Slashdot Mirror
Do You Allow Webmail Use on Your Network?
rtobyr asks: "I don't allow users at my organization to use any third party e-mail. When users complain, I point out that we can't control the security policies of outside systems. End users tend to think that big business will of course have good security; so I ran a test of the 'Big Four': Hotmail, Yahoo Mail, AOL/AIM Mail, and GMail. Yahoo Mail was the only webmail provider to allow delivery of a VBS script. GMail was the only provider to block a zipped VBS script. End users also tend to think that a big business would never pull security features out from under their customers. Of course, we know that AOL and Microsoft have both compromised the security of their customers. I don't know of any security related bad press for Yahoo or Google. Three of my Big Four either allow VBS attachments or have a poor security track records. So, if you are a network administrator, do you limit your users' ability to use third party e-mail, and if so, do you allow for GMail or other providers that you've deemed to have secure systems and reputations?"
Besides the obvious Content Filters how are you blocking them? A moderately bright young chap could proxify their way around that.
This
These days, anybody that opens ANYTHING with a .vbs extension deserves whatever happens to their computer! Are users really that dumb?
Are you just not letting people use third party emails for business use or for personal use?
Not allowing it for business use is a no-brainer. Anything internal and private should never be on a public network.
If people are wanting to check email over their breaks or over personal time, then less restriction might make more sense, so long as people know to not use their Yahoo! account for work communication.
with webmail, you still have to download the file in order for it to cause problems, wheras if you force your users to POP it, it will be on their computer for sure.
don't know of any security related bad press for Yahoo or Google.
Google is suspected of saving and data mining users gmail. It may sound paranoid, but if you are worried about corporate info/secrets being leaked, it might be wise to avoid. http://en.wikipedia.org/wiki/Gmail#Criticisms
Libertarian Leaning Political Discussion Forum.
Where do you work? I'd like to know so that I do not inadvertently apply for work at your company.
Then again, I'm sure you've addressed all of your company's really important network concerns first before moving on to this. Or, maybe you were sure to restrict all of the workstations such that no one can change their desktop wallpaper and things like that.
Which webmail system do I use while at work? I use my own squirrelmail installation. I bet you'd really hate that!
Every person is responsible for their own actions while using the network. If they end up comprimising data or causing network wide issues, they know it's their ass on the line. Teach your users to be good users. If you want content blocking, you'll have to cover ALL of your bases, which is impossible to do. Eliminating the problem by having informed users is better than putting all of your users in a box with airholes that aren't big enough for them to breathe.
At this moment, the MS lobbyists are busy reading this and saying to bill, "why don't you have better protection?" Sadly, yahoo and AOL are busy saying "what just happened?".
Shits going to get through, one way or another. Even through your preferred e-mail system, or through a web browser exploit, or through something else.
.vbs scripts. Lol. I know better than to bite a troll like that.
I use hotmail and gmail every day, mainly as spam-sisterns. They've taken pretty much every worm, scam and spam the 'net has seen, and I've never been infected from either service. Nor has my local AV software ever kicked in to protect me from anything. YMMV.
I like the write up. You didn't find problems with hotmail, but hate MSFT, so you put it on the same list as Yahoo, who forwards
So, what are your favorite Apple products? Me, I'm excited about the iPhone.
I don't need no instructions to know how to rock!!!!
I've been part of the Google Beta testing for hosted e-mail (for my own domain) and also been part of the testing for the Google Apps for businesses. During that time, I've not had any issues with spam nor malware mail. Given Google's intent to host small businesses, I strongly suspect that they will pay close attention to security issues, esp. on their e-mail service. I've been pleasantly surprised as to how good their spam filtering works. My wife also has noticed that spam has pretty much gone away. You can access your e-mail both on the hosted site, and at least via a pop client, so you could possibly insert additional security on the pop client, but give folks access to a web version of the e-mail as well.
I'm glad I don't work at your organization!
Seriously, webmail has so much use that blocking it is ultimately counterproductive -- the only equivalent "security" would be totally blocking net access.
If you are worried about productivity loss, well, I often use webmail so I can stay at work longer. Really, it's not hard to imagine that allowing people to use light net access for personal communication means that they do not have to physically leave work to do these things. It's a bonus for all.
If you are worried about security, any net access that allows submission of forms or uploading of files is equivalent security breach. As stated before, any moderately skilled hacker can configure a proxy to get data off your network.
You're crippling your users and kidding yourself.
Simply put, yes.
We would prefer that the work e-mail not be used for personal mailings. One of the reasons is file storage space.
We are willing acknowledge that the parents are going to communicate with their kids, and other folks with friends and family. It makes for better employee morale when they are permitted access to web mail for such things, leading to less abuse of work systems. It is better to use e-mail than the phone, which needs to be left free for actual business calls with clients.
Are there security concerns? Though the poster found some concerns, those concerns are easily disarmed by a good anti-virus/anti-spyware program.
Sure, we could be rather draconian and put the kabosh on all of it, but it comes back to employee morale. A happy worker is a productive worker. Our workers are given the task of being responsible and are rewarded for their success.
Bearded Dragon
We use Google Apps for our company email. We were using an internal service until we switched in February. Apart from IMAP support, using Gmail for company email has been a great improvement over our previous system. The majority of our employees prefer Gmail's web interface to a standalone mail client. That said, we obviously allow webmail use on our network.
Frag 'em all...
it's too big of a business for this to be excusable.
Seriously, why is this considered horrible? Someone might sniff a myspace password? It's Myspace, Everquest ranks higher in the securiy list.
The big Net Admins in the sky tried to block web based e-mail from Comcast, Aol, G-mail, Hotmail, Yahoo, etc... then all the physicians freaked out and got pissed enough for them to change it back. Or at least that is the story I was told...
How much is your data worth? Back it up now.
Translation: my organizations' computers are not secure enough to safely access the Internet. This is somehow Google/Yahoo/MSN's fault.
I don't care if it's 90,000 hectares. That lake was not my doing.
It's safest when the users can't run any scripts or executables. With Vista, you can easily configure the UAC to stop such user nonsense.
What's their secret? They take care of preventing stupid users from downloading crap themselves, meaning they scan at their proxy and/or firewall boundaries (I'm not a network admin here so I don't know exactly how it works).
This has been the policy for at least five years and they've never had a single problem. Never.
If a large financial services company can do it, I don't know why everyone else can't either. So you're asking the wrong question - instead, ask "how can I provide a better service to my users by allowing them to access their webmail and also maintain my network security?"
I've worked at companies that either completely or selectively block webmail access. Nothing personal, but you and other network admins like you suck rocks as far as I'm concerned. Trusting or distrusting the webmail provider because they do X or Y is supremely stupid because you're basically bending over for them and waiting for the inevitable vulnerability to show up. What, are you going to go to your CTO and say "well, I didn't trust Microsoft and AOL, but I thought Yahoo was OK! It's not my fault!"?
You should know better and you should do better. If you can't, just block all webmail and stop complaining about what other companies do or fail to do. It's your network and your responsibility.
Web2.0: I love when people Flickr my cuil and digg my boingboing until my google is reddit and I start to yahoo
I guess I understand that, but the bummer is that for a lot of us we don't work just your basic 9-5. If you work a lot its nice to be able to take care of a little personal business, in fact I think it probably increases productivity by making people more willing to hang around at work a little longer. So in that regard these bans are counterproductive.
I don't think IT people really think about stuff like that much...the ideal situation for IT isn't necessarily whats best for the enterprise. That said I can see how security and document retention are valuable goals...maybe webmail could provide some kind of mechanism to allow companies to hook into it and archive messages read or sent using corporate machines. Same for instant messengers. Then everyone's happy (except privacy advocates...)
Making a non-webmail page with links to nasty VBS scripts, etc. is just as easy as send an e-mail, so you are not really protecting your network by these annoying limitations... An attacker can send your charges an e-mail (at the corporate address) with a link to his script. And if you check all browsing (via scanning proxies), then you may as well leave webmails alone, for they'll be checked too, along with all other HTML pages.
You are not alone, unfortunately. I found, that whenever admins (pompously) argue for strict banishment of a particular "attack vector", they almost always ignore another vector for the same attack.
There could be one justification for banning external (non-corporate) means of communications, while at work — compliance and legal issues. A big bank, for example, does not want a broker to be able to claim, that a bank's trader ordered a (bad) trade via. GMail or cell-phone. But this only makes sense, when your official (corporate) communications get recorded and archived (unlike private webmail accounts and personal cell-phones), and can be played back.
In short, you have to remember, that you (an administrator) exist for the benefit and convenience of these people, not the other way around. So if they want to be able to access their webmail, you must have a much better reason than "you may get a virus" to deny it to them.
I bet, more productivity is lost, when an employee brings in flu and half the office gets sick. But no one is advocating forcing people to take vitamin C and wear scarves, right?..
In Soviet Washington the swamp drains you.
There are talks at my employer as well of limiting 3rd party mail usage (along with IM and other services) not just because of security, but because they want (or "need") to monitor all outgoing/incoming messages.
It's really depressing how limited our access to the Internet has become. Its mostly done to "boost" productivity or "prevent" litigation. Security concerns are now adding to that situation. I see a point in the not-so-distant future where businesses and corporations will be so worried about authorized usage and security issues that there will be not be any user desktops/laptops even connected with Internet access, just back end servers (such as Exchange).
Sad. Just sad. And there isn't much that can be done to reverse the trend.
If there is a corporate policy on outside email usage then it sounds like a place I would not want to work. Please expect me to be an adult and I will act like one.
We created our own web access to our server.
