One of my clients has a problem. We’ll call him Melvin, because I like changing names when I tell stories.
Melvin doesn’t like network guys, and takes every possible opportunity to tell anyone within earshot. “You network guys don’t understand what’s going on over that wire, and you don’t want to.”
We do understand, but not the way he thinks network guys should. Melvin is wrong.
Read the training manuals for Security+ or CISSP, and, presumably, Network+, and at its very simplest, they boil the goal of IT down to three things: Confidentiality, Integrity, and Availability. We’ll take it from the bottom:
Availability: Does the system work when the user sits down to use it? 99.999% of the time the answer should be yes, if you follow industry standards.
Integrity: When the user enters data, will it be the same when the user comes back later to retrieve the data? That answer should also be yes, but precisely 100% of the time.
Confidentiality: Will the system protect the data from being read by anyone other than its intended recipients?
So if I’m snooping around on the network the way Melvin wants me to do, so he can further whatever his agenda is (I haven’t figured that out yet), then I’ve blown that tenet. I guess I’d have to mail my Security+ certificate back to CompTIA. It would be the right thing to do, at least.
Network sniffers are wonderful troubleshooting tools. When two computers aren’t talking correctly, they’re what you use to see what part of the conversation is being dropped. But when things are working the way they are designed, the proper place for tools that expose and/or capture the conversation on the wire is inside a locked drawer or cabinet.
I’ll let the guy who signs my annual reviews decide whether I’m an effective IT guy or not. I want no one to question my ethics.
As an ethical IT guy, it’s not my place to snoop around on the network and tell Melvin what people are doing. Not unless he hands me some decree from high above. Very high above. Certainly not for curiosity, and certainly not to feed someone’s messiah complex.
Here’s the correct approach. Melvin needs to find and define a requirement–whatever work needs to be done that isn’t presently–bring it to me, and I’ll figure out who needs to talk in order to make it happen.
In the meantime, I’ll just keep on doing what I’ve been doing. When my phone rings because a real, live user can’t send an attachment to someone else and wants to know why, I’ll figure out why the antispam software we use doesn’t like that attachment and find a workaround or solution.
I told him that. He called me a geek and waved his hand dismissively.
I should have told him I appreciate not being called offensive names.
David Farquhar is a computer security professional, entrepreneur, and author. He started his career as a part-time computer technician in 1994, worked his way up to system administrator by 1997, and has specialized in vulnerability management since 2013. He invests in real estate on the side and his hobbies include O gauge trains, baseball cards, and retro computers and video games. A University of Missouri graduate, he holds CISSP and Security+ certifications. He lives in St. Louis with his family.
Sounds like Melvin has too much time on his hands, if he’s trying to run other people’s business that much.
And I don’t mind the term “geek”, but I probably wouldn’t like the tone of voice that Melvin used.
Good luck with Melvin, for as often and as long as you have to interact with him.
I don’t care much for the Melvins of the world, and I (like most who have spent any amount of time working in IT) have met our share of them.
Non-IT-Folk seem to have a tough time differentiating between things I have access to do and things I have the authority to do. As a Domain Admin, I have the access to do lots of things that I don’t have the authority to do. For example, I have enough access to reboot any server in our data center, although without talking to the system owner, I don’t have the authority. People ask me questions all day (“Can you enable a disabled account for me?”) that I have to ask in return, “Do I have the access, or the authority?”
I think years of hacker stories have convinced users that most network admins don’t have a lick or ethics or scruples. Sure, I could sniff any of the traffic on our network, but it would probably get me fired.
I once had a user completely block my access from his machine because he was convinced I was going through his files and reading his super secret documents. Truth of the matter is, and I’m sure most network admins would agree, I don’t have the time, much less the interest, in going through end user’s files. Trust me, I have plenty to do each day without reading through someone’s mundane e-mail. Rifling through someone’s files isn’t as interesting as it might sound, and it’s sure not worth the risk of being fired or the loss of trust that would be incurred if caught.
I regard the word “geek” much like another word that starts with “b” that most women find offensive. Some take it as a term of empowerment. I may be in the minority in taking offense to being called a geek, but I do, and when my boss called me one once, we actually went through the stereotype and he stopped and said, “Oh, you really aren’t one, are you?”
And Rob’s right, I think the portrayals in the media have convinced people that IT types will look at anything and everything when told. Or when they feel like it. Again, stereotyping.
I don’t think anyone takes this guy very seriously–there are enough incorrect statements in his spiel and apparently not just on the technical level–but that doesn’t mean he can’t be a pain.