BIM vs IT Friction: Security and Efficiency in the Cloud Era

Foreign.

Ladies and gentlemen, welcome to another episode of Design and Influence where we argue amongst ourselves and find solutions.

And you are privy to those arguments and discussions and hopefully we hope that some of it will help you out in your own situation, your own business, specifically if you're running architecture firm.

And also, we are just a bit about ourselves.

We are an IT company called ARC it.

We focus on solving IT for architecture, architecture, design and engineering companies.

My co hosts, My co hosts speak a lot more eloquent and they're managing BIM for architecture and design firms as well.

And welcome, Liz.

Welcome, Megan.

Thank you.

Hello.

My co host today is Boris Rapoport, who's the founder and CEO of ARC it.

And today we're doing battle.

Okay.

Today is BIM versus IT Friction.

Who has control all those things.

But, you know, as Megan says, not that bad.

It's all we can all get along and now we're going to figure out how to get along.

Boris is going to represent the IT side because our job is what is our motorboris.

We solve it so our clients can focus on doing their best work.

Now, security breaches, issues with access, that's basically distracting you from doing your best work because you have to worry about this stuff.

And so we want to prevent it.

Now, Megan here and Liz, they're trying to push projects out the most efficient, effective way, get all the stakeholders to be able to contribute to the project, get it out the door and get you paid.

Okay, so there's a friction.

Maybe Megan, you can kind of introduce us into this friction since you were the initiator of this whole conversation and then maybe give us a story.

Sure.

Well, I think it even starts with how we started talking.

Right.

I started working for a structural engineering company.

And during the first week, of course, I am talking with you guys, learning how everything's set up, getting VPN access if I need it, talking about the Autodesk licensing and how we can work with that, and getting emails set up and integrating into the office so that I can help this client.

And that happens with most of our clients.

We end up right out the gate talking with you guys.

So right out the gate we need to work with each other.

And this happens for most of our clients.

And we have now come across with some of the newer technologies.

For our prime example is Autodesk Construction Cloud, where we have potentially some education and some growing to do around.

Nice.

I just like butter, man.

Smooth.

I want everybody to be friends.

Uh, we basically need, we need to understand each other's side when it comes to this new technology so that we can do what we do best and you can do what you do best.

And I think that's the whole point of this, this topic and this podcast today is to try to ease both sides in their concerns and their.

What are they afraid of is going to happen if these things aren't locked down?

So, so the.

Let me summarize this.

The success looks like.

And I'm kidding with Megan, but she, she's on point, you know, because you have to.

It's not only you trying to help a client ship, ship, product, project.

You know, you're also, you're also fighting, fighting access.

You know, those, those are like nasty battles and, and they just take extra time and, and money on both sides.

But what the success looks like is maybe we can come up with a framework today.

And I swear, we haven't really done this yet.

This is going to be on air right now in real time.

If there's a solution to be had, perhaps we can at least map how that may look like between BIM and IT and how other firms can think about getting.

Still being secure, locking down, making sure the business is secure, but also providing the necessary access for BIM managers to do their work.

I love it.

Yeah.

Okay.

Yeah.

All right.

Who wants to.

I thought we.

You were going to start us with a story of some kind.

A stor.

I could start with a story.

Okay.

First off, and I actually, I have questions because I. I understand enough about IT to talk to you all, but, you know, there's a certain level that, you know, is way beyond what I know and what I'm an expert in.

So when we're talking about this new way of working, which is kind of taking over the industry, working on the Autodesk construction cloud, it really has changed how offices work.

They used to work internally on their own servers, on their own folder file systems.

And there really wasn't this, like, access to the outside world unless someone emailed a file out.

But now we have Boobeam Studio.

We have cloud versions of most of our PDF documents.

We have cloud versions of now, these revit models or design models that we're collaborating on with the whole team up in the cloud.

So it is no longer just this, like, internal system that you all can lock down, where the only way out was if one of the employees emailed something to someone that they weren't supposed to or someone got in.

And I guess that would be a question.

Kind of a good place to start, you know, back in the old way of Setting things up, your concerns and how you really approach that.

And how is it different now in the Autodesk Construction Cloud and Bluebeam Studio World?

Boris, besides just taking those two services.

I think we need to, as you.

Said, this is the new way to work.

And I think IT departments are now.

Instead of trying to manage security just.

For hey, anything that's in the office is inside.

Anything that's out of the office is considered outside.

There's this new way to work.

The cloud is still considered inside, for example.

And also you, your home that you.

Are accessing that information from is also.

Considered part of the network as opposed.

To just being outside of the network.

So IT people have to worry about a lot more things and making sure.

That whenever for if the data is.

Accessed from a location or a device, that device has some baseline levels of security so that they don't accidentally.

Right.

Bring in a virus or something that.

Is, that is bad juju basically for the company.

Right.

And in fact, you know, infect the.

Files, infect the files in the cloud and so on.

And yes, I mean.

Cloud providers could say, hey, we have these security measures.

In place, hey, we scan all the data for any viruses and so on.

