“This is my first IT job, I’ve only been working here 3 months”
Then you need to learn this lesson quickly: YOU ARE NOT THE BOSS. The Boss is the Boss. Not you. You make your concerns known to him then you leave it at that.
“I’m considering talking directly to the owners about this issue” Yeah, going over his head is really going to go down well /s. As you have proven you are hard of learning, let me state clearly: it won’t, that was sarcasm. The owners will see you’ve gone over your boss’s head and when he says “I’ve had enough of this jerk, let’s get someone else in” they’ll be hard pressed to disagree with him.
“my boss’s refusal puts our operations at risk” Your boss already knows this. Especially as you keep banging on about it. What you’re doing here is heading for an unceremonious out-kicking. Your boss also knows a lot more about the business than you do. If he’s keeping that machine on Win7 then he probably has some good reasons to do so.
“I want to ensure I handle this professionally” No you don’t. You want to force your boss to do what you think he should do. If you were being professional you’d state your concerns, in email if necessary, then move on.
“I definitely feel like I’m going to be used as a scapegoat” That’s why you put your concerns in an email (ONLY to your boss, nobody else. Or maybe a sympathetic team member). This creates a paper trail so that if and when they come knocking on your door saying “Why did you let this happen! You’re fired!” you can point to that email which proves you did everything you could. (Which they won’t by the way. You’re an idiot newb three months into your first job. You don’t have any responsibility yet. So this isn’t on you.)
“I’m also planning on seeking employment elsewhere” It doesn’t matter where you work while you have this attitude. Newsflash kiddo: you’re the asshole here. You’re a newb three months into your first job. No matter what you think you know, you don’t know anything. Instead of trying to dictate to others what you think they should do, try to learn why they’re doing it differently from what you expect. Maybe you have to find somewhere else now; that boat may have already sailed. Maybe if you approach your boss saying something like “er, sorry I was an asshole, I thought I knew more than I do, can we start over and I want to learn from you” (but obvs phrase it better than that) then MAYBE you stand a chance of getting through your first year.
[Sympathetic mode on.]
We all have to learn this stuff and it takes time. Your boss also knows this, and remembers when he was an overenthusiastic hothead. So while all the above might seem harsh, especially the YTA bit, hopefully it’ll cause a course correction (which is my intent here) and you’ll be back on track to a successful career in IT. This position may still be salvageable but you need to go in on Monday understanding clearly that it might not be, and that it is your fault. And maybe you need to be fired a few times before this sinks in. Good luck.
lol. no. everything you said, just… lol. no.
In the end, this is true for any job. Learn to stop caring that you know better than your boss, and just give the minimum expected and ordered effort. It’ll save you SO much stress in the long term. Even if you do manage to improve things, you won’t get paid extra for it, so screw 'em. Just do it the bosses way and then shrug when it goes tits-up. Also, always make sure your resume is up to date and prepare to jump ship at the first opportunity for a better paycheck.
The most important career you can learn is that to your employer, you are neither friend nor family; you are an expendable resource, so treat them the same way.
The whole point of this post was to get advice, not to be insulted. I’m new to the field, and documenting everything is a valuable lesson I’ve learned. My boss can be unpredictable, and there’s no good reason for not upgrading a system that only runs a single program and has significant security risks. I already plan to send the CYA email tomorrow and then drop it.
I’m not going over anyone’s head. The employee who needs the machine is the one asking for the upgrade because it’s impacting his work. He’s been requesting it for 8 months. Your attitude is unhelpful, and you’re making faulty conclusions. Just because I’m new doesn’t mean I don’t have valid concerns.
I’m looking for advice to handle this professionally, not to be made to feel bad for asking for help. Maybe next time, try offering constructive advice instead of acting superior.
I guess this entirely depends on what country you’re from. I’m a developer, and I constantly have to deal with ignorant bosses. They push me to write code faster, sacrificing proper planning, architecture, and testing. Then I’ll be the one sitting up all night fixing a broken release, because my code doesn’t work.
