Slashdot Mirror
Security Fears Prod Firms to Limit Staff Web Use
Carl Bialik from WSJ writes "Companies are limiting employees' use of free Internet services, such as Skype and video downloading, to protect themselves from viruses, communications traffic jams and regulatory missteps, the Wall Street Journal reports. ABN Amro's global head of strategy and engineering tells the WSJ, 'I'm not allowing Skype because I don't know what it does.' Some colleges and departments at Cambridge University also ban Skype. The limits affect executives as well as the rank-and-file, the WSJ finds: ' "I used to think nothing of checking my Yahoo mail several times a day," says Global Crossing Chief Marketing Officer Anthony Christie. Now that he can't, his long workday makes it hard to avoid using his work email account for personal messages, he says.'"
What's next? Complaining that you can't use company funds to go on a vacation? Complaining that you can't use company computers to play games?
This guy should write legal policy in Burma: ... tells the WSJ, 'I'm not allowing Skype because I don't know what it does.'
I mean, just, wow. And here I thought that the "anything I don't understand must be bad" school of management was going out of style.
"I used to think nothing of checking my Yahoo mail several times a day," says Global Crossing Chief Marketing Officer Anthony Christie. Now that he can't, his long workday makes it hard to avoid using his work email account for personal messages, he says.
Sometimes I wonder if this is exactly what companies *want*. They don't want people to use outside e-mail (especially ones running over https) because then they can't easily monitor what their staff is doing.
If people are using their work e-mail for their personal use, the company gets to see exactly what, where, how, and when their employees are spending their own time. If the employee opts to not use their work e-mail for anything personal, the company knows that they now have the other added benefit of possible added productivity.
I'm just glad I can use SSH and tunnel everything over that. If I can't do that, I have GPRS service on my mobile device and I *could* use that for AIM, e-mail, and browsing instead.
Dear employee,
We hope you enjoy working here. Please work hard and do some great work for us!
Thanks,
Your employer.
P.S. WE DON'T TRUST YOU.
I'm not allowing X because I don't know what it does does not necessarily equate to X is bad
Banning an unknown service from a network is the more sensible default decision for a corporate network to take. Firewalls should block everything by default, corporate desktops should stop installations of anything not checked and cleared. Why should skype be any different?
You have to admit that honesty is a rare quality, even if he is a bad manager.
I've always prevented my users from downloading *any* program from the internet. There are a multitude of reasons: spyware, bandwidth issues, etc. I just think it makes good sense to limit the crud that can be put on machines. I don't have to wonder if the problem a user is having is due to something they downloaded. Being Healthcare, I'm also bound by HIPAA. My interpretation of it is what I just mentioned above. It actually gets me in a frizzle (word?) when I see the junk my father's company allows them to put on their machines. They aren't healthcare, but I would think the hassle of tech support would be magnified many times over...
If your employees only need particular websites and particular applications to do their jobs, then why would you willingly open up additional attack vectors? It's a completely unnecessary business risk.
If you have employees complaining about needing to use personal email (what did they do before email in the workplace was common?), then simply set up a shared cheap PC in the coffee room for them to use on their lunch break. Firewall it off so that when all the inevitable crap gets onto the machine, it doesn't affect any important systems.
Bogtha Bogtha Bogtha
I expect a few hundred flames of this statement, but it's a rock-solid security policy. Yes, this guy probably "should" know what Skype is in most people's opinions, but his default "deny" policy for anything he doesn't know is correct, and that attitude WILL prevent trouble. On a corporate network, especially one potentially carrying any kind of sensitive data, anything not specifically allowed should be denied. If employees can make a case about what any new service is and why they need it, it can be evaluated and perhaps allowed, but it should be denied by default.
-- http://frobnosticate.com
Skype is closed source, the binary is full of obfuscation, and you can't examine the network traffic. "Trust but verify" is replaced by "trust".
You could use Filemon to make sure Skype's not reading your disk, and other tools to check whether it's keylogging, but a busy paranoid could be excused for not taking the trouble.
I sure wouldn't want to pay a sysadmin who allowed things on the network without knowing what they did.
(I use Skype at home but I'm not risking someone else's network by doing so).
Note, he is not saying that he doesn't know what Skype is he is saying that he doesn't know what it does. That's fair enough; I've read a fair number of accounts by people who have attempted to work out exactly what Skype is up to on their networks, and very few people outside of skype know exactly what Skype does.
It uses a proprietary closed protocol, nicely encypted; is adept at getting through firewalls and most important can turn office PCs into high-traffic relays without warning and without the ability to stop the relaying behaviour from the client.
In related news, the submitter conflates the Internet and the Web. Which is pretty annoying.
