003 because of incompatibility. I mean really? The only option is to upgrade the software which management isnt willing to do because of cost. So what can we do?

 

[JeffreyLebowski]

Originally posted by: TheStu
I know that compatibility is oft quoted as the root cause of it, and I can understand that. However, from a security standpoint... they are way behind the curve and that is what gets me.

Never forget, that most IT departments are run by people that know IT, but the people that determine the IT department's budget know jack sqaut about IT.

The last place I was at, the CIO couldn't tell you the difference between a 32-bit and 64-bit OS.

Basically, purchases done for IT equipment by that company were soley based on getting one of his buddies a fat commission check at that vendor.

 

[Nothinman]

I know that compatibility is oft quoted as the root cause of it, and I can understand that. However, from a security standpoint... they are way behind the curve and that is what gets me.

Security is all about tradeoffs. If you install IE7 to make the system more secure but now can't log into your ERP system to do your timesheet was it really worth it?

And IE6 isn't that bad if you're running as non-admin and it's even less of an issue if you have something like Cisco CSA deployed properly.

And there's also just time management. For a small place with a handful of machines it's no big deal but if you've got 50, 100, etc machines to upgrade you've only got a few options. Do it during the day piecemeal, which puts out users and might not work because of applications that have to be upgraded to work with the new versions and you've still got to deal with your normal support load. Do it after hours which just plain sucks although that's probably the best option. Push the software out via GPOs or login scripts and annoy the users as they login and have to wait for the install, reboot, etc and then field all of those support calls for that day.

 

[Genx87]

Originally posted by: JeffreyLebowski

Originally posted by: TheStu
I know that compatibility is oft quoted as the root cause of it, and I can understand that. However, from a security standpoint... they are way behind the curve and that is what gets me.

Never forget, that most IT departments are run by people that know IT, but the people that determine the IT department's budget know jack sqaut about IT.

The last place I was at, the CIO couldn't tell you the difference between a 32-bit and 64-bit OS.

Basically, purchases done for IT equipment by that company were soley based on getting one of his buddies a fat commission check at that vendor.

Yup. I had a CIO in my first helpdesk job who didnt know wtf ethernet was. He thought everything was run by modems. /shake head

Of course he was educated out the ass and is probably still running IT depts into the ground due to his lack of real world knowledge and collecting a 6 figure salary to boot.

 

[VinDSL]

Originally posted by: TheStu
[F]rom a security standpoint... they are way behind the curve and that is what gets me.

I was asking IT about this - where I work - and a tech told me their #1 problem is keyloggers. He said, at any given time, 25% of the (XP) machines have keyloggers installed on them, and we have a LOT of computers - 100's of them.

And, we'll get an occasional warning about not opening a certain email that's floating around the network.

Other than that (and spyware causing slowness on individual workstations) it doesn't seem like we have many security problems... that's what gets me.

Keyloggers aside, how can something so unsecure NOT be compromised daily?

LoL!

Speaking of unsecure, I can see every computer in this resort - guests and staff - using my Linux Mint install. Scary!

People give their computers some weird names - probably figure nobody will see it, expect them.

Guys (I assume) like to give their computers a studly or official sounding name. Women (obviously) like to use their own name... Weird!

I'll post a screeny if anyone is interested...

EDIT: BTW, I'm not knocking anyone - I name my machines after Ghostbuster characters.

This lappy is named after Gozer (the traveler) the shape-shifting god of destruction. LoL! :laugh:

 

[tomt4535]

When you have a network of over 100k PCs and hundreds of applications, it takes time to go through and test in the different departments and make sure that everything is working fine. We just started to deploy SP3 to the desktops(no laptops yet) last week. Thank god for SMS mandatory software installs.

 

[spikespiegal]

Security is all about tradeoffs. If you install IE7 to make the system more secure but now can't log into your ERP system to do your timesheet was it really worth it? And IE6 isn't that bad if you're running as non-admin and it's even less of an issue if you have something like Cisco CSA deployed properly.

Thread should have ended right there Good response, Nothinman.

I was asking IT about this - where I work - and a tech told me their #1 problem is keyloggers.

Solution for this is to fire the IT staff and replace them with non-morons who can support a user environment where every end-user doesn't have full admin rights. This is how real businesses are run.

Speaking of unsecure, I can see every computer in this resort - guests and staff - using my Linux Mint install.

Why? Because they do such a poor job keeping XP secure? I suppose you will give all those users full /Root rights as well.

 

[VinDSL]

Originally posted by: spikespiegal
Why? Because they do such a poor job keeping XP secure? I suppose you will give all those users full /Root rights as well.

I'm firewalled, except for 10.0.0.0/9. Do you think I should worry?

I can access the 'BUSINESSCNTR-1' machines via SMB. I went down there and looked...

All of them are XP machines!

Heh! I wonder if I can print my boarding passes from here?!?!?

I'm gonna go search for the printer at the concierge's desk...

Thanks!

EDIT: W00T - found 2 network printers (192.168.129.81 & 192.168.133.210)

LoL! Eeny, meeny, miny, moe...

If it wasn't so late, I'd fire up the packet sniffer. Probably just pron going across the network at this late hour. Hahaha! This is sooo cool!