As the professional in this scenario (the one who knows how to develop software), it’s my responsibility to make sure it’s done right. My boss isn’t supposed to know how to do it, so it’s my job to let him know.
Of course, you still have to have your bosses permission to do it, so I totally agree with OP putting pressure on the boss. It’s important that the boss knows what’s at stake, and it’s OP responsibility to make sure he does. But at the same time, it’s important for OP to know why the boss doesn’t want to upgrade, he might have a good reason, or at least it would be easier to argue against.
Again, it probably depends on the country. I work in a country with high job security, but it might be different in other countries (not the responsibility, but the danger of doing your job properly).
CYA at this point. Email the relevant info to your boss, bcc a non-company personal email, or print out and store a copy of the email for reference. When shit goes tits up, it probably won’t save your job (big IT event like that usually kills a family business), but it will save you from getting sued or smeared for the catastrophe.
You need a new job.
Should I start searching now or wait until I get my Network+? I have my A+ right now, but I’m probably not going to get my Network+ until 3 months later. I have 3 months on the job here so far, I’m 20 years old and get paid $55k/year.
See what you can get by putting some subtle feelers out. Talk to a recruiter or two. Best time to search for a job is while you have one, but you don’t have to commit to it full time unless shit really hits the fan. You’re more likely to get written up than fired initially anyway if he’s not the owner, erratic or not he has to answer for that.
Continue working towards whatever certifications you want in the meantime, especially if the job pays/reimburses you for it.
Not my field and i don’t know anything about this. But it’s clearly a stupid job that’s going to fuck you up.
You’ll quickly learn that money isnt everything. The stress of this nonsense will eventually kill your work ethics. Start looking now.
Start looking now. Tell prospective employers that you’re working on the certification and include it in your CV (as a work in progress, ofc). Job searches take a long time, and the sooner you start, the sooner you’re out.
Edit: @[email protected] has exactly the correct approach for getting it in writing. Keep it professional, emotionless, as close to an accurate summary of the situation and the decisions made as possible.
Counterpoint - almost all jobs will have elements of this type of stressful fuckery. Use it as a learning experience, and do your best to navigate the constraints while maintaining professionalism and value to your employer.
It’s a balance; if it’s truly soul destroying then your health and happiness is more important, get out. However, the more you learn how to deal with this, the less likely you are to burn out in other jobs when they get shit like this. Not so that you can just suck it up and grind away for awful bosses, but so that you can give yourself the maximum options for you, and stress less while going through it.
You already seem to have the right mindset about trying to do this right, so the one thing I’ll say is this: everything in writing, straight away. It’s easy to get too relaxed about this when it’s all going smoothly, but then something catches you out and it’s too late (eg already been told not to bring it up again).
This part will feel awkward, but to protect yourself, you need to send your boss an email summarising your conversation and your understanding of the outcome (not updating). Frame it as a “I hear you, and I apologise for my previous insistence” if it helps smooth things over, but just make sure it outlines your previous queries and suggestions and their response to you. It’s the only way to cover your own butt in these situations, and it’s a great habit to get into after every conversation that has decisions or changes etc. Put it in writing as a summary: you can refer back to it later and it let’s the other person know you understood their position / instruction
Thank you a lot for the advice! I’m kinda cheating a bit and using ChatGPT to draft my email, if anyone else sees this and wants to help feel free! Its late so I’ll redo this in the morning. Not exactly what I’m going to send I’ll fix it a little to make it better when I have time.
Email to Your Boss
Subject: Summary of Our Conversation and Security Concerns
Hi [Boss],
I hope you’re well.
I wanted to summarize our recent conversation regarding the desktop running Windows 7. As per your instructions, I have not made any changes to the current setup. I understand your position on not upgrading the desktop at this time.
However, I want to document that the system poses significant security risks due to its lack of support and potential vulnerabilities. While we have good security measures in place, it doesn’t matter how many security measures we have; this outdated OS could lead to data loss and disruptions.
One known vulnerability, EternalBlue, allows attackers to take control of a system just by sending data over the internet, bypassing many security measures.
