Slashdot Mirror
Do You Allow Webmail Use on Your Network?
rtobyr asks: "I don't allow users at my organization to use any third party e-mail. When users complain, I point out that we can't control the security policies of outside systems. End users tend to think that big business will of course have good security; so I ran a test of the 'Big Four': Hotmail, Yahoo Mail, AOL/AIM Mail, and GMail. Yahoo Mail was the only webmail provider to allow delivery of a VBS script. GMail was the only provider to block a zipped VBS script. End users also tend to think that a big business would never pull security features out from under their customers. Of course, we know that AOL and Microsoft have both compromised the security of their customers. I don't know of any security related bad press for Yahoo or Google. Three of my Big Four either allow VBS attachments or have a poor security track records. So, if you are a network administrator, do you limit your users' ability to use third party e-mail, and if so, do you allow for GMail or other providers that you've deemed to have secure systems and reputations?"
Besides the obvious Content Filters how are you blocking them? A moderately bright young chap could proxify their way around that.
This
These days, anybody that opens ANYTHING with a .vbs extension deserves whatever happens to their computer! Are users really that dumb?
with webmail, you still have to download the file in order for it to cause problems, wheras if you force your users to POP it, it will be on their computer for sure.
don't know of any security related bad press for Yahoo or Google.
Google is suspected of saving and data mining users gmail. It may sound paranoid, but if you are worried about corporate info/secrets being leaked, it might be wise to avoid. http://en.wikipedia.org/wiki/Gmail#Criticisms
Libertarian Leaning Political Discussion Forum.
Where do you work? I'd like to know so that I do not inadvertently apply for work at your company.
Then again, I'm sure you've addressed all of your company's really important network concerns first before moving on to this. Or, maybe you were sure to restrict all of the workstations such that no one can change their desktop wallpaper and things like that.
Which webmail system do I use while at work? I use my own squirrelmail installation. I bet you'd really hate that!
Shits going to get through, one way or another. Even through your preferred e-mail system, or through a web browser exploit, or through something else.
.vbs scripts. Lol. I know better than to bite a troll like that.
I use hotmail and gmail every day, mainly as spam-sisterns. They've taken pretty much every worm, scam and spam the 'net has seen, and I've never been infected from either service. Nor has my local AV software ever kicked in to protect me from anything. YMMV.
I like the write up. You didn't find problems with hotmail, but hate MSFT, so you put it on the same list as Yahoo, who forwards
So, what are your favorite Apple products? Me, I'm excited about the iPhone.
I don't need no instructions to know how to rock!!!!
I've been part of the Google Beta testing for hosted e-mail (for my own domain) and also been part of the testing for the Google Apps for businesses. During that time, I've not had any issues with spam nor malware mail. Given Google's intent to host small businesses, I strongly suspect that they will pay close attention to security issues, esp. on their e-mail service. I've been pleasantly surprised as to how good their spam filtering works. My wife also has noticed that spam has pretty much gone away. You can access your e-mail both on the hosted site, and at least via a pop client, so you could possibly insert additional security on the pop client, but give folks access to a web version of the e-mail as well.
I'm glad I don't work at your organization!
Seriously, webmail has so much use that blocking it is ultimately counterproductive -- the only equivalent "security" would be totally blocking net access.
If you are worried about productivity loss, well, I often use webmail so I can stay at work longer. Really, it's not hard to imagine that allowing people to use light net access for personal communication means that they do not have to physically leave work to do these things. It's a bonus for all.
If you are worried about security, any net access that allows submission of forms or uploading of files is equivalent security breach. As stated before, any moderately skilled hacker can configure a proxy to get data off your network.
You're crippling your users and kidding yourself.
Simply put, yes.
We would prefer that the work e-mail not be used for personal mailings. One of the reasons is file storage space.
We are willing acknowledge that the parents are going to communicate with their kids, and other folks with friends and family. It makes for better employee morale when they are permitted access to web mail for such things, leading to less abuse of work systems. It is better to use e-mail than the phone, which needs to be left free for actual business calls with clients.
Are there security concerns? Though the poster found some concerns, those concerns are easily disarmed by a good anti-virus/anti-spyware program.
Sure, we could be rather draconian and put the kabosh on all of it, but it comes back to employee morale. A happy worker is a productive worker. Our workers are given the task of being responsible and are rewarded for their success.
Bearded Dragon
We use Google Apps for our company email. We were using an internal service until we switched in February. Apart from IMAP support, using Gmail for company email has been a great improvement over our previous system. The majority of our employees prefer Gmail's web interface to a standalone mail client. That said, we obviously allow webmail use on our network.
Frag 'em all...
it's too big of a business for this to be excusable.
Seriously, why is this considered horrible? Someone might sniff a myspace password? It's Myspace, Everquest ranks higher in the securiy list.
The big Net Admins in the sky tried to block web based e-mail from Comcast, Aol, G-mail, Hotmail, Yahoo, etc... then all the physicians freaked out and got pissed enough for them to change it back. Or at least that is the story I was told...
How much is your data worth? Back it up now.
Translation: my organizations' computers are not secure enough to safely access the Internet. This is somehow Google/Yahoo/MSN's fault.
I don't care if it's 90,000 hectares. That lake was not my doing.
It's safest when the users can't run any scripts or executables. With Vista, you can easily configure the UAC to stop such user nonsense.
What's their secret? They take care of preventing stupid users from downloading crap themselves, meaning they scan at their proxy and/or firewall boundaries (I'm not a network admin here so I don't know exactly how it works).
This has been the policy for at least five years and they've never had a single problem. Never.
If a large financial services company can do it, I don't know why everyone else can't either. So you're asking the wrong question - instead, ask "how can I provide a better service to my users by allowing them to access their webmail and also maintain my network security?"
I've worked at companies that either completely or selectively block webmail access. Nothing personal, but you and other network admins like you suck rocks as far as I'm concerned. Trusting or distrusting the webmail provider because they do X or Y is supremely stupid because you're basically bending over for them and waiting for the inevitable vulnerability to show up. What, are you going to go to your CTO and say "well, I didn't trust Microsoft and AOL, but I thought Yahoo was OK! It's not my fault!"?
You should know better and you should do better. If you can't, just block all webmail and stop complaining about what other companies do or fail to do. It's your network and your responsibility.
Web2.0: I love when people Flickr my cuil and digg my boingboing until my google is reddit and I start to yahoo
I guess I understand that, but the bummer is that for a lot of us we don't work just your basic 9-5. If you work a lot its nice to be able to take care of a little personal business, in fact I think it probably increases productivity by making people more willing to hang around at work a little longer. So in that regard these bans are counterproductive.
I don't think IT people really think about stuff like that much...the ideal situation for IT isn't necessarily whats best for the enterprise. That said I can see how security and document retention are valuable goals...maybe webmail could provide some kind of mechanism to allow companies to hook into it and archive messages read or sent using corporate machines. Same for instant messengers. Then everyone's happy (except privacy advocates...)
Yes - but stop them using Internet explorer. Most 'issues' then go away.
Making a non-webmail page with links to nasty VBS scripts, etc. is just as easy as send an e-mail, so you are not really protecting your network by these annoying limitations... An attacker can send your charges an e-mail (at the corporate address) with a link to his script. And if you check all browsing (via scanning proxies), then you may as well leave webmails alone, for they'll be checked too, along with all other HTML pages.
You are not alone, unfortunately. I found, that whenever admins (pompously) argue for strict banishment of a particular "attack vector", they almost always ignore another vector for the same attack.
There could be one justification for banning external (non-corporate) means of communications, while at work — compliance and legal issues. A big bank, for example, does not want a broker to be able to claim, that a bank's trader ordered a (bad) trade via. GMail or cell-phone. But this only makes sense, when your official (corporate) communications get recorded and archived (unlike private webmail accounts and personal cell-phones), and can be played back.
In short, you have to remember, that you (an administrator) exist for the benefit and convenience of these people, not the other way around. So if they want to be able to access their webmail, you must have a much better reason than "you may get a virus" to deny it to them.
I bet, more productivity is lost, when an employee brings in flu and half the office gets sick. But no one is advocating forcing people to take vitamin C and wear scarves, right?..
In Soviet Washington the swamp drains you.
There are talks at my employer as well of limiting 3rd party mail usage (along with IM and other services) not just because of security, but because they want (or "need") to monitor all outgoing/incoming messages.
It's really depressing how limited our access to the Internet has become. Its mostly done to "boost" productivity or "prevent" litigation. Security concerns are now adding to that situation. I see a point in the not-so-distant future where businesses and corporations will be so worried about authorized usage and security issues that there will be not be any user desktops/laptops even connected with Internet access, just back end servers (such as Exchange).
Sad. Just sad. And there isn't much that can be done to reverse the trend.
If there is a corporate policy on outside email usage then it sounds like a place I would not want to work. Please expect me to be an adult and I will act like one.
We created our own web access to our server.
I also agreed with the "no third party" rule...
Fast, cheap, correct. You get to pick two.
Do people really chmod +x email attachments?!? I'd say your problem is in user education. Hell, any user knowledgeable enough to know how to set the executable flag should KNOW better!
This sounds less like a real Ask Slashdot question and more like "Hey look at me. I'm an IT fascist!"
Blocking webmail is pointless and serves only for you to needlessly flex your authority in the only part of the world you have authority: your company's network.
Seriously, if you are so paranoid about webmail, why allow internet to the desktop at all? Since you are so afraid of VBS, why don't you just lock out VBS execution at the desktop and keep your enterprise AV up2date?
Grow up, have kids, and annoy them with your stupid restrictions. Leave the people at work alone.
Long, Long ago we just disabled vbs execution across the whole enterprise.. we allow access to any of these services.
Got Code?
Man, was this ever timely. I just finished setting up a very complete solution for my current location (forward deployed military in the M.E.). Yes, of course I allow Webmail access. Everyone relies on it for 'reach-back' capability. What I do in an attempt to secure things is to setup a very complete firewall/filtering/etc. box. Is it perfect? No, but it's very effective. I'm running a Linux box with a slew of services(HAVP, P3Scan, ProxSMTP, HAVP, Privoxy, frox, ClamAV, RenAttach, Rules Du Jour and of course IPTables plus a bunch of others) and have had outstanding success. I recommend just using IPCop + BOT + CopFilter if you need something quick and relatively painless. I also do regular automated Nessus scans, etc. Man I love my job!
