Restricted control over company's laptop [closed]

Question

I have been recently hired as a security engineer on a company.

They provided me a MacBook Pro as a company laptop. As I always do in any computer in my possession - including in previous jobs - I rebooted in order to reinstall the operating system. I consider it to be good hygiene, since I don't know what's on the company's standard image, and by default I don't trust it. Besides, I expect to make my own choices regarding its initial configuration.

However, I noticed I am unable to enter the recovery screen because it is locked with a firmware password.

After requesting its removal, I was told by IT that this is a new company practice and they will not make any exceptions (other than laptops provided before this policy). The password will remain, and I am expected to use the base image only.

The way I see it, this is appropriate for non-tech-savvy users, but inappropriate in scenarios where autonomy is required, and employees are skilled, typically on technical teams.

I don't think any self-respecting security professional would be comfortable knowing that they do not have full control over their laptop, and that it was installed by someone else, with unknown defaults. Yes, it's the company's property and their decision, but as my main work tool, I should be able to use it anyway I need, including reinstalling the OS or booting from a live pen drive.

Effectively, I am being trusted to secure the company's business, but am not being trusted to secure my own laptop. This is a moral issue to me.

My questions:

1. Is my behavior unreasonable (or an overreaction)?
2. Is locking down a computer in this way for a security engineer commonplace in industry?
3. How do I resolve this without quitting?

I am perfectly aware that the company can choose anything they want, as it is their property, but security folk tend to be paranoid, and I am no exception.

I don't mean to turn this into a dispute, but I feel I will be so uncomfortable working like this that I am more likely to consider not remaining on this company.

Answer 1

You should realise that this is largely a question of responsibility. Since the IT department is responsible for the correct functioning of the machine they provide for you to use, they need a certain degree of control over the machine in order to be able to provide that guarantee. For them, this has nothing to do with you personally: they are providing a laptop to an employee of the company and are treating you like any other employee.

While I understand that distrust is an occupational hazard of a security engineer, I would advocate that when it comes to your own company's employees, you employ an "innocent until proven guilty" attitude. If you have a need for certain configuration of the machine, with certain tools installed and certain access rights, make a request for that configuration through the normal channels within the company. Only when the normal process fails do you have a reason to go to your manager and explain why and how the current situation prevents you from doing your job properly.

I can understand wanting full control over your own personal machine, or a machine that is in your domain of responsibility, but for a machine provided to you by someone else it seems unrealistic to expect full control. Anecdotally, I also fail to see how a pre-imaged machine would prevent you from doing your job: I've worked with security engineers that had barely any control over their own machine, they simply worked with their company's IT department in order to get their machine to the state they required.

Answer 2

I doubt that letting them know your feelings are hurt is going to do much good.

If you have legitimate job functions that you can't perform because of this policy, then that's how you need to approach it with your management.

With this policy in effect, I am unable to do X, Y and Z, which are critical to my role as a security engineer. I need an exception or some other work around to this policy in order to do my job.

And let them take it from there. It's useless for you to simply rail at the IT department. If they violate the policy for you, then it's on them if it gets discovered. Whoever has the power to make the exception, it's going to be up to them.

Answer 3

am not being trusted to secure my own laptop

It's not your laptop, it is a tool the company have provided you in order to do your job. However, I do sympathise. It's normal for companies to have a standard image. And I agree, when handing out a laptop to a generic user I would usually ensure quite a few restrictions were applied so that users didn't screw with the machine.

If you need specific tools, you can and should request them.

What I recommend you do in the first instance however is - go and talk to your Manager, explain explain why you need/want it configured in a particular way, and ask if it is possible to have the restrictions lifted. If your manager OK's it, then they should go back to IT and instruct accordingly, at which point the IT team can and should work with you to get the setup you need.

However, if your Manager says no, then that's the answer. And you have to accept it.