IT Departments Are A Security Risk

stlhawkeye writes "An article at Information Week asks the question - is your IT department a security risk? The thesis of the article is that rank-and-file employees will tend to engage in dangerous/insecure/irresponsible computing and internet behavior if they know that there's an IT department to clean up the mess. 'That confidence,' says the article,'leads workers to do risky, even stupid, things at work, such as opening questionable e-mail messages or clicking on unknown Web site links.' Employee education and training doesn't help, either: '[S]ome workers slough off responsibility for even knowing about threats. Workers in larger companies don't worry about being educated. Big company employees just don't see security as their responsibility.'"

Comments

Different Interpretation

[fembots]

I read the summary as if IT Department itself is a security risk, because they have the highest level of access to everything on the network, and one wee mistake, such as failure to lock an unattended admin pc, inappropriate disposal of a backup tape, a misconfigured spam filter and whatnot can easily knock out the company for at least a few hours or cause great harms.

Having said that, it's also true that computer users protected by a competent IT Department do get spoiled and when they're out with a laptop, they can easily be infected on a dial-up. It's like kids with over-protective parents will likely to get hurt/scammed/killed more easily when they're alone.

This naturally leads to the most important discussion in the article, i.e. user education. And I believe in order to really get the message through, IT Department needs to have some sort of security drill (like fire drill, annoying but everybody gets the idea after several attempts).

For example, if a user clicked on an obvious suspicious link (spoofed by yours truly IT Department of course), his computer will be taken away for "maintenance" for a week, and he'll be assigned to another area of the office with a crappy machine. This way, not only does he suffer from his action, others will know why he is working at the "Concentration Cubicle".

Re:Different Interpretation

[NeoSkandranon]

Good punishment idea, but I'm not sure it'll catch on... What company would go for the idea of willfully lowering productivity?

Re:Different Interpretation

[wwest4]

> I read the summary as if IT Department itself is a security risk

Your instincts are right. The article underrepresents this idea. An unchecked IT staff is the single greatest security risk a company typically has. Admins who don't check backups, who are not beholden to SLAs, who see themselves as excepted from policy, who are not externally required to maintain security, or who make cavalier changes are much worse than all but the most malevolent/careless users.

User education is a good idea, but it's still largely up to IT. That's our job, because we are in the best position to do it. If we don't at the very least prominently publish a policy and make it accessible (to a reasonable degree), we can't very well expect the user to intuit and follow it.

The whole concentration cubicle/punitive response idea is just stupid (it's unethical and it wouldn't work), but your other points are good.

Re:Different Interpretation

[easttuth]

I, too, had a different thought about the content of this article when I read the title. My supervisor and myself just had a discussion about the failings of large and cumbersome IT deparments. As with most large and cumbersome organizations, they tend to perpetuate problems to maximize IT department resource requirements. For instance, when one of our internal applications gains a new feature, but consequently develops about 15 new bugs, we have to issue a ticket for correction not for the feature that is causing the problem, not even for each individual problem that has been created by the adding of said feature, but for every single instance of any bug instancing its self on any account in the entire system. Why? Because they want to string out actually hunting down the adapters that are causing issues in the first place, and instead create a patchwork of fixes that eventually have to be refixed. It justifies their bloated existence.

Re:Different Interpretation

[Anonymous Coward]

The IT department is a risk, the same as the accounting department, or the managers, or any other department is a risk. In order to accomplish anything, people have to have enough authority to do their job, and that authority comes with a risk. That's why you hire competant professionals and you put procedures in place. That's also why you need to enforce procedures, as much as everyone hates it. Remember the accountant that bought way too much stock?

It gets worse, though. Try working at a company who doesn't have a competant IT manager, but who won't give any authority to the competant IT people, because they are afraid of what they would do with it. You get a situation where if the IT people really don't have ethics (as the management seems to think), then they can get through the security easily because it isn't done right (as can anyone else at the company). You have to take some calculated risks, and they get harder in areas where you can't evaluate the risks personally.

On the other side of things, people do not do any better about protecting their computer if they don't have IT protecting them. Most people don't know any more about computer security than they do about fruitfly morphology, so they can't try harder when they don't have a safety net. Maybe the IT department should do some 'Internet Safety' training as part of their job, but not necessarily as harshly as you suggest.

Re:Different Interpretation

[XunilOS]

I agree with the concept of "punishing" repeat offenders, but I doubt you'll get much support from department managers with your idea of issuing them a crappy machine. I would imagine you'd get more traction with department managers by informing them their employee has repeatedly subjected the company's sensitive data to risk, and should future incidents occur, this would be grounds for disciplinary action (up to and including termination). This of course depends on your company having established security policies - which are a pain in the neck to write, but worth it in the long run.

I've worked at companies where this has been effective, both for employees who were willfully irresponsible (repeatedly installing weatherbug, etc.), and those who were so unskilled as to be a complete nuisance to IT (calling every day with a question like "How do I print from Word again?").

Re:Different Interpretation

[techno-vampire]

This way, not only does he suffer from his action, others will know why he is working at the "Concentration Cubicle."

I had a diffrent idea. Each project, each department, each work group has a budget. If the costs of having IT clean up a mess that shouldn't have happened come out of that budget, people will get more carefull, fast. If they don't, then the ones causing the loss of funds will get marked down on their reviews, and possibly fired for their lack of cautiion and the problem goes away when they do.

Re:Different Interpretation

[Danger Stevens]

For example, if a user clicked on an obvious suspicious link (spoofed by yours truly IT Department of course), his computer will be taken away for "maintenance" for a week, and he'll be assigned to another area of the office with a crappy machine. This way, not only does he suffer from his action, others will know why he is working at the "Concentration Cubicle".

Yeah, nothing helps employee morale quite like feeling as though their in a Dilbert comic strip.

Can you imagine having a friend come home from work and describing to you that they've been put at the 'Concentration Cubicle' for a week and their productivity is going to nearly disappear just because management felt they deserved being treated like a 3-year-old?

I'd quit if that happened to me. Of course, I run firefox on Linux, but it'd still piss me off.

Re:Different Interpretation

[NDPTAL85]

Wow. With your comment you sum up the real problem with IT depts. You assume you are even on the same level of importance with those you serve, let alone superior.

You are not there to "grant" the privledge of computing. You are there to "support" it. The people who do the actual work of the company are the ones who bring the money in. So if they want to open risky attachments, then fine. Harden your network to brace for that and be done with the issue.

Re:Different Interpretation

[dotgain]

While you're going to get modslapped for that as I have in the past, I'm putting my karma on the line to say I agree with you, and until most SysAdmins get this into their skull, IT folk will continue to be snubbed.

At the moment I work at a fisheries in the country. I'm the only SA within 50 miles of here. I can't afford to be stuck up like I used to be, because I'd be the only one here that thinks I'm more important. I understand I'm not, and it makes people much easier to get along with.

Re:Different Interpretation

[Pharmboy]

Personally, I think you have to have a little more respect for the IT dept. that to just say they are there to "support" IT.

They are there to support IT as it applies to work, but not to remove spyware and viruses because employees visit porn or other inappropriate sites. Over 90% of the problems we have with computers is related to activities that are within acceptable policies, such as roaming around on the wrong kinds of sites. One of the problems is that employees see their computer as "their computer", and not a tool for their use, but owned by the company.

A perfect example: I get many complaints from employees that they do not have speakers on their computers. There is NO task we do that requires sound. The only possible use they could have for speakers is unauthorized uses of the computers.

I do everything I can to ignore other uses as long as it does not cause problems. Go ahead, read news, research stocks, as long as you are smart enough to avoid problem sites. Getting 1000 spam mails a day? Likely using company email for personal reasons, and I shouldn't have to support that.

Actions that have no consequences are often repeated. The only cure is accountability for employees who use their computers for non-business related activity.

Re:Different Interpretation

[QuestorTapes]

> You are not there to "grant" the privledge of computing. You are there to "support" it.

Good point, although you stated it more bluntly than I would have.

> The people who do the actual work of the company are the ones who bring the money in.

True, although sometimes this is the IT staff.

> So if they want to open risky attachments, then fine. Harden your network to brace for that and be done with the issue.

The management at most firms I know would not agree with this. It's not enough to harden the network. Users who open risky attachments can lose data from their local drives which is difficult or impossible to replace. Even if the network prevents infection, a great deal of damage can still be done.

I feel that IT support and IT security decision making need to be separate functions. Support people are not the right ones to restrict the actions of the staff, but sometimes it is necessary to do so. And sometimes the people who need to be restricted are the IT support staff.

Re:Different Interpretation

[BVis]

What company would go for the idea of willfully lowering productivity?

What company would stand for allowing their employees to waste company time and resources on Weatherbug and porn and warez?

Yes, it would negatively impact productivity in the short term, but in the long term, one of two things would happen: Either the "repeat offenders" would change their behavior, or their productivity would be reduced to the point where they became redundant.

Of course, this is in the fantasy world where IT workers are actually allowed to do their jobs (keeping the computers running smoothly and enhancing profitability for the company by improving efficiency), and where anyone in management can see beyond this quarter.

Re:Different Interpretation

[NDPTAL85]

Nightly backups of user machines or even storing certain files on servers would solve the problem of potential loss of data on local drives.

Re:Different Interpretation

[drdewm]

Try to do your "real work" without us. This is why there is such a back lash agaisnt IT people from the non-ITs: you know you can't work without us anymore. There was a day when IT wasn't necessary but these days try to sell something without and EDI infrastructure or without email or powerpoint presentations etc. You hate us because you are threatened by us. The old boys club is threatened by those that are beyond its understanding and control. The world has changed either get technical or get out of the way. I gotta go blog something.. I'm out!

Re:Different Interpretation

[NDPTAL85]

Or get your IT outsourced and fire the arrogant inhouse IT.

Simple is as simple does.

Re:Different Interpretation

[TaliesinWI]

Taking that analogy too far would be like saying the sales department is there to make the money that the accounting department embezzles, or the custodial staff is there to clean up the ashes after the secretarial pool sets random fires.

Yes, it sounds silly, but so does making IT out to be subservient slaves to the whims of every other employee in the company. You're ALL there to make money for the company - all effort is supposed to go towards that goal.

Re:Different Interpretation

[pintomp3]

i have no problem with your statatement, as long as the company realizes that they must spend more on IT to allow for "do as i please" computing. otherwise, support means managing privileges to strike an appropriate balance. what is appropriate? depends on the environment and setup. btw, sometimes the IT group is the one bringing in the money.

Re:Different Interpretation

[mrbooze]

The problem I see is that employees don't get "punished" for inappropriate security behavior as they should.

If I punch someone in the office, I would almost certainly be fired and if not at the very least it would go on my record and be reflected in my review.

Likewise, if I consistently showed up late, frequently lost my security badge, etc etc, all these things I would be called in the carpet for. They would be tracked and reported and come review time they would be remembered.

But people can infect the entire corporate network with a new virus, and not only does that not go in their record, in my experience even attempting to identify the person who compromised the network is discouraged.

Bottom line, people who do not execute company policies properly, and that includes security behaviors, should have such violations tracked and noted, just like when they violate other established policies of their job.

In my experience, this never happens, and I believe it's why so many people just think "Bah, IT will fix it".

Re:Different Interpretation

[Pingla]

For example, if a user clicked on an obvious suspicious link (spoofed by yours truly IT Department of course), his computer will be taken away for "maintenance" for a week, and he'll be assigned to another area of the office with a crappy machine. This way, not only does he suffer from his action, others will know why he is working at the "Concentration Cubicle".

Good idea, that will certainly boost productivity when employees must wait for 30 mins to get Outlook working.
Most people are in fact not 'computer people', they are simple users and the IT departments simply have to realize that.

Re:Different Interpretation

[muzzmac]

No it won't. It will give you a nice warm false sense of security though.

I hope you enjoy it. And your joke emails with dancing half naked chicks. After all, when people come after you for damaging the environment with stupid software, you can always blame IT for allowing you to see it in the first place. ;-)

Re:Different Interpretation

[FLEB]

I'd quit if that happened to me.

Which could be a positive thing, depending on how disruptive and destructive this hypothetical "you" was.

Re:Different Interpretation

[j-turkey]

...And I believe in order to really get the message through, IT Department needs to have some sort of security drill (like fire drill, annoying but everybody gets the idea after several attempts)....For example, if a user clicked on an obvious suspicious link (spoofed by yours truly IT Department of course), his computer will be taken away for "maintenance" for a week, and he'll be assigned to another area of the office with a crappy machine. This way, not only does he suffer from his action, others will know why he is working at the "Concentration Cubicle".

It is not IT's job to discipline users. Doing so in this manner will only serve to make a user's job more difficult, and result in decreased productivity. Such an result will lose the company money, and the IT group will ultimately not be doing their job. Remember that an IT group's job is to serve the users, and increase their productivity by providing systems solutions to handle data and communications. The day-to-day support role should only be a small part of this. Further, when users are constantly doing dumb things, it represents a failure on behalf of the IT department. The IT group should educate the users where possible, and when education is not possible, the users should be protected from themselves. This can be accomplished by techniques similar to what the article criticizes; firewalls, anti-virus, and a restrictive set of permissions...and a helpful IT group to put out fires.

I understand the rationale that a single user can disrupt the entire company's data services. Of course this can be far more costly than a single user losing their computer for a week and sitting in the penalty box. However, in the case of your example, the ends don't justify the means.

In the case you mentioned, what is needed beforehand is a solid set of user policies, which all users must read and sign. When a user consistently violates those policies, that user's supervisor and/or the HR group should be contaced and the user disciplined by those groups. Internal audits (or security drills), can be a very helpful tool in identiying potential problem-users. Once identified, the users need to be warned and educated. Upon further violation of policy, the user is reported to the appropriate personnel.

While I agree with most of your post, I feel that there is a better way to manage problem users.

Re:Different Interpretation

[Anonymous Coward]

Now this is something we did (almost) here at our University...

a few years back we mailed around to eveyone in the Science & Engineering department a file called "funny.doc.exe" from a hotmail account set up purely for the purpose.

All the file did was record back to us who'd run it. We then let everyone know what had happened (but we didn't release the results of those who had fallen for it because we still had some sence of self preservation left).

Let me tell you - this went over *very* badly.

Still, it makes a funny story a few years down the track...

Re:Different Interpretation

[NateTech]

I've worked in IT quite a long time, and I daily see scenarios where the non-computerized version of whatever task I'm doing was much more efficient and intelligent than the computerized "modern" version.

Case in point - labeling a package for shipping. If you can learn to print letters reasonably, this task takes about 10 seconds.

I currently have to dig ten web pages deep into a PeopleSoft application at my employer to even create a mailing label for an RMA, and the application doesn't even have the correct address for my customer's locations in it. I have to click "Override" and put in the shipping address manually because the customer has separate billing and shipping addresses.

Then since there's been no attempt at integration to our separate trouble ticketing system, I have to enter all that information again into another database.

Ultimately, it takes about 1/2 hour to create an RMA in our computerized systems.

In contrast, it takes about 10 seconds to write a mailing label and another 3 minutes to walk to the inventory cage, check off an inventory sheet by hand when removing product and hand it to the guy who packages stuff... if we could do that.

At some divisions of the company, I'm sure automated database driven ordering for just-in-time arrival of parts and things is helpful, but our division makes things that have to be put together long in advance and kept in stock. There's virtually no benefit to real-time asset tracking - no manager above our division level is looking at real-time numbers anyway. They're lucky if they look at the inventory numbers monthly. Thus, a monthly typed-up report in a spreadsheet would be just as effective as a multi-hundred-thousand dollar real-time system that wastes employees time to the tune of about a 10:1 ratio against a pen and company logo mailing label sticker.