GMail supports POP. So you could just setup an account in your mail client at work. I use IMAP for my personal email at work. Barring that, I can VNC / Remote desktop to my windows machine and use the mail client there. Barring that I can SSH into my server and check my imap server there.
I'm god, but it's a bit of a drag really...
Only allowing Gmail access on corporate network for the same reasons as the submitter.
As other posts will/have pointed out, your current thinking is a little misguided.
Here's some suggestions:
1. Corporate has a policy of "acceptable use" for their computers and networks right?
2. I'm running a small network, I log packets passing through the firewall and then filter for certified time wasters like fark.com and report usage by individual to their superiors. Waste of disk space? Waste of time setting up? yes to both. But you get an idea who's abusing and it's up to the manager to decide their fate.
3. I'm not perfectly familiar with Dan's Guardian, but maybe it's another way?
Unless management wants the approach you describe, I'd go at it a different way.
Got Trader Joe's? friendwich.com RSS feeds work now!
unbelievable - "I don't allow users at my organization to use any third party e-mail." What about public phones, cell phones, flash drives, uh... Why not just curtail any network use? Oh, and I'm sure you "don't allow" folks to use tunnels either, right? Go back to cisco class, bozo, there's a big bad world out there that you're clueless about.
-decuser
...like it or not to help protect my users from themselves. In that spirit, as part of my security practices, I run heavy antivirus and antispyware on the firewalls in order to facilitate safer webmail usage by my users. Sure, I could (legitimately) mandate no web mail as policy or simply be a jerk and disallow it, but I *try* to see technology as an enabler. It's a better situation: users get home/private mail access and I get a reasonable-secure network. A bonus is that users see IT as helpful instead of "those jerks who won't let me at my Gmail account. This may not work for others for technical, political, or idealogical reasons, but it's pretty good for us...
Honestly, I've always allowed webmail (and encouraged it) as a way to side-step a certain amount of responsibility for reporting users for things. It may sound crazy, but in my experience you can't stop users from e-mailing their friends, spouses, mistresses, and drug-dealers during the course of the work day.
I've had it happen where e-mails about an employee's drug habit get stuck in our spam filter, which means I saw them when I went through looking for false-positives. Suddenly, I'm in my own personal game of "Scruples", trying to figure out whether I need to report the guy or if I can just ignore it. You might think, "Of course, you report it!" However, after seeing a whole ton of these things, reporting them all is a scary prospect. Do you want to be the company tattle-tale? Do you want to report half of the company for sketchy behavior they've committed on their own time? It's a scary truth: pretty much everyone has skeletons in their closet, and far too many people are sending those skeletons around via e-mail.
So rather than having to report new transgressions every day, I started telling my users, "Get yourself a web mail account (hotmail, yahoo, gmail, etc). If you want to e-mail your mistress about all the coke you did last weekend, send it through your web mail account instead of your company account. If you send it through your work account, assume I will read it. Assume your boss will read it."
Yes, I suppose that means they might misuse the hotmail account somehow, but you just can't keep people from doing completely stupid things. All you can do is make those stupid things someone else's problem.
Exactly; in the name of freedom and promoting a healthy living culture in which employees are able to enjoy their life at work so they are more active and enthusiastic in being productive and creative when they need to, I feel it is extremely important to not impose restrictions (and especially IT restrictions) on the way employees work. In particular, other than offensive, insulting, dangerous, or pornographic content (which I understand), corporations should not block or attempt to control the websites its employees can access at work. An employee who can check his/her personal mail whenever he/she feels like will be much happier at the workplace than one who isn't.
Simply installing and updating a latest virus scanner on all corporate machines should be relatively simple.
Also, employees should be permitted to bring their own computers to use on the corporate network. How do you stop viruses?
1. Demand a periodic inspection of all Windows computers to ensure that the user is using an approved virus scanner that is set to automatically update.
2. Freely allow Linux machines to be plugged into the workplace. They are highly unlikely to cause any problems.
This is how at least two places I've worked at ran it, and employees were extremely happy.
Also, may I point out that my university (MIT) network has nearly no restrictions whatsoever on what you can plug in, what you can serve, and what you can run. I can run a mail server in the office if I want. I can run a web server in my dorm room. I can do essentially anything. The IS&T department here just has it structured pretty well so that nothing bad happens. Solid Unix/Linux servers, and automatic shut down of network drops that are spreading viruses or of Windows machines that appear vulnerable. It's great. I get freedom to do anything I want, and the network is very solid and reliable at the same time. I wish companies could do this too.
Speaking purely as a sysadmin, I'd block those sites utterly. Web-browser components are the biggest target of malware out there, it's bad enough when targeted at an e-mail client that can lock down scripting and such but Web-mail sites let that stuff through to a browser that has to allow scripting in a corporate environment. And if you're a business you've got your own e-mail system, no company e-mail should be going through a Web-mail system in the first place.
As a techie, no decision would affect me. I deal with my personal e-mail by SSHing to my home machine and reading my personal mail there via mutt. Call me a bigot, but the only protocols a mail client should be using are IMAP (for reading) and SMTP (for sending) and the only acceptable interpretation of the message body is as plain text. Anything else just ends in tears these days.
OTOH, as an employee I'd have to think you've an obligation to provide that access at least for some employees. Think about your IT staff, for example. They're probably expected to work extended or odd hours, usually without extra compensation since they're salaried. In effect the company's asking the employees to give it a big chunk of their personal, outside-of-work, "I have a life" time, for the company's benefit, for free. To me it's then only fair that the company has some obligation to let employees take a certain amount of company time, for free, to deal with all the things they'd've otherwise dealt with during that time the company's wanting from them. If you don't find some way to accommodate them, you're likely to end up with employees who're dissatisfied, frustrated and actively looking to ways to get access to those services. They'll succeed eventually and then you'll have the worst of both worlds. At least if you provide some authorized way to access those services you've got some ability to control the situation, eg. adding specialty filters on the Web proxy for the worst problems.
Really there are much more important things to block when it comes to any external mail account. For example, can your users set up a server rule (easy in Outlook/Exchange, probably in others too) to auto-forward their mail to an external service (whether a web mail or not)? If they can, then THERE is your bigger problem. External mail services don't make users abide by your strong password or Smart Card requirements. Their password is probably easily discoverable. They go on vacation and forward all their mail. It's probably trivial now for an attacker to access that CORPORATE DATA that may be in that mail. Worrying about VBS scripts isn't anywhere near as important (since any competent AV will stop the majority of bulk-mailed nasties). It's about the DATA. Not just email either. Are any of your users using one of the web based backup services (or even GMail) to backup their documents? Whoops! Data exposure there too. Anyway, I just wanted to call out that today it really isn't the random script in email that is all you need to worry about.
Methods such as content filters and blocked domains are only going to be useful to the bigger, more prominent webmail sites. This still allows a lot of webmail into your network. A basic "no webmail" policy, is difficult to to enforce without resulting to some fairly invasive and harsh tactics.
The better method is to enforce good network and system security practices. Do things like setting the policies as such that users cannot execute VBS on the local system and early warning detection/isolation on the network.
Regardless, this is one of those things which I believe is going to become less and less of a problem on it's own. With web enabled cell phones and PDAs becoming more and more common, I figure we are a short time away from the bulk of a users mail just going there.
no webmail, no pop3 and no smtp relay unless you are on the golden list. not so much for information security, but for anti-virus purposes. we have antivirus on our exchange server and each PC that is updated hourly or daily. no one really knows the quality of the antivirus system of internet email or how often they update definitions
Comment removed based on user account deletion
If you're in a HIPPA environment, on the other hand, I'd give it some strong thought.
//Information does not want to be free; it wants to breed.
My experience is that the companies that do this type of blocking do it because the workstations are inherently insecure. Security is not in the sites someone can visit or the specific file extensions that are allowed. It is in the setup of the network and the access the user has on their workstation. It's like making the kitchen safe by removing the sharpest knife from the drawer.
My company hasn't flat out blocked web mail yet, but I'm sure they are on the way. IM was blocked awhile ago and a coworker got an email today from IT that she shouldn't check gmail anymore (she would just leave it up all day, which would let gmail do it's auto-refresh). The problem I have is that here at work we have 100MB of email space that gets backed up. On gmail I have 3-4gb. So while this one person got the email to quit using gmail the rest of the office is continuing to use gmail not just for personal mails, but also for work. Gmail is better than the IT solution, and users are smart enough to realize this. So as long as we have draconian, I know what's best for you IT people, we'll have users who do what they have to to get the job done.
Here's an idea! How about IT look to the users as customers and treat them that way.
And you deserve what happened to you when you opened it!
(Yes, nothing happened. And you SO deserved it.)
"If you make people think they're thinking, they'll love you; But if you really make them think, they'll hate you." - DM
Do you allow jackasses to post to slashdot at work?
The truth suffers more from convictions than from lies.
My question is... what exactly are you trying to secure? If you're talking about ensuring that sensitive corporate data isn't leaked outside the company, I hate to say it but, you really shouldn't be using unencrypted email in the first place. If you don't allow VPN's or other ways for people to access their email outside the building (I'm sure the salespeople LOVE you), then you may as well force your employees to use paper, or a custom client that only talks to other people on the LAN.
If you're worried about virus/malware/etc... web based email is no more or less safe than any other modern graphical pop3/imap client. All of them these days are HTML enabled, and unless you personally watch everyone click their messages, some will still run winbig.exe or whatever.
Personally, I'm getting a bit tired of people tossing the "security" word around as a reason to make things more difficult or expensive, without ever justifying what it is that needs the added security, and why.
I was the IT administrator at my old company of about 500 consultants. After many discussions with the upper management I successfully argued for an open webmail policy because we had employees who regularly worked long and odd hours to accomplish our projects and it seemed only fair that we give them a method of private communications during their _overtime_. Quid Pro Quo. We were especially lenient with consultants who traveled all the time... except for a few areas those laptops were considered their property and as long as they didn't jack with the security settings we didn't call them on anything. With that said: 1. We were running squid and clam on any any incoming data (yes this is intensive but $8-10k of equipment will garner you many times that in employee good will). 2. We had a very aggressive AV policy. 3. We had consultants that were governed by stricter SEC and DoD rules that were kept on a separate subnet and different AD that was more restrictive... because laws required it. Seriously though... Unless you tell your salaried employees to work no more than 40-45 hours a week (and give them comp time to balance that out) it is asinine not to let them use the company system for personal activities when the company itself is encroaching into their personal time.