I’ve brought a replacement computer with Windows 10 installed and preconfigured with all necessary software. It has been verified that it has everything needed. This computer will be left here as a drop-in replacement if the current Windows 7 computer breaks down. Given the recent issues with the system and requests for a new computer, this will help minimize any downtime.
Please confirm if my understanding is correct, and let me know if there are any further steps you would like me to take.
Thanks, [Your Name]
Email to Senior Management
Subject: Security Concern Regarding Windows 7 Desktop
Hi [Senior Management],
I hope you’re well.
I wanted to bring a security issue to your attention. We have a desktop running Windows 7 that hasn’t been upgraded despite my efforts to address this with [Boss]. This system accesses our server and poses a significant security risk.
[Boss] mentioned that we have good security measures, but the operating system itself is vulnerable. It doesn’t matter how many security measures we have in place; this outdated OS could lead to data loss, disruptions, and undermine the security expectations of our customers.
One known vulnerability, EternalBlue, allows attackers to take control of a system just by sending data over the internet, bypassing many security measures.
I’ve brought a fully updated replacement computer with Windows 10. It has been verified that it has everything needed. This computer will be left here as a drop-in replacement if the current Windows 7 computer breaks down. Given the recent issues with the system and requests for a new computer, this will help minimize any downtime.
To be transparent and protect our network, I’d like to CC you on my communication with [Boss] to make sure you’re aware and involved. Is this okay with you? Do you want me to CC anyone else?
Thanks for your understanding.
Best, [Your Name]
Is this good?
Windows 10 will be in the same boat again in about a year and a half when Microsoft drops support.
Do you really want to have this fight a second time trying to get him to upgrade to Windows 11?trying to get him to upgrade to Windows 11?
If it’s currently running Win7, it likely doesn’t have TPM 2.0, and in extreme circumstances may not even have the SSE 4.2 that 23H2 requires (Win11 will then fail to boot).
And while a RUFUS-modded installer can remove the TPM 2.0 requirement, the SSE 4.2 requirement is kinda baked into the pie; there is no avoiding that.
Win11 is already available… Just go to that.
That’s my point
First few months in IT? Welcome to hell…
I’m kidding (mostly), I’m in IT also and if you’re in for even a few years, you’ll start to build a collection of horror stories like this one. We’ve all seen things you wouldn’t believe.
So you need to have full buy-in from the owners. If you’re able to talk directly to them, then it sounds like this isn’t a huge company. If you clearly explain in a professional way to the owners the situation with documentation and they don’t fully support you, leave the company asap.
As somebody who has been involved in multiple ransomware recoveries, trust me…you don’t ever want to deal with a rogue unsecured machine on the network. And owners that don’t care or take that risk seriously are absolute fools and this will only be the tip of the iceberg of stupidity.
That computer is a ticking time bomb. Please for the love of God tell me that your boss doesn’t have local admin rights on his system.
If the only thing your boss uses that system for is to connect to a web app to manage inventory, why is he mad about switching from windows 7? Does he just like how windows 7 looks visually?
I guess it doesn’t really matter. Also, windows 10 isn’t a long term solution because it also goes EoL next year in October, so you’ll be in this same position in less than 2 years.
You can either go to Windows 11, or if you wanna be a little wild, install a Linux distro like Mint on there and theme it like Windows 7. You solve the security problem and he gets to pretend he’s still in the early 2010’s.
Honestly though, start looking for another job if the owners don’t support you 100%. IT is already a stressful and intense enough job, you don’t need stubborn idiots like your boss to add flavor.
Fellow IT guy here (welcome!). It’s like everyone else said: have some proof that your boss was informed of the situation. As someone who worked for a few years in IT: avoid verbal agreements; you won’t be able to prove they happened and they’ll make it your fault. As an example, I refuse to do any work that might have long-term consequences if I don’t have a ticket requesting as such or at the very least a mail in my mailbox. All agreements should be documented somewhere. Email is good, hard copies (paper) are even better.
Always, always, always document your requests. Bosses will not hesitate to throw you under the bus when something THEY fucked up goes wrong. Like southsamurai said: cover your ass, then follow orders. When shit inevitably hits the fan, you’ll have something to point to.