Seriously, the world needs to look more carefully at some of our computerized processes and see if they're really as good as we think they are.

There are cases where a blank piece of paper, a pen, and a filing cabinet with a decent organization scheme would be faster -- but we want "computerized" because it's supposedly better.

Re:Different Interpretation

[Anonymous Coward]

Outsourced IT, ha! Lemme know how that works out... I've seen it in the past and it's absolutely hillarious. Companies think they're getting an amazing deal because it's cheaper. Then they find out why...

IT is just as necessary as HR, Finance, Management, etc. People like you are just as arrogant as the "arrogant inhouse IT" in thinking that you're above it as well.

Re:Different Interpretation

[Anonymous Coward]

So you think IT is beneath every other dept? Ok, who's got the superior-than-thou attitude now? Take yourself down a notch there, fella. So who brings in the money? Is it marketing? It is support? Is it management? Guess what? Almost every department is there to support another. That's how a company works. But I wouldn't expect you to understand that with the ego you have.

Sometimes, IT *IS* the company and that's what brings the money in.

You sound like a clueless user who got bitch-slapped and is trying to defend your carefree attitude. "I should be able to open anything I want! I should not be held accountable for my actions! It's the IT department's fault, not MINE!!" Christ, take some responsibility for a change.

Re:Different Interpretation

[surprise_audit]

One things "computerised" ought (yeah, I know...) to get you is trackability. In your RMA situation, if management wants to they should be able to create reports that show which supplier gets the most returns, which could lead to a change of suppliers. Or is there a seasonal-related variation is the numbers, or whatever.

OK, so that may not be a good example, but I'm sure there are others. If the data is "computerised", it should be easier to sort and sift and graph than if it's on paper.

And it sounds like your Peoplesoft app sucks - it ought to be able to handle multiple addresses and you shouldn't have to dig through 10 pages to get there.

Re:Different Interpretation

[Anonymous Coward]

Can you imagine having a friend come home from work and describing to you that they've been put at the 'Concentration Cubicle' for a week and their productivity is going to nearly disappear just because management felt they deserved being treated like a 3-year-old?

Yes. I'd say to them "Well, what did you do to annoy your manager to make them do that?" and then they'd get to tell me how utterly fucking stupid they'd been. Then I'd laugh at them.

I'd quit if that happened to me.

Good. It'd be employee natural selection. The weakest fuck themselves and then quit or get fired. It would only make the company stronger.

Re:Different Interpretation

[Alioth]

In supporting computing, you have to make sure the computing environment is going to work for a company. This means the IT department DOES need to implement some kind of control - allowing everyone to download and install anything they like is NOT supporting computing, it'll end up destroying productivity (through the machines getting pwned). To effectively support business computing needs, you also have to inject some realism into the sometimes bizarre requests of staff. Yes - you *must* accomodate them in furthering the business through their computing assets - but that is NOT done by just letting anything go.

I found a book on the mezzanine level just outside our server room the other day.

"Businessman's Guide to Microcomputers" - by Deloitte Haskins + Sells (an accountancy firm). This book was printed in 1984. First edition 1982. It says this at the end in the section "Common first-time buyer pitfalls":

"We've got a lot of problems, but we're getting a computer"
This buyer is asking for trouble...there is a new "old adage": "Don't computerise a mess...clean it up first". It is important to understand that a computer can't help you to do things you don't understand, and it won't make decisions for you. All it does is process a lot of information very quickly...exactly as it is told to do it. To be of any real use, a computer requires a disciplined approach and an organized mind.

This lesson from 21 years ago *still hasn't been learned* in many quarters (even some IT departments don't appear to understand this). Allow users of the corporate network do whatever they want with liberal abandon, and...well...the entire business pays the consequences later.

Re:Different Interpretation

[dswan69]

You can't blame the employees for just not caring. In large companies IT departments are the computer overlords who will not even allow users to install the own OS or software, or fix something when it goes wrong. Oh no, that's ITs job. If they're babying everyone like that it is to be expected that users will totally abdicate all responsibility.

Some people need help setting up the machine, others don't.

In general large companies seem to treat everyone like they're an idiot and unimportant so why should their employees care about the company?

"his computer will be taken away for "maintenance" for a week"

Possibly illegal in most civilised countries and guaranteed to simply hurt the company not the employee.

"others will know why he is working at the "Concentration Cubicle""

But they'll have no reason to care.

Re:Different Interpretation

[QuestorTapes]

> Nightly backups of user machines or even storing certain files on servers would solve the problem of
> potential loss of data on local drives.

In practice, every IT department I have seen that was certain that they were taking care of this was wrong. Senior staff with the clout to do so had Zip drives with all their data on it. They used non-approved storage locations that weren't backed up. They lied about moving the files to network drives. IT staff lied about verifying the backups, or created new share points for users that weren't part of the backup routine.

"It ain't the things I don't know that get me in trouble; it's the things I do know, that just ain't so."

Re:Different Interpretation

[servo335]

I know the feeling. If i was allowed to run things the way i wanted there would be less spyware to deal with on my network. HR thinks I.T. is expendable not a resouce.

Re:Different Interpretation

[Anonymous Coward]

You run Firefox on Linux, so corporate-types probably already treat you like a 3-year-old. I mean, c'mon! You can't justify corporate bureaucrats' jobs without Powerpoint!

Re:Different Interpretation

[adamplas]

Soooooooooooo, part of me wonders if you've ever worked in IT, and than part of me sighs and says "no"

I really don't understand your argument on not allowing a user to set up his own OS and/or software. Will this user be responsible for supporting this? I'm pretty sure my response would be "Oh, you installed that nonstandard piece of software/hardware that I am not intimately familiar with? Sorry for your luck"

Standardization is important because it makes supporting things easier. Not trying to cramp a user's style, but make it easier to support.

"his computer will be taken away for "maintenance" for a week" Possibly illegal in most civilised countries

I'm sure, since you made the comment, that you have some basis for this? Last time I took a user's machine away for repairs, a SWAT team didn't bust through the windows in my office and hold me at gunpoint, but I'm sure you'll refute this.

I worked at a university once where the users were complaining of the lack of admin rights they had. Our solution was to grant admin rights to those who wanted it, but at the point they signed the form to hand over those rights we (the IT department) wouldn't support them. And as soon as they had a problem big enough to force us to reimage the machine, admin rights were revoked.

Re:Different Interpretation

[NDPTAL85]

An annonymous user. How quaint.

Re:Different Interpretation

[mdielmann]

You are not there to "grant" the privledge of computing. You are there to "support" it.

The same applies to janitorial staff. But if you don't have the brains to throw your garbage in the trash or use the washroom when you have to take a shit, why should they have to clean it up? If you don't know basic hygeine for the environment you work in, that's your problem, no one else's.

Re:Different Interpretation

[Anonymous Coward]

feeling as though their in a

"they're". What are you, three?

Re:Different Interpretation

[Crumplecorn]

Wow. With your comment you sum up the real problem with IT depts. You assume you are even on the same level of importance with those you serve, let alone superior.

You are not there to "grant" the privledge of computing. You are there to "support" it. The people who do the actual work of the company are the ones who bring the money in. So if they want to open risky attachments, then fine. Harden your network to brace for that and be done with the issue.

Wow. With your comment you sum up the real problem with users. You assume you are even on the same level of importance with those whose computers you use, let alone superior.

You are not there to "grant" the privilege of being cleaned up after. You are there to do what you are told. The people in departments like these are the ones who keep everything working so you can do your job. If they tell you you can't open risky attachments on their computers, then fine. Get back to work and be done with the issue.

Re:Different Interpretation

[tbannist]

That's smart, fire the arrogant guys who work for you, and hire the even more arrogant guys to work for you on contract.

Everything I've ever seen or heard has suggested that outsourcing IT departments is on the dumbest moves any company can make. You simply can not afford to make your company entirely dependent on another company.

Re:Different Interpretation

[huge]

Of course badly designed computer system isn't good for the job. It's exactly like comparing the badly desgined "pen-and-paper" system to stream-lined computer system.

Re:Different Interpretation

[NateTech]

Name one computer system you've used that didn't have at least some aspect of it "badly designed". I'm not trying to be a troll, I'm just an older IT worker with a healthy dose of realism injected into my thinking about how we use computers. The vast majority of computing systems are not "well designed".

Re:Different Interpretation

[cmarkn]

Or maybe, just maybe, they want to have a report of every instance of the problem so that they can do genuine troubleshooting of the problem, and verify that their fix, when they finally get around to implementing it, actually solves all the problems that you have reported. If they were to rely on your analysis of the problem and only correct the new feature that you claim is causing the problem, they would not be doing a their job.

You apparently simply assume that any new bugs that appear with a new feature are caused by that new feature. It is very possible that the new feature merely exposes a bug in a totally unrelated portion of the application that has never manifested until the new feature exposed it. If they rely on your simple approach and analysis, they will never find those bugs.

And I'll just bet that you would not consider it fixed if they didn't, even though they did exactly what you told them to.

Re:Different Interpretation

[NateTech]

We're single-sourced on a large number of our components, so they're not getting much value from that theoretical possibility you mention.

Yes, I agree with you it should be easier. But when it's NOT, when do companies ever learn to cut bait and start over? Most don't. They just add more people who are now cheaper than the computers that are supposed to be doing the work (because these large data systems seem to have no upper limit on price tag) to actually sort through the mess the computer created.

Yes, the PeopleSoft app does suck. Got any idea how to convince those in charge of that? That's the problem -- not the app. The lack of clue about how bad it really is in the field because the whole organization washes and pretties up the output (read: more people) to present to the big guys so much that they literally aren't allowed to see how badly it's broken.

And I'm not picking on my employer -- I've seen this same scenario play out many times and many organizations -- organization gets bigger, badly designed computerized processes get "projects" assigned to them by IT managers meaning the best for the organization, huge money follows after bad money into the pit of IT, and the middle-mangement and worker-bees clean messy data via poorly-designed and implemented user interfaces so they can provide the same good-looking smells-sweet reports to the higher-ups they did back when the app was tight, intelligent, and really helped a smaller organization grow.

The big key issue here is probably best summed up in a buzzword that the Xtreme Programming crowd coined or liked a lot: Refactoring.

Sometimes businesses need to refactor whether or not a computer really is the best tool for the job. It's rare to see any company actually do that, though.

Test cases for processes? Could this process cause horrible wastes of man-hours? Could this process be done better with a pen and a notepad?

It's not asked often enough. And good design isn't demanded enough, costs are king. Shareholders today only buy for the quarter, if that. Rental ownership of stocks is very bad for long-term growth of commerce.

Re:Different Interpretation

[pipingguy]

I wish I could mod you up to +5 for this and your previous post.

I've seen this happen where the only purpose seemed to be to make it as complicated as possible to order a new stapler. Of course, the employee "task force" charged with the responsibility to get the moronstrosity to work (and do all the legwork debugging/customization) was essentially an arm of the bigname software vendor (Oracle? I forget now). They really had no idea of how the software actually worked, it was someone else pulling the strings and the accountants and MBAs are to blame for this phenomenon.

High school janitors

[uits]

This is the same reasoning we used to use in high school when we'd drop our wrappers on the floor, spill soda and walk away...they get paid to clean it up, we're doing them a FAVOR by ensuring their job security.

Re:High school janitors

[Seumas]

I'm almost 30 and I still use that justification when I leave my shit in a Wendy's parking lot after lunch.

Re:High school janitors

[Neil Blender]

I'm almost 30 and I still use that justification when I leave my shit in a Wendy's parking lot after lunch.

You should be ashamed of yourself. Wendy's food is terrible.

Re:High school janitors

[Anonymous Coward]

Really? Is it difficult to drop your pants and pinch a loaf in the midafternoon sun? Don't people take offense to your flexing cheeks leaving a tightly wound coil?

Do you carry TP with you wherever you go?

Re:High school janitors

[camelmix]

Good point but when will we have to learn to clean up for ourselves?

Re:High school janitors

[spyder913]

You should be ashamed of yourself. Wendy's food is terrible.

Be fair, the chili is licking finger good!

Re:High school janitors

[mrchaotica]

You know, generally speaking fast-food employees don't pick up trash in the parking lot, unless it gets really bad. What you're actually doing is letting the next rain wash the litter into the nearest creek. In other words, you're a littering asshole.

If you must do something like that, at least leave the trash inside on your table so that the employees are certain to dispose of it properly.

Re:High school janitors

[boring, tired]

Either that or make a really bad mess. :)

Re:High school janitors

[sharkey]

Make sure you're careful! Public defecation will get you arrested most places.

Re:High school janitors

[thc69]

If the chili was available in a beanless version, I'd eat it constantly. As it stands, I tend to eat around the beans unless I'm extremely hungry -- but it's so much trouble I generally don't bother with the chili.

So what, I don't like beans. You got a problem with that?

I like Wendy's burgers and fries, though; some of the best drive-through fast food around. Tim Horton's beef stew & bread bowl is damn fine too.

ObSecurity: During the 2003-2004 Big Honkin Helmet Flamewar of rec.bicycles.*, in which I started a mere novice debater but grew to a Master Debater, I was notified (by a real smart fella named Frank Krygowski, who happens to disagree with me) that the effect described here is called Cognitive Dissonance. In that context, the issue was that people take risks while wearing a helmet that they wouldn't take without a helmet. However, the wiki for cognitive dissonance (at http://en.wikipedia.org/wiki/Cognitive_dissonance ) describes something that's not entirely unlike the effect in question.

Is Frank wrong, is the Wiki wrong, or am I not reading the Wiki well enough? After all, I am like, lazy and stuff.

Re:High school janitors

[E8086]

yes, that makes PERFECT sense
No, it's not ensuring their job security. The interaction with the end users/students is the least important part of their job. I don't know what else high school janitors have to do, maybe disinfect every classroom and fix broken things, there are probably enough routine daily tasks that ensure them keeping their job, no it doesn't include the occasional spilled soda and dropped candy bar. IT staff has to deal with maintaining everything the end users/common office minions doesn't even know exists. I'm sure your IT staff wouldn't like it when the testing of the latest piece of major software or windows patches or new thing that might make the standard drive image crash has to be put off because some fool of an intern in marketing got some virus and/or spyware while goofing off playing some flash game instead of doing whatever marketing does and they loose a day cleaning up after them. Don't confuse network operations(IT) with a HelpDesk or damage control. Even then their main reason for being there is to be experts on and help with the company's mission critical applications, not virus/spyware removal. What happens when someone finds a way to setup a rouge WAP? Depending on the size of the company it might take a while to find and that's possible to happen in companies with and without IT depts.

You could enforce a "the Internet is a privlage" policy. In most cases all your average employee needs is access to the corporate network for internal email and whatever resources they job requires and maybe a select few sites of affiliates/partners/clients which can be allowed by firewall. When a virus is traced back to someone, instead of giving them a slower machine and possibly lowering productivity cut off their Internet access, it will raise their productivity by removing the big distraction that is the Internet.

Re:High school janitors

[vasqzr]

I don't put my shopping cart in the corral when I leave the store. I just leave them out in the parking lot.

Re:High school janitors

[Anonymous Coward]

Chili is not a finger food.

Re:High school janitors

[JimBobJoe]

This is the same reasoning we used to use in high school when we'd drop our wrappers on the floor...

I went to a Montessori school that was too small to have a cafeteria...so we ate in the classrooms. We were taught it was our responsibility to clean up after we eat (the janitor did not come into the classroom to clean up after lunch.)

I believe the "let the janitor clean it up" attitude is a bad habit to inculcate at a young age.