If it was sent from a client on our network, we have ways of finding it. Nothing that passes through a PC goes without a trace.
I use irony whenever I can, but my shirts are still wrinkled...
If you can get to the internet, you can get to whatever you want. Just set up your own Squid proxy at home, get at it over SSH (tunneled via HTTP if you must...), et voila. Freedom from the self-appointed corporate mommies.
"A great democracy must be progressive or it will soon cease to be a great democracy." --Theodore Roosevelt
background: I've worked IT full/part time for about 10 years now (geez) from desktop to network admin to site managing
Statement: In my experience the number of network admins that have the ability to adequately and competently run a network that both allows computing freedom (in reference to how you are saying) and is secure is very small.
I'd also note that I've seen this setup work a lot better with Universities than with corporate environments. Mostly because, insofar as I can tell personally, the network/systems admins/engineers are more concerned with enabling safe but wide-ranging activities in the university environment, as opposed to the corporate environment, where anything not expressly allowed is forbidden.
I'm a network admin for a small-medium sized company, about 40 - 50 people. We are pretty liberal about our IT security policies. We're still at the size where we can place a great deal of trust in our staff, and they don't abuse it. For the most part, we don't block virtually any content. We've never had problems, but we're at a growth stage where we're needing to tighten up security a bit.
My girlfriend's company, which is a larger energy company of about 250 people, does however block some webmail content, as they recently had an employee download material that caused a security concern.
Personally, I don't think it's unreasonable to block web-based mail. However, since email is such a common place in daily life now, if I was to do that, I would make sure there were a few computers in a staff room where people could freely check their email, outside the companies' proxies and firewalls.
VBS Script? Is that anything like a GUI Interface or a NIC Card?
TPJ - Founder, The Amazon Basin
Whatever happened to educating users and enforcing software policies? Instead of calling users stupid and locking down desktops like a prison, how about you actually take the time to hold a class. Teach them and show examples of what happens when they treat a computer like a toy. If they still don't listen, then enforce the company's software policy. (If there is one.)
I am a junior admin at our firm. Our motto here is that if a computer has a problem then it is because of IT's fault. Not the user's. If a user doesn't understand how to use a computer then it is our fault for not teaching them.
Firefox and many other browsers are immune to VBscript. The very same idiots who ban webmail citing security concerns, blithfully allow IE to run rampage in their internal networks. What gives? If data leaks through a hole in IE, the brass will claim, "We followed the industry standard practices. We are not responsible. We are actully irresponsible. Go chase Microsoft". If they want to ban IE, they cant because MSFT has woven IE into the fabric of the OS. Even if they say only Firefox can be used, still they are not off the hook. What a mess.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
The general policy is that the company's assets are for company business. That said, policy also allows for limited personal use, as long as it does not interfere with the primary business use of the company. This leaves enough room for most employees to happy, and it gives us the iron hammer if we ever need it (and we rarely have). We can block things outright at the perimeter if we need to do so (e.g. when there is a new virus propogating via email), but we generally trust our employees to be professionals. We train them heavily on security awareness, and we keep our network and client defenses current.
I use irony whenever I can, but my shirts are still wrinkled...
I actually automated the process so I don't know who's doing what because it's way outside my job scope. I don't want to know. _Really_ don't want to know.
But the company policy is clear, our computers, our network don't waste time on them.
Fortunately, your use cases lie outside the application's capabilities and the employee types it follows.
Got Trader Joe's? friendwich.com RSS feeds work now!
If you want to be regarded as a tool and hated around the office even more than most "admins"
I work in small company (~30 employees). We do allow use of webmail. But only for your private stuff. You are not allowed (and it is clearly stated in contract and rules) use your private email for company related stuff (your work). Beside that you can use your private webmail as you wish.
It has to be said that we do not have any monitoring or censoring policies. It is OK for somebody to write personal email in work from time to time untill that person does her job right.
But you have a certainly flawed reasoning. *Any* website can load your browser with VBS script. If the user clicks it than it does not matter wheter it is from webmail or other site. In general if you fear webmails that means that you are not safe from the Web as whole (and there are loads of threats on the web).
The solution would be to use some filtering proxy that would cut down such traffic. Right now we just use AV software on client machines (that tends to work blocking obvious web threats). We also have a proxy server that blacklists known phishing/malware/evil addressess (not for content filtering - for protection from known threats).
A point that has come up in the past but lately glossed over is that by using third party mail services such as Yahoo, Hotmail, Gmail, etc... their Terms of Use and Service state that you give them rights and ownership of your data to do with as they wish. In a corporate environment that means any trade secrets or concepts you mail to or from someone via one of the third party mail systems gives the systems owner license to use your data as they wish. If they want to develope it into a product and market it themselves, they in effect could without paying any royalties as your use of their service granted them consent.
As a rule at all my client offices its stated that all business related correspondance must happen via company owned services. IT doctrine at each site states the computer resources are property of the company and use provided to aid the users in corporate business only. Any personal use can result in disciplinary action, to include firing.
Many of these rules came about when users started clicking on random pop's or installing their favorite screen savers, weatherbug, mail programs, and chat programs. Many of these were found to contain malware that cost the companys lots of money to have cleaned up and slowed down productivity. While users company mail is scanned for virus's, third party mail products and chat programs showed more problematic and became the primary source for infection of the corporate networks.
We've also caught employees suspected of corporate espionage using third party mail services to transmit company information in an effort to side step IT monitoring their mail. That alone was enough for the Board of Directors to decree no employee may ever access such services from their offices.
We've enacted proxys at some sites, others content filtering, and others simply requiring the employees to sign a usage agreement that if caught in an audit means they can be terminated without severence.
How do you block them all. Almost every ISP has a webmail client. Ok so it might be very simple to zoom in on all that start with webmail.xxx.com or the word mail in it. What about other languages? In french it would be courriel.xxx.ca.
How about a mom and pop webmail called GrannyMayApplePie.com (does not exist). or myrealbox.com
People will just find others if you block the BIG 4
No privacy. Unreasonable work hours, without ability to take care of personal business. Everyone is suing them. A company that mistreats it's employees and customers. I'll bet they treat their investors just as well.
Friends don't help friends install M$ junk.
If you are really worried about your users downloading viruses by webmail, I think there are much more fundamental problems with your setup. There are much more other ways your users can get infected than by webmail. What about malicious web sites? What about non-malicious websites which have been compromised? What if your user brings along an infected file on USB memory key? Etc...
Get a good virus scanner (a really good one, not Norton or Mcafee, but Kaspersky or F-Secure or something like that), get some virus filtering and firewalling done on your gateway. Make them use an alternative web browser and e-mail client, which is much less target of attacks than Internet Explorer and Outlook. And most of all: learn your users about potential dangers. Explain how they can recognise suspicious files and web sites. Explain them that they should be careful with their passwords. Explain them that they should do so not only at work, but also at home.
Maybe if you tried blocking computers on your own network that run software that's vulnerable to something like a VBS script..
I allow all those websites; I don't allow Windows.
WEBMAIL USES YOU!
-insert a witty something-
Your point?
Web2.0: I love when people Flickr my cuil and digg my boingboing until my google is reddit and I start to yahoo
I genuinely do not know Linux well enough to be able to tell from own experience, but I thought it was one of those flexible OSes you could misconfigure so completely that explodes.
Of course, a well configured system is as safe as any other box out there. But who knows if all your users are configuring their systems well?
Just as ignorance of the law is not an excuse to commit a crime.
Ignorance of a scam doesn't mean you SHOULD be violated.
If we don't protect the innocent, & week, why protetct anyone?
I am so sick of hearing this arguement. And by sick, I mean sick to my stomach that there are people out there who have this mentallity of "they are weak, they deserve to parish"
It's true that you have to save the people w/ greatest potential to survive, and sometimes even sacrifice those who might not last long if they were saved. Be it a Natural disaster, fire, battle, theft, or computer security.
While it's true that if you know what a *.vbs is capable of, then you should also know how to open it as a text file and see what's in it.
But what if it comes from your boss? What if some top lvl guy is ignorant to scripting, and unknowningly mails something to his subordinates.
While I know the risks, and if I was on top of it, I might ask what it was. I'll be damned if most people wouldn't automatically open an attachment from their boss regardless of their knowledge lvl.
Sorry if your statement was jokingly put out, but as the victim of a recent scam, I am unthrilled w/ that response.
How much is your data worth? Back it up now.
My boss sounds a lot like you. He even went so far as to have a DSL line ran straight to his office and uses a switch to use it instead of the corporate lan to do stuff that he's had banned/blocked. Generally I have no problem with the rules, just when the guys in "IT" seem to have a different set of them.
Comment removed based on user account deletion
Mordac the Preventer strikes again.
I can understand that if you have a regulatory requirement to archive all communications, or maybe you handle sensitive financial or medical data, then you need to block webmail. These, however, are special cases. Otherwise, you are just being a dick, and for no good reason.
There are perfectly legitimate business uses for webmail, such as a backup when the regular mail is down or as a throwaway or spam trap when you need to subscribe to trade mags. On a more philosophical level, I would argue that if you ever expect your employees to take work home, then you must be prepared for some aspects of their home life (including personal email) to sometimes show up at work.
To even ask this question is a symptom of "IT Manager Lockdown Disease"; whose main symptom is setting policies to make IT's life easier no matter what negative impact they may have on the users ability to get work done.
We have an unspoken agreement here, IT does't lock us down, and we in turn try to avoid doing stupid things to make more work for them. Caveat - I work at what you might call a "boutique" engineering firm and we don't hire morons. If your population of users contains more of the "energetically stupid" sort this arrangement may cause you a lot more grief than it does here.
None of them can see the clouds; The polished wings don't care.
You wouldn't make it to your second week in my organization. By enforcing "no web mail" policy, you are pushing the users to use the company email system to send and receive personal messages. And god forbid, your infrastructure is MS Exchange, you are more vulnerable than the webmail systems that you are afraid of, let alone opening up your company to be liable to what people say in their personal email messages.
Time to reevaluate the policies in my opinion.
__________
The more I know people, the more I love animals
The company I work for uses a "As needed" rule to allow this. We, IT, have setup the environment (Mostly XP) so users are user, no admins, and removed the VBS extensions as well. This coupled with several webfilters and out proxy keep us rather save from 99% of what is out there. Are main enry point now is USB drives coming from home, but even they are very limited since users are users and the antivirus software we use catches these rather quickly.