It doesn't always happen like that.

So I think that's where the concerns.

Of many IT departments lies, is the fact that they now basically.

Any location.

Or device that has access to the company data needs to be as secure as possible.

I have follow up questions.

Sure.

Exactly.

Could you explain to me how would a virus get into, let's say Autodesk Construction Cloud?

And has that ever happened and do we have a dialogue with Autodesk or have any sort of guidelines out there that explain how that could happen and how to prevent it?

Because I've actually never ever heard of that happening.

So I haven't heard of Autodesk Construction Cloud, but I have heard of other.

Cloud services like either the Microsoft Cloud.

Or the Google Cloud, but the mechanisms are the same.

You're basically right.

So you're using Autodesk Desktop connector to sync files between your computer and the cloud.

But if your computer gets infected with.

The wires, technically any one of those files can get infected as well and then sync up to the cloud.

So like, and then what happens and what happens?

Depending on what the virus is, it can start encrypting the rest of the data or another person can download that file and now get their computer infected.

And that's how it spreads through the organization.

Does it spread through like PDF files or Excel files or is it like A specific file type that you go to upload, that spreads it can be.

Any type of file.

I mean, the bad guys are really, really smart about how they do it.

PDFs definitely, like any PDF can be, can have Java code encrypted in it.

And in fact, many kind of the.

Email PDFs that get.

That have, let's call, weaponized PDFs, right?

So basically somebody sends you a link.

With a PDF and says, hey, review this proposal.

And then somebody clicks on that PDF automatically.

The system gets it.

That happens.

See that happen?

And what's.

So like, in my understanding, the two main ways that, like, hackers are trying to get you is they either want to corrupt all your data to screw you over, or they want to grab your data and lock it down and get you to pay money to get it back, so on.

Like for this PDF version, can either one of those happen?

So yes and no.

So what you're, what you're looking at.

Is the outcomes, right?

So those are the outcomes they're looking for.

But in order to achieve those outcomes.

There'S a lot of.

We're going deeper in a security discussion.

Let's go, let's go.

This is what I, this is what I've needed because no one really has been able to answer these questions when I ask them, or they just think I won't be able to follow a.

Lot of quote unquote prep work, right?

If a bad guy's, you know, let's.

Call it a group, right?

A threat actor, identifies a target.

A lot of these things, you know, the PDFs that we're talking about, for example, it's part of the prep work.

So what they can do is that PDF.

You open it, a piece of spyware.

Gets installed on your machine.

You don't know about it, but what they start doing is kind of monitor your machine, monitor your email, monitor your communications.

And then once they have like a.

Great subset of data, they can then.

Achieve the next level.

The next level is not necessarily going.

After your files, but it could be an email.

So let's say you're working with a client.

So it could be an email to.

Your client saying, hey, you know, you haven't paid this invoice for $30,000, by the way.

Here's the new, you know, bank account.

Information that you should send the money to.

That's how they get paid off, right?

Your client falls for it.

It's an email that you click.

It's found from you.

They send them the mighty, and they.

Know the invoices you may have already had the conversation about.

It'S spyware installed.

It's not necessarily like the ransomware that kills.

Like, those are the big things that.

We hear about is these little things.

And about like monitoring the conversations about discovering, you know, how you work, how you talk, what you do.

Right.

Like, those are, those are just.

There's basically like three levels of those scam emails.

Right.

Ones that are really, are designed for just click, hey, send the money.

You know, they're.

They're basically designed for people that are.

Gonna fall for it.

They have spelling mistakes.

They're just like, totally, like, if you had any experience, you would say this is ridiculous.

Who fall for it all.

There's specific.

All those phone calls I get where I'm like, yeah, no, click, yeah.

Filtering for those people with low enough IQ that will fall for it.

And usually the ask is not that much.

You know, it's a few hundred bucks here and there.

But they're doing it as a wiring thing.

Then there's more sophisticated docs and the very sophisticated ones are the ones that have their targets identified and they're sitting there taking monitor for like six, eight months.

And they're there to basically get one big one.

They will talk exactly how you talk.

They would sound like you do through email that will have your signature that.

It will look exactly like it would.

Be coming from you.

It's.

It's not.

Yes.

In your case, I don't know how much you guys are charging or billing your plans, but like in our case, right.

It's thousands of dollars.

But especially in the construction industry, a contractor gets hacked like that and their.

Client can send them $500,000 check.

Yeah.

So my question though is, is in terms of security for the old systems, the way it used to be.

Emails, which this is emails and computers and networks that people are working on that allow these things to get in.

They're not necessarily coming or because of people having access to these new cloud services and your security and your agents on all of the employees computers should catch these things and kill them, right?

Correct.

So I guess more or less, yes.

Okay.

So if, if a threat were to come through a PDF and infect a computer that had an agent on it from you guys, your defense systems should be able to handle that.

Really.

It's.

The cloud is just like email, where it is the mode of transportation.

Yeah.

And that's the concern.

Transmission mechanism.

That's a concern.