Re:High school janitors

[Anonymous Coward]

You shit in public parking lots?

Re:High school janitors

[freewaybear]

A rouge WAP? I didn't know they came in colors.

Re:High school janitors

[Anonymous Coward]

If your so worried about humans fecal matter, then why are you leaving you're shit in the park'ing lot? What are you, some kind of masticist? fuck'ing prevert looser.

Re:High school janitors

[Anonymous Coward]

Flamebait?

Christ, sarcasm and satire are completely over the heads of about 98% of Slashdot.

IT Department itself the danger

[Sascha J.]

It was not rare in the past, that the IT guys themselves were the thread to the company.

Quite often they served the company's bandwith for warez exchange, as we all know... ;)

Ah yes,

[Anonymous Coward]

The thesis of the article is that rank-and-file employees will tend to engage in dangerous/insecure/irresponsible computing and internet behavior if they know that there's an IT department to clean up the mess.

I see... just as the Fire Department is a fire risk, hospitals increase reckless activity, having a police force causes crime, etc.

How brilliant the author of this article must be to draw such an unusual conclusion!

Re:Ah yes,

[ndansmith]

I see... just as the Fire Department is a fire risk . . .

Of course it is. What do you think firemen are supposed to do? Put out fires? It's pointless now that every house is fireproofed!

</Fahrenheit 451>

Re:Ah yes,

[Anonymous Coward]

Fire - Burns Hurt!
Hospital - Injuries
Police - Jail

Fucking up your computer - less work.

Re:Ah yes,

[An Onerous Coward]

I don't think the article is trying to show that a company with an IT department has worse security than a company without one (though the /. article seems to interpret it that way). I think that, in the same sense, you're right about hospitals, police, etc. Think how much more careful you would be about locking up your house if there was nobody to report robberies to, or how much less likely you'd be to take up bungee jumping knowing there isn't a hospital to fix you up.

Re:Ah yes,

[stlhawkeye]

I see... just as the Fire Department is a fire risk, hospitals increase reckless activity, having a police force causes crime, etc.

There's a flaw in your analogy. The fire department is there to save my ass when my own property is threatened. The police are there to deal with threats to my stuff or my person.

When I'm at work on the company's equipment, and the company is paying an entire IT department to maintain that equipment, do I give a shit about it? No, that's their JOB, and it's easily repaired like magic in a few short hours. So to hell with it.

The axiom at work here is that people are careless and irresponsible with other people's property, especially when that property comes with an entire team of people to keep it running no matter what stupid shit I do it.

There's a world of difference between getting a virus on my computer and throwing it down the stairs.

There's a world of difference also between cleaning toilet paper out of my yard and letting my house burn down.

The computer is not typically damaged beyond repair when Joe Q. Employee fucks it up through willful ignorance. If it was, he'd be asked to pay for it, especially if he broke it while in violation of company policy. This is nothing like me lightning candles and placing them next to my Classic Collection of Petroleum Samples from AcCross the Globe and then going to bed, thinking, "If anything goes wrong, the fire department will fix it!" They won't fix it, they'll put out the fire, but they won't rebuild my fucking house. The IT guy puts out fires and then fixes everything back to how it was before you broke it.

There is no accountability to the end user, and when people have neither ownership nor responsibility for something, they don't take care of it. They just don't, no matter how well-meaning they are.

Re:Ah yes,

[Anonymous Coward]

How about "Dumbasses are a security risk"

Re:Ah yes,

[Anonymous Coward]

I call incomplete analogy!

Fire Deparment is a fire risk...when flamethrowers are handed out to the average citizen who then believes they need to know nothing about fire safety since the Fire Deparment can handle all that stuff.

Hospital increase recless activity...if that reckless activity is failing to treat yourself after injury (first aid) or first signs of illness (Doctor, I have a cold!!! Treat me before they guy with a broken leg).

A police force causes crime...because, of course, without police there'd be nobody to enforce laws, which are the real cause of crime. No laws means no definition of crime.

Re:Ah yes,

[Deltaspectre]

You mean there were actually houses without fireproofing????

Re:Ah yes,

[isilrion]

I don't think many hospitals will "fix you up" if your bungee jumping session goes wrong :D

Solution in three easy steps:

[Anonymous Crowhead]

1. Get rid of IT department
2. Let company infrastructure rot
3. Rehire IT department

Sounds like a management decision to me.

Re:Solution in three easy steps:

[Anonymous Coward]

Where I work, we have one huge IT department. But alot of smaller departments opt to spend some of their money on IT guys who work only for them so they don't have to deal with the big IT nazi's. Of course the big IT dpt hates it.

I think if this is really the way to go. A small IT department that handles the major stuff as needed, and having an IT guy or two actually inside of each of the subdivisions of the company.

For us this has worked extremely well. The main IT department is not inundated with petty requests, and the department doesn't have to put in work orders for viruses that'll get filled like two weeks later (after they nix that department's network and internet access - true story!).

Re:Solution in three easy steps:

[OldManAndTheC]

1. Get rid of IT department
2. Let company infrastructure rot
3. Rehire IT department

Dogbert, is that you?

Re:Solution in three easy steps:

[networkBoy]

No.
He's the PHB, Dogbert is the consultant that talked him into doing it.
.
.
.
.
And the outsourcing agency for the new IT staff.
-nB

Re:Solution in three easy steps:

[CthulhuDreamer]

That sounds like my company. They're on step 2 right now.

Somewhere there are managers reading TFA and deciding that eliminating the IT department is the answer to all their problems.

Re:Solution in three easy steps:

[Anonymous Coward]

FEAR will keep the local systems inline - fear of this battle.... network administrator...

I abuse them for wasting my time when I've got more important things to work on. Its never work related activities that cause problems so thats my overall arguement and I'm practically the boss so I have that power.

Thats how I've cut virus, spyware, adware problems. Actually we havent had a problem for over a year now.

Re:Solution in three easy steps:

[Anonymous Coward]

I think it should be:

3. Hire new IT guys for lower wages (straight out of school, looking for work).
4. Get promoted for saving the company's tech and saving the company money.

Re:Solution in three easy steps:

[lullabud]

That's pretty much how it works. That's how it was for me during a takeover at one of my pervious empoyers. They fired everybody except the head IT guy, at a 24 hour operation of 200 or so employees. Our systems were all getting messed up and nobody had any permissions to even defrag, scandisk or clean out temp files. We had permission to run two applications, one of which was the calculator. I nearly got fired for finding a workaround in the security in order to repair our workstations so we could get some work done. ...actually, now that I think about it, one of my workarounds involved l0pht, but that's beside the point.

Re:Solution in three easy steps:

[Anonymous Coward]

True, but unfortunately at step 3 you have to replace the word "Rehire" with "Outsource".

Re:Solution in three easy steps:

[Trejkaz]

We started with step 1 a couple of years ago, and haven't moved onto step 2 yet. Got any tips on how to get there? Does it take longer than a couple of years? (I guess it must.)

Re:Solution in three easy steps:

[MisterMoney]

1. Get rid of IT department
2. Let company infrastructure rot
3. Rehire IT department

4. Profit?

Not if they're good.

[DrEldarion]

The thesis of the article is that rank-and-file employees will tend to engage in dangerous/insecure/irresponsible computing and internet behavior if they know that there's an IT department to clean up the mess.

This is assuming, of course, that the IT department is very lax on their users. Besides the fact that the users should be locked down to the point where irresponsible computing isn't as much of an issue, IT shouldn't be just allowing this behaviour to continue. Mindlessly cleaning things up without trying to change them is the problem, not having the department.

If you get punched in the face every time you drop a cigarrette butt on the ground, you're going to stop dropping them. The same principle should apply here. Punish the user for bad behavior, and they'll eventually stop.

Re:Not if they're good.

[vertinox]

Punish the user for bad behavior, and they'll eventually stop.

That's hard to do if the user is your supervisor, upper managment, or your customer. It's not like you can tell the Excec-VP of marketing "No! Don't do that!" and smack their hand when they are set on doing it and demand they be allowed to do what they want to do. The better solution is to give a good argument against it and then try to avoid getting blamed when their continued actions.

Sucks to work for a company like that, but sometimes you have to roll with what you have.

Re:Not if they're good.

[GMFTatsujin]

Love to.

Don't have the authority to refuse to help.

Find another solution or better empower your IT team.

Re:Not if they're good.

[Anonymous Coward]

This assumes a competent IT department, which is not always the case. The article can really be summarized with "false sense of security" whether it be from an IT department, an anti-virus, anti-spyware, firewall, or whatever cure-all is supposedly established to protect.

A competent BOFH-type would have the machines in such a lockdown where threats aren't too feasible. (note, even then I wouldn't claim 100% security). However in the real world these lockdowns are often porous enough to let things through.

Here's my beef with all this -- consider this scenario: a bunch of pricks from IT restrict most everything in the name of security. As a regular luser, you'd think "oh...well, they've got this place locked up pretty tightly, surely nothing will happen if I open this file even though it's suspicious."

As a rebellious bastard, you're more likely to think "these idiots restrict shit thinking they've got everything locked down but forgot to filter for such and such, don't update their virus scanner, and have large gaping holes through their firewall. Fuck 'em." Think milton and his red swingline stapler.

In the end, it's as much about educating lusers as it is about competence and PR.

Re:Not if they're good.

[Valiss]

If you get punched in the face every time you drop a cigarrette butt on the ground, you're going to stop dropping them. The same principle should apply here.

Thanks a million. I just got fired for punching a co-worker in the face for not understanding the inner workings of sendmail.

Re:Not if they're good.

[Kelson]

Punching them in the face is probably against company policy.

Maybe zapping them with a spray bottle?

Re:Not if they're good.

[CrackHappy]

Sure you could do that. Hell, it would even be FUN if I got to smack idiots all day.

Of course, I do like my job, and the money.... so I guess I won't do that.

Re:Not if they're good.

[Idarubicin]

Maybe zapping them with a spray bottle?

That's probably not such a good idea around electronics. Have you considered a rolled-up newspaper?

Re:Not if they're good.

[surprise_audit]

Just partially unplug their network connection while thy're at lunch...

Re:Not if they're good.

[Anonymous Coward]

Unless of course your staff is union and they don't have accountability for squat, sans taking a shit on the CEO's desk, or calling her a bitch, maybe. But we'd still have to spend $40,000 on arbitration to get rid of the offending employee.

Re:Not if they're good.

[friendswelcome]

If you get punched in the face every time you drop a cigarrette butt on the ground, you're going to stop dropping them. The same principle should apply here. Punish the user for bad behavior, and they'll eventually stop.

Yeah, punch em in the face!

Re:Not if they're good.

[cmarkn]

You're trying to be funny, but you actually have come closer to the real solution than anyone I've read so far. Company Policy.

Everyone has been saying "educate the users" but no one has said what you are supposed to teach them. But Kelson has the answer: teach them the company security policy.

This works even if the transgressor is the President of the company, because he signed off on the policy. And if you don't have a security policy, then you cannot have any security. If you have an outdated security policy, then you cannot have any security.

The IT department is not there to make the rules, it is there to follow them and help everyone follow them. Of course, it may and probably should really make the rules, but they have to be issued from the highest level.

This wouldn't explain ...

[subsoniq]

Why Home users get into so much trouble. I don't think it's because they feel they can ignore security due to the existance of an IT department to clean up their mess, I feel it's because they try to think of this technology like any other technology, a blackbox that you push a few buttons and turn a few dials, something that is completely harmless.

Our company has consequences for stupid user action, up to and including employment termination, so uers are "motivated" to learn the dangers that might confront them and how to avoid them.

Re:This wouldn't explain ...

[Xarius]

I feel it's because they try to think of this technology like any other technology, a blackbox that you push a few buttons and turn a few dials, something that is completely harmless.

Yet these same people manage to operate a gas oven, steam iron, and mechanical automobile most of the time without incident. I don't see why they treat computers with such stupidity... I think it's because they view this intarweb thingy as not exactly real and that it doesn't really affect the real world at all, but I could be wrong.

But I get what you're saying though.

Re:This wouldn't explain ...

[Kelson]

There's the problem! If only they'd stuck with beige boxes instead of switching to black, people wouldn't be so confused!

Re:This wouldn't explain ...

[petermgreen]

well gas ovens are pretty simple really and at least here in britan they add a stinky substance to the gas so you can smell leaks. also obvious danger of bodiliy harm makes people take more care.

steam irons are again pretty simple and again have an obvious danger of bodily harm so again people take more care.

cars have a mandatory training and licensing programme in all civilised countries i know of.

the problem with computers is people view them like a vcr or a phone, something where they can't really do any harm through ignorance. Sadly in the days of the e-mail instant messaging online shopping etc this simply isn't the case.

Re:This wouldn't explain ...

[YrWrstNtmr]

Actually, it does. Home users, and regular users at work, don't see all the behind the scenes stuff that IT does to keep the network and the PC's running. They don't see the firewall, the spam filters, the restricted ports.

They turn the machine on, and it works.

At home...they don't have that IT layer to keep them out of trouble.

Re:This wouldn't explain ...

[Anonymous Coward]

I always thought that when a user at an office screws up their computer, the machine is removed, and within two weeks, they get the fixed, cleaned machine back. During the interrum, they must continue to do their jobs without replacement. If they can't: we will find someone else who can. Another approach is to make them clean their own computer of spyware with dilligent lessons from IT staff. Apparently they don't know how big a pain in the ass it is, TIME TO LEARN! Likely they only perform really stupid things with the computer once.

absolutely

[patomuerto]

As someone who became the default sysAdmin for our group I would constantly fix many reccuring problems caused by the users. It got so bad that for a few members of the group I took their win notebooks and gave them macs under the guise that the fix "was going to take a while". They would whine a bit that they couldnt run their softwhere (mostly games) but it would give me a chance to do some real work.

Re:absolutely

[patomuerto]

are you implying that my inability to spell (and type) is the reason idiots install every piece of shareware/spyware/game they can, or disable security software because it "slows down" their word processors, or open attachments in outlook is because I cant spell?

For the record I was not a sysadmin. If I were I would not even qualify as an average one. I was just the guy who knew more hten the rest of the staff and the boss would send when someone else would have a problem. It was more of a work enviroment problem because I was still responsible for the job I was hired for. Since neither management was going to hire a full time sysadmin nor my coworkers care to listen to my advice I started helping them so it would not be a problem for me.

Re:absolutely

[patomuerto]

Apparently my grammer is as bad as my spelling.

IT departments are dangerous if arrogant

[Shivetya]

I can't count how many times each DAY that I hear and/or see someone in IT doing something they would scream at a "user" for doing.

It is plain and simple arrogance. From trash talking users to mocking auditors I see it all. Best yet is all the work done to keep users from doing something bad is amazingly and commoningly thwarted on the machines of the same IT staff.

In charge of security administation, most likely to bend the rules too.

Yeah there are good IT departments and I am not say where I work doesn't have a good one. Parts are very good but it isn't hard to find rules bent somewhere at any one time. If not for someone whose title begins with a "C" then its for someone in favor.

It doesn't help when you have so many different system types that you cannot find a single auditing company capable of covering them all. Of course it doesn't help when you don't take advantage of the opportunity SOX did provide and instead keep business as usual, just documented.

Re:IT departments are dangerous if arrogant

[Anonymous Coward]

I know that most people here don't read the article, but to not even bother with the summary?! Jeez...
 
Sounds like that lot had been building up inside of you for a while though...

Re:IT departments are dangerous if arrogant

[Anonymous Coward]

Sometimes what you would scream at a user for doing is what you need to do to get the job done. The difference is that they don't understand the ramifications of what they're doing, while supposedly trained IT professionals supposedly do.