All that is needed is a request to the supervisor and we grant them the access.
"the network/systems admins/engineers are more concerned with enabling safe but wide-ranging activities in the university environment, as opposed to the corporate environment, where anything not expressly allowed is forbidden." Exactly, I believe the corporate environment should change to the former. I realize that it's harder for the IT department to keep up, but you'll have a hundred times happier employees, and those employees will be more willing to contribute more to the company than they are required to if they are happy.
The important thing is that you manage your corporate IT policies to make your job easier, and not to actually serve your customers: the employees who struggle to get their work done in spite of your draconian rules.
I work with similar issues: it can be interesting finding ways to get work done in spite of IT's (un)support and (un)help.
ShoutingMan.com
Thank you very much. Companies like yours are the reason companies like mine can hire brilliant and talented people away from bureaucratic nightmares and pay them 20% less while getting a significant amount more productivity from them. We have internal Web, IRC, chat, etc. servers. If your AOL IM is not working and it is stopping you from chatting with your girlfriend, IT is happy to help. They'll even grab you a beer from the fridge on the way to your desk. For smart people who know they'll spend a significant portion of their life at work, but who chose their work because they love it... there are companies like mine. You're treated like a real person instead of a cog. If you need to go home for the rest of the day while waiting for the plumber to come to your house, go ahead. Don't bother filling out paperwork or logging your time. So long as your work gets done, it's all to the good. If a friend is in town and stops by the office, go ahead and take a few hours to have a beer and play a video game with them in the lounge. Introduce them to your boss and coworkers.
We don't lock down Web access to any type of external site. We track everything, but the tracking system is open to all employees so if you want to see what your boss is doing, just log on and look. We don't seem to have a lot of IT emergencies either. Some of our old and out of date servers overheat or fall over now and again and we power cycle them. No big deal.
Every day I'm thankful I realized early in life that I did not want to take the top dollar offer for my work if it meant I had to put up with nonsense like you advocate. IT's job is not supposed to be to minimize the amount of work they need to do or even to prevent problems. It is supposed to be to facilitate the rest of the company getting work done. Happy employees work harder for the company and stay late to work on something or even come in on a weekend for some project. Happy employees do not quit and move to another company with no notice leaving the company in the lurch. Happy employees are not the largest and hardest to stop threat to the security of your network as they feel it is "wrong" to screw over the company and boss and people who treat them well and with understanding and who are their friends.
But by all means, keep making yourself hated and keep thinking your employees lives should stop and they should act like machines for 8 hours a day. We'll keep hiring away the smartest people you have.
You blame AOL/Yahoo/Hotmail/Gmail for your security. At the end you seem to be really worried about the VBS. As far as I know if you use Macs or Linux or any other non-Microsoft products, you can be sure to be safe from those scripts attacks. i know it's easier to blame the email providers instead of Microsoft for its poor security, which allows scripts to be executed system-wide. So, again, looks fror the cause of your security concerns, not the consequences!
The lad has made the correct decision, but for the wrong reasons. The number one reason is because you want all of your "business traffic" to go thru your corporate email system.
He should be asking himself, "Why do the people who work here feel they need to use the non-corporate system for business work?"
All my work email goes from my work account, personal goes thru gmail.
Also, if he doesn't allow people to use personal accounts for personal email, they'll just use the company email for that. Does he want that to happen?
Then they can use any email program they like.
This was a real problem early on with the Clean Air Act and Air Quality Monitoring regulations as well and still is depending on what state agencies you have to work with. Like, SOX, company officials must affirm that the data they submit is true and accurate and that they are in compliance when there is often significant disagreement over the meanings of terms, measurements, calibration practices, data collection, fraud prevention, and "compliance". Over time, standards for behavior develop and give companies some cover. From what I have seen, showing attempts to work with the regulatory agencies and seek clarification, whether successful or not, shows good faith, and beyond that, adhering to industry standards or seeking independent certification. Sometimes regulatory agency refusal to play nicely and provide guidance goes badly for them in court and forces them to change, but it takes time and persistence on the part of regulatees.
HIPAA seems to be similarly vague in many places and I would imagine fault will most likely be decided by a jury after-the-fact with "benefit" of hindsight.
It is an interesting process to watch but no fun to be a part of. What is distressing in the AQM industry from what I have seen/been told is the number of company officials who depend on contractors to work the process for them and sign on the bottom line without understanding the process or doing any checking themselves even when advised by the contractors that they are personally liable. Managers do not want to understand scientific process, regulations, or data security, they just want it "taken care of".
This is SOP at "my" clients who are financial services companies. They can't allow any message into their system unless it's logged. You can't have a customer complaining, "I told you to sell SCOX when it was at $5 and you didn't - give me my money". They prevent this by disallowing instant messaging, webmail (or any mail that doesn't go through their servers), etc. I think they also prevent usage of cell phones, pagers, etc. unless they are company-issued and company-monitored, but I don't talk to them much with these devices.
I use my own mail, on my own domain.
Block it? Go ahead, I can always SSH in and either pine or ssh tunnel to it. Dare you to take away SSH and Port 80.
There are an ever growing number of stories about companies that block WebMail, IM, VoIP, and other technologies being viewed as completely unappealing by the younger generation. Coming out of colleges and being used to being on 4 IM networks at once, using Skype to make free calls to all their friends, and being on Gmail 24x7 they have, quite frankly, shock when they go to places that block them and typically don't last more than 6 months.
So the pitch to the board isn't, our customers want to do this, the pitch is if you don't find a way to securely allow it you'll cease to be able to hire qualified applicants, cease to be able to attract the most clueful applicatants (who know the policy is stupid), and generally fall behind in information technology. Your competitors who have a more progressive policy will, on the other hand attract these candidates and put your company out of business with better technology.
I've had customers ask me to email them things via their gmail addresses because of boneheaded network administrators who think it is their duty to protect users against every type of attachment known to man. If you block the big four webmail providers, users will just use smaller ones, because ultimately they have a job to do, and your draconian lockdown policies are getting in the way.
Most companies don't block web mail for virus reason, they block it because they cannot control or record the information going out of their corporation.
This is a serious issue since the introduction of Sarbanes-Oxley. Companies HAVE to have a record of the information their employees are sending out.
"but I thought it was one of those flexible OSes you could misconfigure so completely that explodes."
If ever, it explodes on you, not on other people, in general. Those sorts of misconfigurations are like you accidentally wiping your hard drive or deleting something important. There are very few if any viruses and worms for Linux, and an honest employee with a Linux machine is extremely unlikely to do damage beyond their own personal machine, even in the world of Linux vulnerabilities.
Tons and tons of missing the point here. The major concern about webmail is not that it's a vector through which computers can become infected with junk. The concern is mostly that it's a way for information to leak out of the company, and that there's no way to control whether it conforms to company security standards, policies, etc. A couple of posters did mention this, but seemed to approach it from the angle of "if someone wants to leak information, there are a hundred other ways to do it." These are obviously not IT security folks...those of us who deal with these issues on a daily basis know that the clueless users are just as dangerous, just by force of numbers, than any malicious ones. I am FAR more worried about confidential data being emailed to or from a Yahoo account because a user "likes it better than Outlook" or something than I am about deliberate theft. If we lock down webmail access, we are drastically reducing our risks from these sorts of incidents.
HAHA I was thinking the same thing. Wow, nothing happens with you open a .vbs file with an editor? Impressive.
"Anything tastes good if you deep fry it."
Gee We actually just had IPSwitch put in here since the IT Admins didn't like MSN / Yahoo / Google Talk and any other messenger apps and it sucks. I'm on a state / county network and what is even worst is we can't link these 2 networks together to be able to transfer files to each other, I've been looking for a middle ground / setup where both networks could share files and keep in synch with each other since it's getting old running around with the jump drive and burning DVDs just to put the data off this network to this network which is like right next to each other! 1 network is a 3mb fiber connection which is always having problems no wonder! I work out at the Property Tax Assessor's office which has the network linked along with several dozen different departments in this county like the justice center / sheriff's dept / police dept which I'm sure is the #1 reason of our network problems (plenty of goons and disgruntled employees out there that get a kick out of DDoSing these branches) Yet they're still adding more crap to block like gmail etc... Which is like making the damn firewall crawl which makes the point of having a 3mb fiber connection pointless due to the firewall halting and slowing down traffic checking it 1 by 1 It'd prolly improve alot if they'd stop filtering sites and all that and just focus on the real main threats which are computers that aren't up to date or even have anti-virus installed etc.. that's the best thing to do... Ensure every PC on the network has ample protection, AV / Anti-Spam / Adware protection instead of adding crap to the filter and slowing down network performance it's hard enough already with all these security measures. Just my 2 cents :-)
Is your employer hiring? What kind of positions are available?
How much is your data worth? Back it up now.
Right now, all of your users think you're an asshole and many of them are thinking of ways to get around your roadblocks, except for the people who are already doing stuff under your radar. I'm surprised nobody's given you 120V straight to the RJ45 already.
I don't allow users at my organization to use any computers. When users complain, I point out that we can't control the security policies of computer systems. :-)
You were looking at wrong keywords. Instead of "Security", type "Privacy" and "Gmail".
You would be happy if all your corparate users used Gmail to exchange companies private documents with their some gig size "never really deleted" (yes, a fact) mail?
Google fans really started to irritate me. Jump up and down shouting spyware/submit a story to Slashdot.org when your paid software innocently tries to check for updates but abandon your own paid ISP/Network mail for a service with horrible privacy policy like that.
Now, outlaw everything except your favorite webmail/company.
I see what you're saying, but there's a difference in needs and motivations between a university and most companies. Universities specifically need freedom because they're largely interested in education (ok, maybe not really, but at least supposedly). Education requires freedom. Plus, the constant re-evaluation of the setup is educational. When you have a whole bunch of aspiring CS majors and academics without a whole lot of real work to do, you have a free workforce to constantly address the ever-changing threats to network security.
With most companies, there are very limited and specific goals. They can be summed up, like, "we have e-mail so our employees can communicate with customers," or "we have web access so our employees can research [whatever]." Once you've established those needs, they key thing is to enable those services in ways that are as simple and fool-proof as is humanly possible. "Fool-proof" almost always requires that you limit the number of activities that could happen to the activities you expect to happen, that you plan for, and that you would like to happen.