And especially so if I have all.

These things installed on the machines that.

Right.

As an IT department If I have.

All these things installed in the machines that we manage, I quote, unquote, feel safer.

Obviously nothing is 100% and right.

New threats come out all the time.

And technology is not always catching those.

Right.

So that's how we see these things happen.

Still, it would be nice to say we've put a stop to this now.

That's it.

But because I, you know, we're also.

Talking about you in a consultant role and there's not fully, and you know, you can correct me if I'm wrong, but as an IT department, I don't have control of your machines.

Right, right.

If there is a threat actor that has infiltrated your machine and then is sitting there monitoring, well, now they may.

Have a key logger installed.

If you have all this access into their systems as you're logging in, they.

Can gain access to their systems as well and then start other things, other bad processes that can possibly.

Interesting.

This is the, like, this is the point of view that I'm making from.

Inside of the IT department.

Yeah.

They want to have as much control.

As possible over anybody or any device or any location that is accessing their files.

Because that's the, in their mind or in our mind, I guess, collectively, that's.

The only way we can help prevent.

Some of the bad things that can happen to a company.

So that makes a lot of sense.

Thank you for breaking that down.

And what I want to do is further dive into like how Autodesk Construction Card is working and how firms are using it right now.

Because a lot of times in the way that Autodesk set it up originally, you're actually being invited to a whole other company's hub to work.

Your data sits there.

You don't even have access to it unless they give it to you.

Which this is a plug for our bridging conversation a few months ago that now you can work on your own hub with your own dat, like permissions to your own data and you can control all of that locally.

But so then the fear about sharing files and using these cloud based systems to host project data, the fear there is that it's going to be shared access, is going to be shared with people that shouldn't have access.

That's the, that's the main concern that I've gotten from it.

The IT side.

Now I like to compare back to email.

So like if you trust your employees to email and you don't lock down what they can and cannot email, like you can send an email with a PDF attachment to anyone.

You guys don't lock that down right when you're just an employee sitting at a company.

So these cloud based systems and projects where if an employee invites someone from outside the firm into the project, they now have access to that data.

And in the Autodesk construction cloud, which is really great and I think even better than email or just regular PDFs is there's this activity log.

You can see who was added, who opened a file, who even looked at a file, who downloaded a file.

Everything about that file is now documented.

So in, in from your perspective, is that not better and more secure than just like traditional email sharing the way we used to with Dropbox links or you know, whatever because you're able to monitor that.

I, I'm guessing like a little.

But it's not as like just right there for anybody to look at.

Like you could quickly say hey, who's downloaded this file on this construction cloud?

And you can see everything that has happened up in every project.

And Liz could, Liz can show you.

So yeah, no, we haven't pulled up.

Let's do it.

Let's pull.

Let's hope pulled up.

I know I have, I have reviewed that activity log and I know that.

It exists but maybe we should share it with the audience.

Yeah.

And I think it's similar to like Blue Beam Bluebeam cloud studio sessions and all of that.

It you also every single like person, it, everything they do is logged.

So I think like these cloud systems are actually more secure than the old server based systems.

Right.

Where you could just take a file and send it to anyone via email.

Now if you do everything up here, it's tracked and documented.

Absolutely.

So I want to be.

And Liz, do you want to walk us through the log or are we just.

Yeah, I mean we can just really quickly the ACC project.

But over here on the three little dots you have your view file activities like Megan was talking about.

And you can export the log which is great and filter on as soon as it reloads.

Here it was loaded a second ago.

You can see that it sorts it by the most recent activity.

And of course now it's not going to.

Let's try it one more time.

But what it was also showing was bridging files because this project is bridged to an external company.

So two companies have bridged with each other and are sharing files back and forth.

So you can see that and you have a link to that bridge here.

And you can see that also was bridged in do this project.

So that's quite good.

And also the Other powerful thing we didn't talk about here in this discussion, what we had before is I would say the version history of the file too, which is great to have for us as designers.

So that's super to have.

And then the last thing as we mentioned bridging and we want to plug our other podcast again is the.

This is bridged and to another company.

And you can see here as well what's being sent back and forth.

And you can also see this activity log here.

Yeah.

Is there something else you wanted to mention about this, Megan?

No, I think all that's great.

And I just want to point out that in the activity log it mentions like minute things like if someone even looks at a file, you know about it, which I think is really great.

And I think, I guess my question still is.

I understand now, okay.

Like let's say I get a PDF from a hacker and I.

It's a really smart one, so I don't realize that I.

That it is.

And I download it and I upload it to Autodesk docs.

I'm curious what features and I'm sure they have some that Autodesk has that will basically say, no, you can't upload this file.

It's got a virus, it's got a.

It's got this JavaScript attached to it.

Do you know, like from that side of things what their security measures are?

We haven't tested any of this.

And sometimes, you know, the pessimists in me will say, don't ever trust the service provider until you've proven that that's the case.

Just because like, you know, there's.

There's been a lot of real world.

Examples where some of the things that any service provider have said has not been.