Sometimes it's arrogance, but sometimes it's lack of ignorance.

Re:IT departments are dangerous if arrogant

[TekPolitik]

I can't count how many times each DAY that I hear and/or see someone in IT doing something they would scream at a "user" for doing.

You have not given us any examples, but this may well be perfectly rational behaviour. The rules for when it is an is not safe to do a particular thing can be quite complex, and it is not reasonable to expect an end user to be familiar with all of them - they have another job they need to worry about. For example, an IT department will often tell people never to open attachments, but the real rule is much more complex, and IT people are much more likely to know when it is and is not safe to open an attachment.

Re:IT departments are dangerous if arrogant

[XunilOS]

Do you work for my company?

Seriously, though, the reasons I find most IT departments tend to ignore the very rules they set for their users, is 1) because the IT personnel accept that if they screw something up, THEY will be the one that has to fix it; 2) they know what the heck they're doing; 2a) they understand the consequences and ramifications of changes they make to their systems.

I myself work in IT, so perhaps my opinion is biased; but I have never yet, in 12 years, had a bent rule or circumvented "security" device bite me in the ass. It comes down to acceptance of risk and understanding what you're doing.

Re:IT departments are dangerous if arrogant

[v1]

Some of that is justifiable. You don't give a 4 year old a set of sharp scissors to cut his construction paper, you give him a set of those stamped safety scissors. But then YOU aren't going to use those safety scissors are you? Of course not.

Here I sit, drinking a tall glass of milk, setting it down 5" from my laptop. I would never advise an 'average user' to do this, because average users are klutzes and when they dump a can of pepsi into their laptop's keyboard I'll be the one that gets to fix it, so I will say "no food around computers" and proceed to pour another tall glass of milk.

It's not hypocracy, it's "who is responsible enough for the privledge". And with no background history to go on, all users are by default considered klutzes and do not have food or drink anywhere near the computer.

Now if a user sees an IT person drinking a cup of coffee at their console they sometimes will flip out and cry foul, "why can't I do that?" But then again little kids will whine equally when they see their older brother with the "real scissors" and they get handed the chrome safeties. Doesn't mean the little tike should get the sharp ones now does it? It's not being unfair, it's just a matter of risk management.

It's also not a matter of playing favorites. A good friend of mine is a klutz. It's very rare to spend 20 minutes around him and NOT see him drop something. I would not advise him to eat around his computer either.

Anyway, enough about eating around computers, the concept extends to any other risky behavior around computers really, in much the same way.

Re:IT departments are dangerous if arrogant

[QuestorTapes]

> IT departments are dangerous if arrogant

Actually, arrogance can be a danger in any department. Most of the firms led into bankruptcy seem to be led by toweringly arrogant people.

Re:IT departments are dangerous if arrogant

[Anonymous Coward]

> It's not hypocracy, it's "who is responsible
> enough for the privledge". And with no background
> history to go on, all users are by default
> considered klutzes and do not have food or drink
> anywhere near the computer.

No, it's just that you'te foolish - unless it's your laptop that you paid for with non-company money. Because you're still going to have to replace that laptop when the inevitable happens.

Re:IT departments are dangerous if arrogant

[starfishsystems]

I can't count how many times each DAY that I hear and/or see someone in IT doing something they would scream at a "user" for doing.

You raise a good point.

Obviously the purpose of making a special group responsible for system administration is to put this very powerful and potentially risky activity in the hands of qualified experts. Thus risk is managed by constraining responsibility. That said, I encourage my system staff to make a practice of "eating their own dogfood."

In other words, if a given policy is such a great idea, let's see what happens when we too have to abide by it. Presenting that challenge sometimes works wonders:

• Unworkable policies get discovered and fixed quickly. We get in the habit of trying out a policy change on ourselves before releasing it.
• The security principle of least privilege is fully, not selectively, applied in practice.
• Technical staff gain some empathy for users.
• Staff also gain some leverage over demanding users. Some user claims that he needs root to do something or other, we know the contrary from firsthand experience.

Re:IT departments are dangerous if arrogant

[Anonymous Coward]

I can't count how many times each DAY that I hear and/or see someone in IT doing something they would scream at a "user" for doing.

The difference is we usually a) Know what we're doing b) Know it's a stupid or dangerous thing to do c) Know why we're doing it d) Know how to fix it if we fuck it up.

So in conclusion: Fuck off before I reconfigure the router to 10base half-duplex for your network port and then blaim it on a bad patch cable if you ever grow the balls to complain about it.

Sounds reasonable

[maromig]

Any time a groups gets into the role of over-functioning for another, the other group starts to under-function. This isn't limited to IT and corporations. It would explain, among other things, why the poorest and most dependent folks in NO, were not more proactive with their own future in that disaster, instead waiting on the Government and charities to over-function for them. That choice was much more risky for them than just getting out of town earlier like many others decided to do on their own.

Re:Sounds reasonable

[MoggyMania]

A huge percentage of the "poorest and most dependent" folks in NO *couldn't* leave. They are disabled, elderly, and rely on the minimal amount of aid offered to survive that only shows up at the beginning of every month -- that's *why* they are the "poorest and most dependent" in the first place.

They wouldn't own (probably can't even drive) cars, so they couldn't drive themselves out, were likely too physically disabled to evacuate on foot, and the hurricane hit at a time of the month when they lacked the funds necessary for bus/lodging fare. How were they supposed to leave, where were they supposed to go?

Re:Sounds reasonable

[Anonymous Coward]

You sound like the douchebag subject of this story: http://www.livejournal.com/users/toranonekochan/36 699.html

Re:Sounds reasonable

[redKrane]

For the last fucking time, most poor urban people didn't leave becasue they FUCKING couldn't. Welfare checks werent coming out for another 3 days when the storm hit and they dont have cars. Jackass

Re:Sounds reasonable

[Anonymous Coward]

Except for the buses the asshat Mayor didn't use (and which were in the plan)

http://junkyardblog.net/archives/week_2005_08_28.h tml#004752

WTF?

[dmccarty]

Breaking news: Guardrails are responsible for more car crashes. People feel more confident when they see a guardrail and crash into it.

Uh, is this article serious? Do employees throw their trash all over because there's a janitorial staff to clean it up? Does it mean that companies don't need anyone to clean up?

I doubt it.

Re:WTF?

[mjtg]

Question to moderator: why was this comment modded off-topic ? It raises a perfectly valid point.

Re:WTF?

[Anonymous Coward]

To carry you analogy to it's completion, yes, guardrails are responsible for more car crashes. The difference is, and why guardrails don't cause more car crashes, is that the average driver understands the hazards of crashing whether there is a guardrail or not. The average computer user, on the other hand....

And to answer your question, yes, quite often; when people know there are janitors they tend to ignore trash cans for the convenience of the floor. And, no, even if everybody was a concientious about litter, clean up involves more than picking up trash.

Re:WTF?

[vertinox]

They are modding down anyone who uses "In other news" incorrectly. Check out the few posts below this one modded offtopic that start out with "in other news". It should be "redundant". Hopefully the meta-modders will catch it.

Mod Parent Funny!

[Anonymous Coward]

NT

It's true, I suppose

[Otter]

I'm definitely motivated to stay out of trouble in order to keep them the hell out of my computer...

Re:I believe it

[Anonymous Coward]

leads workers to do risky, even stupid, things at work, such as opening questionable e-mail messages or clicking on unknown Web site links

WHat about using software that will not load viruses over HTTP?

mutt instead of Outlook, Opera instead of Firefox should do the job.

To our foreign constituents

[crkpot]

dirka dirka mohammad jihad. We have everything but Americans working at our place and most leave back to China and India soon after learning our entire system..... Problem?... Solution?...

Fire Department Station a fire hazard

[aralin]

In other news the local officials said that a local fire station has become a fire hazard, because people just behave irresponsibly and let their stove on when going to work or candles burning while they go sleep, since they know the firemen will just put the fire off anyway. A new study was commisioned to study whether police departments are not secretly inducing crime.

This has nothing to do with the parent

[jim_v2000]

But I think someone just need to point out that STUPID people are a security risk everywhere they are present.

Just wonderful...

[kex]

from TFA:
"One in three (34 percent) of U.S. users and more than one in four of those in Germany (29 percent) and Japan (28 percent) admitted they clicked on suspicious links or opened iffy e-mail because the computer equipment wasn't theirs."

Now I have to figure out which 4 out of the 12 guys on my mobile force need their laptop replaced with an etch-a-sketch. Time to send out some ebay spoof emails and see who responds...

Not everywhere

[Anonymous Coward]

If nothing else were to discourage me from doing dumb stuff, having our helpdesk staff around would.

They can't come near a machine without screwing it up. Everyone I know who's let them near their machine lost at least a day's work; they can turn changing an outlook setting into requiring a complete HD wipe and OS reinstall.

Luckily some of us have convinced them to just leave us alone and let us do most work ourselves; at most we ask them for a ghosted drive to start from.

horseshit

[Anonymous Coward]

what horseshit

Hot potato

[SuperBanana]

The thesis of the article is that rank-and-file employees will tend to engage in dangerous/insecure/irresponsible computing and internet behavior if they know that there's an IT department to clean up the mess.

After almost a decade in IT, I can tell you why there is this expectation. When it comes to fuckups, IT is usually the last guy to get the hot potato, and they're expected to save the day.

Any time a user screws up, the IT department is EXPECTED to save the day by upper management. If they don't, it is (rarely) the fault of the employee, it's the fault of the IT department for not anticipating such a need, or not being available at a second's notice, or simply not being able to save someone else's bacon. Often times we're asked to perform miracles.

It sounds reasonable, until you cross professions. Someone drives off the company driveway, crashes their car into a tree, car bursts into flames. Do the facilities people get in trouble for not ancticipating the employee who leaned over to pick up his cell phone off the floor while driving, and failed to install a nice big inflatable barrier along all the roads? Of course not. Yet IT departments are expected to back up everything known to man, expected to resurrect deleted+overwritten files...

Another example- it's 4:55pm and Fedex comes at 5 to pick up a package that is going to The Big Client. The employee has procrastinated working on it, and goes to print at 4:57. There's something wrong with the printer or their system. Guess whose emergency it becomes? Guess who gets screamed at on the telephone? Guess who gets reamed by the CEO because the package didn't go out? Usually the IT department. "Why was the printer broken? Why couldn't you fix it?"....not, "Bob, why did you wait until 5 minutes before your deadline?"

Re:Hot potato

[slashflood]

Mod parent up!

Somebody should collect those stories and write a book about all the absurdities that the IT has to take every day. I mean, not like the BOFH stories - true stories.

I could write the first ten chapters.

Re:Hot potato

[cool_number_9]

Often times we're asked to perform miracles.

Having also worked part-time in IT during my student years, I'll be the last one to scream bloody murder if the printer's not working when I could've and should've finished something on time. Having said that, at my current job I stopped depending on them.

They are the ones that must configure my computer in order for me to have Internet access. Waited for a month, calling and emailing at least 5 times while waiting. Also, they are the ones that have to push the buttons in order for my account to have access to my space on the central storage server for backup purposes. Finally, I gave up waiting and configured the internet myself, fully aware that is was against company policy. Maybe they would actually swing by and then I'd have the opportunity to complain. Backup server? One word: DVD's. I burn my data and take it home.

On a related note. I know most IT-department are okay and they do their jobs well, but I have encountered two at which they were actually installing games and playing them. So much for professionalism.

Re:Hot potato

[Fulcrum of Evil]

Guess who gets reamed by the CEO because the package didn't go out? Usually the IT department. "Why was the printer broken? Why couldn't you fix it?"....not, "Bob, why did you wait until 5 minutes before your deadline?"

Sure boss, I fixed the printer. It took 15 minutes because I had to go downstairs to get more toner. Bob missed the pickup, but oddly enough, wasn't around to trot the package down to the fedex shop that was open until 6.

Re:Hot potato

[Anonymous Coward]

The easiest way to deal with this is to make IT costs more transparent.
The IT department should track issues, work performed, software licences required, time spent etc by department/group/whatever.
Deliver quartly reports. Very quickly some departments will see that their IT cost/employee is significantly higher than others. Questions will be asked. IT can explain:
e.g.
This department standardised on linux etc - reducing licencing costs.
This department had n cretin-user-rescue instances that has blown out its quartly cost.

As a side benefit, IT can start to appear a bit more as a profit centre, rather than a cost centre.

It also makes departmental managers (not IT) get upset at wasted IT resources cleaning up repeatedly after miscrient users.

Re:Hot potato

[XunilOS]

Only ten chapters? I think the big problem with writing such a book would be convincing a publishing company to publish all ten VOLUMES.

Re:Hot potato

[slashflood]

I would write the top ten ridiculous/absurd stories that I have. Not about the silly things like the user had his caps-lock on, while he was trying to login. More about the pressure that you feel as an IT worker. I would do some comparisons between IT work and ER personal and so on.

Re:Hot potato

[E8086]

"The employee has procrastinated working on it, and goes to print at 4:57. There's something wrong with the printer or their system."

"It's the best lock money can buy, but it has one flaw, the door has to be closed!" -Seinfeld

The problems need to be better compared to things the average person can understand.

"It's the best printer money can buy, it's only flaw is that there needs to be paper in the tray."
It's no more the job of IT to keep the printers full than it is to keep the supply closet stocked with pens.
The line between something being the responsibility of IT and the office staff needs to be made very very clear. It's the responsibility of the person who finds/causes a problem with the printer or their PC to report it immediately so it can be fixed. It's not IT's problem when Bob can't print because someone accidentally changed the printer's setting earlier in the day and didn't tell someone who can fix it. Even if it takes someone in IT 20sec to reset the printer's settings, someone has to let them know. When you have a leaky sink, the local plumber doesn't use the force to know your sink is leaking, he waits until he gets a call.

Re:Hot potato

[Anonymous Coward]

At the university where I work in an IT Support role we have a couple of fairly prominent signs - "Failure to plan on your part does not constitute an emergency on my part"

Re:Hot potato

[Anonymous Coward]

Wow, you configured the whole internet yourself?!?You're GOOD.

Re:Hot potato

[Anonymous Coward]

Dear Asshole Users:

If you don't want screenshots of your daily seven hour Solitaire sessions E-mailed from your computer to every contact in your list and the local paper, I suggest you STFU about my daily half hour of WoW.

I jest about the last part, I have NEVER played a game at work, I conduct personal business on MY time, et cetera. My recreation at work, during my rare slow times, is to write scripts, et cetera to make my job AND yours easier. Yet, 95% of the population here spends a LARGE portion of their days playing Solitaire, Yahoo! Games (banned now and boy are the natives pissed), E-Baying (when I ban this, NEST will need to secure the area) conducting personal business, et cetera. Then, when the WORK you have put off for two weeks is due in two hours and I am in the middle of a large software upgrade with a vendor, you get pissed when I tell you I'll be there in an hour. Oh, and your problem? You downloaded that fucking malware shit game again that you have been warned about after the last three clean ups--and your department head, whom is doing the same shit, doesn't care because SHE is in control of her office not IT. Then, you call back six times during that hour wanting to know where the hell I am--at call two, you moved yourself to next Thursday on the list. At call three, I'll be down in 15 minutes...with this nice old Windows 95 (upgraded to 2000 with a whopping 64 MB of RAM) banned from Net and E-mail access junker while I work on your daily PC for the next two weeks. You are pissed because: 1) you are an asshole, 2) you are a stupid asshole 3) you mistakenly ASSume I sit around and fuck off all day like you. Seriously. I have checked the proxy logs to see where you got that malware and banned the site...and noted that you spent three hours perusing the site that day. I have stood at your desk to help you with your "urgent" problem while you chat with your sister on the phone for 20 minutes about your weekend get together and then, as that call ends, your insurance agent calls back...I leave, then you come find me and are pissed that I left and am in the middle of something else. I have spent two hours recovering files from a floppy disk for you--despite my telling you a half-dozen times NOT to keep and work on files on a floppy AND why. At the end of the two hour period, I have recovered the invitation for your daughter's graduation. I have listened to you bitch EVERY OTHER DAY for a year about having to copy and paste personal and, 10% of the time, business related links from your E-mail into a web browser so that you don't blow away the authentication applet--if you are so adverse to change, off yourself, PLEASE.