And often that's the real culprit here: opening the network to additional unplanned possibilities also opens it to possible unknown security failures. It's not fool-proof, and it doesn't offer the company any advantage, so there's a motive to block it but no motive for them to allow it.
Yes, we block them. Anything that Surf Control verifies as Web-based Email we disallow. We even setup some custom rules for the sites that Surf Control misses.
Strangely, I'm having problems getting hotmail to load up right now-- usually problems from heavy traffic or something only last a few moments... Is anyone else having problems? Maybe the server is down.
I worked a contract at a large company once where they had coated windows which blocked cell-phone use rather effectively. The problem was that I was there to teach QA techniques in a mobile and pervasive device development lab--- and it was behind two layers of such glass. Employees were constantly filing out to the loading dock to test devices.
My real problem with the lack of cell phone use in some large companies is not personal use. People survived without that at work for many years. I would generally forward my cell phone to the desk phone on arrival. My gripe is with the sprawling campuses where my *client* cannot get a hold of me because I am in another section of the building; it reduces their own efficiency. There is also the fact that as I was often an independent contractor rather than a 9-5 employee, I had other clients to think of as well.
Basically, we have to because of HIPAA, which makes an excellent "boogeyman" to use against rogue employees. We provide Internet access for business use, not for surfing on your own time and not for forwarding that latest email from Aunt Judy. We also block incoming attachments (the common ones, .PIF, .EXE, .COM, etc.) because we've been hit before because our users will open goddamed anything. But that's a training issue, which isn't my department, and I can't control. It used to be worse, we used to not give Internet access at all unless the user's immediate manager could make a business case for such. Eventually, we had to give up on that measure because you'd be surprised how many "absolutely MUST have Internet access to do their job!!!" (even though all they do is put paper in the fax machines.)
I see what you're saying as well, but I also feel that more successful companies also highly correlate with companies that have goals that aren't set in stone.
For example, an employee of Google assigned to a particular task (say, to code something) may spark an idea in their own time about a new project that may be really cool for Google as a company. They will be *far* more inclined to make it a part of the company if the work environment is enjoyable and fun for them; that includes being able to communicate with their family/kids over other e-mail, being able to do things that aren't related to work during work time for creativity's sake (as long as they get their work done), etc.
Also, I think this extends beyond research and development. Seriosuly, suppose you let Taco Bell cashiers the opportunity to surf the net when they aren't serving customers, as long as they will unconditionally appear and serve customers immediately when they arrive. I guarantee you they will be much happier people, and will be much more polite and happy with the customers, will enjoy working at the company, will consider to continue working at the company, and most of all, will be inclined to do their best at their job, rather than just do their job.
To a large extent, I agree with you. IT people have a responsibility to ensure that their systems are as secure as is reasonably possible. The only thing that I might disagree with is personal equipment on the corporate network. Personally, I think I would just create a separate VLAN/wireless SSID mapped to a VLAN for visitors/guests/personal equipment, and basically block most communication between the guest network and the real corporate network. Stuff from that VLAN could also be treated differently by an Internet-side firewall, and maybe forced through a proxy and limited bandwidth wise. (And of course, use 802.1x for the real corporate network, probably authenticating with computer accounts, so users can't easily connect their personal equipment to them).
Security is important, and taking steps like what you said make a network easier to manage/expand/control, and makes sure that people can't screw too much stuff up, either by malice or by ignorance.
Every time you post an article on Slashdot, I kill a server. Think of the servers!
Nothing a bit of TOR or some creative proxying can't circumvent, assuming they can access the WAN at all.
Albeit most (mortals) don't know what TOR or Proxies are, but the ones you should worry about, probably do. =p
the only permanence in existence, is the impermanence of existence.
That is definitely an issue with blocking cell reception (it does seem odd sometimes when you're standing at a window and have little to no reception) and the companies that do have staff that move throughout a building or campus seem to have migrated to the use of VoIP cordless phones for their environment.
What security risks are there in particular with webmail that are not present in general web access? I strongly suspect the answer is none, but I'd be curious to find out.
I allow my users to do what they need to on the network. I REQUIRE that personal email is done with a web service so it does not use any server resources to send 5000 family pictures and retarded "If you don't send this email to 20 people, a starving child will die and you will be killed by an asteroid" emails. I offer to set up gmail for my users if they want me to. I REQUIRE the use of Firefox. If they need IE for a vendor specific app, I need that request in writing.
0xB315AA8D852DCD3F3DCA578FD2E0BF88
Car pollution? Make cleaner fuel, or make it harder to own a car, or boost public transportation/car pooling.
Potential virii through e-mail? Disallow outside e-mail at work.
While those may be probably "solutions", they stay within a narrow scope. "The problem is e-mail, so the fix deals with e-mail."
Why limit yourself to the how? Why not focus on the why?
Let's look at the pollution from cars (yay car analogy!). Rather than ask how people use cars and how those cars can be less used or how they can be used better, ask why people use them.
- Shopping Perhaps allowing some light commercial business into residential areas would cut down on the need to drive, either by requiring less driving or even getting people to walk more (which would help with our obesity "epidemic", as well).
- To go to work Research better telecommuting infrastructures, so they only have to drive to work once or twice a week.
What about e-mail?- Business-related e-mails sent to personal accountWhy would a user do that instead of having it sent to their work account? Is it something with your e-mail structure?
- People need contact with friends/loved ones I'm not saying this a bad thing, but why do they need to do it at work? Perhaps shorter work days would decrease that (yet keep the same amount of productivity, since they would be "wasting time" by checking their e-mail, anyway).
Granted, this aren't catch-alls, and some introduce their own problems, but instead of saying outright "the solution to e-mail is no e-mail", try looking at it a different ways.Perhaps the best solution isn't even tech-oriented.
When I have to send certain types of progams, my office email will not allow it.
When I complained, IT told me to use my personal yahoo account to do it, instead of giving me special permission for my work account.
This is actually typical. The problem with having IT departments block X because it also has feature Y that you don't want, is that X has features Z, and next year they gain Features A,B, and C that your USERS want and need, and honestly, your little IT department simply does not have the time and skill to implement.
The policy of blocking external IT sources puts a severe penalty on innovation and work on the users. Yes, you block one single kind of problem, but you also block tons of GOOD things, without realizing it.
You should only block the 'essential computers', not block all users. Treat your users like they are OUTSIDE your firewall for most things, not inside them. That way they can take full advantage of the innovation from the Web, etc.
excitingthingstodo.blogspot.com
To both of you, I would check to make sure your respective text editors are working properly. When you open a (non-empty) .vbs file in vi or notepad, some text should be displayed on the screen. The fact that nothing is happening might indicate a problem with your systems.
I don't always use unix-like operating systems; but when I do, I prefer FreeBSD.
Whoa... There is a middle ground here between the draconian policies and the opening stuff up. As several other posters have noted, IT is there to facilitate the BUSINESS. That doesn't generally mean helping someone get their iPod working on a company machine, but it doesn't automatically mean banning said iPod either.
We really need to try to hit that middle ground. However, it remains important to remember that IT is seen as a cost center (no matter how much we want to call ourselves "enablers" for the business). Since we are seen as a cost, the business leaders actually DO expect us to operate in a cost effective manner while facilitating BUSINESS. Now, I've seen a lot of "personal use policies" which we know are just there to fire people who do it to excess. Most businesses realize that their employees tend to be more productive if they are allowed to track their order at work or check some stocks or whatever. There does have to be a limit though, because IT is not helping the business value when they spend time working on issues caused by personal use or software.
You all know this I guess - it just seems like there are too many posts here that are too firmly on one side or the other. Balance...
I'm pretty sure that some of RAS syndrome comes from habits that arise from corporate pressure to use trademarks correctly. A lot of abbreviations are trademarks, and trademarks should be used as adjectives that designate the source of a product. For instance: "UNIX system" not just "UNIX"; "Windows OS" not just "Windows"; "iTunes store" or "iTunes software" not just "iTunes". Even in the case of "ATM machine" where "ATM" has become generic, the word "machine" disambiguates "automated teller machine" from "asynchronous transfer mode". Putting a PIN number into the cash machine is expected; putting an actual pin into it is vandalism.
we can access webmail and it's a godsend for the twice weekly Lotus Notes problems. Nice to have email that actually works!
---
We spoke for about a half an hour. I don't recall a thing we said. - Colorblind James Experience
We have legitimate business needs for just about everything you can find on the internet, so we do not filter anything. Of course, this leads to huge spyware issues and the occassional virus, but for a company our size, its not too big of a hassel. You will get fired, of course, for illegal activities, such as child-porn and piracy. Other than that, we have a big, fat, unfiltered fiber connection to the internet. Its nice downloading software updates at 1.5Mbps-3Mbps, depending on the time of day.
There are some cases where I can see blocking of webmail sites, such as government contractors. Truthfully, though, corporate America (and other coutries) really do not have too big of a reason to worry about personal webmail sites, unless you are worried about corporate espianage or something. But as far as viruses and such like that, they can get those off of going to other sites on the internet. You should be working on keeping your Antivirus and Spyware software up to date rather than worrying that Yahoo alows the delivery of vbs files. A good antivirus software will block the executing of those things anyways.
I'm just trying to figure out why it's "third-party email." That means that there must be "first-party email" and "second party email." Now, one of those must be the email that the company provides... Or am I the "first party" and the company is the "second party?" Then I suppose there would be no "first party email" unless I was imagining it in my head? I'm so confused. Who are the parties?
I'm just sayin'.
It is your network, it is your computer, it is your Internet connection, it is your desk, it is your electricity, it is your chair, it is your building, it is your time to deal with issues, it is your butt on the line if there is a problem. You pay people to sacrifice their time to do what you want done. In the USA at least you can do what you want as long as you obey the law. There is no law that says employees get to use your equipment for anything personal in any way. If your employees don't have a problem with the policy, all the better. If people start jumping ship because you don't allow web mail, then it is *YOUR* fault. Just don't forget that when it happens. *You* - not the employee - bare the responsibility of what happens under your roof.
If your employees are complaining, that is usually a sign that turn-over is headed your way. These are not bad people (if they were, why did you hire them?), you are just not interested in keeping them.