I also agreed with the "no third party" rule...
Fast, cheap, correct. You get to pick two.
Do people really chmod +x email attachments?!? I'd say your problem is in user education. Hell, any user knowledgeable enough to know how to set the executable flag should KNOW better!
This sounds less like a real Ask Slashdot question and more like "Hey look at me. I'm an IT fascist!"
Blocking webmail is pointless and serves only for you to needlessly flex your authority in the only part of the world you have authority: your company's network.
Seriously, if you are so paranoid about webmail, why allow internet to the desktop at all? Since you are so afraid of VBS, why don't you just lock out VBS execution at the desktop and keep your enterprise AV up2date?
Grow up, have kids, and annoy them with your stupid restrictions. Leave the people at work alone.
Long, Long ago we just disabled vbs execution across the whole enterprise.. we allow access to any of these services.
Got Code?
If your users can run java applets locally, using an SSL Explorer installation, they're hitting their webmail accounts already - straight out port 443 of your firewall.
Disclaimer: I don't work for 3SP, but I use their product every day at work to evade the corporate firewall
Man, was this ever timely. I just finished setting up a very complete solution for my current location (forward deployed military in the M.E.). Yes, of course I allow Webmail access. Everyone relies on it for 'reach-back' capability. What I do in an attempt to secure things is to setup a very complete firewall/filtering/etc. box. Is it perfect? No, but it's very effective. I'm running a Linux box with a slew of services(HAVP, P3Scan, ProxSMTP, HAVP, Privoxy, frox, ClamAV, RenAttach, Rules Du Jour and of course IPTables plus a bunch of others) and have had outstanding success. I recommend just using IPCop + BOT + CopFilter if you need something quick and relatively painless. I also do regular automated Nessus scans, etc. Man I love my job!
GMail supports POP. So you could just setup an account in your mail client at work. I use IMAP for my personal email at work. Barring that, I can VNC / Remote desktop to my windows machine and use the mail client there. Barring that I can SSH into my server and check my imap server there.
I'm god, but it's a bit of a drag really...
Only allowing Gmail access on corporate network for the same reasons as the submitter.
As other posts will/have pointed out, your current thinking is a little misguided.
Here's some suggestions:
1. Corporate has a policy of "acceptable use" for their computers and networks right?
2. I'm running a small network, I log packets passing through the firewall and then filter for certified time wasters like fark.com and report usage by individual to their superiors. Waste of disk space? Waste of time setting up? yes to both. But you get an idea who's abusing and it's up to the manager to decide their fate.
3. I'm not perfectly familiar with Dan's Guardian, but maybe it's another way?
Unless management wants the approach you describe, I'd go at it a different way.
Got Trader Joe's? friendwich.com RSS feeds work now!
unbelievable - "I don't allow users at my organization to use any third party e-mail." What about public phones, cell phones, flash drives, uh... Why not just curtail any network use? Oh, and I'm sure you "don't allow" folks to use tunnels either, right? Go back to cisco class, bozo, there's a big bad world out there that you're clueless about.
-decuser
...like it or not to help protect my users from themselves. In that spirit, as part of my security practices, I run heavy antivirus and antispyware on the firewalls in order to facilitate safer webmail usage by my users. Sure, I could (legitimately) mandate no web mail as policy or simply be a jerk and disallow it, but I *try* to see technology as an enabler. It's a better situation: users get home/private mail access and I get a reasonable-secure network. A bonus is that users see IT as helpful instead of "those jerks who won't let me at my Gmail account. This may not work for others for technical, political, or idealogical reasons, but it's pretty good for us...
Honestly, I've always allowed webmail (and encouraged it) as a way to side-step a certain amount of responsibility for reporting users for things. It may sound crazy, but in my experience you can't stop users from e-mailing their friends, spouses, mistresses, and drug-dealers during the course of the work day.
I've had it happen where e-mails about an employee's drug habit get stuck in our spam filter, which means I saw them when I went through looking for false-positives. Suddenly, I'm in my own personal game of "Scruples", trying to figure out whether I need to report the guy or if I can just ignore it. You might think, "Of course, you report it!" However, after seeing a whole ton of these things, reporting them all is a scary prospect. Do you want to be the company tattle-tale? Do you want to report half of the company for sketchy behavior they've committed on their own time? It's a scary truth: pretty much everyone has skeletons in their closet, and far too many people are sending those skeletons around via e-mail.
So rather than having to report new transgressions every day, I started telling my users, "Get yourself a web mail account (hotmail, yahoo, gmail, etc). If you want to e-mail your mistress about all the coke you did last weekend, send it through your web mail account instead of your company account. If you send it through your work account, assume I will read it. Assume your boss will read it."
Yes, I suppose that means they might misuse the hotmail account somehow, but you just can't keep people from doing completely stupid things. All you can do is make those stupid things someone else's problem.
Speaking purely as a sysadmin, I'd block those sites utterly. Web-browser components are the biggest target of malware out there, it's bad enough when targeted at an e-mail client that can lock down scripting and such but Web-mail sites let that stuff through to a browser that has to allow scripting in a corporate environment. And if you're a business you've got your own e-mail system, no company e-mail should be going through a Web-mail system in the first place.
As a techie, no decision would affect me. I deal with my personal e-mail by SSHing to my home machine and reading my personal mail there via mutt. Call me a bigot, but the only protocols a mail client should be using are IMAP (for reading) and SMTP (for sending) and the only acceptable interpretation of the message body is as plain text. Anything else just ends in tears these days.
OTOH, as an employee I'd have to think you've an obligation to provide that access at least for some employees. Think about your IT staff, for example. They're probably expected to work extended or odd hours, usually without extra compensation since they're salaried. In effect the company's asking the employees to give it a big chunk of their personal, outside-of-work, "I have a life" time, for the company's benefit, for free. To me it's then only fair that the company has some obligation to let employees take a certain amount of company time, for free, to deal with all the things they'd've otherwise dealt with during that time the company's wanting from them. If you don't find some way to accommodate them, you're likely to end up with employees who're dissatisfied, frustrated and actively looking to ways to get access to those services. They'll succeed eventually and then you'll have the worst of both worlds. At least if you provide some authorized way to access those services you've got some ability to control the situation, eg. adding specialty filters on the Web proxy for the worst problems.
FTA:
"...do you allow for GMail or other providers that you've deemed to have secure systems and reputations"
Sorry to tell you this but no bad security PR, perceiving something is secure or placing you're blessing on a provider != to secure
Really there are much more important things to block when it comes to any external mail account. For example, can your users set up a server rule (easy in Outlook/Exchange, probably in others too) to auto-forward their mail to an external service (whether a web mail or not)? If they can, then THERE is your bigger problem. External mail services don't make users abide by your strong password or Smart Card requirements. Their password is probably easily discoverable. They go on vacation and forward all their mail. It's probably trivial now for an attacker to access that CORPORATE DATA that may be in that mail. Worrying about VBS scripts isn't anywhere near as important (since any competent AV will stop the majority of bulk-mailed nasties). It's about the DATA. Not just email either. Are any of your users using one of the web based backup services (or even GMail) to backup their documents? Whoops! Data exposure there too. Anyway, I just wanted to call out that today it really isn't the random script in email that is all you need to worry about.
Methods such as content filters and blocked domains are only going to be useful to the bigger, more prominent webmail sites. This still allows a lot of webmail into your network. A basic "no webmail" policy, is difficult to to enforce without resulting to some fairly invasive and harsh tactics.
The better method is to enforce good network and system security practices. Do things like setting the policies as such that users cannot execute VBS on the local system and early warning detection/isolation on the network.
Regardless, this is one of those things which I believe is going to become less and less of a problem on it's own. With web enabled cell phones and PDAs becoming more and more common, I figure we are a short time away from the bulk of a users mail just going there.
no webmail, no pop3 and no smtp relay unless you are on the golden list. not so much for information security, but for anti-virus purposes. we have antivirus on our exchange server and each PC that is updated hourly or daily. no one really knows the quality of the antivirus system of internet email or how often they update definitions
Comment removed based on user account deletion
It's amazing how people can tell you the root of their problem without seeing it. The submitter asks about "webmail security" like this:
The issues raised are not "webmail" problems, they are problems of the underlying OS from a company that has "compromised the security of their customers." If you are using a decent OS, these security issues vanish.
Friends don't help friends install M$ junk.
If you're in a HIPPA environment, on the other hand, I'd give it some strong thought.
//Information does not want to be free; it wants to breed.
anybody that opens ANYTHING with a .vbs extension deserves whatever happens to their computer! Are users really that dumb?
It's funny, but nothing bad happens to me when I vi random.vbs
Friends don't help friends install M$ junk.
The question I would raise is if you allow 3rd party email, then the business will need to accept the responsibility that someone could send any file (including your client list, price list, etc) using the 3rd party email with no real tracking abilities. just my 2cents
My experience is that the companies that do this type of blocking do it because the workstations are inherently insecure. Security is not in the sites someone can visit or the specific file extensions that are allowed. It is in the setup of the network and the access the user has on their workstation. It's like making the kitchen safe by removing the sharpest knife from the drawer.
My company hasn't flat out blocked web mail yet, but I'm sure they are on the way. IM was blocked awhile ago and a coworker got an email today from IT that she shouldn't check gmail anymore (she would just leave it up all day, which would let gmail do it's auto-refresh). The problem I have is that here at work we have 100MB of email space that gets backed up. On gmail I have 3-4gb. So while this one person got the email to quit using gmail the rest of the office is continuing to use gmail not just for personal mails, but also for work. Gmail is better than the IT solution, and users are smart enough to realize this. So as long as we have draconian, I know what's best for you IT people, we'll have users who do what they have to to get the job done.