I am not a dick without a personal life that is jealous of yours. I have bills to pay, Scout outings to attend, PTA meetings, concerts to attend, et cetera. And, if you actually worked (I actually don't give a shit that you don't work...until you expect me to drop my real work to help you when your laziness bites you in the ass) and didn't treat me like dirt until the day you need a personal favor, I wouldn't mind providing that personal assistance now and then when I have a FREE few minutes.

I get shit from you all for taking a day off about every other week. Well asshole, what you don't know is that I am BUSTING at the seams with comp time thanks to my desire to NOT interrupt you during your work day. I perform disruptive software and hardware updates in the evenings and on weekends. I have driven 40 miles at 2 A.M. several times over the summer to insure that you could work at 8 A.M. after lightning pummeled the building. What do you do besides fuck off all day? Oh, you have a 7 P.M. meeting once a month for two hours...and you come into work at noon the next day. You spend 8 weeks a year at conferences that aren't much more than drinking and fling bashes. Then, you ask for more money at budget time to hire a friend of yours to help out with the burdensome load in your office.

Out of ~130 employees, I know of five that actually w

Re:Hot potato

[Anonymous Coward]

Bingo. This is why I finally just got up and left my last job. In law school now. That way, when people fuck up, they just gotta pay me that much more.

Re:Hot potato

[Crunchie Frog]

ok so yeah its a rant but dude, i really enjoyed reading that. at work too of course

Re:Hot potato

[pipingguy]

Look at it this way: computers and software are now forced upon people in exchange for them having the privilege of having an office job. Since there is now an "out" for shoddy performance, they blame the nearest inanimate object. 25 years ago you wouldn't see many people blaming typewriters or pencils for their own incompetence.

Bull.

[Pizentios]

Complete bull ****.

If there was no IT department, how the hell would the company run? Buy support from outside companies? I think not, since on average (at least here) support companys charge about $95 a hour and 90% of the techs the send out don't know jack. I have lost count how many times i have had to fix stuff "again" after they leave, simply because they are too lazy to figure out the whole problem, or they don't know how to run/admin/whatever our systems. Since we created our IT department spending has been reduced alot, service and security both have gone up. Also the amount of down time our employee's suffer has droped dramatically.

Then again, i live/work in a fairly small city, so our local support companies don't have much to choose from for employee's since most people that know what they are talking about ether work for a company in the IT department, or move their ass to a better place :-)

This couldn't be any more obvious

[kianu7]

The IT department is clearly a security risk, let me explain. The IT folks have the ability to hit all the dangerous smut portals (without getting logged) and are thus are more likely to download the root kits that are often served up at some of the shadier bukkake portals (I wouldn't know...wink, wink) and thus infect the corporate lan. Management knows taking bigger risks could lead to bigger rewards. So, that's why they keep those smut-hungry IT workers around.

Re:This couldn't be any more obvious

[surprise_audit]

Round here, pretty much the whole place is an IT department. We've got a separate Security Risk^H^H^H^HDept. Let me see - after editing /etc/passwd on a production server and wiping out almost all of it, the Data Security guy actually saves the file. Then he tries to recover by copying opasswd to passwd, but I guess he got the names switched, because opasswd got truncated too. On another occasion, probably the same guy thinks he can limit who logs into a production server by listing names in the /etc/nologin file. I got a panicked call from his manager, "Can you fix this? No one can login." She even gave me the root password over the phone and didn't even want to know how I fixed it. And the number of times those folks have changed a password, then logged out to test it by logging in again, instead of opening up a new window... Passwords for both root and their own generic security ID, that is...

Tradeoffs

[publius_ovidius]

What the article doesn't point out is the obvious tradeoff. By having an IT department to manage risk, companies enjoy lower risk but the risk profile changes. IT departments will routinely reghost machines with unauthorized software and that, arguably, is a strong benefit. Once users lose enough data from having not backed up their machine prior to it being reghosted, they learn to backup their data more frequently or not install unauthorized software (assuming they have the administrative rights to install that software in the first place.)

What that means, generally, is that problems from unauthorized software will be minimized and other problems will be magnified in comparison. I note that the author of that article didn't offer a solution to this perceived problem.

Perhaps a deeper problem is that IT security represents, to the company, what an economist would refer to as a "public good." Your department will enjoy the protection of powerful firewalls, anti-virus protection and locked down machines even if the costs are not applied directly to your department's budget. As a result, I've frequently seen business departments argue against increased funding for IT security in the mistaken belief that the potentially negative impact on their budget will hurt them. They somehow believe that if they do not pay for the security directly, the IT department will magically find other solutions for those problems.

Only increased employee education about the dangers inherent in their actions seems to be a viable method of reducing this problem.

Re:Windows Only policy is a problem

[winkydink]

What color is the sky on your planet?

I won't rehash the reasons why Linux isn't ready for the desktop.

Migrating to an all Apple strategy would hurt the bottom line as the hw is more expensive and there are a limited amount of biz apps that run on them, necessitataing the need for a big virtulization project on top of the new hw.

Yes, Windows has a whole heap of shortcomings and everybody loves to hate it. For the corporate world's desktops, its the only game in town.

Wallet Inspector

[Anonymous Coward]

"It's like kids with over-protective parents will likely to get hurt/scammed/killed more easily when they're alone."

Homer: Guys, believe me, I didn't mean to get you expelled.
Nerd 3: Oh, don't worry, Mr. Simpson, we can take care of ourselves.
Snake appears, holding out his hand]
Snake: Uh, wallet inspector.
Nerd 1: Oh, here ya go. [All three give him their wallets] I believe
that's all in order.
Snake: Huh ho! I can't _believe_ that worked.
Homer: [realization dawning] Heyy...that's not the wallet inspector!

http://www.snpp.com/episodes/1F02.html

Hummm

[Skiron]

To be honest, being a sysadmin, users haven't a clue at work or home anyway, so I think that they feel 'safer' at work due to extra security measures is a dangerous false presumption.

I expect the real reason is that doing it at work doesn't bugger up THEIR computer at home, and as it is at work, it is then not their problem (cue feet up on desk reading newspaper 'sorry, my computer is not working, I am waiting on IT _again!!_).

No matter how many times you tell them, the same resultant behaviour remains.

Look up the O'Really Tee shirt ~ Clue to lusers.

Only one way to fix it:

[Anonymous Coward]

Education and consequences.

Nobody takes security seriously because regular staff thinks that the IT guys are there to clean up the messes when they occur. What they don't understand is that the IT department is not there to be a janitor or babysitter. The IT department is there to provide the information infrastructure to enable the company and to ensure the company's information security. That doesn't necessarily include end users.

My personal philosophy is that end-users should be punished severely for security breaches. Sure the IT department will fix the problem, but the person who clicked on the link (or opened the email) needs to pay a price for their behaviour, otherwise they will continue to do it. Nearly every company has an IT AUP. Nearly every company says that you can be disciplined, including termination of employement, for violating the policy. Yet I have never worked at a company where day-to-day infractions (even those with security risks associated with them) were punished. Sure, every once in awhile someone gets fired for surfing porn, or when their misuse of the system affects their ability to work (goofing off online for hours), but who gets fired for forwarding chain letters with flash animations in them? Nobody.

This absolutely has to change. If you had a receptionist who let random strangers in to wander the halls of your building she would be disciplined and probably sacked. If you have a receptionist who forwards chain letters, clicks on suspicious links, downloads spyware and causes virus infections, the odds are nothing will happen to her.

Company officers think Information Security means securing the company with a firewall and looking out for hack attempts. They still don't take Information Security seriously, and until they do the rank-and-file won't either.

Education alone is not going to do it. Education that is reinforced with consequences will.

Re:Only one way to fix it:

[Anonymous Coward]

At one company where I have a part time sys-admin role, ALL IT support requests are made via email, (I am under strict instructions not to attend to problems without an email) and a copy of any email to IT support gets sent to the management accountant. Management also see copies of my replies to staff. Employees know that management are aware of their support requests, and therefore take a bit more care not to do something stupid. I'm also reasonably pro-active, warning people of the latest email viruses/hoaxes/phishing scams etc immediately they appear. Obviously it helps to have decent anti-virus protection too - but I think the system works well, particularly as a side effect is that the accountants can see just how busy I am and therefore don't complain when it comes to paying my bills!

Re:Only one way to fix it:

[starfishsystems]

I was going to say that a big part of any support activity is managing expectations.

People on a commercial aircraft can't get up in the middle of the flight and go try to cook their own meals in the galley. It's simply unworkable, so it's not permitted, and people have come to accept this.

The problem in many computing environments is that people expect freedom without responsibility. That didn't use to be so, but even now all it would take to prevent the majority of problems would be to configure the environment to restrict both.

It's not fair to just suddenly lower the boom on users, but as far as I'm concerned, when they are allowed to install software on the office computers, something is deeply out of whack with the organization. It's not a technical problem, it's a policy problem, and senior management is responsible for fixing it.

Say what?

[Anonymous Coward]

How can one possibly surf the web without clicking on unknown Web site links.?

Re:Say what?

[HermanAB]

Exactly. This whole don't click dangerous link thing is pure crap. Why is the PC affected by the link in the first place? I can browse the web happily with my Linux box and open any email without trouble and guess what, my Windows users can too, because the bad things don't get to them.

Shady

[markass530]

I know it says don't complain about story rejects, but still whats up with this 2005-09-13 21:22:21 Risky Corporate computer use (IT,Security) (rejected) hmm sounds familiar.

Re:Shady

[Anonymous Coward]

Now here's a thread that will be quickly squashed by "ye editors". Over the years I have posted many story links, ALL have been rejected, and most have shown up a few days later posted by someone on "YE"s "favorite posters list". I have never complained, just felt insulted, but now it's time to shout from the rooftops, FUCK YE EDITORS!. Now I no longer use my Nick, (should put it on eBay), and always post AC.

There, I feel better now.

You've just described

[CiXeL]

exactly why im trying so hard to get out of IT. I've been in IT coming up on 20 years. Who wants to be the scape goat and take the blame all the time? Do the executives think I'm a toady? I realized awhile ago that I am a paid bitch and that is never going to change the way management trends are going.

Besides now that computers are as normal as a phone they are a tool that we innovator types can use to take things to the next level. The internet has opened the door to so many new professional and the permutations of combining those professional with the technology and sharing of vastly new ideas.

Abandon computers, it isnt where the action is anymore and unless youre a toady or masochist, have a little respect for yourself. Go into a profession again where people respect you and what you do.

Re:You've just described

[Anonymous Coward]

Go into a profession again where people respect you and what you do.

Not meaning to be a troll, but can anyone name such a profession? I've certainly can't think of one. Even the late Mother Teresa seems to be suspect (Google for her + Christopher Hitchens for details).

Depends on Enforcement

[sstamps]

I worked as a contractor to a large soft drink company some years back, and their corporate culture made it hard to fire most employees. However, they took improper computer / network use seriously and included it in their corporate code of conduct. Violating the CoC was about the only way you as an employee there could get fired, and they followed it. They even had security walk an upper management person out the door the day his little escapades took down a large segment of the network in his building.

Thus, as far as I have seen, it is all about not only having a good IT department, but having good company policies and proper enforcement to support it.

Re:Depends on Enforcement

[xmorg]

Right, I have seen power hungry IT managers who dont even want your screen to face away from them when you walk by or get all medieval when someone start passing around one of those "reply all" letters.

Its not really a security risk if the IT department can impose martial law in the workplace.

maybe if the company is ran by idiots

[chillzatl]

. As someone who supports several large companies networks, I've seen both kinds. Some companies just don't care. They think that network problems due to careless, idiot users is just par for the course. They will just continue to pay to have you constantly fix problems that wouldn't be problems if they fired a person or two for screwing things up. Then you have companies that set limits from the get go. The network crew isn't there to pick up after them. In fact they are there to tell the boss who's causing the problems. After a few people get smacked around by the boss, you'd be surprised at how quickly clueless users become caring, semi-responsible users. The only downside is that they call a lot more often asking ridiculous questions. But I guess it's better than the alternative.

Re:maybe if the company is ran by idiots

[FatMacDaddy]

I must be one of the few people who work in a secure environment. We have security rules drilled into our heads routinely, and to a lot of us they're just common sense. Yes, there are people in IT who install unauthorized shareware, but if anyone introduces a virus to the network, whether in IT or not, it's easy to find out where it originated. That person is then made a spectacle of (only as a side effect) by the response staff as they lock down the person's workspace and haul away their PC like it was radioactive. Management, as you might imagine, finds little humor in these events. An occurence like this is a reflection on management (as far as upper management is concerned), and the risk and lost productivity can cost the boss his or her job. Thus, anyone who does this more than once probably doesn't have much network access after that, assuming they even have a job at that point. (Violating the security policy can be cause for termination, and it is enforced.) Just my two cents.

It's just like seatbelts...

[TreyHarris]

Drivers might drive somewhat more recklessly because they have seatbelts and airbags, but the solution to that isn't to get rid of these safety features.

As an IT worker, the message to bring home from this study is only this: employees will assume that you'll pick up the pieces for them. You need to either plan to do that, or dissuade them of their assumption.

And you can dissuade them. Saying, "don't do X, it reduces company security" will be met with yawns. But say "doing X is a terminable offense and people have been fired for doing it" gets people's attention.

Wendy's Employee

[systemofadown]

Thanks for protecting my job.

Include IT issues as a KPI

[GroovinWithMrBloe]

Big companies should include IT issues as a KPI, to encourage staff against relying too much on the IT department to fix their stupidity. Of course, this could just drive people away from using the department at all for fear of getting a bad performance review and thus drive down productivity.

Re:Include IT issues as a KPI

[colinrichardday]

K Personnel Issue? What does the "K" stand for?

Re:Include IT issues as a KPI

[GroovinWithMrBloe]

Key Performance Indicator.

Laziness

[Nuttles1]

At first I was going to post a comment that maybe workers are to busy to worry about security so they leave it to IT to fix problems, but I thought about it and came to the conclusion if somone really is too busy then they won't have time for SPAM type email or for surfing.

So, I thought about it some more and came to the conclusion that it may simply be because of laziness. I work in a group of 12 programmers, 6 of which are either naturally tech savy or keep up with tech. These people have no issues with viruses and stuff like that. The others, the programmers who have been programming the same programming language, in the same industry, in the same one or two programs for 10+ years(granted there are some programmers with 10+ experiance and are not like this but most of them are) haven't read a technical book or done anything but the absolute bare mininum to get by for years and years. If 50% of programmers who SHOULD know better are too lazy to know exactly what they are doing when they are at a computer, what hope do IT departments have with people who think that there job is strictly whatever (accounting, being a doctor, being a pharmacist, etc) and the computers are for IT/Geeks. Too many people do not take pride in everything they do. They are content with being good enough. They are Lazy.