Now my employer is awesome. We get an IRC server, we get IM, we get web mail, I can take 15 mins and read/post on slashdot on the company laptop running Linux. There are basically no restrictions except for obvious stuff like porn. I am very grateful my employer has such a liberal policy and chooses to let me integrate their gear with my life. It helps make things easier, and fosters a work hard/play hard environment. Would I go work for your company? Only if you were my last option.
The prime goal of a company is to make money and it's main responsibility is to it's shareholders. Restrictions are put in place for a variety of reasons: legal, techinical, security, financial, and procedural.
The company I work for is a security company; webmail is a bad idea because files such as drawings, designs, and specifications could be leaked if individuals had access to webmail.
Personal laptops are just that; they're personal. When you bring in a personal item, the companies liability insurance may or may not cover any damages sustained while in the office. Also, again with security; it's a lot harder to secure a device that needs connectivity on multiple systems, then if it only needs to connect to one system.
Your example of your university doesn't apply to businesses; the criteria are much different.
Your ideas work in an academic environment, but aren't real plausible in the real world.
And people wonder why our country is so stressed and rigid.
Loosen up a bit, chief - you're pushing good employees away, not drawing them in. Nobody wants to be a robot. I've worked in IT for over 15 years, and during my interview, if I even catch a whiff of stuff like this, I politely decline, and run the other way fast.
Your employees will be far more happy, productive, affable, and in general put in more hours, if they can take care of some personal business while at work. Sure, it takes away a little time, but if their work gets done, who cares?
You sound like you have a chip on your shoulder, and are taking it out on everyone else... At least, given the text and tone of your email, that's certainly the way you rub off.
and work does not get done with viruses and worms rampaging on the network. work also doesn't get done when the boss goes to jail.
Snowden and Manning are heroes.
Well, that's just stupidity in action. But a good point none the less.
Our current primary access to email is IMAP based and the main provided interface is a webmail client (we currently use squirrelmail but are in the market for a better one). We also allow Outlook (not Outlook Express) in IMAP mode on PC clients and Mail for Macintosh in IMAP mode on macs as an alternative...
disclaimer: I work IT at a school district so our needs are probably quite different than the average company)
That said, We allow our students to access gmail, hotmail and yahoo mail to send assignments in from home or to home from school and some teachers allow students to mail them assignments. We don't have an in-house email system that covers all students so we feel it is necessary to allow access to those webmail sites. I use GPOs on Windoze boxes to keep the inrush of attachments minimized and can easily re-image a machine if it gets hosed to the point of no repair.
...quicker, easier, more seductive the darkside is...but more powerful, it is not.
I was once in the situation were an external department was brought back under the companies big wing, basically a bunch of hippes was put in an office of suits. This lead to the following amusing situation.
I could NOT get ssh and ftp access to the companies external servers wich ran the company owned website. The proxy in use, was not just extremely slow and frequently out of action, it also blocked certain key sites an admin/developer needs access too. Trivial stuff perhaps but as a webdeveloper I sometimes need to able to browse to such obscure corners of the internet as the companies own site. I know I know, crazy.
When that was finally solved (well actually I only ever managed to get ssh access, but well, with that you can solve almost every other network problem, but I don't need to tell slashdot that), I got called in by HR, apparently people from other departments had complained that whenever they walked by our desks they always saw us reading news or playing webgames.
Indeed we did, my job was to add a newsfeed to the site and the graphics monkeys were building/adopting flashgames for the site. Odd as it may sound but that required us to actually test that stuff over and over again.
It is truly amazing how bad some companies can get if they get too big. They had outsourced most of their IT and it was a mess, the internal IT department had been gutted by people just leaving. I at one time was asked to make it possible for a re-seller to upload their sales data into the system to automate this process. So I developed a system against the test system they had setup. Reasonable, except I know IT and so I said the test system was not the same as the live system, they said it was, I said it wasn't, they said it was, they knew for certain and I should just do as I told. I told the director it wasn't and went ahead and coded the system. I wanted it tested but their developer was on holiday, so the deadline approached, it went life with everyone present and voila, live system totally incompatible with the test system and the developers holidy, turns out he is on a sailboat on some around the world trip and has given his notice months ago.
Guess who got to clean up the mess? Guess who that sameday activated his resume on monsterboard and handed in his notice?
Still I spent another two weeks trying to get a crappy windows system with undocumented and untested software to accept my linux requests. Would you believe that it can take a windows machine over 5 minutes to add a new customer to a pending activation list?
Apparently this was already known by the reseller wich is why they wanted it automated, NOT because the job of typing in the sales by hand was to much but because the person doing it had to wait for minutes between each entry and refresh to see if the system had finally processed the action.
The sad thing? When I started working there it was just as your describe your departmant, IT in service of the business and not the other way around. That is not just good news for the sales department, it is actually good for the people in IT itself.
MMO Quests are like orgasms:
You may solo them, I prefer them in a group.
You're right, you don't know Linux that well. You can configure it to explode as easily as you can do with Windows, possibly even easier.
My blog. Good stuff (when I remember to update it). Read it.
Sometimes it works this way, but honestly, I could imagine it backfiring. Give Taco Bell cashiers internet access, and I could easily imagine that leading to them telling customers, "Hold on a second..." while they finish reading some MySpace page. If you fired them over that, you'd just fire a bunch of people all the time, because people would do it anyway.
Web usage probably, overall, has a net-loss of productivity, but it isn't practical for me to ban myself from port 80, even if I didn't need it for my job (which I do).
I guess I'm just not of the belief that happier employees are necessarily more productive employees. There's a limit on each side. If people are too unhappy, they aren't productive, but if you give them everything they want and let them do what they want when they want to, they aren't productive then either.
It depends on the job/company. Working for Google, it's better that you know about whatever is happening on the Internet. If you're a data-entry drone for some boring company, then not so much.
But also, none of this is really what I was talking about. I'm not talking about maximizing productivity of general employees, but minimizing IT costs and security risks. If your network is running like the wild west, you're going to have to hire more technicians who will spend all day straightening out problems. Restricting the services offered and allowed will cut downtime and the number of trouble calls, which will allow a company to function with a smaller IT staff.
Maybe your mindset changes when you work in support for a couple years. For example, most of your users will complain at some point that they don't have admin rights on their computers, and you'll hear some people with computer experience say, "If someone knows enough about computers, then why not?" But if you give users admin rights, their computers will break much more often. Honestly, I don't even really know why. There's not always a clear cause-- it might have nothing to do with viruses or spyware or anything particularly horrible, but you find out that the fewer configuration changes people can make, the less downtime they have. It's just some sort of whacky mystical rule.
Maybe there's a good theory to explain this, but I just know it as a truth I've learned through experience. If you want your computer to function without trouble, install only the applications you need, and don't operate it as an admin. Only log in as an admin (or root) to do those rare things that require it. Don't install then uninstall things you don't need, and don't screw with settings you don't need to, or else your computer will slowly go to hell.
It's similar with networks. When it comes to networks, don't let protocols travel through firewalls that you don't explicitly intend on using. Don't enable services on servers without a clear concept of what you're going to use that service for. Plan ahead, and be a minimalist. Keep things simple and restricted to what you want to use.
All this runs contrary to the idea of "education", but if you're focussed on easy and efficient network/systems management, be restrictive.
Well, other than being forced to see BASIC code, nothing bad happened =)
Web2.0: I love when people Flickr my cuil and digg my boingboing until my google is reddit and I start to yahoo
The reason why companies consdier web mail a security risk isn't because of viruses and trojan horses, it's because of the potential dissemination of proprietary corporate information.
I wonder (on average) what is more productive though - a happy employee with freedom to do non-work-related tasks while utilising work infrastructure and time, or a not-happy employee that comes in and works at 80% because he's not particuarly happy.
Obviously this is massively subjective depending on the role and the person, so I wonder if in some cases companies have actually done studies on this to see what happens.
Our company policy is this: company resources are to be used for business purposes only. Now having said that, everyone knows that people use it for personal things. Nobody has a problem with that so long as it doesn't interfere with performing your job and isn't considered offensive.
In our department, we try to balance security and convenience. We don't block webmail etc, however all the traffic is proxied and logged. Executable type code is not permitted to be downloaded. We keep all the clients up-to-date on patches, virus signatures etc. to help minimize the risks.
We also do try to educate our users a bit. We hold "mini-classes" where we cover a topic or two (people can make requests). We try to keep them short and have them early in the morning or after general work hours. They are completely optional and we get a good turn out (60% to 70% depending on the topic(s)). People learn a little bit that can help them either at work or at home. I do most of the work to organize this over a lunch or two, it costs the company so little, and it helps everyone. Hell, the executives attend most of them, partially because they support it and because they too learn a little.
This approach works very well for us.
Yes, I know many companies aren't too interested in morale and employee happiness, but I feel like even though it is not necessarily profitable, that ought not to be 100% of the game.
There should be a human aspect to being a company -- that is, promoting good culture and true employee happiness is something I would morally/ethically expect out of a company, much in the same way that I would expect help from a friend or love from a parent.
I say this because a company is a bunch of human beings that in some cases perhaps ought to be a little more human. Driving straight for profit only, while killing happiness, extending work hours, or expecting too much out of an employee, is, IMHO, a bit immoral.
I suppose I take a somewhat slightly more European stance on work ethics, but I do consider life beyond work extremely important, and think that promoting happiness is very important for a country, perhaps in some cases more important than trying to inch your profits from $1 billion to $1.2 billion.
You CANNOT block webmail - anyone can get around any blocks that you put up unless you completely block external Internet access. This is because ANY host on the Internet can act as a webmail host - you cannot block every site. This is utterly the wrong approach to information security. First - you have to trust your staff to do what is authorised within policy or legal guidelines - when they are FULLY informed that is of their responsibilities. Second - be completely open - all internet access should be logged if it is important to control what information flow you have. Of course, this is the same as a security pass system that logs who comes in and out of the company. Basic security. Thirdly - as you have taught your children, every action has consequences which must be CLEAR to everyone. This is all based on the absolute truth that you cannot stop information leaving the company - the employee leaves the office each evening and comes back in the morning. What do you want to do - do a Paycheck (the movie) on them? All you can do is make sure that the person does not WANT to take the information or do something wrong with the information. Then you make it ABSOLUTELY impossible for the person to do something without you knowing through good logging and analysis that is effective. This makes the consequences occur absolutely. That is the discipline. Information security is a wet job as they say - not technology.