Here's an idea! How about IT look to the users as customers and treat them that way.
Do you allow jackasses to post to slashdot at work?
The truth suffers more from convictions than from lies.
My question is... what exactly are you trying to secure? If you're talking about ensuring that sensitive corporate data isn't leaked outside the company, I hate to say it but, you really shouldn't be using unencrypted email in the first place. If you don't allow VPN's or other ways for people to access their email outside the building (I'm sure the salespeople LOVE you), then you may as well force your employees to use paper, or a custom client that only talks to other people on the LAN.
If you're worried about virus/malware/etc... web based email is no more or less safe than any other modern graphical pop3/imap client. All of them these days are HTML enabled, and unless you personally watch everyone click their messages, some will still run winbig.exe or whatever.
Personally, I'm getting a bit tired of people tossing the "security" word around as a reason to make things more difficult or expensive, without ever justifying what it is that needs the added security, and why.
I was the IT administrator at my old company of about 500 consultants. After many discussions with the upper management I successfully argued for an open webmail policy because we had employees who regularly worked long and odd hours to accomplish our projects and it seemed only fair that we give them a method of private communications during their _overtime_. Quid Pro Quo. We were especially lenient with consultants who traveled all the time... except for a few areas those laptops were considered their property and as long as they didn't jack with the security settings we didn't call them on anything. With that said: 1. We were running squid and clam on any any incoming data (yes this is intensive but $8-10k of equipment will garner you many times that in employee good will). 2. We had a very aggressive AV policy. 3. We had consultants that were governed by stricter SEC and DoD rules that were kept on a separate subnet and different AD that was more restrictive... because laws required it. Seriously though... Unless you tell your salaried employees to work no more than 40-45 hours a week (and give them comp time to balance that out) it is asinine not to let them use the company system for personal activities when the company itself is encroaching into their personal time.
Agreed. We allow webmail where I work. Like someone else mentioned, a file has to be downloaded to infect your machine anyway and our antivirus takes care of that reasonably well.
;).
If I worked at a company with a draconian policy like yours, I'd just find a way around that with a proxy or something (at least until I could find a better company to work for
If you can get to the internet, you can get to whatever you want. Just set up your own Squid proxy at home, get at it over SSH (tunneled via HTTP if you must...), et voila. Freedom from the self-appointed corporate mommies.
"A great democracy must be progressive or it will soon cease to be a great democracy." --Theodore Roosevelt
I'm a network admin for a small-medium sized company, about 40 - 50 people. We are pretty liberal about our IT security policies. We're still at the size where we can place a great deal of trust in our staff, and they don't abuse it. For the most part, we don't block virtually any content. We've never had problems, but we're at a growth stage where we're needing to tighten up security a bit.
My girlfriend's company, which is a larger energy company of about 250 people, does however block some webmail content, as they recently had an employee download material that caused a security concern.
Personally, I don't think it's unreasonable to block web-based mail. However, since email is such a common place in daily life now, if I was to do that, I would make sure there were a few computers in a staff room where people could freely check their email, outside the companies' proxies and firewalls.
VBS Script? Is that anything like a GUI Interface or a NIC Card?
TPJ - Founder, The Amazon Basin
I used to work for a Telco that is also a major ISP. Our internal .com users were not allowed to access our own .net webmail accounts PROVIDED BY OUR COMPANY!!! It was claimed to be for security reasons.
i ty/articles/rr_elements.html
Bad files are going to get inside regardless of what you do to prevent them coming in - unless you disable all USB ports, floppy drives and external networking like DoD does. Your network and each system needs to be able to protect itself even when "inside." Blocking at a firewall is just 1 of many layers that are needed in any network environment.
Don't be a fool, your PC is never safe. Learn it, know it, get over it, protect it.
http://www.checkpoint.com/products/internal_secur
Whatever happened to educating users and enforcing software policies? Instead of calling users stupid and locking down desktops like a prison, how about you actually take the time to hold a class. Teach them and show examples of what happens when they treat a computer like a toy. If they still don't listen, then enforce the company's software policy. (If there is one.)
I am a junior admin at our firm. Our motto here is that if a computer has a problem then it is because of IT's fault. Not the user's. If a user doesn't understand how to use a computer then it is our fault for not teaching them.
Firefox and many other browsers are immune to VBscript. The very same idiots who ban webmail citing security concerns, blithfully allow IE to run rampage in their internal networks. What gives? If data leaks through a hole in IE, the brass will claim, "We followed the industry standard practices. We are not responsible. We are actully irresponsible. Go chase Microsoft". If they want to ban IE, they cant because MSFT has woven IE into the fabric of the OS. Even if they say only Firefox can be used, still they are not off the hook. What a mess.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
The general policy is that the company's assets are for company business. That said, policy also allows for limited personal use, as long as it does not interfere with the primary business use of the company. This leaves enough room for most employees to happy, and it gives us the iron hammer if we ever need it (and we rarely have). We can block things outright at the perimeter if we need to do so (e.g. when there is a new virus propogating via email), but we generally trust our employees to be professionals. We train them heavily on security awareness, and we keep our network and client defenses current.
I use irony whenever I can, but my shirts are still wrinkled...
I actually automated the process so I don't know who's doing what because it's way outside my job scope. I don't want to know. _Really_ don't want to know.
But the company policy is clear, our computers, our network don't waste time on them.
Fortunately, your use cases lie outside the application's capabilities and the employee types it follows.
Got Trader Joe's? friendwich.com RSS feeds work now!
If you want to be regarded as a tool and hated around the office even more than most "admins"
I would just block these sites then you have less of a security issue. Most of the time people like sending around useless jokes with powerpoint and other attachments or links to e-cards and other spyware laden sites. Unless you have made sure you patch for every jpg and office exploit you are putting yourself at risk by allowing them access. Its not just the VBS scripts that you need to worry about. Like the person said before. Work systems are for work. If they want to surf the web and their personal email they can do this at home. Learnt from my experiance as a sysadmin is that if you give a user an inch they will take a mile. The nice approach of saying "please don't" and here is why and why never works and then the users believe they have the right to do as they wish. God help you if they get infection of some sort because it will be turned around on you for "not having adequate protections" in place. Also if you have the right type of firewall in place you can block access most public proxies and track the remaining attempts at access in your firewall.
I work in small company (~30 employees). We do allow use of webmail. But only for your private stuff. You are not allowed (and it is clearly stated in contract and rules) use your private email for company related stuff (your work). Beside that you can use your private webmail as you wish.
It has to be said that we do not have any monitoring or censoring policies. It is OK for somebody to write personal email in work from time to time untill that person does her job right.
But you have a certainly flawed reasoning. *Any* website can load your browser with VBS script. If the user clicks it than it does not matter wheter it is from webmail or other site. In general if you fear webmails that means that you are not safe from the Web as whole (and there are loads of threats on the web).
The solution would be to use some filtering proxy that would cut down such traffic. Right now we just use AV software on client machines (that tends to work blocking obvious web threats). We also have a proxy server that blacklists known phishing/malware/evil addressess (not for content filtering - for protection from known threats).
A point that has come up in the past but lately glossed over is that by using third party mail services such as Yahoo, Hotmail, Gmail, etc... their Terms of Use and Service state that you give them rights and ownership of your data to do with as they wish. In a corporate environment that means any trade secrets or concepts you mail to or from someone via one of the third party mail systems gives the systems owner license to use your data as they wish. If they want to develope it into a product and market it themselves, they in effect could without paying any royalties as your use of their service granted them consent.
As a rule at all my client offices its stated that all business related correspondance must happen via company owned services. IT doctrine at each site states the computer resources are property of the company and use provided to aid the users in corporate business only. Any personal use can result in disciplinary action, to include firing.
Many of these rules came about when users started clicking on random pop's or installing their favorite screen savers, weatherbug, mail programs, and chat programs. Many of these were found to contain malware that cost the companys lots of money to have cleaned up and slowed down productivity. While users company mail is scanned for virus's, third party mail products and chat programs showed more problematic and became the primary source for infection of the corporate networks.
We've also caught employees suspected of corporate espionage using third party mail services to transmit company information in an effort to side step IT monitoring their mail. That alone was enough for the Board of Directors to decree no employee may ever access such services from their offices.
We've enacted proxys at some sites, others content filtering, and others simply requiring the employees to sign a usage agreement that if caught in an audit means they can be terminated without severence.
How do you block them all. Almost every ISP has a webmail client. Ok so it might be very simple to zoom in on all that start with webmail.xxx.com or the word mail in it. What about other languages? In french it would be courriel.xxx.ca.
How about a mom and pop webmail called GrannyMayApplePie.com (does not exist). or myrealbox.com
People will just find others if you block the BIG 4
Are you sure playing golf during the day is in line with your company's employment policy?
The above was typed without a smirk nor attitude.
No privacy. Unreasonable work hours, without ability to take care of personal business. Everyone is suing them. A company that mistreats it's employees and customers. I'll bet they treat their investors just as well.
Friends don't help friends install M$ junk.
If you are really worried about your users downloading viruses by webmail, I think there are much more fundamental problems with your setup. There are much more other ways your users can get infected than by webmail. What about malicious web sites? What about non-malicious websites which have been compromised? What if your user brings along an infected file on USB memory key? Etc...
Get a good virus scanner (a really good one, not Norton or Mcafee, but Kaspersky or F-Secure or something like that), get some virus filtering and firewalling done on your gateway. Make them use an alternative web browser and e-mail client, which is much less target of attacks than Internet Explorer and Outlook. And most of all: learn your users about potential dangers. Explain how they can recognise suspicious files and web sites. Explain them that they should be careful with their passwords. Explain them that they should do so not only at work, but also at home.
