It has been few month now since I am asking for permission to install Backtrack, on a VM, in the internal network. This it will help me to do other scans than Nessus, I can use Metasploit, Dradis... you get it.
My boss didn't want to take the responsibility to approve it, so it forwarded my request to a senior architect. Every week I kept asking for an answer.
Yesterday he told me that they will not approve it because Backtrack is not supported.
Reality is... Get over it
And I don't mean this in a spiteful/mean manner. You have to take a different approach to the way you're looking at this.
Their concerns (managers_ are valid although they may not seem to make sense to you. You asked for an application suite (bunch of tools bundled in one) that you would be the only one capable of running. Even though the tools may be free to use for the most part, there still is the cost of them having to train someone else on using them if you leave.
So while you will see it as: "everything is open source so its easy to use" they will see it from a cost benefit perspective. "What would it cost me to train existing individuals to use this... What would it cost for support when you need someone on the phone RIGHT NOW..."
You were wrong to go over your bosses head 1) because of the chain of command (and no I'm not in the military) and 2) your approach is wrong
When approaching management, you ALWAYS
need to remember that business comes first and even though you may have an alternative solution, your presentation was non-existent. To overcome this, you should have shown them some financial benefits to choosing Backtrack versus a pay for play model.
Now what *I WOULD HAVE DONE
* is gone out and done the research on say 5 enterprise tools. Put together your own RFI/RFP using those tools and show them the cost benefit of training existing and or new staff to use Backtrack versus the other options.
GFI Languard cost benefit versus Backtrack(Open Source Tools)
Core Impact cost benefit versus Backtrack(Open Source Tools)
Immunity Canvas cost benefit versus Backtrack(Open Source Tools)
Each commercial tool has a cost which dwarf the cost of training say 3 employees via OSCP + using Backtrack and other open source tools. Make it a business case for them and be factual with your information. Not biased by "I want to use this.... Well you won't give it to me, I'll ask someone else
You need to remember that your manager also answers to someone and if you think about this from his
perspective, why would he want the headache of trying to understand something - which may be simple to you - or not being able to call a support line and have them fix the issues.
Right now, I love FOSS, I love BSD, Linux, etc., but the reality is, I'd prefer say SAP or MS Office since I can always call and bitch and moan at 3AM without having to spend say 3-4 hours digging out via Google, jumping on IRC, etc.
alucian wrote:Unfortunately this isn't the only initiative denied by him (them) so I am becoming very unhappy at work. I even started to think about leaving.
You need to always remember that a business' objective is to make money. This is their first and primary goal. What you've done is nothing more than offer an opinion without allowing them to understand anything associated with what you want to do. You also confuse creativity and innovations. Your bosses don't need to be creative, they need to meet the goals set for them by THEIR managers. Present it to you boss from a business perspective. What are the costs, what are the risks and what are the benefits.
I've done this for years on end and almost always end up getting my way at the end of the day. HOWEVER
(big however here...), I ALWAYS, ALWAYS, ALWAYS
put together a good fight. This includes prices, research, what the herd says, etc., this way no one can call it a biased opinion:Research indicates other similar companies have done X and saved Y amount of money.
I'm not coming down at all, giving you constructive criticism here... All you've done is complained about not getting what you wanted, but you haven't actually fought for what you want now have you