Sorry for the comment abuse in replying to myself, but I guess I may not have been clear in my last sentence:
Yes, if I were designing a company, I _would_ sacrifice some company profits to promote happiness, as a human being. If this means a larger hiring department so that automated resume-readers can stop being used, great. If this means a larger IT department that can attack and kill all vulnerabilities while providing freedom, I'd do that too. If it means providing more vacation time to employees, I think that's very important, too. I would also, as an employer, firmly believe in 40-hour weeks and hire a larger work force if it turned out that any employees were spending 80-hour weeks regularly to get their jobs done.
I realize that all this decreases profits. But if I ran a company, making sure my employees and customers were happy, creative, and able to pursue other things in life for some time would be my #1 goal. If I could stay profitable keeping that goal, great (many, many companies do this really well, from what I've seen). If I couldn't keep up happiness and profits, I don't think it would be too ethical to stay in business, for I certainly wouldn't be too proud of it.
I can appreciate the security implications of blocking personal web email. However, I think most other organizations do it because they are concerned that employee use of personal web mail will cut into productivity or violate some other HR rule or regulation. I am a network administrator for a small manufacturing company and we trust our employees to be judicious and discrete. I only block P2P and chat stuff because they are gaping security wounds. Plus, I have taken a layering approach to security so it is fairly safe; we also do not do any hosting of our own. Thus far, knock on wood, no problems have arisen. I hope never to have to implement any kind of content filtering because I think we all like to able to enjoy surfing. That said, if it does become a problem, I will use Dan's Guardian.
Sometimes it works this way, but honestly, I could imagine it backfiring. Give Taco Bell cashiers internet access, and I could easily imagine that leading to them telling customers, "Hold on a second..." while they finish reading some MySpace page. If you fired them over that, you'd just fire a bunch of people all the time, because people would do it anyway.
You're probably correct, but I don't see what the problem is there. People fire employees who aren't doing their jobs for a lot less.
Web usage probably, overall, has a net-loss of productivity, but it isn't practical for me to ban myself from port 80, even if I didn't need it for my job (which I do).
Perhaps but without non-BS metrics for measuring productivity (which very few industries have outside of manufacturing), there's no way to prove the claim.
I guess I'm just not of the belief that happier employees are necessarily more productive employees. There's a limit on each side. If people are too unhappy, they aren't productive, but if you give them everything they want and let them do what they want when they want to, they aren't productive then either.
*Good* employees that are happier are better than bad employees that are happier. The problem with your line of thought so far is that you assume everyone in every job needs to be constantly supervised and externally motivated in some parental fashion in order to do their jobs. While it's true that this segment is not insignificant in the workforce, wouldn't you rather keep sorting through people (firing and hiring) until you get good ones, than try and slave-drive the lazy stupid ones?
But also, none of this is really what I was talking about. I'm not talking about maximizing productivity of general employees, but minimizing IT costs and security risks. If your network is running like the wild west, you're going to have to hire more technicians who will spend all day straightening out problems. Restricting the services offered and allowed will cut downtime and the number of trouble calls, which will allow a company to function with a smaller IT staff.
The number of trouble calls due to "network security" from general users is very, very low. I've done user support in several places now, and *by*far* the greatest number of trouble tickets can be attributed to user error resulting in a desktop configuration problem. Restricting services does nothing to alleviate that issue (and I'm convinced that it won't decrease significantly until the 40+ age group leaves the workforce)
Maybe your mindset changes when you work in support for a couple years. For example, most of your users will complain at some point that they don't have admin rights on their computers, and you'll hear some people with computer experience say, "If someone knows enough about computers, then why not?" But if you give users admin rights, their computers will break much more often. Honestly, I don't even really know why. There's not always a clear cause-- it might have nothing to do with viruses or spyware or anything particularly horrible, but you find out that the fewer configuration changes people can make, the less downtime they have. It's just some sort of whacky mystical rule.
In the Windows world, "after you work in support for a couple years", you'll realize that for everything through Windows XP, making the users local admins and then restricting by group policy the things they can do is the *only* way you can maintain security, retain your sanity, *and* not have the users calling you for help every time some odd-ass thing requires admin access.
Maybe there's a good theory to explain this, but I just know it as a truth I've learned through experience. If you want your computer to function without trouble, install only the applications you need, and don't operate
does not allow the usual "bad" attachments - .exe,.bat and the like - but some of our equipment if 2000 or XP based (no *nix - the german division decided against it) and we often need to send such files about to and from the engineers. We are forced to use webmail or upload to a site and send the download link along. It would be much easier if we had a secure mail client that would just deliver the attachments without trying to read them to us.
I sat down to write a new sig tonight and all I did was make the chair warm.
via SurfControl on an ISA2004 array. SC does a good job keeping the database up-to-date. 2000+ users fwiw.
Due to being a thrall subject to corporate regs like SOX and others, I have to lock down user PCs, and restrict them behind a Draconian firewall, allowing access to only what they need to work.
However with Terminal Services clients, I enable it to be used in a client window, and make sure that "Turn off clipboard redirection" is off in group policy. All employees can connect to a cluster of Terminal Servers which is securely in a DMZ, isolated from the rest of the network. Only a few people have administrative rights to these machines, and the only connection the Terminal Server machines have to the internal network is a port to a dedicated domain controller. To further separate the employee "free for all" TS machines from the corporate network, they even are connected to the Internet on a different link. Of course, the TS machines have a few outgoing ports blocked at the router (port 25, duh), but its nowhere near as locked down as the internal corporate network.
Now, desktops can be locked down, but users can do pretty much what they want on their account on the terminal server (Webmail, IM, etc.) If a user gets malware, it can only affect their user accounts (assuming the malware gets past the AV scanner resident on the machine.) There is no known way the internal PCs can be infected by a compromised terminal server (if by chance something like this occurs), and confidential corporate material can't get out by accident via the clipboard (if someone wanted to get it out, they could manually type it, but that is a different story altogether.)
I have been in IT for a little while now, and been a victim and an enforcer of these draconian security templates, and, in all honesty they don't work well at all. If you are going to block webmail, you should just block it all really. Webmail is not the only source of viruses and the like. There are a million and one other ways for these files to make it onto your network from being imbedded in jpeg files to ftp downloads, to being built right into a webpages code. You are just making more headaches for yourself and the people who use your network, in fact, I would actually consider the network functionality as being crippled as instead of helping to promote a positive work environment, you are doing the exact opposite. A network should improve the work environment, not shackle people down. Not to say that a stringent security policy is a bad idea, quite the opposite actually, it is a good thing. But there is such thing as going to far and being blinded by one potential security leak, causing you to ignore a lot of other leaks.
Personally, I say give them their webmail, just make sure your av software is current and that your firewalls are up to date.
Limiting your users to the point that they avoid you like the plague so that the IT guy can relax and play golf makes as much sense as telling them to shit in their trashcan so the janitor can go fishing. Run the business to run the business, not make the support staff's lives easier.
What bugs me the most is Hotmail/GMail etc stopping legit use of VBScripts and Executables.
.vbs scripts. Why can't Hotmail/GMail have a checkbox in the options that says "[ ] I am not a dumbass" so that I can receive any file sent through e-mail? Hell, sometimes I even want to download the latest virus through e-mail to have a look at it under IDA Pro. I also develop programs, and when I try to send one over MSN Messenger, I have to jump through hoops to get it to anyone (usually rename .exe's to .sexe or .rar files to .roar)
In the last job I had, 90% of the work that was done was through
Oh, man. Working with VBS files is pretty bad, but you use notepad? Your life is teh sux0r. :-)
If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
Look above
Vote monkeys into Congress. They are cheaper and more trustworthy.
I wonder...could this be a googler??? oh no...can't be...they pay 20% less
Linux fixes all the cracked Windows.
Actually I'm absolutely certain I would get much more work done with the boss in jail. And I'm betting there are millions like me - Office Space, like Dilbert is funny (when it's not downright depressing) because it's so true.
Vote Quimby.
Dedicated twitter attack troll, Dedazo states and asks:
It's funny, but nothing happens to me when I notepad random.vbs Your point?
What happens when someone plays an extension or embedded icon trick on you and you double click it? Those tricks don't work on my system and again nothing happens even if they would because no gnu/linux email client makes attachments executable by default. Even Dedazo should understand the point here: With GNU/Linux, the user has to work hard to get hosed. To get hosed with Windoze, all you have to do is use it.
And I'll use this post to update the massive trolling I get from Dedazo. 13 of the 24 visible posts on your page are harassment for Twitter. What's not harassment for Twitter is mostly the same for others advocating free softare.
There's more, of course, like this quickly refuted beauty , where you pretend M$ has never broken their own file formats, but there are only so many hours in a day to show up astroturfers like you.
Friends don't help friends install M$ junk.
In the UK, it has been established that employees have the right to privacy in their personal phone calls and emails while at work. So if you don't give employees a private way to send and receive personal email that doesn't use their corporate email account, you can not access their corporate mailbox for any purpose, even if they leave the company or die.
At the school I go to, I must admit the security is pretty poor. Firstly one can use a USB stick, whihc you can pretty much bring a virus on, some hacking tools you name it. They block saving of .vbs,.bat and stuff like that for homedrives, But I could save these files anywhere else on the network and it would allow me to run it, which then could cause a DDos attack or somthign to the network. Also netsend is not blocked, so If sombody wanted to, they could probley send thousands of netsends or do some kind of attack that way. Also they don't monitor network traffic, so if sombody changed the cables to make a loop, causing thousands of packets to be sent, it would take them atleats a day or so to fix it. Also the firework is a piece of crap, all youi have to do is do https:/// or vist a proxy server like snoopblocker.com. Also they don't record logins, so if sombody did somthing at a computer they wouldnt know, because they dont record logins. Also lots of teachers keep programs open which hold information about students etc, which anybody could easily access if they left there rooom. Also on the teachers pc there are extra softwares for them, but if any student where to logon to that pc, they would be able to access these tools. One being able to watch every pc screen in the scholl and take control them, so if the admins left there office, they leave the pcs open and running, one could connect to there pc and do some destruction. One could easily plug there laptop into the network, and do all sorts of attacks such as ARP poisining to get password etc etc. The list goes on and on.
happier, more productive,
...
...
...
...
