
An evening on the computer
Photo originally uploaded to Flickr by Unhindered by Talent Used under a Creative Commons licence.
I stumbled upon a fascinating article in CIO magazine, regarding the battle between the users and IT in the workplace. I found it relevant both from the perspective of a user in a locked down Standard Operating Environment (SOE) and from the perspective of a sys admin-in-training.
The Shadow IT
The "Shadow IT" are the users who know too much, or just enough to cause problems. They want to use their corporate desktops as they would use their home computers, installing non-approved software. When they want to work on something at home, they'll email it to their personal address rather than try and jump through the hoops required for remote access. If they want someone to collaborate on a document, they'll put it up on
Google Docs rather than wait for corporate IT to investigate and maybe one day implement a
Sharepoint-style system. They want to use IM and
Skype.
Corporate concerns
Of course, the Shadow IT causes its own problems. By installing non-approved software, they could be exposing the corporate network to security breaches. I'm not an expert on firewalls (yet - I hope to be one day) but it seems intuitive to me that they could be opening up holes. Who knows what little nasties are buried in the latest and greatest downloadable piece of freeware? From a compliance perspective, who knows exactly where documents are beings sent, hosted or stored once they leave the corporate network? Who else can access them?
I can understand the attraction in keeping a network locked down. If the network and the SOE are tightly controlled, it makes it much easier to keep it secure. On the other hand, it's entirely possible that if users are busy forming a Shadow IT, scheming to work around the barriers thrown up by IT, there may be shortcomings in the work environment that are hurting efficiency and collaboration. One problem may well be that people have a tendency to treat their work desktop as if they own it, rather than as if it was a corporate resource. When you consider that
up to 25% of all computers might be zombies (and this is probably a conservative estimate), letting users install software on their desktops unsupervised is probably not a good thing.
Moving forward
One of the suggestions of the article (and something repeated in the comments attached to the
US edition) is that the Shadow IT needs to be brought back in to the fold (or "insourced" as the kids are saying these days). If you find they're using IM all over the place, maybe there's a need for the real-time communication and perhaps a secure solution can be found (although what's wrong with the phone, people?). Can remote access be made more user-friendly and readily accessible? Can Sharepoint be set up, or perhaps IT could roll their own
LAMP stack and put it up on the intranet. Most problems do have solutions if you're prepared to look for them. Having said this, I recognise that new features and software also requires tech support. If the IT department doesn't have the resources to provide this support, they're going to do everything they can to lock things down and keep it simple.
Dancing in my own shadow
I'll admit that I'm a bit of a Shadow IT guy. My workspace is fairly limited due to a Government requirement that our network has a defined level of security to maintain its pre-determined national security classification. The basics in the SOE are there, but they are not always the tools I choose to use. For example, I like to listen to music as I work. While
Media Player 10 is available, most of my music has been converted to
ogg vorbis (or increasingly,
m4a) which are not formats that Media Player support. Since I can't install software on my desktop (and I'm okay with that - there's a good reason for it), I burn my music to a DVD along with a copy of a music player that stores itself entirely in the memory and requires no installation to the hard disk at all (I originally was using
VLC Portable but it doesn't support gapless playback so I now use
XMPlay instead). I keep my
GTD mojo flowing using
GTDTiddlyWiki with
Firefox Portable on my USB thumb drive. In my previous job I used the free version of
Basecamp to keep track of my major projects. I like flexibility, but I'm also aware of just how far I can push it.
My shadowiness formed because I have found that corporate IT departments tend to be very inflexible and unreceptive. As an example, I used to use
Freemind, a small and free Java-based app, extensively for mind mapping and brain storming. However, when the workplace refreshed the SOE, only a Java runtime was provided instead of a full installation of Java, which meant that Freemind would no longer work. My options were:
- request an installation of the full Java environment so that I could continue to use this "non-critical" app (unless you are totally incapable of doing your job without it, it's non-critical);
- request an installation of the mind mapping software that work had spare licences for, if they had any spare licences and if my manager was prepared to approve the several hundred dollars that the licence would cost my unit; or
- stop using mind mapping software and reduce my effectiveness and functionality.
It's probably no surprise that I went with option 3 because I knew from past experience that "non-critical" apps are dismissed out of hand without consideration and that no one was going to approve several hundreds of dollars of expenditure, especially when I didn't need or even want that level of functionality (I just wanted my simple brain storming tool).
C’mon Corporate, work with me here…
What I would like to see are IT areas prepared to receive requests and at least do a basic analysis on whether or not the request will impact on security, the effectiveness of the network (ie isn't going to choke bandwidth and reduce other people's ability to use the network), cost money or require extensive support. If something passes that test, approve it. Don't just dismiss it out of hand.
Working together, corporate and shadow IT could really be an effective team. The trick is to have the processes in place that allow that conversation to happen in the first place. If I ever become a CIO, that's exactly the kind of environment I want to create.