Some companies see giving employees small perks as part of keeping a happy and productive work force... can anyone remember the stories of the environment at EA? Now, we have tin foil hat stories about companies that give their employees pens and paper, but warn them to only write in block letters because anything else is a waste of company resources, or could lead to dangerous events in the file cabinets.
Ummm, perhaps its just me, but it is about fscking time that both government and businesses learn the lessons that have been sitting in front of them since about 1991... computers are here to stay, and the advantages and disadvantages of computers are here to stay too.... Its not that hard to limit outside network connections to a specific bandwidth, or monitor all packets in and out... this is not rocket science. Using draconian measures to squeeze every drop out of the company resources is not good for business... see Boycott, Company Stores et al, slavery,
I guess my point is that anything that stifles free and unfettered flow of information and ideas is going to stifle business productivity and innovation. I don't have links, but I thought this was pretty much already scientifically proven... or at least proven in the advent of F/OSS and what it has done to the computer and software markets. Just as the *AA needs to wake up and find a new business model, most of the rest of the business world has some work to do... its just common sense. Anything else usually involves putting holes in your feed with lead ladden projectiles.
Support NYCountryLawyer RIAA vs People
"Locking down" machines, which usually means preventing users from installing or running software that the admin hasn't "approved" is far more likely to reduce productivity than anything else. I can't tell you how many times I've been frustrated by the admins who have the idea that they know better than I do what tools I need to do my job... In fact, it's something that I ask non-manager employees when I interview: "Do you have admin privileges on your box" (working in software, I usually get a sensible response).
Listen, all you genius admins, I don't tell you what firewall software to use, you don't tell me what file conversion software I need to get the Windows line breaks out of text files, Ok? I don't what you're using for an anti-virus tool, and I don't expect you to know about my use of FrameScript to automate FrameMaker. The MicroType FM extensions make me about 10% more efficient in my work, and if I can't download and install them, I'll see if we can't backcharge IT for that extra hour a day.
A sensible policy is that "unapproved" applications are unsupported. This means that if something I install causes problems, I have to resolve them or have my box re-imaged. I'm fine with that. Don't "lock down" my machine, prevent me from doing my job efficiently, and then crow about how you've saved the company money.
Interested in a Flash-based MAME front end? Visit mame.danzbb.com
What everyone here is missing, from what I was able to read, is that for some strange reason employees feel they have some inate rights/entitlements to company owned resources. This simply is not the case. People are paid to do work, not engage in a social event, regardless of what it is. This is no different from limiting phone use to business only calls, or preventing people from making copies for non-business related items. There is no difference. But, as the computer culture and pervasiveness of instant gratification continues to expand, people believe that the computer is exempt from these long standing ideas. Your work time is for work. Your social time is for other things and use of any equipment or resources, regardless of what it is, lies solely with the policy and discretion of the employer.
The "I can do X on my home computer" does not work, nor should it be allowed to work as some catchall for enabling and allowing those uses in the workplace. I have a saw at home. If I worked as a carpenter that doesn't give me the right, nor the expectation, to use a company provided saw as my own to work on personal projects. Try that on a job site and watch yourself fired in no time flat. Your at work....work. If your employer allows you to use company resources for other things, count yourself fortunate and be happy with what you can do while getting paid.
I'm one of the head network honchos at a Very Large Company... things like AIM, MSN Messenger, Skype, Limewire and BitTorrent are all banned and blocked. We monitor our employee web usage, block just about every outbound network port except for 80 and 443. Why? Because even though we know why Skype is, our policy forbids users from installing software that we don't provide. We certainly don't want users utilizing our 100Mbps lines for donwloading pr0n, MP3s and warez. We don't want support calls from users who have bolloxed up their machines by installing $UNAPPROVED_SOFTWARE_PACKAGE, diverting valuable resources to try to fix this. We don't want the worms, viruses, spyware and other crap that comes with some of these packages. Every employee that uses a computer reads and signs our usage agreement, so they know what we expect from them. Some of them try, and some get to see the man when they do.
Because of all the attack vectors, we have to spend many tens of thousands of dollars on antivirus, monitoring software, desktop security agents, intrusion detection, firewalls and what have you...
Things like SOX and HIPAA make it extremely hard for us to "just let users be". We can't allow unmanaged VoIP or instant messenging. FTP? Blocked. SSH? Blocked. Our data could easily walk out of here, which is why on top of the layer 3 blocks, we block USB access as well. Our users are given the tools they need to get their jobs done. And if data can walk out of here, there is certainly possiblity that something nasty could come in. We'd rather not have to deal with that possibility, so we make sure we don't have to.
It's the company's network, they can dictate how its used. Don't like it? Don't use our network. Go home, do whatever you want on your equipment, but when you're in my house, it's my rules.