Slashdot Mirror


Telecommuting Backlash

coondoggie writes to tell us that advocates of the telecommute have stood up against recent finger pointing based on recent telecommuter screw ups. One of the more notable screw up was the recent loss of many veteran's personal information by a VA employee. From the article: "Despite years of growing acceptance, telework still has such detractors. 'The No. 1 challenge is cultural inertia. It's motivating the middle managers, teaching them a new way of doing work,' O'Keeffe says. 'It's the Luddite mentality that we need to change.'"

18 of 250 comments (clear)

  1. The problem isn't telecommuting by Loconut1389 · · Score: 5, Insightful

    The problem here isn't telecommuting, it is bad security practices and these problems probably would have happened one way or another, whether it's over a SSH tunnel, VPN, or local on the lan.

    1. Re:The problem isn't telecommuting by susano_otter · · Score: 4, Insightful

      It's kind of hard to walk off with tons of senstive information when it's being transmitted over an encrypted channel.

      I think it really is about telecommuting, and laptop computers. More and more, sensitive data is portable, and more people are taking advantage of that to move sensitive data from "secure" environments to "convenient" environments.

      Having some asshat steal a computer full of data doesn't really happen that often to people who keep their computers locked in an office at their employer's campus.

      --

      Any sufficiently well-organized community is indistinguishable from Government.

    2. Re:The problem isn't telecommuting by drinkypoo · · Score: 4, Insightful
      The problem here isn't telecommuting, it is bad security practices and these problems probably would have happened one way or another, whether it's over a SSH tunnel, VPN, or local on the lan.

      I both agree and disagree. On one hand, the problem IS bad security practice. It's possible to telecommute safely. On the other hand, the simple truth is that telecommuting opens up new attack vectors. Your data can now be attacked on your system at home, before the VPN is up. It can also be stolen more easily; security on your average office building is better than on your average house.

      On the other hand, THIS particular problem could have been avoided by simply using some encryption. Clearly, those who take home confidential data without encrypting it are morons. Some of you are now parting company with me over my allegedly elitist attitude but let's face it, people have been encrypting messages for hundreds (thousands?) of years. This is not a new concept. A user taking home confidential data should be asking themselves how they can protect that data. Anyone who doesn't ask that (in our litigious society, especially) deserves what they get, because they're stupid.

      I don't expect everyone to know how to keep data secure. I DO expect them to care enough about it to seek the advice of someone who DOES know.

      --
      "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
    3. Re:The problem isn't telecommuting by networkBoy · · Score: 5, Insightful

      Take your secure environment with you!
      My employer mandates that the encryption feature of our notebooks be used. But it's a PITA, especially if your drive gets corrupted. To counter that we have an on-line backup system that takes a daily image (file by file, not binary image of the disk, for obvious space savings possibilities) of your drive and stores it whenever you are in the plant. While you are off-plant you are still secure because of the encryption. If we lost a notebook we could lose billions of dollars (assuming it's the right notebook). Shit, the data on mine is worth ~$75-100M.

      The headlines should read: MegaCorp loses notebook with customer data on it. Company issues this statement: "This is a non-issue, the notebook was encrypted with a system that meets XYZ standard, it will take no less than 200 years for the system to be cracked."
      And the statement should be true.
      -nB

      --
      whois gawk date unzip strip find touch finger mount join nice man top fsck grep eject more yes exit umount sleep dump
    4. Re:The problem isn't telecommuting by AK+Marc · · Score: 4, Insightful

      Having some asshat steal a computer full of data doesn't really happen that often to people who keep their computers locked in an office at their employer's campus.

      No, the companies give away the working computers with all the data on them when they are obsolete.

      More and more, sensitive data is portable, and more people are taking advantage of that to move sensitive data from "secure" environments to "convenient" environments.

      A VPN into a corporate network then a terminal session would fix most of the complaints. Have them work directly from the server and there are no problems. Have the VPN client check that the firewall and virus software is installed, running, and up to date and there are fewer holes. If you are really worried about it, toss more money at it and make a non-split-tunneled hardware VPN from the homes of those that will be going in, then use locked down terminal services. They won't be able to get anything from the Internet without the protections that everyone else in the office has, and no data will be ever put on the local computer.

      I can think of lots of ways to make these just about as secure as those at the office. The problem isn't figuring out how to make them secure. The problem is getting executive buy-in and end-user compliance.

    5. Re:The problem isn't telecommuting by networkBoy · · Score: 4, Insightful

      :):)
      Have fun with:
      2 proxies
      3 NAT layers
      1 terminal server (which I suppose is another proxy).

