It's amazing how there's so many cybersecurity incidents now. Bypassing IT will always backfire spectacularly, IT is the people that stop you from dumbing.

The opposite was/is true. If your cloud box can only be used by two people and IT don’t even know about it then IT can never be persuaded to provide the keys to the rest of the company as they were predisposed to doing.

I saw this stuff too many times, and it is precisely why the cloud exploded in use in about 2010.

What you're telling me is two people potentially have regulated or confidential data not secured by IT, which nobody knows if got leaked.

For many organizations, that's literally illegal, and anyone who does this should be fired.

One notable example was signing keys for builds for distribution actually. And IT had a habit of handing them out to absolutely everyone. Being able to audit who did the signing was done in spite of IT who could, of course, never be persuaded of the merit of any process they don’t own.

But sure jump to more conclusions if you want.

I won't discount your IT can be bad, but also if you're keeping something as core to your security as signing keys somewhere your IT can't audit, you are just as bad. And your IT won't be the ones fired when your keys leak.

You are under the erroneous impression IT would be fired for leaking keys and not simply impose a new process that blames everyone else.

And this is in Fortune 500 of course.

>, that's literally illegal, and anyone who does this should be fired.

I mean yea, but who knows how long that box would sit around before it was discovered.

That might have been true for some kind of organization, but definitely not for every kind. On the other side, there were start-ups that wanted the elasticity and no commitments. But both sides at least partially liked the "it's not on me anymore" feature.