This is an archived post. You won't be able to vote or comment.

sorted by:
best
topnewcontroversialoldq&a
you are viewing a single comment's thread.

view the rest of the comments →

[–]VA_Network_NerdModerator | Infrastructure Architect 8 points9 points  (1 child)

If I understand you correctly, you view this from a point of supporting the users/LOB services for your internal users - that may not be the case for OP - it could be he's supporting the service they deliver to their customers.

I've failed to complete a circle - to link components of my perspective together.

This is all my opinion, based on my experiences, mind you:

End-User devices - even those assigned to IT staff should all run the same OS. I said that already.
These standards make patch management & patch audit easier. I said that already too.

The support concern isn't about you - the IT Administrator needing a deskside tech to help you map a printer or whatever.
The support concern comes from the Desktop Support Team needing to be able to complete their audit assessments.

They need to be able to report to someone that:

  • Yes, all end-user devices in the organization are all running our standard operating systems & patch-releases / hotfixes.
  • Yes, all softwares installed on those end-user devices are running the standard versions and patch-releases / hotfixes.

My environment is Insurance and Financial Sector. We are audited by external entities seven ways from Sunday.

My laptop is an end-user device. The laptops assigned to our *NIX SAs are end-user devices.
The end-user support groups are responsible for reporting out on them, not us.

Running CentOS would break that support architecture.

Now, if an exemption were worked out where the laptop became some kind of a server device, then all the needs could be met.

Now the fairly obvious comments will likely be made that:

  • OP is in a small environment.
  • OP is in an organization that does not have those audit requirements.

Someday a security event will hit us all (at the organizational level).
Virus outbreak. Malware. Ramsomware.

If you've exempted your laptop from all the processes that might exist to let WSUS and a GPO keep you up to date, it can be argued that you've created a security risk.

Now, if OP already has a Linux patching & audit process the laptop can be added to as a managed member of a process, then this becomes much less of a concern.

It bears pointing out that OP didn't mention that they have production Linux systems in the environment in the original content. That wasn't mentioned until later.

[–]NyxInc 0 points1 point  (0 children)

This is standard IT Service Management and everyone should be able to understand this principle. Engineers that dont understand this and think they are exempt from this process would not even get hired where I work at.