2

I am basically asking this question to see if I am being unreasonable. My current employer has locked down the machines of all developers so that we do not have access to the root or c: drive. For example, I cannot write a directory under C:. I also cannot install any software which touches the registry. Is this an extreme action or am I overreacting to common security measures?

What is the extent of security on your company provided machine? To add some scope to this question, I am a web application developer and I'm talking about a laptop owned by the company.

  • 2
    What do you do if you would like to download and install a new software package to prototype a better way of performing X? Not having administrator rights to your local machine as a developer inhibits creativity and innovation. I have worked in such development shops before and the drop off in innovation, discovery and quality is staggering. – maple_shaft Mar 14 '12 at 12:06
  • @maple_shaft in that scenario I would put in a help desk ticket to request access for temporary admin rights. I agree, reducing permissions to this extent is very stifling to innovation. – kmb385 Mar 14 '12 at 12:13
  • Why do you have things to install? Why do you need to modify the C directory, its bad practice to use it as a storage location, you should be using the suggested directorys (i.e. public documents and public application data ). Yes you are being unreasonable it doesn't sound like you have a reason to have said permission. – Ramhound Mar 14 '12 at 15:02
3

It depends a lot on your work environment. In bigger firms, it may be unfeasible for everyone to get their custom configuration, and your employer may do this to simplify assistance.

Where I work, I changed the OS the day I arrived, and have always been mantaining my computer since.

  • I understand the need to standardize configuration, I just can't believe I'm locked down to basically putting all of my files in my user directory. Thanks for your opinion, I'm just trying to think this one through before I start causing a ruckus. – kmb385 Mar 14 '12 at 10:51
  • It would help to know the size of your workplace. Is it a 10 people shop or a 10000 people corporation? – Andrea Mar 14 '12 at 10:55
  • About 150 people. This type of configuration just doesn't make sense to me for the type of work we are doing. I need to have local instances of servers running and I'm constantly tweaking their configs. I'm not just surfing the web and using the Office Suite, I'm constructing software using complex tools and may have the need for tools that I cannot predict. – kmb385 Mar 14 '12 at 11:01
  • 1
    I perfectly agree with your sentiment. I also think that 150 people is a reasonable enough size to let the developers choose their own tools. – Andrea Mar 14 '12 at 11:02
5

This is not unusual as the default position for many large companies. The attitude is quite understandable as there may be many thousands of machines connected to a "secure" company network and the consequences of having a rogue machine can be severe.

You may be able to negotiate an exemption for your machine if you can demonstrate a real need for additional privileges but if it is a company laptop that you take off site and connect to external/public networks then this may be difficult.

2

We are using linux on our development PCs - that means that only people with root access are allowed to update PCs and to handle requests to install custom software.

That goes with linux philosophy, and it makes perfect sense, since it is so easy to screw up the system. Who are you going to call in that case?

  • I don't see how its possible to develop on Linux without root access to install applications. sudo apt-get install is your friend. – maple_shaft Mar 14 '12 at 12:03
  • @maple_shaft Ask people assigned to it to do it. People who have root access. Their job is to make sure the development PCs are running 24/7. – BЈовић Mar 14 '12 at 12:08
  • 2
    If that is something that you are okay with and feel doesn't hinder you then I am happy for you. For myself however the hindrance of submitting a request, waiting, and having my computer taken away for software to be installed onto it just to trial a new open source framework or library would deter me from actually staying up to date with new technology. – maple_shaft Mar 14 '12 at 12:12
  • @maple_shaft I am not working in a big company. I can simply walk to one of persons, and ask to install something. They log in, and install. No need to take away anything. Also they created some scripts with list of software to install, and they keep all PCs up to date. – BЈовић Mar 14 '12 at 12:15
  • 2
    @maple_shaft, first of all, sudo is different from root access. You can get permissions for apt-get and nothing else. Second, you can install any software except kernel modules in your home directory without even sudo. – Karl Bielefeldt Mar 14 '12 at 13:18
1

It sounds like developers need a second PC to use as testing sandbox. This can be inconvenient to test development tools, but it is safer. Think of your main PC as you would a production server. If you blow it up the test PC, you fix it. This way you can continue working on the corporate standard machine maintained by the staff.

0

Just for contrast:

We are not allowed to install software on our PCs and that is enforced (we can be dismissed for plugging in a personal usb drive). There are regular scans of our PCs to ensure that no new ports have been opened and no extra software shows up.

This is on our low-security computers that we use to do web browsing and email.

The ones we use to develop on can't get to the net and adding anything to our stack requires filing paperwork, a committee meeting and a security review before we can try it out in dev. More forms if it becomes part of our production stack.

Yet still attackers (that we hired to test our security) were able to get on the first network and jump to the air-gap to the second, so we are continuing to improve our processes.

We are a pretty high-value target though.

I guess what you can do on your work computer has to relate to how important it is to your company to keep their network secure. I wouldn't want to be the one that accidentally installed the root kit that let attackers at all their customers credit cards, especially after the company made it clear that we weren't supposed to install anything.

0

I am a web application developer and I'm talking about a laptop owned by the company.

My current employer has locked down the machines of all developers so that we do not have access to the root or c: drive. For example, I cannot write a directory under C:. I also cannot install any software which touches the registry.

Are you able to do the work that your employer allocates to you?

If so, then you're out of luck and will just have to live with it.

If not, then you good grounds to complain.

In my experience, Developers generally do require a [very] high level of access to their machines just to do their jobs. This is largely down to the toolsets that they have to use and the environment in which they work, e.g. it's very hard to set up a new web site in IIS without elevated levels of permission and, if that's what they're paying you to do, then you should be allowed to do it.

0

In my opinion, you are focusing on the wrong thing here. Instead of asking for access to write to the C: drive or install software, you should be talking about what it is you need to do your job. The reason that these are locked down is that if you were to download a malicious piece of software or have a vulnerability in your machine that an attacker were to exploit, these are main rights that the attacker will use to solidify their access and expand it. Not to mention that insider threats are the biggest risk for many companies. Who says you can be trusted?

Figure out why specifically this is an issue i.e. what exactly can't you do that is causing you issues. And it's not "write to the C: drive". Why exactly do you need to write to the C: drive? Once you have enumerated the issues, take that list to your boss or the person in charge of security and ask for help in how to resolve these problems while maintaining security.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.