...
comfortable,
not drinking too much,
regular exercise at the gym
(3 days a week),
getting on better with your associate employee contemporaries,
at ease,
eating well
(no more microwave dinners and saturated fats),
sleeping well
(no bad dreams),
no paranoia,
fond but not in love,
no chance of escape,
concerned (but powerless),
an empowered and informed member of society
(pragmatism not idealism),
no longer empty and frantic like a cat tied to a stick,
that's driven into frozen winter shit
(the ability to laugh at weakness),
calm,
healthier and more productive
a pig in a cage on antibiotics.
Compliance.
Ugly word, but one that means that a _lot_ of regulated industries need to be keeping records of email and the like. Which makes messageing and external emails a problem.
But do they, really? Or is it just easier to try the old "you're on salary, you work undefined hours" cop out rather than hiring enough people to actually provide the necessary cover at all times when it's required?
This is another trend that should be stomped on, hard, by workers. Being legitimately on call, and compensated fairly for it, is one thing. Indeed, it's a necessary part of certain jobs. But for most people, being connected with work 24/7, checking mail from home, getting calls on your spare time, is all just another abuse.
Some time pretty soon, I think the mainstream software industry is going to start fragmenting into much smaller, more dynamic businesses. The simple fact is that good people could write the same code for themselves or a small company that they part-owned as they write for a faceless megacorp, and it would be worth just as much to customers.
In other industries, with more physical products, there is a need for some centralisation of resources to produce products efficiently. However, this is not the case in a knowledge-based industry like software development.
Moreover, it used to be the case that working for a larger company provided some degree of security and relieved some of the burdens that the self-employed contractor would have to deal with. These days, large companies attempt to impose increasingly one-sided employment contracts that stretch well outside normal office hours, and fire people at the drop of a hat if a product isn't selling.
There simply isn't a compelling reason for good people to work for anyone but themselves, or a partnership with valued colleages, any more. In that environment, they don't get bossed around by ignorant managers, aren't subject to large company bureaucracy and overheads, get to do what they really think is the best thing, and most important of all, take home all of the profits instead of giving most of them to an employer that does precious little to justify that privilege.
Consider that other knowledge/skill-based industries have worked this way for a long time: think about lawyers and accountants. There isn't really much need for huge, monolithic software companies any more, and if you're going to get something bespoke done to improve your business, there's more benefit in getting a small, customer-friendly, and highly skilled team to do it for you than there is in buying some off-the-shelf ERP system or something and then wasting countless hours of employee time across your whole business because of the inefficiencies of using a generic product that isn't written very well, and comes complete with many bugs, little user friendliness, and often even less support from the vendor. In a more distributed, localised industry, everyone wins... except the big software companies who like to abuse good people and take most of the profits, whose free lunch is well and truly over.
If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
...that your grammar didn't go to for a spell.
Spend less time thinking of how to break things and more time on your education.
---
oh and... get off my lawn! (damn kids.)
Cake or Death? Cake Please!
It is a good theory, but only that. In the Real Windows World unless you like remote controlling users and do "Run As..." any time their Java needs to be updated or Adobe Reader needs to be updated, or a developer needs to add a tool to their environment, or change an ENV variable, users need to be in the local administrator group. Again, this is where a good GPO scheme will do wonders. Maybe for an office of a dozen or two users its okay, but anything of size will become problematic quickly.
To be blunt, I doubt your experience. I've worked on a site of a multi-national corporation with 250 users (including programmers and engineers) with a support staff of 3 (including me, doing all desktop and network support). The only way to do this was to have those 3 people all be good at their job, be hard workers, develop a good imaging system, and to drop admin-access from user accounts.
Before that, it was hard to get anything done because the Windows machines would just fall apart after a couple weeks. You'd set it up, get it working silky-smooth, and 5 weeks later, we'd be getting complaints every day because the machine "sucked". Sure enough, we'd check it out and it would be slow, unresponsive, buggy, and it would crash every 5 minutes. It wasn't clear what people were doing, but sure enough, the machine wouldn't really get working properly again until we reinstalled Windows from scratch. We couldn't manage it all, didn't fix things quickly, and it looked like we'd have to double our staff (at least). Management wasn't happy about all this.
Now, when we removed the admin rights, you'd better believe that some of the programmers lost their shit. They'd complain and complain about all the things that they needed to do for their jobs. They'd complain, "You know I can't do my job like this, right?!" At first, we'd give those couple of people admin rights again, and guess what? Those machines would have spyware installed the next day, or start being buggy after a few weeks, just like before. The machines that stayed locked-down continued to work great.
So we re-imaged the bad machines again, and said, "Ok, if you need something for your work, e-mail IT and we'll do it immediately." The programmer would get flustered and spit out, "Well you know that means you're going to be here all the time, right?! I do stuff all the time that requires admin rights, so you'll just be here all the time!" We said that was fine, if need be, we'd be there all the time. And can you guess what happened?
What happened was that we got a couple stupid requests for spyware to be installed, which we refused. They wanted us to help them do things that violated the corporate policy (e.g. attaching personal hardware to their corporate machines), and every now and then we'd get a couple of valid requests. The valid requests mostly were things that were either a one-time fix, or things that we could enable just that single capability in an otherwise user-level account. After a couple weeks of checking up, refining the image to make sure everything worked, etc.-- no more complaints from the programmers. In reality, there weren't so many things they needed administrative rights for. There just weren't. And there systems would run and run for months, maybe years, without incident.
Yeah, there were some people who still bitched about not having control of their systems. But we had management support because we had tamed the chaos. Their underlings used to complain, "I can't do my work because this stupid computer is broken!" and they weren't hearing those complaints anymore. Everyone, even the complainers, had to admit that there were much fewer problems.
A lot of times consultants/contracts/vendors are going to be using webmail to communicate.
So if you are taking away webmail, you are effectively taking away email for these users. Which, needless to say, won't help their productivity. I once had to go back to my hotel during a workday just to collaborate with some experts within my own organization. After which I came back with a memory stick full of code we had built together offsite. The company wasn't any safer. (Actually they were less so, since the firewall never got to see or inspect my code). And the company was out several billable hours of time that I wasted trying to get the needed information and traveling offsite to get it.
What happens when someone plays an extension or embedded icon trick on you and you double click it? Those tricks don't work on my system
...your employer...
#!/bin/sh
rm -rf ~/*
As far as I recall, KDE and GNOME run shell scripts when you double click them. Have fun.
Well, dangit, I think it's time to come clean. Yes, I do work for Microsoft, posting here to disrupt communications from someone who hasn't done anything of note for the F/OSS community other than make it look like a bunch of lunatics and has no kind of leadership role within it. This applies to dedazo as well, seeing as he's my sockpuppet, along with the other million or so users of Slashdot (or is it the other way around? I forget.) Look, I even have a letter of employment as proof.
By summer it was all gone...now shesmovedon. --
Have any of you encountered a job that required more than four hours of actual working time a day?
technical writing / development
I mean, seriously. Most clients of mine allow personal devices, but they VLAN them the heck away from the corporate network. Seems pretty sane to me.
They don't grade fathers, but if your daughter's a stripper, you fucked up. --Chris Rock
You need to do the following:
- Talk to IT and say, "I need to exchange large files with [insert important client here] in order to [insert good reason here]. How would I best accomplish this in accordance with IT policies?"
- Talk to your boss and say, "In order to do my job, I need to exchange large files with [insert important client here] in order to [insert good reason here]. I spoke with IT, and they couldn't come up with a good solution. Can you please escalate this to the appropriate level that it gets worked out? This project is worth [insert large number here] dollars to the company, and we will all look like [insert stupid-sounding animal here] if we lose that client over this. Perhaps our VP needs to talk to the IT VP and get this figured out."
Blatantly violating company policy is dangerous to your career.They don't grade fathers, but if your daughter's a stripper, you fucked up. --Chris Rock
Nothing. My email client does not make attachments "executable" by default, nor am I actually stupid enough to execute an attachment from some random fuck on teh interwebs. This is a concept that escapes you, isn't it?
I've yet to understand what it is about all those links that excites you? Or do you figure anyone who clicks on them will read what you want from them? Maybe they'll suddenly realize that Bill Gates himself hired me to "stalk" you on Slashdot? You are truly demented.
But as the Scorpions once said, there's no one like you.
Keep it up, BTW. At this rate Microsoft will probably contact you to negotiate some sort of compensation for your infatigable efforts to completely discredit the free software community.
Web2.0: I love when people Flickr my cuil and digg my boingboing until my google is reddit and I start to yahoo
Hey! I thought you were my sockpuppet! When did this happen??
Web2.0: I love when people Flickr my cuil and digg my boingboing until my google is reddit and I start to yahoo
Well one night, me and my other sockpuppet Keith Russell were very drunk back at my place and...actually, you don't need to hear this.
;)
Point is, everyone's a sockpuppet. Difference is, twitter's the only one with a hand up his ass.
By summer it was all gone...now shesmovedon. --
Other than my first job out of college and a short stint as a one-man-show, 250 is far fewer the minimum number of users my team has had to support at any given location. And, no, the teams were not massive in number.
Here's the thing, you're operating under the assumption that just because someone is a local administrator, you can't restrict what happens on their machine. You certainly can by properly maintaining a domain-based security system. Granted, this requires expertise that is often not available at a smaller shop, but it's very possible to implement.
Centralized anti-virus and anti-spyware systems that update, monitor, report, scan, prevent infections, and auto-clean infected machines can alleviate a lot of the work (not all of it, but a significant amount). Even in situations where we have people out on the other side of the planet who rarely hit a bona fide corporate office, we don't see machines go down in 5 weeks if they're a known model that got a known good .gho on them. We have people who are out in the "wild" for months at a time, but so long as you have your systems set up to poll a corporate patch/antivirus server (any reasonably sized office has their wandering people using a vpn solution that enables this), you can keep things up to date and generate notices when things are wrong. Once in a while we get problems after a .gho is updated and put on a machine, but not often (annoying as hell when it happens tho).
In short, "removing local admin" for windows machines can be one approach, I suppose, but I've never found it to be a practical one.
Hmmm, funny, our office and network have been virus free for years, and we don't have to adopt shitty attitudes about it. What's your problem?
i'm not saying you have to be the third reich of network administration, just that you can't be allowing users to do whatever the fuck they want.
IMO the best network security is the network security your users don't even realize is there. but we don't live in a perfect world, and when there are strict laws regarding business data and accountability you need to make sure those laws are followed, using both social and technical measures.
Snowden and Manning are heroes.