But from what I heard is they're.

Supposed to be scanning for viruses and making sure that none of the bad files get uploaded to that cloud.

Haven't heard of any instances where that's not the case.

So I have not heard.

Yeah, and neither have I where their.

Cloud have been infected.

But I want, you know, I want some.

Yes, I'd love to see some proof.

Maybe they can come out with a, with a video that shows, hey, this is.

I'm sure they have it somewhere.

I mean, I'm sure we're not the person.

All my conversations about Autodesk construction cloud.

Has been with salespeople and you know, salespeople always say, oh yeah, we have that.

We also have like backups on backups of backups.

We also have an necessarily test.

So I will only say that as.

Far as I know, they have these.

Features, But I can't 100% say that they do.

Gotcha.

Yeah.

So can we try to understand.

I really, I think we need to deliver on this because the one specific thing we talked about was the admin level of access.

Now we sort of, I think we've assessed what the potential threats might be.

Now let's talk about mitigation and actually kind of coming together to solve this or to come up with some kind of a good solution that people can think through.

You need admin access, correct?

Yeah.

So with Autos Construction cloud, there's two types of access for each project.

You can have a member only access or project admin access.

Project admin access allows you to use features like bridging.

And then on an account level, there's access required to set up things that we've talked about in other podcasts, the plug for the add ins with the Autodesk, the libraries that are available up there now, and the more advanced features that are meant to like, expedite project delivery.

So there's the project admin that allows you to now use bridging and invite members.

That's the big one, is that they want people to stay only project members where they do not have the ability to invite other people to the project.

That's their biggest fear.

I guess the specific challenge we're talking.

About is, right, your ability to be an admin in the Autodesk construction.

There's two admins, so project versus account admin.

Okay.

And I'm saying that BIM people, bim, BIM managers, anyone working in the BIM world should have access to both.

I don't see why not.

So, I mean.

Good answer.

No, I'll be, I'll be honest.

Right.

Really?

I mean, we've talked about, right, Security.

Concerns and all the other stuff, but the reality is there is a scale of, on the one hand you have the security, on the other hand you have efficiency and the ability to produce work that is always a fine balance that needs to be constantly adjusted to ensure that the environment stays as secure as possible in that moment.

But also.

We'Re able to do the.

Work that we need to do and as quickly as possible.

There's project deadlines to be had, you need to meet the deadlines.

There has to be things that can be put in place to make sure that that's done as secure as it.

Could be, and you can meet the.

Deadlines as efficiently as possible.

So from that standpoint, like if we.

Just look at this particular issue with administrator access.

I mean, I'll be honest.

Yes, anybody who's in charge of bim.

Anybody who's a BIM manager along with it, right.

Dorothy Sung, People in IT should have full access to both the account and well subsequently you can make yourself then a project manager and the project in there.

I can see, again, we can see that there may be security concerns with.

That, but if we don't have that and it's not allowing the team to do their work as best as possible, then what's the point?

What are we trying to secure?

Right.

At some point the business suffers, the business loses and maybe even we're not.

Going to go too extreme.

But because the business suffers so much and not delivering on time, you know, there's not much things to secure it.

And how would you.

Do you agree with my analogy that like if you allow your employees to have email where they can technically send anything to anyone, that allowing them to have this project admin access where their biggest features is them adding someone into the project who might have access to the data for a second before someone realizes that they shouldn't because everything's tracked.

Do you see that being less of a threat almost than an employee having email access and access to a server that has all your files versus this like more controlled cloud based system?

So if the challenge is data loss.

Prevention, then yes, you're absolutely right.

The Autodesk construction cloud and any cloud for that matter.

Right.

Cloud service has a lot more controls in place against that happen as opposed to email where it's wide open, you can send anything to anybody.

So yes, I would agree with that.

That that's the only thing that is of concern.

But who does this.

Sorry, interrupt, but who does this argument or not argument, this, this kind of versus this analysis, who does it help?

I mean, are you trying to convince principals to allow BIM that level of access?

Are you trying to convince other IT providers by giving this, this sort of comparison?

Who's the question for?

Oh, it's for Megan Meghan.

Correct.

So yes, I'm trying to convince it.

Yeah, IT providers that are nervous about these new systems that they potentially don't understand and have locked them down away from the employees and it's inhibiting their ability to deliver projects because it's, it's these administrators, they see the word administrator and they automatically assume that it should not be access given to anyone.

But like high app project managers who actually don't even know how to use the system, it's the BIM people that do.

If I may give you my opinion on this.

If I'm an it, which I am, and you're giving me this sort of.

This sort of analysis or comparison, I'm almost like I'm going to feel a little bit underappreciated to say the least because this is a position where your stance is like, I really don't understand what's going on.

And I'm doing this out of my.

Potentially out of my own fear of what's new and stuff like that.

Is there like.

I know.

I know that I'm going sideways a little bit, but I. Boris, is there a better argument Megan and other beam people can make to the IT personnel that will sound.

That will actually open up the gate in conversation.

