Schneier on Herding Cats, etc.

Bruce Schneier has a fascinating post here on the difficulties of managing IT security in a great university, interesting in itself, but also a useful reminder of the difficulties of managing anything in a great university. In a word, decentralization. A university is a lot like a leased-department bordello, where every entrepreneur is trading on his own account ("hello, sailor, going my way?).

Universities are edge-focused; central policies tend to be weak, by design, with maximum autonomy for the edges. This means they have natural tendencies against centralization of services. Departments and individual professors are used to being semiautonomous. Because these institutions were established long before the advent of computers, when networking did begin to infuse universities, it developed within existing administrative divisions. ...

The lack of central authority makes enforcing uniform standards challenging, to say the least. Most university CIOs have much less power than their corporate counterparts; university mandates can be a major obstacle in enforcing any security policy. This leads to an uneven security landscape.

There’s also a cultural tendency for faculty and staff to resist restrictions, especially in the area of research. Because most research is now done online -- or, at least, involves online access -- restricting the use of or deciding on appropriate uses for information technologies can be difficult. This resistance also leads to a lack of centralization and an absence of IT operational procedures such as change control, change management, patch management, and configuration control.

I also liked "students" as "a large number of potentially adversarial transient insiders." No dean would quarrel with that one.

Herding cats, as they say, or (I believe this one is Woodrow Wilson) like trying to move a graveyard. Or like trying to marshal a parade of turkeys, except that if you don't control the turkeys, they pile up in a corner and suffocate each other.

My friend Katy likes to say that antisocial behavior that would be punished anyplace else is rewarded in the university. Quite right, although perhaps the alternative is worse.