Click here to Skip to main content
14,330,041 members

Welcome to the Lounge

   

For discussing anything related to a software developer's life but is not for programming questions. Got a programming question?

The Lounge is rated Safe For Work. If you're about to post something inappropriate for a shared office environment, then don't post it. No ads, no abuse, and no programming questions. Trolling, (political, climate, religious or whatever) will result in your account being removed.
 
GeneralRe: DELETE SysAdmin FROM Company Pin
jschell8-Dec-17 5:55
memberjschell8-Dec-17 5:55 
GeneralRe: DELETE SysAdmin FROM Company Pin
Sander Rossel8-Dec-17 6:58
professionalSander Rossel8-Dec-17 6:58 
GeneralRe: DELETE SysAdmin FROM Company Pin
jschell8-Dec-17 13:23
memberjschell8-Dec-17 13:23 
GeneralRe: DELETE SysAdmin FROM Company Pin
englebart8-Dec-17 8:07
memberenglebart8-Dec-17 8:07 
GeneralRe: DELETE SysAdmin FROM Company Pin
Sander Rossel8-Dec-17 8:16
professionalSander Rossel8-Dec-17 8:16 
GeneralRe: DELETE SysAdmin FROM Company Pin
obermd8-Dec-17 8:23
memberobermd8-Dec-17 8:23 
GeneralRe: DELETE SysAdmin FROM Company Pin
Sander Rossel8-Dec-17 8:28
professionalSander Rossel8-Dec-17 8:28 
GeneralRe: DELETE SysAdmin FROM Company Pin
willichan8-Dec-17 10:03
professionalwillichan8-Dec-17 10:03 
Not speaking of you directly, but generally, developers in many companies do not have have the security or legal compliance mindset. This has been the case at most every company I have worked at, and unfortunately is the case at my current company.

A few months back, the new Senior Manager that is over both my team and the applications (development) team came up to me and informed me that he was making me the "gatekeeper" over all security aspects of our internal AS/400 system. I am not an AS/400 person. I have very limited experience with it as a user. I basically know how to unlock an account, reset a password, and restart a stuck print queue. Any of the AS/400 administration has been handled by the applications team for decades.

So, why am I now the security "gatekeeper"? He explained that the developers would just create a new service account with full sysadmin access for every application and every robot and every agent. Whenever anyone with a Supervisor or above title asked for access to something, they granted that access without questions asked. My Sr. Manager had discovered that one of our warehouse workers had access to just about every system, including Accounts Receivable and Payable (because his supervisor wanted him to be able to check to see if some customers were current on their invoices before shipping out).

I had to audit user access across the board. I took away access that was not properly approved and documented. Because people could not do their jobs the (wrong) way they were used to doing it, production ground to a screeching halt for almost a full week while access was straitened out, and people were re-trained to do their jobs the correct way. It cost the company thousands upon thousands of dollars. Granted, if something serious had happened and we had been found to be out of legal compliance, it could have cost millions.

I still do not have the know-how to administer the AS/400 (although I am slowly learning). So, how do we make this work? The developers must submit security requests to me for review. I properly log the requests, ensure that all the required parties have reviewed the request and approved it, then I create a work order and send it back to the developer/admins to actually execute the security change. If they are found to have made security changes without following the procedure, they are subject to disciplinary action. (It only had to happen once.)

- - - - - -

I'll go out on a limb and say that most (I did not say all) developers are focused on "Making it work" and are not focused on security and legal compliance. That is why there needs to be a separation of development from administration.

It is indeed sad that the separation is implemented so poorly at your company. It is regrettable that an appropriate separation is not yet achieved here at my company. The unfortunate reality is that giving production administration to development teams is not the way to go.

In your case, you need a procedure in place to have a copy of your production system and config pulled to a dev/test system, allow you to make the changes needed to deploy/repair whatever is needed, then pass the specific changes (properly documented) back to the admins to review and implement as a whole, not in piecemeal. That would not only make implementing the changes easier, but would also make the sysadmin's manager's job easier in determining what training or additional personnel are needed for them to give you better response time and better collaboration.

Money makes the world go round ... but documentation moves the money.
GeneralRe: DELETE SysAdmin FROM Company Pin
Sander Rossel9-Dec-17 2:00
professionalSander Rossel9-Dec-17 2:00 
GeneralRe: DELETE SysAdmin FROM Company Pin
willichan11-Dec-17 8:22
professionalwillichan11-Dec-17 8:22 
GeneralRe: DELETE SysAdmin FROM Company Pin
iskSYS10-Dec-17 21:28
professionaliskSYS10-Dec-17 21:28 
GeneralRe: DELETE SysAdmin FROM Company Pin
pmauriks17-Dec-17 14:53
memberpmauriks17-Dec-17 14:53 
Generalcodeproject.com- server Downs Pin
JustWatchLittle 7-Dec-17 6:52
professionalJustWatchLittle 7-Dec-17 6:52 
GeneralRe: codeproject.com- server Downs Pin
charlieg7-Dec-17 6:58
membercharlieg7-Dec-17 6:58 
GeneralRe: codeproject.com- server Downs Pin
kmoorevs7-Dec-17 6:59
memberkmoorevs7-Dec-17 6:59 
GeneralRe: codeproject.com- server Downs Pin
Chris Maunder7-Dec-17 7:05
adminChris Maunder7-Dec-17 7:05 
GeneralRe: codeproject.com- server Downs Pin
JustWatchLittle 7-Dec-17 7:11
professionalJustWatchLittle 7-Dec-17 7:11 
GeneralRe: codeproject.com- server Downs Pin
Chris Maunder7-Dec-17 7:42
adminChris Maunder7-Dec-17 7:42 
GeneralRe: codeproject.com- server Downs Pin
Roger Wright7-Dec-17 9:37
professionalRoger Wright7-Dec-17 9:37 
GeneralRe: codeproject.com- server Downs Pin
Chris Maunder7-Dec-17 9:39
adminChris Maunder7-Dec-17 9:39 
GeneralRe: codeproject.com- server Downs Pin
Roger Wright7-Dec-17 10:06
professionalRoger Wright7-Dec-17 10:06 
GeneralRe: codeproject.com- server Downs Pin
Chris Maunder7-Dec-17 14:34
adminChris Maunder7-Dec-17 14:34 
GeneralRe: codeproject.com- server Downs Pin
Roger Wright7-Dec-17 15:23
professionalRoger Wright7-Dec-17 15:23 
GeneralRe: codeproject.com- server Downs Pin
Gary Wheeler8-Dec-17 2:12
memberGary Wheeler8-Dec-17 2:12 
GeneralRe: codeproject.com- server Downs Pin
JustWatchLittle 7-Dec-17 9:54
professionalJustWatchLittle 7-Dec-17 9:54 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.