Something I haven’t seen mentioned yet - who is the company’s HIPAA “Compliance Officer”? If it’s anyone other than your boss, you could document the situation to them in an e-mail. If you want to be slick about it, ask them if there is “still any compliance need to keep the replacement machine ready or if it would be OK to repurpose it, given [your boss’s name here]'s decision not to move forward with the upgrade.” They’re on the hook for compliance violations, so they’ll likely see to it.
I would also suggest making a habit from now on of documenting verbal conversations that result in actionable decisions in short e-mails to the other party: " To recap our discussion, [bullet point list]"
You can excuse this as being for your own reference so you don’t forget any to-do items or so that they can correct any misunderstanding on your part, but it makes for a fantastic CYA if that ever becomes necessary. For really important items likely to bite someone later, print a paper copy if you don’t fully own and control the machine AND the e-mail local archive. Only bring those out if absolutely necessary, as in when SOMEBODY will be fired or you’re about to be legally scapegoated. They’ll save your butt once, but it will probably be time to start looking for another job because the boss will think either that you should have pushed harder earlier to fix the issue or be worried about their inability to scapegoat you in the future.
I don’t have advice, just a worthless anecdote.
I work at a large tech company. We had a Windows XP system on our network get hacked. They used that to jump to our servers. IT had to quarantine off the whole lab, because they didn’t know where the hacker had hopped next. So then IT had to do a post-mortem and figure out how they got in and what was affected. That process took 3 months. In the meantime, any team with servers in that lab couldn’t use them. The team directly responsible for this couldn’t work at all for the full 3 months.
We lost 2 months of local Windows servers in a smash and grab ransomware. we were lucky that our PROD servers were Linux. And this was a place with an active Windows 10 upgrade plan, gateways and air gapping for non-compliant systems. Our luck/planning was the backups system allow for two months of roll back to remove the malware. For the sysadmins, the character limit on the file paths meant we lost a bit of deep dive information 8/10 folders deep. (Over 64 characters or something like that.)
What a disaster. Post IP and system information on 4chan. He will switch after being compromised.
This is (presumably) people’s personal health care information. Please don’t fucking do this, Jesus Christ.
If not just because it’s a really shitty thing to do, I’m pretty sure it’s also at least one felony.
Then compromise the machine yourself without stealing personal data from unrelated people.
You understand that legally speaking this is approximately the same thing as telling your boss that the front door isn’t strong and thieves could easily kick it in, and then when they refuse to fix it, the response you’re suggesting is “show up at 3 am and take a sledgehammer to the door, but just dont steal anything from inside” right?
The point is to cover your ass, not pull your pants down.
The point is to get him to switch so you have peace in your network and don’t have to handle the shit show when someone else does it.
Yes I understand the intention, but in one of these scenario’s I’ve covered my ass legally and if something happens where the company gets ransomware for example, I likely get paid thousands of dollars in overtime restoring backups and the user ends up updating anyway, and in the other I can go to prison, lose my job, and never be able to use my time at that company as a reference on a resume let alone probably easily get a job again because now I have a criminal record.
I know this because I have lived scenario A probably 6 times in my life.
I know, I live those scenarios too, I said let some 4chan degenerate do the dirty work, get paid for fixing it and get your network in check - if you morally can’t handle that situation because of the data, then do it yourself and you can ensure that your boundaries are not crossed.
Free pro tip: If you do it yourself, you still get paid to fix it ;D
Yea I don’t trust the opsec of some random 4chan user to cover their tracks and therefore mine in that scenario.
I’ll just take the option that guarantees I can’t go to jail and ruin my entire fucking life lol.
Then he gets fired for hacking. And possibly winds up arrested for illegal activity.
It’s a stupid idea.
Just send the boss an email that says what they spoke about verbally. That way if the system does get hacked, the guy has a paper trail to cover his own ass to show he told the boss.
He is a security advisor for their IT infrastructure, he will not get caught lol
lol said every individual who went to court. “I didn’t think I would get caught”.
