I just ended the second day working with an installer from a software vendor for a line of business application for one of my small business clients. At evey turn, she would say, “we don’t do it that way”, users need to have Domain Admin rights, DHCP can’t be used, Group Policies don’t coexist well with their software, no other applications can be installed on the server because their software “doesn’t play nice” with them, and the list goes on and on, but the ultimate is “I think passwords are the problem, there shouldn’t be any.”
Now it isn’t that I haven’t heard this before. It seems every piece of software developed requires full and unrestricted access by the user in order to function, and that no concern is paid to the fact that the end user is going to have other software on their workstations or network.
It’s as if developers work in a little utopia in which their software is the only one that exists, and that every user is going to be a Domain Admin.
I hear people blame Microsoft a lot for security issues, but even with the raised awareness of the dangers of giving users elevated rights and the havoc they can wreak, even “by accident”, it seems that developers continue like nothing has changed. This even applies to banking and financial services software vendors. You would be surprised how many need users to have local admin rights just to function. Be aware though, that this doesn’t just apply to Windows, it also applies to Linux as well, it is just that they will tell you that Linux is “more secure”, because there are less known vulnerabilities.
Whenever their are problems with their software, the first thing I hear is “are you running Anti-Virus? Are you running a firewall? What if you shut those off or remove them?” Excuse me, but I think that AV and firewalls should be considered standard in today’s environment.
So this is what I have seen over the last 5-10 years, and now working primarily with small business clients, I seem to be seeing it more and more because the software vendors are small themselves, and simply pay no attention to security at all.
The problem I have with it, is when they blatantly come out and tell you that the brand new server that the client just forked out $5-10K for can only be used to run their software and nothing else.