Maybe if you tried blocking computers on your own network that run software that's vulnerable to something like a VBS script..
I allow all those websites; I don't allow Windows.
WEBMAIL USES YOU!
-insert a witty something-
I changed our dns to send hotmail users to the ip address for the local unemployment office's website. they get the message pretty fast.
Obviously not serious about making money at this company.
Just as ignorance of the law is not an excuse to commit a crime.
Ignorance of a scam doesn't mean you SHOULD be violated.
If we don't protect the innocent, & week, why protetct anyone?
I am so sick of hearing this arguement. And by sick, I mean sick to my stomach that there are people out there who have this mentallity of "they are weak, they deserve to parish"
It's true that you have to save the people w/ greatest potential to survive, and sometimes even sacrifice those who might not last long if they were saved. Be it a Natural disaster, fire, battle, theft, or computer security.
While it's true that if you know what a *.vbs is capable of, then you should also know how to open it as a text file and see what's in it.
But what if it comes from your boss? What if some top lvl guy is ignorant to scripting, and unknowningly mails something to his subordinates.
While I know the risks, and if I was on top of it, I might ask what it was. I'll be damned if most people wouldn't automatically open an attachment from their boss regardless of their knowledge lvl.
Sorry if your statement was jokingly put out, but as the victim of a recent scam, I am unthrilled w/ that response.
How much is your data worth? Back it up now.
Assuming you can and do sniff someone's Myspace password, you can then try the same password on other accounts. Chances are, you'll find at least one that it works on.
My boss sounds a lot like you. He even went so far as to have a DSL line ran straight to his office and uses a switch to use it instead of the corporate lan to do stuff that he's had banned/blocked. Generally I have no problem with the rules, just when the guys in "IT" seem to have a different set of them.
Certainly, an abacus network will never get any problems at all. Maintenance free.
Those policies you describe make the job a jail. Nothing comes in, nothing goes out. I would think that people is as happy as Peter Gibbons!
Comment removed based on user account deletion
Mordac the Preventer strikes again.
I can understand that if you have a regulatory requirement to archive all communications, or maybe you handle sensitive financial or medical data, then you need to block webmail. These, however, are special cases. Otherwise, you are just being a dick, and for no good reason.
There are perfectly legitimate business uses for webmail, such as a backup when the regular mail is down or as a throwaway or spam trap when you need to subscribe to trade mags. On a more philosophical level, I would argue that if you ever expect your employees to take work home, then you must be prepared for some aspects of their home life (including personal email) to sometimes show up at work.
To even ask this question is a symptom of "IT Manager Lockdown Disease"; whose main symptom is setting policies to make IT's life easier no matter what negative impact they may have on the users ability to get work done.
We have an unspoken agreement here, IT does't lock us down, and we in turn try to avoid doing stupid things to make more work for them. Caveat - I work at what you might call a "boutique" engineering firm and we don't hire morons. If your population of users contains more of the "energetically stupid" sort this arrangement may cause you a lot more grief than it does here.
None of them can see the clouds; The polished wings don't care.
You wouldn't make it to your second week in my organization. By enforcing "no web mail" policy, you are pushing the users to use the company email system to send and receive personal messages. And god forbid, your infrastructure is MS Exchange, you are more vulnerable than the webmail systems that you are afraid of, let alone opening up your company to be liable to what people say in their personal email messages.
Time to reevaluate the policies in my opinion.
__________
The more I know people, the more I love animals
The company I work for uses a "As needed" rule to allow this. We, IT, have setup the environment (Mostly XP) so users are user, no admins, and removed the VBS extensions as well. This coupled with several webfilters and out proxy keep us rather save from 99% of what is out there. Are main enry point now is USB drives coming from home, but even they are very limited since users are users and the antivirus software we use catches these rather quickly.
All that is needed is a request to the supervisor and we grant them the access.
The important thing is that you manage your corporate IT policies to make your job easier, and not to actually serve your customers: the employees who struggle to get their work done in spite of your draconian rules.
I work with similar issues: it can be interesting finding ways to get work done in spite of IT's (un)support and (un)help.
ShoutingMan.com
Thank you very much. Companies like yours are the reason companies like mine can hire brilliant and talented people away from bureaucratic nightmares and pay them 20% less while getting a significant amount more productivity from them. We have internal Web, IRC, chat, etc. servers. If your AOL IM is not working and it is stopping you from chatting with your girlfriend, IT is happy to help. They'll even grab you a beer from the fridge on the way to your desk. For smart people who know they'll spend a significant portion of their life at work, but who chose their work because they love it... there are companies like mine. You're treated like a real person instead of a cog. If you need to go home for the rest of the day while waiting for the plumber to come to your house, go ahead. Don't bother filling out paperwork or logging your time. So long as your work gets done, it's all to the good. If a friend is in town and stops by the office, go ahead and take a few hours to have a beer and play a video game with them in the lounge. Introduce them to your boss and coworkers.
We don't lock down Web access to any type of external site. We track everything, but the tracking system is open to all employees so if you want to see what your boss is doing, just log on and look. We don't seem to have a lot of IT emergencies either. Some of our old and out of date servers overheat or fall over now and again and we power cycle them. No big deal.
Every day I'm thankful I realized early in life that I did not want to take the top dollar offer for my work if it meant I had to put up with nonsense like you advocate. IT's job is not supposed to be to minimize the amount of work they need to do or even to prevent problems. It is supposed to be to facilitate the rest of the company getting work done. Happy employees work harder for the company and stay late to work on something or even come in on a weekend for some project. Happy employees do not quit and move to another company with no notice leaving the company in the lurch. Happy employees are not the largest and hardest to stop threat to the security of your network as they feel it is "wrong" to screw over the company and boss and people who treat them well and with understanding and who are their friends.
But by all means, keep making yourself hated and keep thinking your employees lives should stop and they should act like machines for 8 hours a day. We'll keep hiring away the smartest people you have.
As others have said, you are kidding yourself. First, the no personal usage of network policy is total bullshit. You want your employees bitchy and with high turnover, then institute this policy. Of course, I am sure none of your IT staff is sitting around surfing the net and *ahem* posting to slashdot right now. (Yeah, no "personal duties" my ass.)
No information on public networks, with 3rd party e-mail? Hmm, does your corporate e-mail travel along some mystical secure pipeline where only you and your customers see it? I really doubt it. So, travelling from point-to-point your e-mail is on some VERY PUBLIC networks and probably a few private ones as well. Have you thought they might need webmail access because your system is blocking certain outgoing extensions, or perhaps it is limiting attachment size too much? These could be good reasons why someone might need to send corporate e-mail beyond the bounds of your limit domain of false security.
I personally cannot fault you for no devices on the corporate network, so long as the no PDA rule doesn't mean they cannot even hook them to their desktop for syncing. If that is the case, congratulations on convincing someone to allow you to make policy that is complete BS and totally restrictive. Did I mention high turnover rates before? Are you sure you are not my old boss?
You are avoided like the plague and hated even more. You have no friends where you work, except for a few naive staff people that work for you, who are probably just kissing your ass so they can keep their special access that IT surely has. I always hated the preventing fires line. It ranks up there with arresting someone because of what they might do, not what they did. If you really just secured your systems with proper firewall, antivirus, and spyware protections, you would not need to worry about the 3rd party e-mail and the user devices.
Coming from a company that had a loose network policy my pager went off all the time. Now I can actually take time off and play golf or take the day off. Like today. Best advice is to rule the network with an iron fist but with a gentle voice.
You see, this is the sort of thing that doesn't work. You didn't make this policy for the others benefit, or even for the company's. It is for your own personal gain and that is truly the wrong motivation for setting up policies like this. Make you be struck by lightning on that golf course.
You blame AOL/Yahoo/Hotmail/Gmail for your security. At the end you seem to be really worried about the VBS. As far as I know if you use Macs or Linux or any other non-Microsoft products, you can be sure to be safe from those scripts attacks. i know it's easier to blame the email providers instead of Microsoft for its poor security, which allows scripts to be executed system-wide. So, again, looks fror the cause of your security concerns, not the consequences!
The lad has made the correct decision, but for the wrong reasons. The number one reason is because you want all of your "business traffic" to go thru your corporate email system.
He should be asking himself, "Why do the people who work here feel they need to use the non-corporate system for business work?"
All my work email goes from my work account, personal goes thru gmail.
Also, if he doesn't allow people to use personal accounts for personal email, they'll just use the company email for that. Does he want that to happen?
Google gmail is trawled by bad, bad, people, lifting out links and anything else that can be copied.
... and I am not. Nor am I the Senior Network Administrator at the company where I work. I am an Assistant Network Administrator. I don't have the final say.
But if I were king, I would certainly allow web-based email as well as messenger services.
Yes, we have a proxy server and a firewall. We currently do not allow access to any web-based email to users (that is, users who have been granted Internet access at all). The rationale: "Company assets and technologies are the property of [company name]. Employees may only use these assets for business purposes. The use of company assets for personal use is strictly prohibited." --employee handbook
Understand that this was not solely an IT decision. The CEO and other company officers in conjuction with recommendations from the IT department are behind these decisions. We, the IT department, put the technology in place which makes the policy reality.
So you might want to consider being nice to the Network Admin. Remember, he has to work for the same people you do.
Take your mod and shove it!
As has been pointed out, SOX makes document retention/protection a major concern. My employer has the problem that many items we work on are ITAR protected. Leak of these data can subject us to loss of government contracts and huge fines.