Personal Accountability Is Just No Longer Stylish

[ScentCone]

The problem is that the behavioral culture at work is exactly the same as it is everywhere else. People can't stand hardship, complexity, accountability, or even just the discomfort that comes from having to think for a moment. It shows up in how they drive, how they bank, how they prepare for bad weather, how they marry, how they study for exams, and how they surf. And to the extent that the largess of our economy allows for it to keep happening, it just keeps happening.

The crazy thing is that most of the reasons I've seen for stupid-IT-end-users getting the axe (the ultimate behavior modification) have nothing to do with their poor security-related behavior, but rather for the things they've done that might offend someone. You know:

"Well, of course we'll reset your cracked password again. But when you get back to the field office, be sure to tell Bob that he's probably going to lose his job over that whole Carmen Electra desktop wallpaper thing."

doctors a health risk?

[Anonymous Coward]

You are a lot more likely to roller-blade, sun-bathe, and bang skanky hos if you know there are doctors around who will set your broken bones, slice off your melanomas, and give you penicillin.

Why won't those doctors think of the children before they take dedicate their lives to medicine?

Re:doctors a health risk?

[Anonymous Coward]

You know, I honestly don't think the parent should be modded funny.

Doctors are a pretty good analogy in this case, better than most of the ones mentioned earlier.

A lot of risky behaviors have taken off as medicine advanced. While I'll grant that STDs are probably no more widespread, people are more aware of the risks and yet they still spread, partially because, aside from AIDs, the mortal ones are curable.

Similarly, extreme sports rely on competent doctors. Virtually every pro skateboarder, dirt cyclist, etc. has broken a sizable percentage of the bones in his body. Without modern medicine, they'd be lame, crippled or dead.

While I doubt it's a factor (people just lack foresight), similar arguments can be made for obesity and carcinogenic risks being incurred more frequently since a lot of it is "curable."

          -ShadowRanger

I'll tell you how much of a security risk we are

[dbIII]

... but not until you slip me some cash.

On the serious side, with access to everything typed in or emailed in trustworthy competant people who are more worried about everything running well than personal gain with some sort of check or balance should be the default.

ummm

[rogabean]

Aren't the users security risks?

AOL to be bought by MSN

[Anonymous Coward]

Hey, did you know that AOL will be bought by Microsoft? Yup you heard it here first.

-1, Offtopic - yea yea

Not their responsibillity?

[Shin Chan]

Big company employees just don't see security as their responsibility.'

Put in place a penalty system in combination with correct education on computing for the employees. Those who still do not want to listen have to feel it in their pockets. That might change their mind. Plus, if given correct education along the way it will most likely make them more responsible at home as well.

Of course, it should be done basically the same way in any company in the same field -- Otherwise employees can "just" switch jobs and avoid it.

Bad logic.

[Vellmont]

This is the same kind of logic that people use to claim air bags don't make people safer. The argument is that people will drive more dangerously if they know they have an airbag to save them.

The problem of course in both these cases is that no one is adding up the benefit of both protection schemes. Of course if you don't also look at the added security that an IT department provides, and only look at potential problems it's going to look like "IT departments are a security risk". Shame on Information Week (and mostly Slashdot for the dumb headline) for making this dishonest claim.

Bad Analogy.

[sglider]

The thesis of the article is that rank-and-file employees will tend to engage in dangerous/insecure/irresponsible computing and internet behavior if they know that there's an IT department to clean up the mess.

That's like saying that Traffic light signals are bad because motorists simply learn how to time the red light to speed through them.

Re:Bad Analogy.

[An Onerous Coward]

No it isn't.

It's more like saying, "If traffic lights are installed, some motorists will behave dangerously while attempting to get through them." If an IT department is making even a minimal honest effort, then it's likely that their efforts are making the computer infrastructure more secure and reliable than they would otherwise be, even if the users are more lax as a result.

Now, you could be in a situation where management "tasks" (stupid verb) the IT department with "making everything secure", and then shoots down every suggestion as inconvenient. At that point, people behave insecurely because the existence of the IT department provides a false sense of security.

At that point, management really should be asking itself whether or not their ineffectual IT department is making things less secure.

If your supposed to keep the printer running

[winkydink]

why don't you develop some proactive way of making sure it's working? People expect their computing environment to be utility-grade. Failures of the environment should be about as common as power failures. Most IT environments fall far short of the utility-grade mark.

Re:If your supposed to keep the printer running

[slashflood]

why don't you develop some proactive way of making sure it's working? People expect their computing environment to be utility-grade. Failures of the environment should be about as common as power failures. Most IT environments fall far short of the utility-grade mark.

His example was about a f*cked-up printer. What do you think what happened? Toner went empty in the middle of a print. Paper jam. Do you think that this guy can prevent that?

That is actually what he was talking about: people, who think that the whole corporate IT should be an "utility-grade computer environment". Thats what you get, when you flip the lid of your Powerbook, but an IT environment is way more complex than your single computer.

Re:If your supposed to keep the printer running

[networkBoy]

Failures of the environment should be about as common as power failures.

Except:
Users load the wrong paper in the wrong tray, mix up the color stix in the Phasor, etc. To be sure you could hire extra heads to do these things proactivly (sp?), but you don't have the budget for that. If you rely on the users to notify you then you are back where you started. Usually the user who thinks they know what they are doing are the ones who don't and fsck it up.

In the case of the power line, the system protects its self from the stupid people (or at least ensures they only try once).
-nB

Re:If your supposed to keep the printer running

[winkydink]

Toner running out? Most definitely predictable (most business printers will indicate low toner before they run out).

Paper jam? Not. And clearly defensible, especially if the rest of your IT group's shit is together.

I've been in IT for 22 years and in large environments in most of them. Utility-grade computing is hard, but achievable. If you don't think so, you either need to find a good mentor or a new line of work.

Re:If your supposed to keep the printer running

[slashflood]

I was in IT for about 14 years, not as long as you, but I've seen it all.

Sometimes, the IT department is heavily understaffed (two persons, when there should be four or five), because of the lack of budget.

If you're 22 years in IT, you should know exactly, what the OP means, or maybe you are 22 years at the same overstaffed, overpaid IT department of a very huge company. You know, what I mean. :-)

You're nitpicking about his specific printer example. Sure, a good printer tells you, when the toner is getting low or a paper jam occurs, but he mentioned the user that gets upset, just because he wasn't able to deliver his print on time - minutes before the Fedex guy left the building.

Re:If your supposed to keep the printer running

[mungtor]

Utility grade computing is easy as hell if you have the money for it. Who are you kidding?

It's when you get the IT department squeezed into leasing crap copier/printers (for example) that the infrastructure starts to degrade. And you can only have 1, because 2 is a waste compared to flying sales-douches all over the country to wine and dine people who won't buy anything anyway. And suddenly all the execs need $5k Vaio laptops so they look good at meetings, but IT can't get $2000/year to send the backup tapes to offsite storage.

All that said, utility grade users would still be great compared to most of them.

Re:If your supposed to keep the printer running

[user43]

Damn, I need to work with you for a while.

Re:If your supposed to keep the printer running

[slashflood]

Huh? Are you my former IT co-worker?

Re:If your supposed to keep the printer running

[stor]

Most IT environments fall far short of the utility-grade mark.

Most IT departments don't have a budget for utility-grade IT environments. Where I work, I am the IT department of a number of companies and I need to really fight to get ANY of them to spend money on stuff they need to help prevent disasters. Redundancy? Hah! "It's not broken now... what are the chances it's going to go down? Haven't you set it up right or something?"

Cheers
Stor

Re:If your supposed to keep the printer running

[winkydink]

IT depts get more money when they demonstrate a value to the business. When they don't, they find their budgets getting trimmed.

It's not just IT that gets judged this way, it's every department in the company. You invest in what delivers value and improves the bottom line and you trim from those areas that don't. I hate to say it, but it sure looks like your team is in the latter category.

Re:If your supposed to keep the printer running

[Mad Leper]

"...mix up the color stix in the Phasor.."

Oh God, your people did this too ? I couldn't believe that when stores ran out of black (we get black free for gawds sake, how could they run out ?) someone took some blue sticks, shaved then down so they'd fit and rammed them in.

Then "we have no budget to purchase a new HP colorjet, but lots of money in the repair budget, so get it fixed". So we spent $1200 in parts and labor to clean it out.

Guess which department got blamed for the downtime and the cost..

Re:If your supposed to keep the printer running

[Almost-Retired]

"Toner running out?", thats a nice one when a toner cart is several hundred bucks for some of them, and management has to see it with their own eyes before they'll authorize cutting a check for a new one.

"Paper jam?", again, I can lay that little problem squarely in managements lap when they see that this no-name brand of 16 lb recycled paper is 1/3rd the cost of a decent grade of name brand 20-24 lb.

So don't be so damned quick to blame IT when IT doesn't have the ability to specify and order sufficient stocks of quality expendables.

This is the same IT dept that, when one of the machines catches a cold because the dip in sales thought the "don't open attachments from unknown sources" rule didn't apply to her/him, has no guilty concience whatsoever in re-imaging the drive while the guy/gal is screaming about losing their contact list. Do that 3-4 times and they get religion, enforced by the losses they will have if they don't.

--
Cheers, Gene

Re:If your supposed to keep the printer running

[networkBoy]

Did yours use the supply drawer the printer was sitting on as teh method to shave the block, thus getting color wax shavings all over the place (including in the carpet), which the janitorial staff dutifully vaccuumed up using the same cleaner the'd been using for the last hour (those get kinda warm), thus fusing the wax (some of it at least) into the carpet and brushes of the cleaner?
cause mine did.

Our solution? Placed the printer in the controlled doc department so you had to sign for color prints. Boy did our costs (supply and maintenance) drop!
-nB

Re:If your supposed to keep the printer running

[Anonymous Coward]

1) You go to Wendy's for finger licking good chili.
2) There is a large box truck behind Wendy's with an (apparently) brand new Sony 50" projection television and a sign that says $100.
3) You buy it, pay the guy another $50 to deliver it to your house.
4) You plug it in after he leaves and nothing happens. You smack it...nothing.
5) You go to bed.
6) You wake up at 9:17 A.M. instead of 6:30 A.M. as your alarm clock was set for.
7) There is no display on your bedside clock.
8) Your power is out.
9) You put your glasses on and realize they are dirty.
10) You grab your bedroom doorknob and burn the shit out of your hand.
11) You realize that your glasses are clean but your home is full of smoke.
12) You escape, glad to have your life. Tis a shame your wife died in the fire.
13) Your house burns down.
14) Sue Sony, collect $2.7 million.
15) Sue the power company, collect $1.2 million.
16) Profit.
17) Due to your continuing poor judgement, you take a skank ho you meet at some slimy bar back to your hotel room.
18) She sees your suitcase with $3.9 million in it.
19) She, being a dumbass too, calls her usual Friday night lay while you piss.
20) He shows up with a .45 and caps both your asses.
21) Profit.

Re:If your supposed to keep the printer running

[surprise_audit]

Redundancy? Hah! "It's not broken now... what are the chances it's going to go down?"

Anyone tried that on me, I'd ask if they carry a spare tire in their car. If the answer's yes, the next question's obvious: "So, you don't trust your other tires not to go down?? Are they not properly installed, or something??"

Re:Windows Only policy is a problem

[dbIII]

I won't rehash the reasons why Linux isn't ready for the desktop.

It's a lot better than MS Windows3.11 isn't it - of course it's ready and is in use in a variety of places. The important thing however is the applications which is why there isn't a monoculture in the first place.

For the corporate world's desktops, its the only game in town.

It depends entirely on what the corporation does. The stuff the company I work for uses has never run on MS Windows and some earlier versions predate MS Windows - in the situation a *nix environment is used. Until recently a graphic designer without a Mac couldn't do a lot either. It's tools for the job - there's not much point putting MS Windows CE on an embedded router, there's a lot of other choices - just as you don't put XP Home on a server that has to do more than spit out files.

One problem with your fix...

[pentalive]

AC says: "My personal philosophy is that end-users should be punished severely for security breaches. "

I have found, working in various IT departments, that if your users know they will get whacked for having caught a virus, they will never report the virus until it is hurting them worse than IT will. In that case, the virus has spread through other machines and the mess is bigger to clean up.

Re:One problem with your fix...

[Anonymous Coward]

I have found, working in various IT departments, that if your users know they will get whacked for having caught a virus, they will never report the virus until it is hurting them worse than IT will. In that case, the virus has spread through other machines and the mess is bigger to clean up./

I have yet to see an antivirus suite that did not include centralized management and reporting. If you are relying upon your end users to tell you that they had a virus alert go off on their PC, then you already have a much larger problem than the virus.

Re:One problem with your fix...

[pentalive]

I have been out of the loop for a few years, we were using McAfee and it had an automatic signature download, but it did not have any report back to the help desk feature.

It still does not help to make your customer an enemy.

Actually

[Sir_Eptishous]

IT guys are a multi-thread to the company...

BULLSHIT - What about janitors

[a_greer2005]

Plenty of offices have janitors, yet I don't see people throwing shit all over the floor and saying "let the janitor worry about it", they use the trash cans/paper recycling containers.

I think the problem isnt complacentcy, it is lack of education -- no one asks the janitor "what is the trash can for?" but all the time the IT guys feild questions at that level of stupidity...and worse -- THEY ACCEPTT IT!!!

Blaming is a part of the problem

[msblack]

The article is rather light on backing and employs weak logic to reach its conclusions. It also relies on some tired urban legends or scapegoating when it compares sloughy users to renters:

...akin to the difference between how renters feel about their apartments and home owners think of their homes.

These tired ownership society attitudes assume actions result from a lack of vested interest while discounting the training issues.

Other postings in this topic lament being on the receiving end of the blame game. Get used to life because there are many situations where others will shift responsibility to high-horse IT employees who, like most others, are not immune to accusations. A little dialog can go far in diffusing the following situation:

[BOSS] John couldn't get that package out to big client yesterday. Why was the printer down?

[IT] Equipment sometimes fails and we put in 110% to keep things running.

[BOSS] Yeah, we lost a million-dollar contract due to your incompetence.

[IT] I suppose it would be fair to ask why Marketing waited until 4:55 to make their print out?

[BOSS] Because they were putting in 14-hour days for the past week. The printer needs to be working during times of crisis.

[IT] If it was so critical, we would have posted someone to continually monitor the printer had Marketing given us the heads up of their deadline.

If you have an unreasonable boss, run fast. These blame throwing tirades are just that.

IT Departments securing thier own jobs

[Bryansix]

Not only are IT Departments a serious security risk for both the reasons that they give a false sense of security to the end user and that a simple mistake on thier side can have grave consequences. They are also mostly around in an attempt at securing thier own jobs.

It seems to me that 90% of all desktop maintenance could be performed by an informed end user. Instead IT locks down everyones computers and forces the end user to submit a request for help to do the most simple mundane things. These inlcude things like oh I don't know, installing the latest version of Java, Defraging your own hard drive, or changing the power management settings on your laptop. This is so demeaning to the end user that most give up and go with the flow. That is they see education in computers as useless since they can just pick up the phone and ask IT. So the very tactic that IT uses to secure thier jobs ensures that most end users are totally computer illiterate and therefore creates a serious security problem.

Re:IT Departments securing thier own jobs

[VoiceOfDarkness]

90% of maintenance could be done by users but 90% of it would never get done because the average user could care less about system maintenance. Most IT staff are not trying to create job security by locking users out of doing things they are capable of. Most of us are trying to save our jobs by preventing users from horking the rest of the enterprise.

Anyone who has ever had to lock down a Windows system to prevent malicious behaviour knows it isn't easy. Until XP you had to be full administrator just to renew your IP address. You still have to be full admin to run a defrag. 99% of users should never even have power user rights - not to mention admin rights - because they do not understand the consequences of their actions.