What would convince you?

Start thinking deeper about it.

So.

Here'S my concern.

I don't know if this should be.

Left in the hands of the IT department.

I think the firm's leadership needs to.

Be involved and this guidance needs to come from the leadership, from the partners.

Because this effects, as we just talked.

About this could affect deadlines, could affect project deliverables.

Obviously it affects project workflows.

In the end.

This type of head body is affecting the financials of the firm.

If we look really closely.

Right.

This would affect the bottom line just because things are not getting done the way as officialization.

So I think the leadership needs to be well because look, I can see both sides of this.

I can see the IT department not wanting.

The main thing about it is.

And I may have said it before, but the more control we have, the safer we feel.

It doesn't mean that that's true.

Right.

But.

Many IT people will want to.

Maintain as much control as possible or all talk.

And.

And that's where I think you're hitting that nerve.

So in the end I think they.

Will do everything in their power to present back to the firm's leadership.

Look, we need to keep process safer, secure.

We need to have as much control.

So any argument around the technological side of it is not necessarily going to be.

I don't know if it's going to be used for.

Right.

Because as you position your argument one.

Way, they will position their argument opposite way.

And still going to sound just as.

Good the argument though with email access versus ACC.

Doc.

Doc access.

I think that could be helpful for a principal to visualize like.

That's for sure.

Megan.

What I would pull that card out.

But talking to IT almost like ensures you will get into pulling match.

Yeah.

Unless.

So unless somebody's already predisposed like you guys, both sides.

So I'm trying, you know, I know that.

And with our clients, this is what we have is, yes, we part of.

The Autodesk construction cloud administration team, but.

You know, the employees and people, BIM.

Managers that require access or full access have that access as well, because it's important.

But it also has been agreed with.

Leadership and it has been communicated from the leadership down.

So I think that's what needs to.

Happen in these instances, is leadership has to be involved.

Interesting.

And so, Megan, when you run up against these sort of, no, you can't or you shouldn't.

Have you gone up.

Have you sort of gone up to the company leadership and sort of validated that it prevents you from access?

Yeah.

And I think the conversation is tricky from us being an outside consultant coming at them from the other side of an IT system that they're supposed to put their entire trust in.

Right.

And someone saying, this is an issue, and me outside consultants saying, I don't think it is.

There's.

There isn't a good argument there for me to make any headway with leadership as an outside consultant.

That is a very astute observation.

You probably come up against it.

That's.

Yeah, that's.

Boris, do you have anything to say?

Because, yeah, you're right.

I mean, you're sitting on the board of the company, Whatever your leadership, your.

It's telling you one thing, you've been with them for seven years, eight to 10 years, they've done you right.

And then here Liz comes in, the hot shot, you know, trying to give.

Me access to everything, and they're like, heck, no.

Yeah, I can see.

Can we craft some kind of approach here that we can end up with sort of recommendation for our viewers if they've stayed with us thus far?

I mean, it's difficult position to be in.

And we have been in a similar position too, when we're not kind of fully managing our customers, but working with internal IT as outside, quote, unquote, consultants.

And sometimes we, you know, we're not able to win those battles as we would say, as we want to do.

I always look at it from a perspective of like, you know, if this company has hired you as a consultant, right, they're looking for you to do certain things for them and they're expecting.

Right, their C volume and you doing that work then.

And it's easier said than done.

Right.

Like in the ideal world.

In the ideal world, they will work with you to try and figure out what will make your Work most efficient.

Right.

And what will give you the most ability to.

So you can do the work quicker and maybe cheaper for them.

Right.

That's kind of the idea.

But I understand.

Look, egos are at play.

Things happen.

It's a difficult situation.

I don't know if I have like a real answer here.

I have one last approach that I've tried and I guess that this is what I'm trying to do is come up with these like the email versus like cloud sharing scenarios.

And I have another analogy where it's, you know, your internal file server.

We specifically at Aurora BIM do not access, we do not vpn, we do not touch file servers, internal file servers, even though most of the companies are set up for remote employees and they would allow us access through their IT department in some capacity.

But we don't touch that.

So we do everything on Autodesk Construction Cloud because we hold it up as this like safer environment to work in.

As you said, we're working with many clients.

Who knows if we download a file and upload it to their system and in fact unknowingly their files.

I think these cloud systems are much more secure, at least from my understanding of them, in battling that kind of like virus or infection that can come in and hurt a company.

The other analogy that we make too with our clients when we set them up on ICC docs is that this is essentially your new file server.

It is more secure, it has a way easier way of sharing data.

It's cheaper.

It comes with your Autodesk subscription that you're already paying for and it's unlimited storage.

Files can never be deleted.

They have these activity logs.

You have the ability to coordinate with other companies up all up in this cloud based platform that was created specifically to do this so that teams could collaborate with each other and that the old way of sharing files where you're uploading and downloading via email or Dropbox links or anything like that is way less secure than this new system.

And we actually, when, because they're using our clients are starting to use these systems in the industry as their file servers because it's cheaper storage.