In addition, it is rumored that a virus outbreak that cost big bucks to stomp out was traced to a worker using hotmail and downloading an attachment. So now, all workstations are locked up tighter than a tick and all known webmail is blocked. Non-corporate machines are prohibited from connecting to the intranet and wireless ethernet requires an almost-impossible-to-get permission from corporate IT and security.
However, major installations have "outside the firewall" network drops available to connect personal laptops to check personal email. This is a good compromise, allowing transient workers access to email as well as the local staff.
Then they can use any email program they like.
This was a real problem early on with the Clean Air Act and Air Quality Monitoring regulations as well and still is depending on what state agencies you have to work with. Like, SOX, company officials must affirm that the data they submit is true and accurate and that they are in compliance when there is often significant disagreement over the meanings of terms, measurements, calibration practices, data collection, fraud prevention, and "compliance". Over time, standards for behavior develop and give companies some cover. From what I have seen, showing attempts to work with the regulatory agencies and seek clarification, whether successful or not, shows good faith, and beyond that, adhering to industry standards or seeking independent certification. Sometimes regulatory agency refusal to play nicely and provide guidance goes badly for them in court and forces them to change, but it takes time and persistence on the part of regulatees.
HIPAA seems to be similarly vague in many places and I would imagine fault will most likely be decided by a jury after-the-fact with "benefit" of hindsight.
It is an interesting process to watch but no fun to be a part of. What is distressing in the AQM industry from what I have seen/been told is the number of company officials who depend on contractors to work the process for them and sign on the bottom line without understanding the process or doing any checking themselves even when advised by the contractors that they are personally liable. Managers do not want to understand scientific process, regulations, or data security, they just want it "taken care of".
This is SOP at "my" clients who are financial services companies. They can't allow any message into their system unless it's logged. You can't have a customer complaining, "I told you to sell SCOX when it was at $5 and you didn't - give me my money". They prevent this by disallowing instant messaging, webmail (or any mail that doesn't go through their servers), etc. I think they also prevent usage of cell phones, pagers, etc. unless they are company-issued and company-monitored, but I don't talk to them much with these devices.
I use my own mail, on my own domain.
Block it? Go ahead, I can always SSH in and either pine or ssh tunnel to it. Dare you to take away SSH and Port 80.
There are an ever growing number of stories about companies that block WebMail, IM, VoIP, and other technologies being viewed as completely unappealing by the younger generation. Coming out of colleges and being used to being on 4 IM networks at once, using Skype to make free calls to all their friends, and being on Gmail 24x7 they have, quite frankly, shock when they go to places that block them and typically don't last more than 6 months.
So the pitch to the board isn't, our customers want to do this, the pitch is if you don't find a way to securely allow it you'll cease to be able to hire qualified applicants, cease to be able to attract the most clueful applicatants (who know the policy is stupid), and generally fall behind in information technology. Your competitors who have a more progressive policy will, on the other hand attract these candidates and put your company out of business with better technology.
I've had customers ask me to email them things via their gmail addresses because of boneheaded network administrators who think it is their duty to protect users against every type of attachment known to man. If you block the big four webmail providers, users will just use smaller ones, because ultimately they have a job to do, and your draconian lockdown policies are getting in the way.
Most companies don't block web mail for virus reason, they block it because they cannot control or record the information going out of their corporation.
This is a serious issue since the introduction of Sarbanes-Oxley. Companies HAVE to have a record of the information their employees are sending out.
Tons and tons of missing the point here. The major concern about webmail is not that it's a vector through which computers can become infected with junk. The concern is mostly that it's a way for information to leak out of the company, and that there's no way to control whether it conforms to company security standards, policies, etc. A couple of posters did mention this, but seemed to approach it from the angle of "if someone wants to leak information, there are a hundred other ways to do it." These are obviously not IT security folks...those of us who deal with these issues on a daily basis know that the clueless users are just as dangerous, just by force of numbers, than any malicious ones. I am FAR more worried about confidential data being emailed to or from a Yahoo account because a user "likes it better than Outlook" or something than I am about deliberate theft. If we lock down webmail access, we are drastically reducing our risks from these sorts of incidents.
We need to avoid any unwarranted N.S.A. intercepts of our financial market trading orders as we attempt to
manipulate markets with our frequent bogus statements about Freedom
and Democracy.
Feloniously yours,
George W. Bush
Gee We actually just had IPSwitch put in here since the IT Admins didn't like MSN / Yahoo / Google Talk and any other messenger apps and it sucks. I'm on a state / county network and what is even worst is we can't link these 2 networks together to be able to transfer files to each other, I've been looking for a middle ground / setup where both networks could share files and keep in synch with each other since it's getting old running around with the jump drive and burning DVDs just to put the data off this network to this network which is like right next to each other! 1 network is a 3mb fiber connection which is always having problems no wonder! I work out at the Property Tax Assessor's office which has the network linked along with several dozen different departments in this county like the justice center / sheriff's dept / police dept which I'm sure is the #1 reason of our network problems (plenty of goons and disgruntled employees out there that get a kick out of DDoSing these branches) Yet they're still adding more crap to block like gmail etc... Which is like making the damn firewall crawl which makes the point of having a 3mb fiber connection pointless due to the firewall halting and slowing down traffic checking it 1 by 1 It'd prolly improve alot if they'd stop filtering sites and all that and just focus on the real main threats which are computers that aren't up to date or even have anti-virus installed etc.. that's the best thing to do... Ensure every PC on the network has ample protection, AV / Anti-Spam / Adware protection instead of adding crap to the filter and slowing down network performance it's hard enough already with all these security measures. Just my 2 cents :-)
Is your employer hiring? What kind of positions are available?
How much is your data worth? Back it up now.
I hope your company pays extremely well, because most people won't put up with that sort of thing.
IT may run extremely efficiently, but like it or not, people run the company not computers. If the more
people have to work around IT limitations, the less efficient those people become. The less useful they find
your IT systems, the more likely they are to not use them. A less utilized IT system is a waste of money.
Right now, all of your users think you're an asshole and many of them are thinking of ways to get around your roadblocks, except for the people who are already doing stuff under your radar. I'm surprised nobody's given you 120V straight to the RJ45 already.
I don't allow users at my organization to use any computers. When users complain, I point out that we can't control the security policies of computer systems. :-)
You were looking at wrong keywords. Instead of "Security", type "Privacy" and "Gmail".
You would be happy if all your corparate users used Gmail to exchange companies private documents with their some gig size "never really deleted" (yes, a fact) mail?
Google fans really started to irritate me. Jump up and down shouting spyware/submit a story to Slashdot.org when your paid software innocently tries to check for updates but abandon your own paid ISP/Network mail for a service with horrible privacy policy like that.
Now, outlaw everything except your favorite webmail/company.
Yes, we block them. Anything that Surf Control verifies as Web-based Email we disallow. We even setup some custom rules for the sites that Surf Control misses.
Strangely, I'm having problems getting hotmail to load up right now-- usually problems from heavy traffic or something only last a few moments... Is anyone else having problems? Maybe the server is down.
I worked a contract at a large company once where they had coated windows which blocked cell-phone use rather effectively. The problem was that I was there to teach QA techniques in a mobile and pervasive device development lab--- and it was behind two layers of such glass. Employees were constantly filing out to the loading dock to test devices.
My real problem with the lack of cell phone use in some large companies is not personal use. People survived without that at work for many years. I would generally forward my cell phone to the desk phone on arrival. My gripe is with the sprawling campuses where my *client* cannot get a hold of me because I am in another section of the building; it reduces their own efficiency. There is also the fact that as I was often an independent contractor rather than a 9-5 employee, I had other clients to think of as well.
Basically, we have to because of HIPAA, which makes an excellent "boogeyman" to use against rogue employees. We provide Internet access for business use, not for surfing on your own time and not for forwarding that latest email from Aunt Judy. We also block incoming attachments (the common ones, .PIF, .EXE, .COM, etc.) because we've been hit before because our users will open goddamed anything. But that's a training issue, which isn't my department, and I can't control. It used to be worse, we used to not give Internet access at all unless the user's immediate manager could make a business case for such. Eventually, we had to give up on that measure because you'd be surprised how many "absolutely MUST have Internet access to do their job!!!" (even though all they do is put paper in the fax machines.)
No, of course not. However we do have several computers set up in a room near the cafeteria that are connected to a DSL line. Those have unrestricted internet access.
To a large extent, I agree with you. IT people have a responsibility to ensure that their systems are as secure as is reasonably possible. The only thing that I might disagree with is personal equipment on the corporate network. Personally, I think I would just create a separate VLAN/wireless SSID mapped to a VLAN for visitors/guests/personal equipment, and basically block most communication between the guest network and the real corporate network. Stuff from that VLAN could also be treated differently by an Internet-side firewall, and maybe forced through a proxy and limited bandwidth wise. (And of course, use 802.1x for the real corporate network, probably authenticating with computer accounts, so users can't easily connect their personal equipment to them).
Security is important, and taking steps like what you said make a network easier to manage/expand/control, and makes sure that people can't screw too much stuff up, either by malice or by ignorance.
Every time you post an article on Slashdot, I kill a server. Think of the servers!
Nothing a bit of TOR or some creative proxying can't circumvent, assuming they can access the WAN at all.
Albeit most (mortals) don't know what TOR or Proxies are, but the ones you should worry about, probably do. =p
the only permanence in existence, is the impermanence of existence.
