This, on the surface of it, seems like a really fringe issue. But I’ve seen it four times in the last year.
If a client is extensively using cloud services, and it makes no difference which ones, because this problem applies to them all. Then nearly all cloud services require access to third-party utilities or additional tools to work efficiently.
It can be anything from trying to use Python with Azure, to trying to do anything with Salesforce without a Chrome or Edge extension. Whatever the platform, no cloud service works perfectly straight out of the box with just its built-in tools. If it did, you wouldn’t see so many third-party vendors and tools at conferences.
So, to do the best job, you install a bunch of plugins. That might be loads of extensions to get VS Code working properly, or Chrome and Azure extensions to get Salesforce working, or whatever your particular platform requires.
That’s fine and everything, but increasingly there is a problem.
When you have cloud services set up or development done by a vendor, they use their own company’s laptops. They connect to the cloud, install all the tools they know they need, and develop perfectly happily.
But if they’re using a company laptop, it can be very hard to get those same tools made available because they all expose a certain amount of security risk. Most corporate laptop builds are set up for the average manager or office user using a very minimal set of tools.
You therefore end up with vendors having a significantly better development configuration on their company machines than the internal staff members.
And because the vendors continue to do the work successfully, it is never really exposed to the security teams that there is a wider need for all these exemptions. So few internal people need them that the problem stays small. The majority of the development is being done by vendors, while the few internal people doing the same work end up fighting security for extended periods because there are only one or two of them asking for these rights.
Sounds like a small issue. Everything’s working. You’re delivering everything. There’s only a couple of people being inconvenienced. What’s the problem?
The problem is that you’re saving a bit of a bomb for the future.
You’ve now got a situation where your vendor can do things your internal people can’t. There is no proper exit plan for vendors, or for swapping vendors, because they’re using a whole set of tools and third-party items that your internal people not only don’t know about, but couldn’t use even if they wanted to.
And if you try to enforce on the vendors the same limited tools that are allowed internally, delivery plummets. Things don’t get deployed. Code doesn’t get written. So everyone backs out of that idea very quietly but very quickly, whether formally or not.
It means that if you have to change vendor, there will be a period of time where you are completely hamstrung when it comes to actual delivery and continuation of the work.
So, what’s the fix?
It’s well known and obvious…
You have a developer profile for company laptops.
Unfortunately this tends to involve quite a lot of effort to get set up and working, and, as already said, only a few people will initially be using it. Therefore, in this world of tough budgets, it gets put to the back of the queue and never really gets done.
So I advise either work out a standard set of tools that everyone adheres to and talk with your security teams about enabling them generally, or build a proper developer profile.
If you don’t, it will bite you sooner or later.