I like to observe how organization affects how a company operates. As soon as you create a department, that department will start to generate reasons why it should remain being a department, as a sort of self preservation instinct. If you establish a design department, they will start planning complete redesigns sooner or later -- they need to have something going on to justify their existence. When I see this type of redesign, I can't help but wonder whether it is something that was cooked so that the design department can have a place at the table.
As a tangent, HR departments are very often affected by this as well. As soon as you have large enough HR, they will start generating ideas about how to waste other teams time. They have to justify their existence by organizing some events, trainings, activities, even if they actively harm the bottom line.
“Pournelle's Iron Law of Bureaucracy states that in any bureaucratic organization there will be two kinds of people:
First, there will be those who are devoted to the goals of the organization. Examples are dedicated classroom teachers in an educational bureaucracy, many of the engineers and launch technicians and scientists at NASA, even some agricultural scientists and advisors in the former Soviet Union collective farming administration.
Secondly, there will be those dedicated to the organization itself. Examples are many of the administrators in the education system, many professors of education, many teachers union officials, much of the NASA headquarters staff, etc.
The Iron Law states that in every case the second group will gain and keep control of the organization. It will write the rules, and control promotions within the organization.”
I see this daily in our banking megacorp. We have IT security team(s), which permeates all other IT activities like ink on paper. On its own its a good approach obviously, we weren't for example hacked or scammed in any high profile case, ever.
But there is no limit to how much additional security you can bring, so they do bring all of it. Recently had to get new Tomcat distribution deployed via Chef tool, of course our own package of it. Now it runs under 2 unix users, each owns various parts of Tomcat. Main startup config (options.sh) is owned by root, to which we will never ever get access, one has to do all changes in a complex approval and build process via Chef. Servers disconnect you after 2-3 mins of inactivity, if you deal with a small cluster you need literally ie 16 putty sessions open which constantly try to logout. And similar stuff everywhere, in all apps, laptops, network etc.
All this means that previously simple debugging now becomes a small circus and fight with ecosystem. Deliveries take longer, everything takes longer. Nobody relevant dares to speak up (or even understands the situation), to not be branded a fool who doesn't want the most security for the bank.
I would be mad if this would be my company, but I go there to collect paychecks and sponsor actual life for me and my family so can handle this. For now at least.
Alternative approach, also from a financial services world: VMs are created with a DSL on top of qemu/firecracker, containers with Dockerfiles. Cyber are part of an image review group alongside other engineers that validates the base images.
But: no interactive access to any of these VMs at all. There’s hypervisors running on bare metal, but SRE teams have that scripted pretty well to the point a physical server can be added in a day or so. It does mean you’ve to be serious about logging, monitoring and health.
This is one instance where we got it right (I think). We do have some legacy servers we’re trying to get rid of. But we’ve learnt we can run even complex vendor apps this way.
Conway’s Law comes to bite us in other ways though! Like I said, it’s a bear.
In large companies, each project is approved at each stage by a steering committee. And then as appropriate more senior committes, senior leaders and eventually the CEO and the board.
The poster above is right in that if you create a design team they will want to justify their existence but it's the controls above and around it that is responsible for keeping them in check.
As a tangent, HR departments are very often affected by this as well. As soon as you have large enough HR, they will start generating ideas about how to waste other teams time. They have to justify their existence by organizing some events, trainings, activities, even if they actively harm the bottom line.