Many of us spend days on end tweaking registry settings, file permissions and security policies to make the good stuff work seamlessly for (ungrateful) end users while blocking as much of the bad stuff as possible. Our reward? Being bashed at every opportunity because a user couldn't load the latest version of Flash when he surfed to Jib-Jab.

Re:IT Departments securing thier own jobs

[pintomp3]

but what percentage of users are informed? should there be a test to determine what level of local access a user should get? or do we just take the users word for it? kind of like the speed limit, it's set low as a least common denominator.

Re:Windows Only policy is a problem

[Anonymous Coward]

Any IT Dept that adamantly refuses to incorporate, or even switch to, an alternate OS for purely selfish reasons is certainly a problem.

When upper management asks for recommendations and the same old, tired, arguments for sticking with a Windows Only environment are trotted out by the MCSE's in the basement, then IT is doing the company a disservice.

Bah! You're being ridiculous. The single largest factor in determining which platform a company should use for any given purpose is "what platform does our desired application run on." If the market leading product for your particular purpose only runs on Windows, you're going to run Windows. If your application runs on Linux, you'll run Linux. This is the single biggest hole in the vision of certain OSS zealots (and I do prefer OSS software, just not necessarily Linux 100% of the time).

Here's a perfect example. I was involved with a startup about 2 years ago that was going to be a specialty surgical hospital. This was to be a small (less than 50 bed) hospital that focused on a very narrow branch of specialty medicene. The IT department varied from 3-5 staff members over time, including a director. For this hospital we needed the following systems:

Lab information system
Radiology information system
PACS system
Transcription system
Registration system
Patient accounting system
Clinical documentation system
Clinical ordering system
Medical record system
CPT coding system
Surgery scheduling system
Surgery documentation system
Nurse call system
Security and surveillance system
Numerous database and instrument interface systems
Email system
File and print sharing
Intranet site
Directory services
General office systems
Decision support systems
Database analysis systems
Computerized faxing system
And so on...

Newsflash! This hospital's IT infrastructure could only have been built on a Windows platform. Now I won't say that Windows is the only OS that has all of these sorts of applications available (especially since two of those systems run on AIX servers, though with Windows clients). But if there are OSS, Linux, or Debian versions of these applications they certainly are not best of breed, and they absolutely do not have the support of a large company that is a leader in the healthcare software field. And with a IT department of 5 people or less, they were hardly in a position to "roll their own."

That's probably a more eloquent response than a troll post like yours deserves, but I think that it's important that people realize that it's not the "bunch of MCSEs in the basement" that drives purchase decisions for large companies.

Only way to get rid of unresponsible users...

[Anonymous Coward]

...is to make them pay. think about it. if the worker crashes a machine because he hit the wrong buttons or he crashed a car because he was overslept, he will likely be fined or fired by his company. same should be done with IT-equipment; calcuate the working hours the IT-guys have to invest for undoing his/her stupidity and make him/her pay for it. last time you saw this person whining for help ;P

Only if they are hosting UT2K servers

[hawks5999]

I have to say, I've been in more than a few IT departments that use their position and their management's ignorance to host everything from game servers to MP3 servers. Ordinary users can't even think of attempting these activities. It's great to be in IT!!! :D

Re:Only if they are hosting UT2K servers

[Ph33r th3 g(O)at]

You would think it would be just the opposite, that they would be held even more harshly accountable because they should know better. But often, eye-tee is the fox in charge of the chicken coop, as in your workplace. Indeed nice work if you can get it :).

Re:Only if they are hosting UT2K servers

[Anonymous Coward]

Hey! I was just, uh, stress testing that hardware.

Yeah.

Re:Windows Only policy is a problem

[Fulcrum of Evil]

Yes, Windows has a whole heap of shortcomings and everybody loves to hate it. For the corporate world's desktops, its the only game in town.

Who said anything about desktops? Linux works great on the server side. Also, since you brought it up, sure Apple hardware costs more, but it also lasts longer and works better (albeit slower). Maybe it works just fine for some companies - there's no excuse for recommending Windows only out of inertia.

Yeah, yeah. Stupid users, but....

[smchris]

what about the man-bites-dog scenerio where the techs should know better?

What about the IT department that leaves your server's admin password on a piece of paper beside your server? About the busy support that tells the user the data on their boot-unrecoverable desktop is "gone, just gone. Here, let me get things started by reformatting for you!" Couple things I've seen. And a couple things that made me an enemy of that IT department when I pointed them out (and stepped between the tech and the reformat to do the PC data restore for the department in that case).

social responsibility

[doodlelogic]

"Do the facilities people get in trouble for not ancticipating the employee who leaned over to pick up his cell phone off the floor while driving, and failed to install a nice big inflatable barrier along all the roads? Of course not." ...and yet poor road design is one of the greatest contributory factors to road deaths (alongside pubs serving drivers drink).

Re:Windows Only policy is a problem

[Anonymous Coward]

"Migrating to an all Apple strategy would hurt the bottom line as the hw is more expensive and there are a limited amount of biz apps that run on them"

Tell this to the video production department that that has to use Premier instead of Final Cut because IT doesn't "support" Mac's.

Or better still, the thousands of real estate agents who have to use a PC running IE to add new listings to the MLS because Safari, and even IE, on a Mac isn't supported.

2nd failure means your boss gets a bill

[davidwr]

The second time you screw up your boss gets a real bill from IT services, taken out of his budget.

The first time he gets a bill but doesn't have to pay it. He shows it to you. Assuming you were trained on what not to do, that should be enough to scare you into compliance.

Re:Windows Only policy is a problem

[winkydink]

The article is about users feeling emboldened to download risky stuff because the computer isn't their property and IT will fix it. Most users I know don't have servers, but instead have desktops.

The increased cost of Apple hw is small in comparison to the cost of making biz apps run on the Apple hw.

Web Content Filters

[HermanAB]

Considering how easy it is to set up a web content filter and how few corporate IT departments bother to do that - I tend to agree with the headline that IT departments are security risks.

If a user can click on something in a browser or email client and cause a security issue, then the problem is incompetence in the IT department.

Re:I believe it

[HermanAB]

What about filtering viruses over SMTP and HTTP. It is not black magic. If the IT dept doesn't filter everything, then they are either lazy, stupid or incompetent - pick any three...

Do seat belts make people bad drivers?

[GrigorPDX]

Come on now ... just because there's some sort of protection doesn't mean the protected person is more likely to take risks.

Now, the concept so many have posted about regarding the IT staff themselves being the greatest risk is entirely plausible, if not likely. Power and a feeling of being above the rules is far more dangerous combination than simply knowing someone's there to clean up the mess you make.

Re:Personal Accountability Is Just No Longer Styli

[Infonaut]

It shows up in... how they surf

True. I can't tell you how many times clueless Valleys have cut me off when I'm about to drop in. I feel no compuction in slicing their boards.

*ducks*

Just like a healthcare savings account

[Anonymous Coward]

Ok, rank-and-file employee. We've put aside $X.
If you screw up your box so bad that you can't fix it yourself, we call in the big boys and deduct their charges from that account.

Whatever is left at the end of the year, you get to keep.
If you deplete the whole account before the year is up, you're fired.

gewg_

Not suprising...

[gnovos]

...because this is the same behavior that people will exhibit if there is a security guard working the desk downstairs. Anyone who makes it into the building has free reign to wander around and steal stuff if they have the right expression on thier face.

Same thesis, different department

[soft_guy]

It is like saying that having a QA department lowers your quality. Sometimes true. Sometimes not.

Re:Same thesis, different department

[NaDrew]

It is like saying that having a QA department lowers your quality. Sometimes true. Sometimes not.

Having a QA department doesn't necessarily lower quality, but it most definitely lowers the mean IQ of the office.

Bad author! No donut!

[Sigma 7]

I read the first paragraph - almost immediatly, I remembered a job offer:

- System Administrator (network)
- $7.25/hour. (That's right - below mimimum wage.)
- Located in Navan (which is hard to reach by bus - taxing a car is an option, but only minimally.)

The systems were alreahy infested with malware that generate popups. This is also a computer consulting company. (I'd love to name them, but was never given the name of the company.) This single example proves that hhe lack of IT department or equivalent thereof is no less secure.

Besides, with an IT department (not counting pseudo-departments by nome only), there is actually an ability to learn from mistakes of users, ane refining policy and training to make sure that inappropriate computer use is known by the employees to be inappropriate (and detectable.)

I agree

[schoolisdeath]

On your arrogance comment. I was on the IT side of things for around 8 years in 4 different places (including a university) where I was, or was a part of the IT department. We all did things that we would have reimaged a user's computer for. On a daily basis. With one of my co-workers at the univ., I legitimately reimaged (it had died from misuse) more times than any user. wow. Now I'm IT Audit at a big 4 firm... and I see that the IT departments I worked at were actually good. I hear a lot of the arrogance of which you speak. Not to brag or anything, but even the newbies over here are incredibly intelligent and, generally speaking, know more than the senior vps, cios, it directors, etc combined. I think the arrogance is a defense mechanism in most cases for having, in ascending order: a) a crappy job i) crappy mgmt ii) crappy IT security policies b) crappy attitude c) lack of knowledge that's my $.02 But most IT people are better, now that I deal with almost exclusively Fortune 500 people. Which, should be the opposite if arrogance is a result of actual knowledge or success as many people think. btw, I think all the big-4 have enough expertise and experience to audit all your systems, but I may be wrong. ---- my username has a long history, don't asque

Limited set of operations

[Pac]

A gas oven, a steam iron and an automobile all have a very limited set of possible operations. Even the most versatile of these machines, the automobile, can be operated with a small set of phisical operations and the knowledge of a simple ruleset (the side of the road you're supposed to be on, the meaning of traffic lights, etc). If you were right, misusing any of them would be very rare, obviously not the case with automobiles (the one with most degrees of freedom).

Computers, on the other hand, are almost limitless machines - change the software you completely changed the way the computer works. There are so many possibilities and so many degrees of freedom that most people won't be capable even to contemplate them all, much less control them.

Related to eye-tee powertripping

[Anonymous Coward]