MAN is this a spot-on response. Thanks! There's nothing worse than fucking IT guys who forget that they are a cost center - they are there to HELP THE REST OF THE COMPANY GET ITS WORK DONE. IT guys aren't the company. They aren't the ones making the money. They are effectively high-tech janitors - the HVAC guys are not there to make their day easy, they're there to make sure the office is a nice comfy 72 degrees (or whatever).
That is definitely an issue with blocking cell reception (it does seem odd sometimes when you're standing at a window and have little to no reception) and the companies that do have staff that move throughout a building or campus seem to have migrated to the use of VoIP cordless phones for their environment.
Unless blocking webmail is a coherent instance of a security policy that ensures that data is not leaked by means of a sequence of trust relationships, this whole business of blocking webmail smells of IT dudes on a power-trip or IT dudes that needed something to say at a weekly meeting.
Block email in the name of documentation, but allow use of cell phones? What's stopping me from getting a Treo and a data-plan and syncing it to my webmail account? Any security policy that makes the assumption that the same choke-points of the network are the same choke-points for documenting what people are doing is bound to fail eventually as it is simply not true.
My employer provides webmail access, but I refuse to allow it on my home network... They won't tell me what security precautions they take, and personal networks aren't supposed to be used for business purposes anyhow.
What security risks are there in particular with webmail that are not present in general web access? I strongly suspect the answer is none, but I'd be curious to find out.
Well our network uses Surfcontrol to block access to numerous sites including some webmail sites, so I used SSH as a socks proxy on port 80 as 22 is blocked to log into my box at home and tell firefox to use it as my default route, slight lag but otherwise works a treat.
I allow my users to do what they need to on the network. I REQUIRE that personal email is done with a web service so it does not use any server resources to send 5000 family pictures and retarded "If you don't send this email to 20 people, a starving child will die and you will be killed by an asteroid" emails. I offer to set up gmail for my users if they want me to. I REQUIRE the use of Firefox. If they need IE for a vendor specific app, I need that request in writing.
0xB315AA8D852DCD3F3DCA578FD2E0BF88
Car pollution? Make cleaner fuel, or make it harder to own a car, or boost public transportation/car pooling.
Potential virii through e-mail? Disallow outside e-mail at work.
While those may be probably "solutions", they stay within a narrow scope. "The problem is e-mail, so the fix deals with e-mail."
Why limit yourself to the how? Why not focus on the why?
Let's look at the pollution from cars (yay car analogy!). Rather than ask how people use cars and how those cars can be less used or how they can be used better, ask why people use them.
- Shopping Perhaps allowing some light commercial business into residential areas would cut down on the need to drive, either by requiring less driving or even getting people to walk more (which would help with our obesity "epidemic", as well).
- To go to work Research better telecommuting infrastructures, so they only have to drive to work once or twice a week.
What about e-mail?- Business-related e-mails sent to personal accountWhy would a user do that instead of having it sent to their work account? Is it something with your e-mail structure?
- People need contact with friends/loved ones I'm not saying this a bad thing, but why do they need to do it at work? Perhaps shorter work days would decrease that (yet keep the same amount of productivity, since they would be "wasting time" by checking their e-mail, anyway).
Granted, this aren't catch-alls, and some introduce their own problems, but instead of saying outright "the solution to e-mail is no e-mail", try looking at it a different ways.Perhaps the best solution isn't even tech-oriented.
When I have to send certain types of progams, my office email will not allow it.
When I complained, IT told me to use my personal yahoo account to do it, instead of giving me special permission for my work account.
This is actually typical. The problem with having IT departments block X because it also has feature Y that you don't want, is that X has features Z, and next year they gain Features A,B, and C that your USERS want and need, and honestly, your little IT department simply does not have the time and skill to implement.
The policy of blocking external IT sources puts a severe penalty on innovation and work on the users. Yes, you block one single kind of problem, but you also block tons of GOOD things, without realizing it.
You should only block the 'essential computers', not block all users. Treat your users like they are OUTSIDE your firewall for most things, not inside them. That way they can take full advantage of the innovation from the Web, etc.
excitingthingstodo.blogspot.com
Guess we gotta have these people with a stick up their ass to add more red tape. I'm still dealing with AOL to allow users of my website to register with AOL addresses. Frankly I don't give a fuck if AOL blocks the confirmation e-mails, it's their and their stupid ISP's loss.
in a company comprised largely of wanna-be geeks or semi techie types it's tough to limit access without too much headache from users.
but at the same time email shouldn't be such a large security concern these days and internal networks still need to be properly secured in case of the unforeseen - you never know what could happen, like someone swapping their laptop onto a port and getting access to the network and unwittingly spreading some kind of windows infection.
woooo! Fun!
Spam Thwart: Anti-Spam Collective
Whoa... There is a middle ground here between the draconian policies and the opening stuff up. As several other posters have noted, IT is there to facilitate the BUSINESS. That doesn't generally mean helping someone get their iPod working on a company machine, but it doesn't automatically mean banning said iPod either.
We really need to try to hit that middle ground. However, it remains important to remember that IT is seen as a cost center (no matter how much we want to call ourselves "enablers" for the business). Since we are seen as a cost, the business leaders actually DO expect us to operate in a cost effective manner while facilitating BUSINESS. Now, I've seen a lot of "personal use policies" which we know are just there to fire people who do it to excess. Most businesses realize that their employees tend to be more productive if they are allowed to track their order at work or check some stocks or whatever. There does have to be a limit though, because IT is not helping the business value when they spend time working on issues caused by personal use or software.
You all know this I guess - it just seems like there are too many posts here that are too firmly on one side or the other. Balance...
I'm pretty sure that some of RAS syndrome comes from habits that arise from corporate pressure to use trademarks correctly. A lot of abbreviations are trademarks, and trademarks should be used as adjectives that designate the source of a product. For instance: "UNIX system" not just "UNIX"; "Windows OS" not just "Windows"; "iTunes store" or "iTunes software" not just "iTunes". Even in the case of "ATM machine" where "ATM" has become generic, the word "machine" disambiguates "automated teller machine" from "asynchronous transfer mode". Putting a PIN number into the cash machine is expected; putting an actual pin into it is vandalism.
we can access webmail and it's a godsend for the twice weekly Lotus Notes problems. Nice to have email that actually works!
---
We spoke for about a half an hour. I don't recall a thing we said. - Colorblind James Experience
rtobyr asks:
"I don't allow users at my organization to use any third party
e-mail. When users complain, I point out that we can't control the
security policies of outside systems. End users tend to think that
big business will of course have good security; so I ran a test of the
'Big Four': Hotmail, Yahoo Mail, AOL/AIM Mail, and GMail. Yahoo Mail was
the only webmail provider to allow delivery of a VBS script. GMail was
the only provider to block a zipped VBS script. End users also tend to
think that a big business would never pull security features out from
under their customers. Of course, we know that AOL and Microsoft have
both compromised the security of their customers. I don't know of any
security related bad press for Yahoo or Google. Three of my Big Four
either allow VBS attachments or have a poor security track records. So,
if you are a network administrator, do you limit your users' ability
to use third party e-mail, and if so, do you allow for GMail or other
providers that you've deemed to have secure systems and reputations?"
Dear Rtobyr,
What's the point of trying to block mail when someone can just post
an executable in a slashdot comment? If this had been a VB Script,
your network can be pwnz0rz3d. Who do you think you're kidding?
Sincerely,
Anonymous Coward
We have legitimate business needs for just about everything you can find on the internet, so we do not filter anything. Of course, this leads to huge spyware issues and the occassional virus, but for a company our size, its not too big of a hassel. You will get fired, of course, for illegal activities, such as child-porn and piracy. Other than that, we have a big, fat, unfiltered fiber connection to the internet. Its nice downloading software updates at 1.5Mbps-3Mbps, depending on the time of day.
There are some cases where I can see blocking of webmail sites, such as government contractors. Truthfully, though, corporate America (and other coutries) really do not have too big of a reason to worry about personal webmail sites, unless you are worried about corporate espianage or something. But as far as viruses and such like that, they can get those off of going to other sites on the internet. You should be working on keeping your Antivirus and Spyware software up to date rather than worrying that Yahoo alows the delivery of vbs files. A good antivirus software will block the executing of those things anyways.
I'm just trying to figure out why it's "third-party email." That means that there must be "first-party email" and "second party email." Now, one of those must be the email that the company provides... Or am I the "first party" and the company is the "second party?" Then I suppose there would be no "first party email" unless I was imagining it in my head? I'm so confused. Who are the parties?
I'm just sayin'.
It is your network, it is your computer, it is your Internet connection, it is your desk, it is your electricity, it is your chair, it is your building, it is your time to deal with issues, it is your butt on the line if there is a problem. You pay people to sacrifice their time to do what you want done. In the USA at least you can do what you want as long as you obey the law. There is no law that says employees get to use your equipment for anything personal in any way. If your employees don't have a problem with the policy, all the better. If people start jumping ship because you don't allow web mail, then it is *YOUR* fault. Just don't forget that when it happens. *You* - not the employee - bare the responsibility of what happens under your roof.
If your employees are complaining, that is usually a sign that turn-over is headed your way. These are not bad people (if they were, why did you hire them?), you are just not interested in keeping them.
Now my employer is awesome. We get an IRC server, we get IM, we get web mail, I can take 15 mins and read/post on slashdot on the company laptop running Linux. There are basically no restrictions except for obvious stuff like porn. I am very grateful my employer has such a liberal policy and chooses to let me integrate their gear with my life. It helps make things easier, and fosters a work hard/play hard environment. Would I go work for your company? Only if you were my last option.
And people wonder why our country is so stressed and rigid.
