[wolvoleo]

> Unfortunately it’s people like yourself who implement shadow IT that end up forcing security and infra teams to add those annoying bureaucratic hurdles to force people in line.

It's because I still need to do my job. And I am also in the security team in fact. But we can't even "burn ISO's" anymore on memory sticks to install stuff in our test lab. When I ask they just say "80/20 rule" which apparently means, they spend the 20% effort on 80% of the usecases and the other 20% can go F themselves. Because the project manager doesn't care, he just wants to tick some boxes in the easiest way possible. That's how you get shadow IT.

> Also RBAC doesn’t prevent you from being hacked. It just limits the blast radius of what is exposed when you do get hacked. It also makes it harder for those who “know enough to be dangerous” to do the wrong thing. Like the shadow IT shenanigans you’ve admitted to.

Exactly, all the mega hacks with the release of millions of customers' data wouldn't have happened if that was properly implemented. Salesforce does have it but companies don't implement it.

And if people go to shadow IT it means that RBAC is not properly implemented because they don't have enough rights to do their job.

[hnlmorg]

You’re hugely over simplifying things.

For starters, your complaint about IT is representative of bad IT operations. NOT security as an industry, like you claim it is.

And your comments about RBAC are such a massive oversimplification that I wonder if you actually do work in security at all. Because no competent security professional would claim that RBAC is a silver bullet that solves all issues.