Yes, but if any individual would fly a plane, I wouldn’t be to shocked when most of them crash, but when a pilot is flying one, I’d expect him to land safely.
an email I sent to my boss about upgrading was never responded to
Dear Boss, As per our recent discussion [blah blah] Thanks for allowing me to leave early on Friday for my appointment. HnK, -Staffy McStaffersonWhen you get a ‘brown M&M’ response …
Staffy, I don't remember the discussion about Friday. -Jefe JefenbaumThen you know you got 'im.
This is kinda genius, lol
The most chaotic good thing to do would be to use the known security issues to hack into your boss’ computer in the most scarry looking but harmless way. That would possibly scare them into upgrading.
With that said, you should create a paper trail on how you warned your boss, and either wash your hands of the issue or kick it up the chain, depending on how much you care.
More like chaotic dumb. This is a good way to get fired and possibly end up with criminal charges depending on how petty the boss is. And based on how stubborn and tech illiterate they are it is likely.
I didn’t actually mean the fist option, it was meant as a joke. I clarified it in another comment, maybe I should just edit the original one.
Yes! There is a website somewhere that has a tonne of fake os screens - updating/upgrading windows, bsod loop etc.
Run a scary looking one of those, disconnect mouse/keyboard so it can’t be interrupted and let the boss discover it
Just be be clear, I wasn’t advising OP to do the first idea. It was more of a joke. It has potential to be traced back and get him into trouble.
As a user at a big company that needs to lock down its security, we get quarterly phishing emails that would tell you that you failed the test so to speak if you click the link. It shows how easy it is to everyday users of how easily an entire system can get compromised.
Having a “test” like this might not be bad if you run it by boss first?
As far as I understood the problem here is OP’s boss, so I don’t think that would be a feasible solution in this situation
you can advise but the boss man has the final say
I would absolutely send him an email to the effect of
“Per our multiple verbal conversations, this is just to serve as notice that, in my professional opinion, your refusal to allow me to upgrade a system at risk of multiple security vulnerabilities on a platform that is no longer supported is a risk that you are choosing to accept against my advise.”
with a list of known major vulnerabilities attached if possible.
That way at least if this comes back to bite the company on the ass, he can’t say “Well he never told me this was a problem!”
this is the correct response.
get it in writing that they accept the risk that comes with not upgrading so it can’t come back on you. all you can do is CYA and make recommendations - if management does not agree with your recommendations make sure you have it documented that you informed whoever is making the decision of the risk.
if you think your employer will somehow still try to hold you accountable for this, save the aforementioned correspondence using something your employer does not manage i.e. a personal device. you could also let other people than this specific individual know about this so it isn’t just your word vs his.
I disagree. That’s a consultant-style answer. OP is an idiot newb three months into his first job with zero responsibility, and not in any position to “serve notice” or have any meaningful “professional opinion”.
Exactly. After that he can basically let it go. Unless he has some stake in the company or ite survival, he’s done his job. It’s his bosses problem, the one responsible.
And keep a copy off site
to emphasise something missed - you said the employee using the old machine asked for an upgrade?
make sure you have it in writing. from them, in a full clear email, what they want and exactly why they want it. They need to be verbose enough to cover every point. (it’s okay to secretly help them, but do NOT have your fingerprints on it).
Then, reply and forward that email to your boss, with your professional opinion of their request and their reasons for it.
Include cost for proceeding, and what the costs will be for doing nothing.
Acknowledge that this matter has been spoken in person, an apologise for the informal tact; that this email is intending to follow proper procedure, which you will continue to do in the future.
Ask to confirm their response so you can officially deal with the matter one way or another.
The main thing to add, to clarify: you are the middle man. Don’t make it look like you are the one wanting to do this. The employee is. You are wanting to do your job, which is dealing with problems that are brought to you.
These seems more like a tactic you’d use at a big corporation since everyone has a boss above them. At a small clinic like this, it’s probably fruitless as the stubborn owner isn’t going to stop being stubborn over an email and documentation.
Just curious, what are his reasons for not wanting to upgrade?