Loosen up a bit, chief - you're pushing good employees away, not drawing them in. Nobody wants to be a robot. I've worked in IT for over 15 years, and during my interview, if I even catch a whiff of stuff like this, I politely decline, and run the other way fast.
Your employees will be far more happy, productive, affable, and in general put in more hours, if they can take care of some personal business while at work. Sure, it takes away a little time, but if their work gets done, who cares?
You sound like you have a chip on your shoulder, and are taking it out on everyone else... At least, given the text and tone of your email, that's certainly the way you rub off.
and work does not get done with viruses and worms rampaging on the network. work also doesn't get done when the boss goes to jail.
Snowden and Manning are heroes.
Well, that's just stupidity in action. But a good point none the less.
Our current primary access to email is IMAP based and the main provided interface is a webmail client (we currently use squirrelmail but are in the market for a better one). We also allow Outlook (not Outlook Express) in IMAP mode on PC clients and Mail for Macintosh in IMAP mode on macs as an alternative...
disclaimer: I work IT at a school district so our needs are probably quite different than the average company)
That said, We allow our students to access gmail, hotmail and yahoo mail to send assignments in from home or to home from school and some teachers allow students to mail them assignments. We don't have an in-house email system that covers all students so we feel it is necessary to allow access to those webmail sites. I use GPOs on Windoze boxes to keep the inrush of attachments minimized and can easily re-image a machine if it gets hosed to the point of no repair.
...quicker, easier, more seductive the darkside is...but more powerful, it is not.
I was once in the situation were an external department was brought back under the companies big wing, basically a bunch of hippes was put in an office of suits. This lead to the following amusing situation.
I could NOT get ssh and ftp access to the companies external servers wich ran the company owned website. The proxy in use, was not just extremely slow and frequently out of action, it also blocked certain key sites an admin/developer needs access too. Trivial stuff perhaps but as a webdeveloper I sometimes need to able to browse to such obscure corners of the internet as the companies own site. I know I know, crazy.
When that was finally solved (well actually I only ever managed to get ssh access, but well, with that you can solve almost every other network problem, but I don't need to tell slashdot that), I got called in by HR, apparently people from other departments had complained that whenever they walked by our desks they always saw us reading news or playing webgames.
Indeed we did, my job was to add a newsfeed to the site and the graphics monkeys were building/adopting flashgames for the site. Odd as it may sound but that required us to actually test that stuff over and over again.
It is truly amazing how bad some companies can get if they get too big. They had outsourced most of their IT and it was a mess, the internal IT department had been gutted by people just leaving. I at one time was asked to make it possible for a re-seller to upload their sales data into the system to automate this process. So I developed a system against the test system they had setup. Reasonable, except I know IT and so I said the test system was not the same as the live system, they said it was, I said it wasn't, they said it was, they knew for certain and I should just do as I told. I told the director it wasn't and went ahead and coded the system. I wanted it tested but their developer was on holiday, so the deadline approached, it went life with everyone present and voila, live system totally incompatible with the test system and the developers holidy, turns out he is on a sailboat on some around the world trip and has given his notice months ago.
Guess who got to clean up the mess? Guess who that sameday activated his resume on monsterboard and handed in his notice?
Still I spent another two weeks trying to get a crappy windows system with undocumented and untested software to accept my linux requests. Would you believe that it can take a windows machine over 5 minutes to add a new customer to a pending activation list?
Apparently this was already known by the reseller wich is why they wanted it automated, NOT because the job of typing in the sales by hand was to much but because the person doing it had to wait for minutes between each entry and refresh to see if the system had finally processed the action.
The sad thing? When I started working there it was just as your describe your departmant, IT in service of the business and not the other way around. That is not just good news for the sales department, it is actually good for the people in IT itself.
MMO Quests are like orgasms:
You may solo them, I prefer them in a group.
The reason why companies consdier web mail a security risk isn't because of viruses and trojan horses, it's because of the potential dissemination of proprietary corporate information.
I wonder (on average) what is more productive though - a happy employee with freedom to do non-work-related tasks while utilising work infrastructure and time, or a not-happy employee that comes in and works at 80% because he's not particuarly happy.
Obviously this is massively subjective depending on the role and the person, so I wonder if in some cases companies have actually done studies on this to see what happens.
Our company policy is this: company resources are to be used for business purposes only. Now having said that, everyone knows that people use it for personal things. Nobody has a problem with that so long as it doesn't interfere with performing your job and isn't considered offensive.
In our department, we try to balance security and convenience. We don't block webmail etc, however all the traffic is proxied and logged. Executable type code is not permitted to be downloaded. We keep all the clients up-to-date on patches, virus signatures etc. to help minimize the risks.
We also do try to educate our users a bit. We hold "mini-classes" where we cover a topic or two (people can make requests). We try to keep them short and have them early in the morning or after general work hours. They are completely optional and we get a good turn out (60% to 70% depending on the topic(s)). People learn a little bit that can help them either at work or at home. I do most of the work to organize this over a lunch or two, it costs the company so little, and it helps everyone. Hell, the executives attend most of them, partially because they support it and because they too learn a little.
This approach works very well for us.
You CANNOT block webmail - anyone can get around any blocks that you put up unless you completely block external Internet access. This is because ANY host on the Internet can act as a webmail host - you cannot block every site. This is utterly the wrong approach to information security. First - you have to trust your staff to do what is authorised within policy or legal guidelines - when they are FULLY informed that is of their responsibilities. Second - be completely open - all internet access should be logged if it is important to control what information flow you have. Of course, this is the same as a security pass system that logs who comes in and out of the company. Basic security. Thirdly - as you have taught your children, every action has consequences which must be CLEAR to everyone. This is all based on the absolute truth that you cannot stop information leaving the company - the employee leaves the office each evening and comes back in the morning. What do you want to do - do a Paycheck (the movie) on them? All you can do is make sure that the person does not WANT to take the information or do something wrong with the information. Then you make it ABSOLUTELY impossible for the person to do something without you knowing through good logging and analysis that is effective. This makes the consequences occur absolutely. That is the discipline. Information security is a wet job as they say - not technology.
As a consultant, it is you and people like you that I find annoying. Typically every client-site blocks OWA, which means that I cannot access my company e-mail during working hours. Since I not only bill, but am also a senior resource within the company, this typically means that both my manager and the people who report to me need to wait 24 hours to receive a response. This is highly annoying.
I use Circumventor to get around this kind of crap. Sorry to invalidate your "one size fits everybody" BS, but I'm not an idiot, and I'm able to filter out malicious email just fine, thanks very much.
To reiterate: It's my email, and I'm going to read it whether you like it or not, and if you don't like it, bite my ass.
I often think the answer is most places should have two physically separated networks. One for strictly work, on for outside mail/web,etc. Keep the corporate/client/patient data safe on one. Allow workers to spend any free/needed time to take care of personal business on the non-work machine/network.
I can appreciate the security implications of blocking personal web email. However, I think most other organizations do it because they are concerned that employee use of personal web mail will cut into productivity or violate some other HR rule or regulation. I am a network administrator for a small manufacturing company and we trust our employees to be judicious and discrete. I only block P2P and chat stuff because they are gaping security wounds. Plus, I have taken a layering approach to security so it is fairly safe; we also do not do any hosting of our own. Thus far, knock on wood, no problems have arisen. I hope never to have to implement any kind of content filtering because I think we all like to able to enjoy surfing. That said, if it does become a problem, I will use Dan's Guardian.
does not allow the usual "bad" attachments - .exe,.bat and the like - but some of our equipment if 2000 or XP based (no *nix - the german division decided against it) and we often need to send such files about to and from the engineers. We are forced to use webmail or upload to a site and send the download link along. It would be much easier if we had a secure mail client that would just deliver the attachments without trying to read them to us.
I sat down to write a new sig tonight and all I did was make the chair warm.
It's people like you who've made me into an absolute expert in IP tunneling. If you lock me out of web mail, you'd better lock me out of admin privileges and httpd too or I'll walk right around your webmail blocks.
And don't think you can hide your rootkit keystroke loggers and remote control software from me either.
If you do figure out a way to keep me from tunneling through port 80, I'll plug my blackberry in and dial up to get to my personal email.
And I always use https for my gmail account and skype for instant messages just to keep your nose out of my business.
So what was your obstructionist rationalization again? Policies you can't control? That's nonsense. It's management thinking that their engineering staff is wasting company time on the internet. Anything else is a big fat lie.
via SurfControl on an ISA2004 array. SC does a good job keeping the database up-to-date. 2000+ users fwiw.
Due to being a thrall subject to corporate regs like SOX and others, I have to lock down user PCs, and restrict them behind a Draconian firewall, allowing access to only what they need to work.
However with Terminal Services clients, I enable it to be used in a client window, and make sure that "Turn off clipboard redirection" is off in group policy. All employees can connect to a cluster of Terminal Servers which is securely in a DMZ, isolated from the rest of the network. Only a few people have administrative rights to these machines, and the only connection the Terminal Server machines have to the internal network is a port to a dedicated domain controller. To further separate the employee "free for all" TS machines from the corporate network, they even are connected to the Internet on a different link. Of course, the TS machines have a few outgoing ports blocked at the router (port 25, duh), but its nowhere near as locked down as the internal corporate network.
Now, desktops can be locked down, but users can do pretty much what they want on their account on the terminal server (Webmail, IM, etc.) If a user gets malware, it can only affect their user accounts (assuming the malware gets past the AV scanner resident on the machine.) There is no known way the internal PCs can be infected by a compromised terminal server (if by chance something like this occurs), and confidential corporate material can't get out by accident via the clipboard (if someone wanted to get it out, they could manually type it, but that is a different story altogether.)