If a user who used to be trusted and expected to know how to avoid problems is suddenly placed in lockdown, what motivation does she have to mitigate the threat? Why would she spend her time try to protect the heavy-handed network Nazis?

~~~

Re:Windows Only policy is a problem

[Fulcrum of Evil]

The article is about users feeling emboldened to download risky stuff because the computer isn't their property and IT will fix it. Most users I know don't have servers, but instead have desktops.

The GP wasn't addressing Linux on thr desktop, and the idea of it is sufficiently odd that people still refer to it specifically when they're talking about it.

The point about bizapps stands unless the company moves its apps to intranet servers, which is happening a fair bit. An Imac + webapp makes for a fairly nice, secure setup.

Well...

[Tuxedo Jack]

I run my LAN like Simon Travaglia's BOfH does.

- Lock my machine and the server room doors when I leave for ANY reason
- Only use Firefox
- Mac OS X machine for work, fully-patched locked-down XP machine for admin stuff
- Realtime antivirus on the Windows machine, plus HijackThis and Ad-Aware
- Total and complete control of EVERYTHING on the LAN - if I don't personally approve it, it doesn't go on
- VNC is on all my user machines (I told them it was for remote repairs. Let them believe it - I like watching J. Random Luser downloading things with lots of flesh tones)
- If a user misbehaves, I lock their accounts until they've come to me and apologized in some suitable manner

Just know your LAN, know your role, and beat the shit out of the users who don't cooperate.

Re:Windows Only policy is a problem

[stor]

I won't rehash the reasons why Linux isn't ready for the desktop.

It depends on the business.

I used to work for an ISP that utilised XTerminals w/4M Ram for all departments, including customer service. The apps ran on FreeBSD.

It was a DE of: fvwm (although I ended up moving to olvwm), exmh and Netscape.

Sure it wasn't the prettiest thing in the world and it's not appropriate under all conditions but for the role we had it doing it was fine. No-one complained: they could do their work.

One of the great things was these machines had no hard drive. That alone reduced maintenance costs significantly and when a machine crashed you could reboot with almost reckless abandon.

The XTerminals with centralised server setup is a great demonstration of the elegance and manageability of X and Unix. Having all client data and applications on one server that can be scanned for viruses, backed up, etc. is wonderful. Being able to roll out (or roll back) new versions of applications to all clients by changing one symlink is powerful.

I know you can do similar things with Citrix but I only really hear horror stories about that product and it costs more than most businesses can afford. MS Terminal Services is pretty good but it still feels like an add-on product/hack like VNC rather than a network-transparent desktop environment.

Cheers
Stor

and Katrina victims...

[Anonymous Coward]

assuming the rest of us (i.e. the Federal Government) will foot the bill for their poor choice of living in a location with well known risks. (and then having the hubris to complain if it's not large or fast enough!)

Whatever happened to personal responsibility?

That's yer job.

[Mr. Underbridge]

'That confidence,' says the article,'leads workers to do risky, even stupid, things at work, such as opening questionable e-mail messages or clicking on unknown Web site links.' Employee education and training doesn't help, either: '[S]ome workers slough off responsibility for even knowing about threats. Workers in larger companies don't worry about being educated. Big company employees just don't see security as their responsibility.'"

Well, at the end of the day, it's not. It's your responsibility as the IT person. Giving users privileges to do thise stupid things is the problem. Don't do it.

Workers shouldn't be expected to be security experts any more than the IT person should know how to do everyone else's job.

IT needs more balls

[VoiceOfDarkness]

Both sides of this debate are correct. Simply having protection does not create the behaviour you are trying to protect against. BUT, users will get lazy and complacent the more they are coddled. The lazier and more complacent they become the louder they whine and complain. Management looks at the situation and decides IT needs to do more with le$$. It's a downward spiral from there.

We can't rely on acceptable use policies with no teeth. And we can't expect C-level executives to make the rules and enforce them. At the risk of being flamed into oblivion let me say, IT needs to grow a pair and lay down the law.

We need to take a long hard look at the business and figure out what THEIR pain is if the users screw up. You can talk about spyware and anti-virus until you're blue in the face and most non-techies will just glaze over. But, when you tell a sales exec that a "million dollar proposal" could be delayed by several hours because his numb-nut sales reps are infested with spam-bots, ears perk up - FAST.

As painful as it may be, we have to think outside the tech realm. We have to understand what the business thinks is important and play off that. Once you start putting dollar values on consequences - in terms the business can understand - funding and policies with teeth are right around the corner. Or, we can sit and whine like users.

Before anyone says I must be management or an MBA weener let me say Wrong. I've fought this battle for years from the help desk all the way up to network engineering. The only way to stop the madness is to think about it from the business' perspective and put the costs in terms they can understand.

Re:IT needs more balls

[dbIII]

we can't expect C-level executives to make the rules and enforce them

Then get rid of those losers and replace them with A-level executives.

If you put things to higher levels of management in the manufacturing terms of downtime and lost production then it is a lot easier to implement a policy.

Mitnik

[Wayfarerman]

Is this not what Kevin Mitnik has already displayed in public. Exploiting the lack of security displayed by most non-IT employees in large corporations?

It's the other way around

[Gary Destruction]

It's not the IT department that's the problem. It's the higher ranking people that whine because their workstations lock after five minutes or because they have to enter their user name in after logging off or rebooting. But those people are so important that if they whine enough, they end up getting their way. Those are also the people that bitch because someone messed with their computer while they were away.

Re:Windows Only policy is a problem

[winkydink]

Everybody used FreeBSD and Xterms? What accounting package did your finance team use?

Re:I believe it

[Oriumpor]

Which is all well and good until the first genious logs into a non-virus filtered SSL Web based proxy and starts surfing finaldownloads.com. User education and management policy are just as important (if not moreso) than software solutions.

Not to worry...

[Anonymous Coward]

...the IT department where I work is so incompetent, no one would ever rely on them to clean up anything. ;)

This article is wrong, and dangerous.

[Harker]

The problem with corporate security is NOT that of the IT department, it is the users, who may or may not be in the IT dept.

This kind of attitude is a dangerous one for IT because if corporations start to think in this manner, it's only a matter of time before they start to "outsource" even more.

No, the problem IS with the user. The one who opens a suspect email, or who's visiting risky sites is the one who needs to pay the price for their mistakes. Downtime, or worse.

The attitude that "IT will clean things up if I get a virus" will quickly go away when people start getting reprimanded for unsafe practices.

Perhaps I'm just being a hard-ass, but I guarantee after one or two people get fired for surfing inappropriate sites, or opening an email with a virus, the problem will start to go away.

H.

Responsibility

[Kludge]

Big company employees just don't see security as their responsibility.

That's because it's not their responsibility! It is the responsibility of the IT department.

workers do risky, even stupid, things at work, such as opening questionable e-mail messages or clicking on unknown Web site links.

I have no fear of opening my emails. I have no fear of clicking on (gasp!) unknown web sites. Any IT department that allows computers where such petty actions are actually threats to security is a pretty damn poor one indeed.

There are two effective ways to deal with this:

[dgh]

Set the rules, anyone who violates them gets fired (maybe three strikes or something for minor things).

Or, you fix your own mess. IT will get to it when they have time.

I've been employed in different companies where one or the other method was practiced, they both work.

Logic?

[OBeardedOne]

Quick! Get rid of the hospitals, they are making us sick!

Re:I believe it

[HermanAB]

Heh, yeah, though the first time that happens, the IT geniouses should find a way to plug the hole and then it should never happen again.

At present, most companies don't filter web access at all and also install IE with Craptive-X for their users and then still has the audacity to blame the users for fucking up their machines.

This is equivalent to leaving a 4 year old in a candy store and expecting him not to take anything - or deliberately placing a drugged bull in the middle of a china shop.

Whatever happens then is your own damn fault...

Maybe Doctors are a risk...

[Comen]

Maybe Doctors are a risk because
People tend to engage in dangerous/insecure/irresponsible habits (ie smoking eating crap etc...) because they know doctors and medican will clean up the mess.

You can say this about lots of things that are dangerous.

Re:Windows Only policy is a problem

[vertinox]

Yes, Windows has a whole heap of shortcomings and everybody loves to hate it. For the corporate world's desktops, its the only game in town.

You'd be suprise what major companies are only Mac only shops. I probaly shouldn't name names (because of my current job as an outsource person) but next time you look at a magazine rack at a store, you can bet more than two of those are mac only shops.

Not to mention a major clothing store has mostly Macs...

But yes the majority of the standard corps are Windows only. IMO the main reason Mac isn't used yet is because there is no really good Exchange replacement except for Lotus Notes.

There is Groupwise and Outlook for the Mac but they are crippled compared to their windows counter parts. Entourage can't even do delegation and "out of office" plug-ins so its not going to work as a replacement.

Until someone compiles a book of them...

[phillymjs]

...this site will have to do.

~Philly

No Brain, No Headache

[Doc Ruby]

"White lab rats cause cancer."
  - /usr/bin/games/fortune

maybe IT IS the problem

[Anonymous Coward]

Cmon, the guys that actually download most of the stuff around the workplace are usually the IT guys.
Man, you should just get back to work fix the stuff and dont say anything, if you dont like it im afraid its not going to change, its simple human nature.

Ive done helpdesk for a long time now, and although most of the stuff i get calls on is pretty simple stuff, well, thats the reason i get paid.

My job is not to change the final users habits,
since they already have an assigned task!

Besides, i found that the more i thought about it, the less i actually enjoyed the work, and i would rather not become bitter over it.

Just for me....

[Anonymous Coward]

*Make* me use the-pile-of-poo-OS, and I'll be abusing it.

Offtopic?

[theTerribleRobbo]

Sometimes I wish mods would read the post before marking posts as 'Troll' or 'Offtopic'.

You think THAT'S bad...???

[Anonymous Coward]

Try getting top-level government officials and executives in government agencies to cooperate with security requirements. I know FIRST-HAND that, at least in the VERY LARGE, PROMINENT, TOP-TIER government agency where I work, you can't tell the upper-brass anything-- and they're dumb as bricks when it comes to security, computer safety, opening questionable attachments, potential virus-laden mail, or even dealing with spam/phishing. They do really stupid shit and then blame everybody else for "lax security".

Right, and what of real security?

[Telastyn]

I'm sure that workers at companies without security guards are the paragon of vigilance.

This is called "moral hazard"

[Anonymous Coward]

...and is used to justify failing to provide security for those not able to fend for themselves.

The problem, of course, is that the idea is ridiculous. People, when faced with the choice between leaving New Orleans (how inconvenient!) or staying and *being taken care of by overproviding relief organizations after their lives are destroyed* rationally choose the latter?

Computer users aren't educated enough to maintain their own systems. They aren't making a choice between occasional security breaches or system failures and a constant low level of effort to keep things working. To them, computers break, and then they get fixed.

The parent should probably be marked "troll", but because of what passes for mere partisanship in the US, it is instead an insightful defense of the government.

If you want to make a legitimate argument, talk about federal flood insurance.

Yes it is their responsability

[cactux]

The big big company where I am currently working forces me to use windows. I requested Linux, and it would be better for my job: I am either doing email or connected to unix machines (Tru64, HP-UX and Sun).

But no, the corporate 'standard' is windows xp.
That's irony when you know they sell hardware with Linux pre-installed :-/

They forces me to use windows, the security responsability is theirs.

Basic Security Comes First

[msobkow]

All laptops, workstations, and PCs provided by the company are the property of the company. They are provided to help you do your job.

• Password protect all accounts. Enforce password hardening and mandate changing passwords every 90 days.
• Secure the root, Administrator, and service accounts. General users should not have access to these accounts.
• Ensure that all company approved and installed software is updated in a timely fashion. Have an emergency rollout plan in place for high priority security fixes.
• Maintain a corporate update server for deploying software updates.
• Check systems for unauthorized software on a weekly basis.
• Identify and deploy anti virus products for required client platforms.
  • Schedule weekly full system scans of all client workstations and PCs.
  • Do not allow laptops, PCs, or workstations to be connected to the internal networks without updating the anti virus.
  • Do not allow laptops, PCs, or workstations to connect to internal networks if full system scan has not been performed in the past seven days.
• Identify and deploy anti spyware products for required client platforms.
  • Schedule weekly full system scans of all client workstations and PCs.
  • Do not allow laptops, PCs, or workstations to be connected to the internal networks without updating the anti spyware.
  • Do not allow laptops, PCs, or workstations to connect to internal networks if full system scan has not been performed in the past seven days.
• Identify and deploy firewall products for required client platforms.
  • Default deny all incoming ports.
  • Servers open specific incoming ports required to publish and run their service.
  • Require management signoff to forward service ports to the public internet.
• Assign all users a corporate email account id.
  • Default-deny internet email for user accounts, restricting them to emailing in the company domain.
  • Management signoff is required if a task/role requires internet email.
  • Run email through as many virus scanning tools as you can afford.
  • Identify supported email clients for required platforms. Ensure that email clients are configured to virus scan all incoming emails.
  • Quarantine all emails with executable, screen saver, or other high-risk attachments.
• Secure all internet access.
  • Use password-protected proxy servers to prevent unaudited use of corporate resources.
  • Audit access to external websites and ensure that all users are aware of the policy.
  • Flag all attempts to access questionable sites.
  • Block all attempts to access blacklisted sites.
• Install and configure office automation software. Management signoff is required.
• Install and configure additional software as per management signoffs.

Re:Basic Security Comes First

[Tye_Informer]

I work in an environment that is this restrictive. I estimate that it costs me 3 to 4 hours a week of productive time to work around the security restrictions.
  1)The checks to make sure my machine is secure before I can connect it to the corporate infrastructure alone take 10 - 15 minutes a day every day that I take the work laptop home. And I have to take it home everyday because I am frequently called at home to check/fix something. This is an hour a week of lost time waiting to even be able to open email first thing in the morning.
  2) I do not have access permissions to install any software, which also means software I write on company time to do company tasks. What this ends up meaning is a one to two week delay in deploying softare I write to speed up my job to my own machine, let alone the other team mates.
  3) All internet access is restricted. If I need to download a patch that can't be sent to me via email I have to do it somewhere other than the company network.
  4) I am unable to send email to any internet address that is not specifically white-listed by management. This means even sending logs to a 3rd party for analysis requires me to send to a white-listed external address with a request for them to forward it to the person I need it to go to.
  5) My system is scanned for unauthorized software on a regular basis, unauthorized sofware is removed even from an external storage device. This means any executable file that I create to automate some task is removed without warning. Until I realized this was happening I wasted many hours automating several tasks only to lose all of that work when the file was removed.
 
Basically it is a nightmare environment to work in, and I am positive the workstation support personnel that implement this do not have the same restrictions.
 
If you want to implement draconian restrictions, implement them for everyone with no exemptions. Every security restriction plan needs a documented process to handle exceptions to the default, everyone must follow this process. When the manager of the security team gets an onslaught of emails with exceptions for his own team he will understand how the restriction affects most other teams. Unless your company is filled with large groups that do exactly the same thing you cannot make a single image/list of applications that will work for everyone. Even the secretary group will have one-off needs. (One secretary needs access to MS Project, another to Visio, another to internet-travel sites, etc)
 
  My other piece of advice, fire the power-hungry sysadmin. And if that is you, remember this: "Why do we need you if the system is so bulletproof now? And if it isn't bulletproof, why do I put up with all the restrictions!"

  "Those that give up work-flexibility for network security get neither"

Re:Basic Security Comes First

[tbannist]

Final Step:

• Wonder why you don't have any employees

Seriously, many of these rules are overkill and/or impossible to enforce. At some point you have to site back and realize that employees are people too. That means they're going to use internet access for personal use, they're going to use email for personal use. Trying to block both of those just means any reasonably competent employees will immediately begin looking for a new job somewhere else. The only people you'll be left with are the lumps who have few skills and no ambition.

Particularly, forcing users to change passwords every 90 days is pretty dumb. What the hell is it supposed to accomplish anyway?

Re:Windows Only policy is a problem

[stor]

Everybody used FreeBSD and Xterms? What accounting package did your finance team use?

Good point. We had an MIS department that produced reports in Perl. They were on Xterminals too.

Sales and Marketing were in a completely different office (in another suburb) and they probably used Windows but I don't know, sorry.

The ISP was a manufacturer of XTerminals before becoming an ISP, hence the unix-centric focus and plenty of spare XTerminals.

I'm sure there must have been a Windows box with Quicken somewhere though. There always is, even if just for payroll... that's why I think you're right in pulling me up on it.

As I stated in my previous post this setup isn't appropriate under *all* conditions. I can't see a graphic design firm or advertising agency taking on this sort of setup any time soon for instance. My point is that this setup is very workable under a very good number of conditions, more than people think apparently.

Cheers
Stor

Re:Personal Accountability Is Just No Longer Styli

[i_am_not_a_bomba]

and how they surf

Oh i don't know, when you're face to face with a set of 20 foot waves about to unload a few hundred tonnes of water on your head, the only help you can expect is from yourself. No government department, "safety net", charity, family or friends to lean on. Just your primal fear and weak and puny flesh and bone versus the full fury of the ocean.

Most surfers understand personal responsibility better than anyone else.

Oh you mean 'internet surfing', well can't help you there ;).

It's called risk compensation

[driptray]

I don't know about guard rails, but the evidence suggests that both mandatory seatbelt laws (throughout the world) and mandatory bike helmet laws (in Australia and New Zealand) have not reduced the rate of death and serious injury of car occupants and bike riders respectively.

It's because of a well-known phenomenon called risk compensation.

Nonsense

[Tom]

That's like saying that police is the reason for crime because people don't lock their houses down as much knowing they can go there.

It's utter and ridiculous nonsense. Without IT departments people might (and I very much doubt it) be more careful with their computers, but as soon as something happens anyways (and it will), there is nobody there to clean it up and it will spread uncontrollably.

Bright idea, really. Let's dismantle the police, I'm sure crime rates will drop.

Oh so *that's* why so many IT departments suck

[allanc]

It's not that they're staffed by incompetents, it's that they're trying to increase security by making people think they're incompetent so they won't assume IT can fix their messes!

It's brilliant!

Competent MIS?!

[jandersen]

I have yet to work in a company (or even hear about one) where the MIS are not incompetent, footdragging anal-retentives; what planet is this article referring to?

No, the biggest security risk in any company is the use of Outlook, Word, and Windows.

Windows, with its tendency to default to executing things and hiding information from the user, so the average user doesn't always have a chance to know that they are executing code.

Word, with its builtin BASIC interpreter; I should think that would be obvious.

Outlook - need I say more?

I use Linux with Firefox and Thunderbird; I've even turned off HTML viewing in Firefox. I haven't been bothered with anything like viruses ever. Not once - but our Windows users are constantly under attack, and even though they constantly upgrade their virus filters, they still get infected.

Is you IT department a security risk?

[halleluja]

Yes.

Clicking on unknown links?

[Anonymous Coward]

Amazing to see that "clicking on unknown links" is considered bad security practice. That's, like, the entire point of the Web! Somebody needs a better browser...

IT and Auto Safety Glass

[SeanDuggan]

Their argument reminds me far too much of that argument by the auto industry against using safety glass in windshields because it would cause people to drive faster because they would feel too safe.

Cause and Effect - User Training

[DaveFromChicago]

We try to keep our users informed and teach them what to do and what not to do when it comes to surfing, clicking and virus prevention. Nevertheless some manage to shoot themselves in the foot. Those who do, after being isolated from the network and shut down, are moved to the bottom of the help list and dealt with at the end of the day. I've found that making them simmer for a couple/few hours without a PC tends to drive the message home.

Oh, Yeah???

[Anonymous Coward]

[ petulant rant ]

Well FUCK YOU! Fuck your mother, and fuck your sister, and the guy that does your laundry, and your household pets, and the horse you rode in on. FUCK all of it. You IT people are here to serve US. If you can't stand the heat, get out of the kitchen. He who hesitates is lost. Look before you leap. A penny saved is a penny earned. Why don't you go skiing? If architects designed buildings the way you IT people design your security procedures, then the first woodpecker that came along would be killed by some loser. There are 10 kinds of people in this world: one who understands binary, and six who don't.

I hope that I have made myself sufficiently abusive without being overly clear.

Re:open source?

[Forbman]

No they won't. Eventually, this will go up to the VP/SVP level, and then you have several VP/SVP's squaring off at the IT department and its chain. Guess who loses the executive politics battle if the CEO decides that IT is "out of control"?

Re:open source?

[techno-vampire]

Guess who loses the executive politics battle if the CEO decides that IT is "out of control"?

That's not the issue we're discussing here. We're discussing ways to teach people to be responsible for their actions and not force IT to pay the price for cleaning up messes that shouldn't have happened in the first place. My suggestion implied that it was company policy that those costs be paid for from the budget of whatever department, division, project or whatever was responsible for it, instead of being paid for by IT.

It also assumed (though I didn't specify) that there'd be some objective way to decide who pays. Getting infected by a brand-new virus, before definitions are updated? IT pays. Getting infected with an old one because you opened an attachment from a total stranger? You made the mess, you pay for cleanup.