That's where you need to keep your models anyways.

The viewer is you can, it's basically I call it Dropbox with like a really great viewer.

You can look at any type of file that we use in the construction industry, almost any type, you can view it up there versus just seeing it as a file.

And in using this system as your new server we actually say that everyone in the Company should have administrative access just like they did to the server.

Because if you want to add yourself to a project to look at project files as like a reference, you should be able to do that.

You shouldn't be locking this data away from people in your company.

If you don't trust the people in your company, you've got bigger problems.

Is that.

I'm not going to say it like that, but does that, does that make sense and is that a valid argument to also bring to the table?

That is not a valid argument.

Okay, it is not a good argument.

It may be valid argument, but it's not.

I'll tell you why.

Well, so none of the people are.

Admins on their local files, but they can add.

So the way Construction Cloud works is you cannot access a project unless someone adds you.

That is a project admin.

Or if you're an account administrator, you can add yourself to projects.

And that's the reason we have them be account admins.

Yeah, but I think.

So what you said is that you.

Wanted all the users to be admins.

So I want to make sure that you either made a mistake when you.

Said that or is that.

That's true.

Because on your own Autodesk Construction Cloud, the worst that can happen is that they're in there doing something on a file which is tracked and documented, and they blow it up.

They delete it.

They do something.

You can always get that file back.

Always.

You can always track who did that and when it happened.

Yeah.

So that like the things that you can actually get in and mess up are way less.

Way less, I don't know, like catastrophic than what could happen if someone was on a file server and like accidentally pull the file folder into another folder.

Then you guys have to go find it where they delete a file and then you guys have to go find it and they don't realize they deleted it until a month later.

And then.

Oh, no.

Can you go get it?

No.

So now that you explain it, it's.

All different than it originally sound.

But still, if somebody goes and just randomly deletes a bunch of data, it still takes time to restore it and.

Be try to identify who that person.

Was on a server and in a construction environment too.

Somebody needs to go and do that work.

Isn't it easier just to restrict people.

And allow them to do that?

No, because on Autodesk Construction Cloud, it literally is always in this little button that has a trash can on it.

Because you just say restore and seconds later it comes back.

Sure.

It stays.

That's and you can see who did it immediately.

If you.

So if somebody notices it and somebody.

Else needs to go in and do that.

What I'm saying is, and I'm not arguing the point that it's just as easy, what I'm saying is if I don't give anybody the ability to delete.

Any of my files, then none of the files will ever get deleted.

So that's how that other side argument works.

But the problem is you can delete file even if you're just a project member with minimal access.

True.

So they aren't even locking that down.

That's also fair.

So I guess maybe we should discuss what does being a pro, being an account administrator and project administrator give you in terms of.

I think this is great.

This is the root of it that you guys don't.

The it doesn't understand.

So let's talk about it.

Yeah.

So Liz, maybe you can help me here too.

So like, when you are an account admin on ACC Docs, maybe Liz, you could share your screen to show what it is.

The primary thing that you have control over is how your, your ACC Docs system functions.

So you've got, you've got these libraries that you use.

And this is all integrated with revit and the software that we are specialized in using.

Right.

So all, Everything is set up so that we can coordinate with clients.

We have libraries up there.

So this is.

Yeah, so we have account admin access.

So we, we have access to settings, but just for Autodesk Construction Cloud.

So like really what you could.

There isn't really anything in my mind other than like someone coming in here and changing the name of a project or archiving or adding the wrong person.

We're adding the wrong person.

But you see it and it's there and you can track it, but there really isn't anything that they can destroy.

It's all.

You actually cannot delete anything off of Otis Construction Cloud ever.

So, and then project.

And then the other big thing with account admin access is that you can help set up templates, which means that you can start a project project, which most people need to do.

Start project, type in the, like, information about that project, and set up the file structure, the folder structure that's within that.

So you have access to make a template that you like.

And this is just like a file server.

Anyone can create a folder.

Anyone can, you know, kind of.

It's, it's training your employees and you need to have training around this.

I'm not saying you just let anyone in here, but it's just the level of training.

It's training them on another software that they need to be able to navigate and use.

And there's not really anything that they can do up here that I can.

That I have ever experienced that puts the company at a security risk other than inviting people that shouldn't be part of that project or that system, because then they can see the data, but you can see that they saw the data and you can boot them out.

So account Admin really isn't this, like, crazy thing.

I think that, like, it is concerned about, like, when you hear about administrative concerns or when you're talking about that, like, what is.

What's the fear?

I think I should rename Admin.

I should just take away admin from the title.

They should.

That's the scary part, I think needs a rebranding.

Well, that's part of it.

I think the other part still comes down to control.

Right?

Control from standpoint of there's certain.

Yeah, we want to live in that ideal world where we trust all of our employees to just go in and follow an SOP and create something.

If you have an sop, start with.

And go ahead and let's just talk about, hey, create a project.

What does that entail?

How do we name it?

What, you know, what template folders need to be in there, what things go into creating a project.

