It’s “more secure” because there’s a specific company to blame when it goes wrong.
Worked for a company that had a similar policy against free software, but simultaneously encouraged employees to use open-source software to save money. I don’t think upper management was talking to the IT department.
Anon works for my company? Because they did exactly this with the same excuse.
Yeesh. I would find a new job immediately. Absolutely unhinged behavior.
Yup, my boss would get my 2-weeks notice immediately. Like same day. I’m not putting up with that BS.
how thoroughly was it followed through? how was ensured that no free beer software was used?
That’s a great question. In my experience (15 years at MSPs and several years as a freelance consultant where I’m mostly in house one place but take side jobs) I’ve been the one who had to make this change.
Some companies are very serious about it. Laptops end up on some device management solution that can tell every program you’ve got installed and flag anything not pre-approved. Then take away everyone’s ability to install outside of device management.
Some companies want to scare the users into compliance but want IT to be able to do their own thing. So they’ll install some easily bypassed thing or enroll everyone but not keep an eye on their network to find rogue devices.
Some companies threaten it, pay money for a consultant to put together a plan, don’t like the price, threaten to go elsewhere, and the exec who championed it finds a new job while nothing of note was done, but they’re sitting on a handful of licenses for software no one is using.
I used to carry a toolkit of free software in portable format on a thumb drive and another thumb drive with a full Linux environment in case I had to do something at the first kind of company.
this is supposed to be more secure because it costs money
It makes blaming someone really easy though and that’s all that matters in a corporate world.
This is legitimately it. The same reason corporations often pay for Linux (e.g. RHEL)—the people in charge want to be able to pick up a phone and harass someone until they fix their problem. They simply can’t fathom any alternative approach to managing dependencies.
Not just pick up the phone and harass someone but to also have someone to press a lawsuit against if things go really wrong. With free software the liability typically ends at the user which means all they can do is fire the employee and eat the loss. Suppose now corporate paid for it, well now there is a contract and a party that can be sued.