I have been in IT for a little while now, and been a victim and an enforcer of these draconian security templates, and, in all honesty they don't work well at all. If you are going to block webmail, you should just block it all really. Webmail is not the only source of viruses and the like. There are a million and one other ways for these files to make it onto your network from being imbedded in jpeg files to ftp downloads, to being built right into a webpages code. You are just making more headaches for yourself and the people who use your network, in fact, I would actually consider the network functionality as being crippled as instead of helping to promote a positive work environment, you are doing the exact opposite. A network should improve the work environment, not shackle people down. Not to say that a stringent security policy is a bad idea, quite the opposite actually, it is a good thing. But there is such thing as going to far and being blinded by one potential security leak, causing you to ignore a lot of other leaks.
Personally, I say give them their webmail, just make sure your av software is current and that your firewalls are up to date.
Limiting your users to the point that they avoid you like the plague so that the IT guy can relax and play golf makes as much sense as telling them to shit in their trashcan so the janitor can go fishing. Run the business to run the business, not make the support staff's lives easier.
What bugs me the most is Hotmail/GMail etc stopping legit use of VBScripts and Executables.
.vbs scripts. Why can't Hotmail/GMail have a checkbox in the options that says "[ ] I am not a dumbass" so that I can receive any file sent through e-mail? Hell, sometimes I even want to download the latest virus through e-mail to have a look at it under IDA Pro. I also develop programs, and when I try to send one over MSN Messenger, I have to jump through hoops to get it to anyone (usually rename .exe's to .sexe or .rar files to .roar)
In the last job I had, 90% of the work that was done was through
Look above
Vote monkeys into Congress. They are cheaper and more trustworthy.
I wonder...could this be a googler??? oh no...can't be...they pay 20% less
Linux fixes all the cracked Windows.
Actually I'm absolutely certain I would get much more work done with the boss in jail. And I'm betting there are millions like me - Office Space, like Dilbert is funny (when it's not downright depressing) because it's so true.
Vote Quimby.
Google lets you drink beer at work?
In the UK, it has been established that employees have the right to privacy in their personal phone calls and emails while at work. So if you don't give employees a private way to send and receive personal email that doesn't use their corporate email account, you can not access their corporate mailbox for any purpose, even if they leave the company or die.
At the school I go to, I must admit the security is pretty poor. Firstly one can use a USB stick, whihc you can pretty much bring a virus on, some hacking tools you name it. They block saving of .vbs,.bat and stuff like that for homedrives, But I could save these files anywhere else on the network and it would allow me to run it, which then could cause a DDos attack or somthign to the network. Also netsend is not blocked, so If sombody wanted to, they could probley send thousands of netsends or do some kind of attack that way. Also they don't monitor network traffic, so if sombody changed the cables to make a loop, causing thousands of packets to be sent, it would take them atleats a day or so to fix it. Also the firework is a piece of crap, all youi have to do is do https:/// or vist a proxy server like snoopblocker.com. Also they don't record logins, so if sombody did somthing at a computer they wouldnt know, because they dont record logins. Also lots of teachers keep programs open which hold information about students etc, which anybody could easily access if they left there rooom. Also on the teachers pc there are extra softwares for them, but if any student where to logon to that pc, they would be able to access these tools. One being able to watch every pc screen in the scholl and take control them, so if the admins left there office, they leave the pcs open and running, one could connect to there pc and do some destruction. One could easily plug there laptop into the network, and do all sorts of attacks such as ARP poisining to get password etc etc. The list goes on and on.
talk about being spaced out
there are many many points to debate on, yet you choose
typography.
subtle.
very,
very
subtle.
i hate you, too
happier, more productive,
...
...
...
...
...
comfortable,
not drinking too much,
regular exercise at the gym
(3 days a week),
getting on better with your associate employee contemporaries,
at ease,
eating well
(no more microwave dinners and saturated fats),
sleeping well
(no bad dreams),
no paranoia,
fond but not in love,
no chance of escape,
concerned (but powerless),
an empowered and informed member of society
(pragmatism not idealism),
no longer empty and frantic like a cat tied to a stick,
that's driven into frozen winter shit
(the ability to laugh at weakness),
calm,
healthier and more productive
a pig in a cage on antibiotics.
Setup a 'personal server' running VNC Server, and completely isolated from the internal network.
Allow people to vnc to it and access a limited account with small temporary space with the sole purpose of accessing personal webmail. No other internal box is allowed to access webmail, keeping personal and company stuff completely separated. the amount of time accessing the vnc server can be accounted. no virus will jump from the vnc server to the internal network or vice-versa.
Ever since we purged Windows from the machines at work receiving VBS has not been a problem. People who don't need a web browser don't have one and nobody is bothered by Outlook. Really, why does every computer need to run a system packed with non-business related software and all that multimedia junk or a system filled with programs and files that are without any documentation? If someone has a good reason to run Windows he's got it but it better be a good (business) reason. If we were switching to Vista instead we would have been forced to buy a lot of new computers and still have the original problem.
Compliance.
Ugly word, but one that means that a _lot_ of regulated industries need to be keeping records of email and the like. Which makes messageing and external emails a problem.
But do they, really? Or is it just easier to try the old "you're on salary, you work undefined hours" cop out rather than hiring enough people to actually provide the necessary cover at all times when it's required?
This is another trend that should be stomped on, hard, by workers. Being legitimately on call, and compensated fairly for it, is one thing. Indeed, it's a necessary part of certain jobs. But for most people, being connected with work 24/7, checking mail from home, getting calls on your spare time, is all just another abuse.
Some time pretty soon, I think the mainstream software industry is going to start fragmenting into much smaller, more dynamic businesses. The simple fact is that good people could write the same code for themselves or a small company that they part-owned as they write for a faceless megacorp, and it would be worth just as much to customers.
In other industries, with more physical products, there is a need for some centralisation of resources to produce products efficiently. However, this is not the case in a knowledge-based industry like software development.
Moreover, it used to be the case that working for a larger company provided some degree of security and relieved some of the burdens that the self-employed contractor would have to deal with. These days, large companies attempt to impose increasingly one-sided employment contracts that stretch well outside normal office hours, and fire people at the drop of a hat if a product isn't selling.
There simply isn't a compelling reason for good people to work for anyone but themselves, or a partnership with valued colleages, any more. In that environment, they don't get bossed around by ignorant managers, aren't subject to large company bureaucracy and overheads, get to do what they really think is the best thing, and most important of all, take home all of the profits instead of giving most of them to an employer that does precious little to justify that privilege.
Consider that other knowledge/skill-based industries have worked this way for a long time: think about lawyers and accountants. There isn't really much need for huge, monolithic software companies any more, and if you're going to get something bespoke done to improve your business, there's more benefit in getting a small, customer-friendly, and highly skilled team to do it for you than there is in buying some off-the-shelf ERP system or something and then wasting countless hours of employee time across your whole business because of the inefficiencies of using a generic product that isn't written very well, and comes complete with many bugs, little user friendliness, and often even less support from the vendor. In a more distributed, localised industry, everyone wins... except the big software companies who like to abuse good people and take most of the profits, whose free lunch is well and truly over.
If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
...that your grammar didn't go to for a spell.
Spend less time thinking of how to break things and more time on your education.
---
oh and... get off my lawn! (damn kids.)
Cake or Death? Cake Please!
A lot of times consultants/contracts/vendors are going to be using webmail to communicate.
So if you are taking away webmail, you are effectively taking away email for these users. Which, needless to say, won't help their productivity. I once had to go back to my hotel during a workday just to collaborate with some experts within my own organization. After which I came back with a memory stick full of code we had built together offsite. The company wasn't any safer. (Actually they were less so, since the firewall never got to see or inspect my code). And the company was out several billable hours of time that I wasted trying to get the needed information and traveling offsite to get it.
But there it is, if it is work related email then it is not part of your private life. If it is not work related then you shouldn't be sending or receiving it while at work.
At least the trains...err, the system updates are on time.
Have any of you encountered a job that required more than four hours of actual working time a day?
technical writing / development
I mean, seriously. Most clients of mine allow personal devices, but they VLAN them the heck away from the corporate network. Seems pretty sane to me.
They don't grade fathers, but if your daughter's a stripper, you fucked up. --Chris Rock
You need to do the following:
- Talk to IT and say, "I need to exchange large files with [insert important client here] in order to [insert good reason here]. How would I best accomplish this in accordance with IT policies?"
- Talk to your boss and say, "In order to do my job, I need to exchange large files with [insert important client here] in order to [insert good reason here]. I spoke with IT, and they couldn't come up with a good solution. Can you please escalate this to the appropriate level that it gets worked out? This project is worth [insert large number here] dollars to the company, and we will all look like [insert stupid-sounding animal here] if we lose that client over this. Perhaps our VP needs to talk to the IT VP and get this figured out."
Blatantly violating company policy is dangerous to your career.They don't grade fathers, but if your daughter's a stripper, you fucked up. --Chris Rock
> from your network to protect your fragile windoze boxes
Are you really serious? Did you actually read that comment, or are you just retarded?
Hmmm, funny, our office and network have been virus free for years, and we don't have to adopt shitty attitudes about it. What's your problem?
i'm not saying you have to be the third reich of network administration, just that you can't be allowing users to do whatever the fuck they want.
IMO the best network security is the network security your users don't even realize is there. but we don't live in a perfect world, and when there are strict laws regarding business data and accountability you need to make sure those laws are followed, using both social and technical measures.
Snowden and Manning are heroes.