So technically, you cannot just have anybody who hasn't created a project before go in and create a project unless we have specific documentation around what it takes.

And the person has been pinned on it.

And do you think it should be controlling that or do you think the project manager, slash BIM manager, should be controlling that?

I don't think it should be controlling that.

Okay, great.

I think this is part of the quote, unquote, technical design team, right?

Or design technology team, if there is one.

Or, you know, you guys would be a part of that, right?

Like, usually the firms that are larger in size that usually we work with or you guys work with have at least a person that is kind of that one responsible person, hopefully.

So they should be in control of understanding who else should be having access.

Or if there's a technology committee, like.

That committee should be having the guidelines on who has access and who creates projects and how that.

I mean, it's like a file server, right?

Like you could create a folder on there.

Anybody could, but they just know they're not supposed to, right?

Like they're not supposed to create their own project folder.

The company has a system in place for that.

I argue that on various file servers.

That we manage, there's various levels of access.

Like some or you can like not allow people to create projects.

Projects.

Right.

So people can view, they can delete, but they cannot create folder.

So there's.

There's things that.

But usually, usually you're right.

If you have access to that folder.

You can move things around, delete things, the right things.

However, I think this goes back to our leadership discussion.

Right.

That judgment call.

If it's not coming from it, that.

Needs to come from somebody who is part of that design technology committee or role or you know, a partner in charge of design technology.

Right.

I.

Otherwise it will always be deferred to.

It and always most like erratic decision where maintaining control is more important than having the company.

Okay, let me.

So this is.

This is a lot more interesting than I thought it was going to be.

We are way out of time.

Hopefully we didn't run into other people's meetings here.

But.

But I think it's tb.

Tb.

Tbc.

To be continued.

In some ways I think we've gotten somewhere.

Let me try to summarize.

Megan, help me with this.

It's up to the leadership if they're involved.

If they're not, it needs to get a little bit more progressive and understand their architecture and engineering based clients and their needs.

So there needs to be an education element.

Hopefully this podcast will serve as one so you can kind of pop it towards the next person that gives you.

Gives you a problem.

And then maybe they'll sort of at least connect with Boris and I some thinking here but I.

What about this?

What about.

What about a document?

What about creating like a one pager, right, that has the why, what and how.

So why what the value is to create, to make.

What's the value for giving your BIM managers and tech team admin level access what it actually means?

Because again, I think the word admin scares the heck out of people.

So the why is why this is important and it should be a simple list of bullet points.

What are the risks?

Data loss.

Be.

Be open about that.

Data loss or unauthorized access.

Really those are the two.

Maybe you can put not even data loss.

Not even data loss.

Take it's unauthorized access.

You can argue that point only because.

Let me finish, let me finish guys.

I know you all so excited.

Next one is the how.

The next where you address it.

You got to be honest.

When you want somebody to look at your document and actually value it, you have to put the risks.

And the risks are data Loss.

Okay.

Unauthorized access.

Okay.

And malware.

Okay.

And potential hacking.

Right.

So if you put those out, the how of it is the mitigation mitigating them, then you can address one by one.

Again, very simply, what we just discussed actually puts a lot of fears to rest.

Right.

Because I.

So he's absolutely right.

So you need to put data loss out there because there will be argument.

Made for data loss.

Now you can turn that around and say, well, here's all the controls that are in place.

99.9% of the cases like there will.

Be no data loss.

Right.

Because we have this control.

We have this control to have this control.

But I can argue we see this with other cloud services because what is advertised is not always what is there.

So some will say we got unlimited versions.

Awesome.

But the file is deleted.

It's only available to be recovered for 30 days.

Nobody knew that.

Right?

So then somebody looks 31 days later, the file's missing and it's no longer.

In the recycled B.

It's gone.

So like those things do happen and.

We'Ve seen those happen.

That can contribute to that a lot.

So what we have to say is, look, there's versioning, there's ability to recover from recycled.

We need exactly how long.

You know, the Autodesk construction cloud says it is.

They say forever, which was like a big, a big pinch point with lawyers who were like, delete your data after seven years because you can't.

So what?

So there's a difference between whether it stays on the recycled bin and you can recover it or it's taken out of this cloud forever, but you need to open a support case, which takes forever.

I work with Autodesk support, don't love.

Autodesk support, but somebody needs that file right now.

So that still is a problem.

Even though it can be recovered in.

Three days versus something you need in the following.

But none of that is true for Autodesk construction cloud.

I just want to make sure people know that.

All right, so I don't.

I think that document should have those specific.

Explain.

Yeah.

Documentation and directly.

Like directly quotes from Autodesk from their website and says it will stay in.

The recycle bin forever until.

So I'm going to try to wrap up again.

This should be a follow up episode on this because this seems to be a longer discussion to be had here and maybe a better solution as an outcome.

But as your Boris pointed out, we are all skeptical of what our cloud providers are going to do if my icloud says it's Going to keep my pictures forever.

You know, I believe it because I have to, but I don't really.

