Slashdot Mirror
One-Third of Employees Violate Company IT Policies
BaCa writes with a link indicating that a survey of white collar US workers shows that something like a third of all employees break IT policies. Of those, almost a sixth actually used P2P technologies from their work PCs. Overall, the survey indicates workers aren't overly concerned about any kind of security: "The telephone survey found that 65% of white-collar professionals are either not very concerned or not concerned at all about their privacy when using a workplace computer. A surprising 63% are not very concerned or are not concerned at all about the security of their information while at work. Additionally, most employees have the misconception that these behaviors pose little to no risk to their companies."
I'm guessing a more accurate headline would be: One-Third of Employees Admit to Violating Company IT Policies
The rest just didn't let on - because there is no way the number is that low. Or they didn't outright lie, they just didn't even know they had violated company policies.
It's hard to believe that's how Micronians are made. Why don't we see it right now by having you both kiss one another?
I think most of us could've told them that without all of the silly research.
Seriously though, for most people, unless they know there's a risk of being fired if they don't comply, chances are that they're not going to care about corporate IT policies. Most companies don't actual police them, so what benefit do they have in following them?
While people should be responsible enough to do what their job requires, it falls back on the corporate IT folks to make sure their policies are enforced.
Of those, almost a sixth actually used P2P technologies from their work PCs.
In other news, one sixth of one third of all IT admins are stupid enough to not block P2P traffic on their networks.
There are a lot of really stupid IT policies out there that, in the name of security, in fact merely hinder getting work done. I am not talking about P2P. Giving a developer a workstation with a user account with no administrator privileges on Windows is among them.
Insert self-referential sig here.
by executives to make unrealistic deadlines which they decided without IT input.
She was like chocolate when she drank... semi-sweet at first and then increasingly bitter.
Blacklists=>Proxies
Traffic filters=>TOR
etc. etc.
But the real problems are still caused by moron employees who double click on an attachment they got via email. Just happened again last week. The problem isn't people who don't adhere to policies, it's employees who don't have a clue.
And what's wrong with reading Slashdot while you're slacking off with a coffee for a couple of minutes? I'd consider an employer a slave driver if they have a problem with that.
thegodmovie.com - watch it
Pick something you can remember. The simplest way to have mixed case, alpha numeric password with punctuation, is a sentence that you can remember. "Today, a coffee cost $1.99 + TAX!" Secure, simple to remember, and passes all the validation you want to throw at it.
Gibble: Descriptive of an emotional state in which one's mind is scrabbling for some purchase on reality
with the privacy of their employees. Case in point, mine provides my Social Security number to third parties, against my express direction, with absolutely no business need, and in direct violation of their own written privacy policy.
"National Security is the chief cause of national insecurity." - Celine's First Law
...there's a very relaxed IT policy.
Browse whenever you want, take whatever software you want home, check your email if you want, everyone's their own local admin, no audits.
However, if you get caught with illegal software, miss a deadline because of blatant time-wasting, then you get fired (for continuous abuse). People work not because of policy, but because they want to do well and enjoy what they're doing.
I happen to also work in one of the biggest names in IT too....not some small company. The policy works very well, as is evident from the company's success and the fact people rarely leave. That and brain-implants, anyhow.
throw new NoSignatureException();
what is wrong here? Rules or people?
Whenever rules are broken, something of the two is off.
Remedies are not always adequate and can lead to more trouble.
And is that the phrase for the for the dental plan password, the diversity training registration password, or the office supply purchasing password? Or an older phrase for one of them, as each one needs to be changed (out of sync!) 6 times a year.
What I'm listening to now on Pandora...
I'm not supposed to post on internet forums.
-Dave
I've actually tried this little social experiment.
I run the network for my mother's company for free, so I'm allowed whatever liberties I'd like in deciding policy instead of having it dictated by a boss. They've got over 20 machines, and they aren't formally assigned, so if one goes down it's not the end of the world, the employee can use one at another desk for awhile. Usually they use the same one every day though.
The experiment was this:
Four new employees. Four new Windows XP Professional PCs. All use Firefox for a browser and Thunderbird for e-mail, along with the proprietary manufacturing/sales app that they run their business with. Two machines got Symantec anti-virus, and the other two got no anti-virus. They were told that since we don't have a copy for that machine, they'll just have to be extra careful about what documents they open, and how they use their e-mail. (We really were out of licenses/subscriptions, which is how this started)
After three months, both of the AV-free PCs were completely fine, and one of the machines that had the anti-virus was running a botnet spammer (the outgoing spam was being blocked by the firewall). The most amazing bit though, was that the fear of not having anti-virus protection had stopped users of those two machines from doing most of the non-viral bad stuff that average windows users do. There was no proliferation of toolbars, no weatherbug.... They didn't even have realPlayer.
It's amazing what a false sense of security people get from running anti-virus software. They don't even realize that they still have to be careful because 0-day threats aren't in the latest virus definitions yet. They think they can do whatever they want, because they are protected.
The whole company has since gone anti-virus free on the desktop, and problem reports and performance complaints have dropped way down. Education and a healthy dose of respect for the evils of the world work better than any anti-virus on the market. And the cost savings are nice too.