      My real point was that there is not a reason for theft of a notebook to be an IP asset issue. If I can "safely" take my data with me, then why not customer data in the same method?
      the answer is simple: most companies think their IP is worth more than customer records. If they would simply make the statement:
      {IP += CustomerRecords};
      then there would be no issue, as you would see the data locked up tight.
      -nB

      --
      whois gawk date unzip strip find touch finger mount join nice man top fsck grep eject more yes exit umount sleep dump
    6. Re:The problem isn't telecommuting by Sinus0idal · · Score: 4, Insightful

      What benefit do you gain from 3 layers of NAT and 2 proxies other than a ton of lag? A single well configured version of each should surely be sufficient.

    7. Re:The problem isn't telecommuting by Fudge.Org · · Score: 4, Insightful
      Having some asshat steal a computer full of data doesn't really happen that often to people who keep their computers locked in an office at their employer's campus.

      Consider yourself lucky to have never experienced two floors (dozens of employees) of locked PC's and laptops removed overnight... more than once. In my experience it isn't someone but some group and they know what they are after and they have tools. Yes, most criminals are stupid, but many are organized and professional.

      What's the bigger payoff?

      a) single telecommuter setup in home where there is someone that is around most of the time

      b) office space with dozens of systems guarded by the lowest price bid security firm/system

      --
      http://fudge.org
    8. Re:The problem isn't telecommuting by colmore · · Score: 5, Insightful

      The headlines should read: MegaCorp loses notebook with customer data on it. Company issues this statement: "This is a non-issue, the notebook was encrypted with a system that meets XYZ standard, it will take no less than 200 years for the system to be cracked."

      Oops, the laptop that was stolen had the PGP password written on a post-it-note. Or it was the guys' daughters' college fund account number. Or they were logged in while working at a coffee shop, got up to use the bathroom, and came back to an empty table. Or a corporate spy stole it once, put on a keylogger, and then steals it again. Ask the police how private your fingerprints are. Does your boss put retina scanners on all company laptops? Can you be sure that nobody with data access would be dumb enough to keep any of that info on their USB drive or a CDR? Are you using strong crypt on your swap space? What do your bosses do to make 100% sure that nobody is printing out information on their home deskjet and leaving the printouts in the recycle bin on thursday morning? Are you so sure that there aren't moles in your office that you'll let a billion dollars juts walk out the front door? If your data is really as valuable as you say it is, then you need to have the working assumption that someone out there is going to pull some James Bond style shit to get at it, they're not going to stop at "aw shucks, they *encrypted* it!" A password is relatively easy to bribe someone out of. If they never have to show up on site to access the data, then that's all they'll ever need.

      When your data is valuable enough that people would REALLY want to steal it, people, not protocols and passwords, are the big problem. When you let people just walk out of your office with company secrets, you're not just increasing the size of the problem, you're adding entire DIMENSIONS to it. People get lazy about things that they have to do every day. Lab Chemists and Biologists have horrible cancer incidence rates because they eventually get lax with safety procedures, even though they know better than anyone on the planet how dangerous what they're doing is. The human brain is set up in such a way that something it encounters every day without visible harm stops registering as "threat" pretty fast. No matter how rigorously you try to follow standard XYZ at the office, people will get lazy when they're looking over some work in front of the TV.

      --
      In Capitalist America, bank robs you!
  2. Backlash for security? by DarthParadox · · Score: 4, Insightful

    Telecommuting isn't the problem. Ineffective security policies are.

    It's possible to set up secure connections between a telecommuter's computer and a secure server. Encrypted tunnels for VPN or something like that. Encrypt data on the laptop hard drive - if you even permit sensitive data to be stored there at all.

    But until government and corporations are seriously committed to taking the measures necessary to keep private data secure, incidents like this will keep happening, whether it's due to a stolen telecommuting laptop or a server that gets broken into.

  3. the article says it all! by dan+dan+the+dna+man · · Score: 5, Insightful

    "The analyst whose laptop was stolen from his house was not a teleworker, just someone who took work home with him."

    On what grounds are you going to detract from telecommuting in that statement? Every worker I know a)has a latop and b)moves it around. I don't think any of us would call ourselves telecommuters in any sense of the word. The fact we take work home, on 'theivable' media isn't an argument against telecommuting, it's an argument for us not taking work home!

    I know there are telecommuters on /., but everyone I know, even in the IT industry has to go and show some flesh at a physical location to get paid. I'd love to telecommute but to be honest, it's mostly impractical for most people who have to engage with humans to get their job done effectively.

    The next question for me is, who is this backlash against?

    --
    I don't read your sig, why do you read mine?
  4. Telecommuting by Badgerman · · Score: 4, Insightful

    Interesting article. It pretty much notes what's being said here - good telework requires good policies, good enforcement, and good planning.