I don't think that something happens, somebody hacks somebody, you know, they have a data loss, they're going to send you a.

A very nice letter saying oh, you get a free security monitoring for a year because all your.

She got freaking hacked and you lost your Social Security number, your bank account numbers.

You look.

So there's as much as they can say what they have.

I am like okay, it's.

Maybe so.

But that same argument can be made for Gmail.

Absolutely, absolutely.

Right.

Like I don't trust Gmail either.

Right.

Like I don't trust Microsoft either.

Even though we run all our business.

With Microsoft, we don't trust anyone.

Oris and I communicate via letters and we have pigeons very fast.

No, we always like there is I guess we are in where we deal with risk all the time.

You have to always assume that there's some risk involved.

And it's not always no, there's no risk.

We'll keep your data unlimited for forever.

Right?

If they did that, they will be paying a lot of money and they're hosting on AWS because anytime AWS cloud.

Goes down, your autodesk goes down too.

They will be paying a lot of money for those petabytes of data that.

They'Re storing there if they never deleted it.

So they're hung it something has and.

Then there's like the side of the servers where like there could be a building fire and then what.

I'm not.

Arguing that their product is not superior to service servers.

I wish all of our clients like.

I mean there's some caveats there, right?

Like with work sharing and other things for especially like Adobe products.

But I'm not arguing that the product.

Is not superior than the file server.

The workloads work.

What I'm saying is we can, we cannot always take it at their word.

Now if it's our own file server, we control that.

So we know what our backup plan is.

We know how far we can restore throughout grade backups and we keep the data forever.

We know we'll be able to get.

Unless there's a fire.

Yeah, well, so you can replicate backups are not.

We have backup in a warehouse which also maybe has a fire or an.

Earthquake at the same time we replicate.

You know, there's a flood.

I see Guy Say this to me once.

He's like, my analogy is, it's like driving down the road in your car with a seat belt on and a helmet on.

Like, it's.

You don't need the helmet, you just assume the risk.

You got your seatbelt on and you just carry on.

That's all you can do.

Because your helmet.

Yes.

And probably that's how most it.

People look at the world is because we've.

We've dealt with.

So we have to assume all this risk.

Right.

Because we never know when something can happen.

And usually the only reason people would call us is not to say, hey, have a great day.

They would call us because they have a problem.

Right?

So we are always dealing with the problem at all times.

And I think that's how it.

People position to look at life, really.

They will call us and say, my file got deleted.

They'll restore it.

And you're like, well, we only had 30 days worth of backups.

Because you guys agreed that we only.

Keep in 30 days worth of backup.

No, but I need a file restored from a year ago.

Right.

So, like, those type of things we.

Always have to deal with and think about.

And I think that's what drives a lot of this aversion to risk, let's say.

And it's a good thing to have in our world.

Right.

Because if everything's like, we're doing our job, if everything is quiet and nobody.

Ever talks to us.

Yeah.

And we appreciate you.

We need you.

Thank you.

All right, third attempt.

I don't think there's a single listener left.

I mean, if.

If you are, please announce yourself.

Send us an email, alex.olsonetarchit.com and I'll send you a 25 gift card, I promise.

The first email that says, hey, I'm here.

Minute 50 plus listening.

I sent you an email.

Preach it.

Come on.

Come on now.

$25 gift card.

Personally, I will send that to you.

If person sends me an email with the subject line, I'm still here.

And yeah, I don't.

I think I'll be waiting for that email for a long time.

So, anyway, third attempt to wrap.

This was excellent.

Very good discussion.

I think we should go back to the topic.

Yeah.

But there's no clear right answer.

I think Megan's got a really good point.

You got it.

You gotta work.

You gotta get work done.

How else are you gonna get work done if you go to Ox and then we.

Boris got a point.

Hey, while you're getting your work done, you know, let's not burn down the barn.

So we're gonna keep going to keep this friction going.

It's hopefully, I mean there yeah, hopefully.

There is a lot less going forward.

And I again with a lot of.

So I agree with a lot of what Megan says.

I think I also I understand the other side and I'm trying to think.

In this scenario I'm playing more devil's.

Advocate where I But that's important too, right?

Because we need to understand what both sides are going to argue.

Well and I think this is a plug for AEC specific IT professionals like yourselves because we really appreciate getting into firms and working with people like you who understand the intricacies of Autodesk because it's a beast on its own to manage on the IT side outside of Autodesk Docs, we need your help.

Awesome.

That is if you are the last architect slash engineer left on this podcast and still listening to us and you need IT support.

What are the odds?

Nicole, go to getarchite.com or email me or Boris.

We're easily accessible through the Arc IT website.

Just click Contact Us or the aforementioned email address for your 25 gift card.

If you happen to be also prospect and a person to get to gift card, that'd be awesome.

But in any event, this is it guys.

I'm wrapping it up.

Have a fantastic day.

Thank you very much for listening and thank you very much for participating.

Everyone here and all of you who are listening.

We'll see you all next time.

Thank you.

Thank you.

Thank you.

Awesome.

Thank you.