@JaredBusch said in SQL security over the LAN:
@Donahue said in SQL security over the LAN:
@tonyshowoff said in SQL security over the LAN:
but if the company is basically dismissing concerns over encryption by saying "it's up to you to secure your network" that's basically saying "what's encryption? We're morons."
I have a suspicion that this is true. I feel like there are maybe two sides to software development, there is the functional aspect of the SW itself, but then there is how it incorporates into the overall IT plan for a target business. It feels like all of this company's development resources go into the first category, and none in the second.
In general, actual software developers have no idea what IT is. They shouldn't. Otherwise they would be in IT. A good software development house should have staff on hand to handle how the software works in relation to IT needs though.
Actually you're describing how bad software is written, in my experience of 22ish years programming professionally, the programmers who know about IT and hardware do the best over people who know neither. I'm not an IT person, and yet I get hired to do things a lot of IT people couldn't figure out, largely because they were inexperienced, and it's not my job, I just understand networks, domains, and so forth enough to get by but it also had helped me write good client-server programs, know how to authenticate and deal with AD, and so on. And I'm not the only one, a lot of good programmers do this work a lot, either as favours or between projects.
Just because a development company has an IT person doesn't mean it's because the programmers need them because they don't understand IT, it's usually because the programmers are too busy to deal with IT problems. Good programming talent is incredibly hard to find, not necessarily because it's rare, but because the market is overflooded with incompetence, just like IT is, especially with outsourcing to the third world and young people who think they know everything because they've changed video cards or configured printers (this applies to IT and programming). Just look at Spiceworks.
If you want good programming with concepts of how security works such as GPO, and good network design (such as IRC networks, MySQL clusters, etc), and an understanding of load balancing, how infrastructure works and how it relates to your programming, how data travels over networks and why encryption matters, etc you need a solid IT understanding. You can't just try to find some IT person who happens to know what you need to know so you can write your programs, then try to explain to them any issues or design questions you have with your project only for them to have no idea how to program. You need to be able to answer these things yourself and all good programmers are very good IT people, some of us just can't crimp rj45 connectors, I can't see those tiny ass wires!
I have known programmers who don't know the first thing about IT, they were all terrible, wrote terrible software, and shrugged at essentially all security concepts. The descriptions in posts above about the incompetence of companies not understanding network encryption (that ERP company) and not understanding the basics of network latency (Eaglesoft) and not understanding why a program needing local admin rights is stupid (Eaglesoft) are not virtues to suggest they should fall on some IT guy to solve the problem rather than the programmer know what he's doing.
Anyway, it's like suggesting IT people are best that don't know scripting because then they'd be in programming. While really experienced IT people will certainly know things even good programmers don't, they do have a hell of a lot of knowledge overlap, it comes with the territory.