    In my last job I telecommuted for a good 3-5 months until I left. The company had excellent policies and security. There wasn't a single reported incident of data theft from our division in the two-and-a-half years I was there. I was definitely more productive, and I was also better able to plan around illness, holidays, and emegencies.

    It's all about good policy. A company without telecommuters is still insecure if it has a crap IT Risk policy.

    --
    "The Sage treasures Unity and measures all things by it" - Lao Tzu
  5. It can happen in an office building to by joshv · · Score: 4, Insightful

    I had a laptop stolen in a secured office building. Each floor required a badge, as did the lobby. A laptop at home is no more or less safe than a laptop at work. In fact, my house is probably harder to break in to than most office buildings.

  6. security issues aside... by papasui · · Score: 4, Insightful

    One thing I personally feel is you don't develop a bond with your co-workers if you don't see them face to face. I'm a network engineer for a large fortune 500, I have a company laptop with VPN software that I can use to work from home if I want. Occasionally I do, especially if I need to watch a sick child but still want to get some work done. Otherwise I try to go into my office and be present for face to face meetings whenever possible. My direct boss lives and works 300 miles from my office and I rarely see him, maybe 6 times a year. We talk over the phone and email frequently but we don't have the kind of boss/employee relationship that I've had in the past. Very hard to feel comfortable working/trusting other people when they seem almost like strangers to you.

    1. Re:security issues aside... by inKubus · · Score: 4, Insightful

      Well, bonds are good. But so is working without distractions. For a coder or programmer, being at home is probably the best environment. No one cares about the lack of shower that leads to grease level 6 where the real work gets done. Maybe the nut cheese vapors have some sort of nootropic effect.

      Anyway, I think the best thing is a good mix of tele and in the office work. For me, I like to tele in the morning from home where I have my dual monitors, my espresso maker, my clean air, etc. It allows me to work solid in the morning right after getting up until I start to lose focus. I'm usually at my highest focus right after waking up. If I waste that time showering and driving, I'll just sit around at work.

      So I work in the morning from home and when the focus starts to fade I save all and sync up, and then go shower and commute. I spend about the same amount of hours working but FEWER hours in the car, etc. becuase the traffic is lighter at 10:30 than at 7:30. Plus there's fuel savings, etc. And I don't have to go in every day--sometimes you get on a roll and don't need to go to the office to stay motivated to work.

      There are some jobs that need you to be there: anything physical obviously (factory worker, garbageman, etc.). In my opinion, most meetings are bullshit though. Sending an email is usually enough to get it across. But I think some people need meetings to make them feel like they are part of a family. I'm like a hitman, a contractor, BOFH style, so I just do what I do.

      What really bugs me is when I get PICNIC calls from the office (usually the same couple of people) who demand I come in and make their computer run faster or reconnect the cable they kicked out of the wall. Oh well, I bill extra for those.

      --
      Cool! Amazing Toys.
  7. Questioning a basic assumptions by putigger · · Score: 4, Insightful

    I don't see anyone asking the question: "what effect does telecommuting have on productivity?" I work in the R&D arm of a major multinational corporation and the projects I work on are highly collaborative. I can often accomplish more in 15-30 minutes of face-to-face conversation with a colleague than in an hour or more over the phone or video conference, even with fancy collaboration tools like Lotus Sametime and Microsoft NetMeeting.

  8. Telecommuting is not a slam dunk by pedleyj · · Score: 4, Insightful

    The backlash against telecommuting is not just security related - it's cultural. How can an organization stay fresh and bring on new people who can learn from mentors and rapidly come up the learning curve if all the senior engineers are tucked up at home coding in their PJs? How will that organization build a culture, build commitment, build team spirit? There have to be some limits or a company will stagnate. security issues can easily be handled with better technology over time but I don't think the cultural ones are so easily dealt with.

  9. "Telework" is entirely implicated in the VA case by csoto · · Score: 4, Insightful

    "Telecommuting" means working away from the normal office environment. This guy was a "teleworker." Sure, he isn't NORMALLY a teleworker (e.g. he usually works out of the office). But he took work home. He was telecommuting. There would have been little chance of this data being stolen had he not "telecommuted."

    Telecommuting has drawbacks. The number one issue is that the home is not usually a good environment for work. This includes issues of safety and data security. Operations are at risk if you do not take sufficient precautions.

    One interesting solution to this is thin client computing. I've experimented with Sun Ray thin clients that connect over a broadband connection back to a server. No data is stored on the thin client. All it really transmits is pixels and keyboard and mouse clicks (encrypted, too). That's the right way to approach this. Never store data away from the people paid to protect it (then make sure those people do a good job).

    --
    There exists no way of exchanging information without making judgments. --Bene Gesserit Axiom