(There is still some basic protection in place. All internet access is through a secured web proxy. Non-http traffic isn't allowed. Intrusion detection on the firewall, etc... And the servers are still scanned, AVG on the windows servers, chkrootkit on the linux servers.)
I recall before a lot of companies had terms of network use, a few employees where I worked had been downloading games from warez servers because the company network was significantly faster than anything available at the time. I knew even the network admin was violating this. I very much felt like reporting it, but as an entry-level employee on their first job, 1) I would feel guilty with getting someone fired; 2) I didn't feel like testing management by reporting this and see myself get fired; 3) I didn't really understand the policy and didn't know what to do.
I'll make clear that I wouldn't let this go today.
My point in all this is, some people starting at the company may be aware of activities the admins themselves or other staff are performing which management may not be. My first job was relatively simple and well paid, I have had no beefs with the company. But our Acceptable-use policy book was some 20-30 pages long. This was about 10 years ago. I would rather have had a 1 page document, sign at bottom: I will not download virsues or warez, share company information or NDAs to outsiders, etc on company time. If I know another employee is doing so, please report anonymously to. Violators will be disciplined or fired.
Really, does it really need to be any longer than this or more complicated? It simplifies reporting and makes the issue and repercussions clear. Get the 20 page document too if you must. But the one-pager should be clear to *all* employees regardless of law degree. But help make it clear too, that if you mistype a domain and get a porn site, you shouldn't have to hide it and feel like someone is about to can you (e.g. whitehouse.com vs whitehouse.gov).
*YOU* are in the wrong. This is true if *YOU* are not paying for the hardware. This is true if you do not pay the support staff. It is not up to an employee to dictate what services a companies IT department will support -- that's up to management (hopefully with IT input -- but certainly not final say-so).
We have limited budgets. I don't want to require that my staff knows eudora AND pine AND OE AND outlook AND thunderbird AND xyz AND abc AND fillintheblank. By making everyone use the same email client (or limited set of clients), you reduce training costs and quite frankly, you eliminate the user shooting themselves in the foot. YES there are some users who are quite able to troubleshoot for themselves. BUT, try telling Bob the luddite he can't use thunderbird (something he may have never used, but likes the way it looks) when Lennie The Linux Master two desks down is running pine!
Simple solutions for companies who don't want silly and frequent helpdesk calls: Keep the workstations as uniform as possible within the scope of work any given employee is required to complete. Feel free to start your own business if the company rules don't appeal to you.
For example the last place I worked at, the official line was "no personal use" but it was deemed OK to download a few mp3s or a Fedora ISO image here and there, thansfer your photos to flickr etc, but they stomped down hard on the guy who used approx 1/3 of the network bandwidth to download DVDs for his home viewing (and to give to his buddies etc). Printing a few tens of pages here and there for personal use was OK, but they stomped the the person who did a 5000 page print run for their club newsletter.
It comes down to "reasonable force".
Engineering is the art of compromise.
The problem is, companies are cheap. Developers should have their own network that they can do whatever they bloody like with (IT dept. hands-off), and it should be isolated from the corporate network. But that means they need two machines, one with their corp email & IM and office tools & the like, and one that they actually develop on in their own sandbox...
There are rules, like the 70mph speed limit or no surfing Slashdot, which are usually ignored unless someone needs a reason to fire you.
Then there are RULES, like not killing people and not using office computers to plot the overthrow of corporate executives, that will get you fired no matter what.
Most people are smart enough to know rules from RULES. Those that don't get the corporate Darwin award.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
If you are reading this thread at work, you're probably violating the policy as well. Has anybody actually read the employee handbooks given out on your first day of work? I have never worked for a company where IT stuff did not violate policies to a greater degree. Sure, soccer mom / accountant Jane may look at the news site or shop at gap.com during work hours, but Billy, the director or IT, can run as many P2P applications from the QA lab. I have constantly heard IT engineers bragging about yet another wonderful Quake 3 lunch. It is nothing wrong to have some fun at work, but ordering extra-beefy hardware only for specific individuals so they can play Quake may not sit right with a CFO. What about all that licensed software that magically ends up being installed at home? The about box reads that it is licensed to Some Company while it is being used for personal purposes. Things like this happen all the time. Hell, I had a co-worker who did not mind browsing pr0n and personals online at work. He even bragged about it. Noticed how I stated things in the past tense :)
Stupid policies make people break the laws. Just like teenagers love liquoring up despite the fact that it is illegal, white collar professionals like their news sites and forums. There is nothing you can do about it. In fact, if I were a boss, I would encourage people to relax and take breaks once in a while. I seriously see no harm if Johnny-work-all-night-to-meet-deadline takes 10 minutes and reads his Slashdot. As long as work is getting done, who gives a shit about what people do when they have a spare minute.
You really have no grasp on reality, do you?
You think virus protection protects your net work? You missed the entire point. Then you followed it up with a broken car analogy.
Perhaps you should try understanding what you do for a living instead of doing whatever some book and a whole bunch of marketing literature told you to do.
I check in on my machines and make sure they are working. I protect my networks, and make sure that if they *do* get infected they're not going to infect *your* network.
Judging by your comment, on the other hand, you merely install security-blanket style security software on your systems and think that makes you "responsible".
Users have no remorse because they are given zero responsibility. Why should they care if they fuck up your machines? You secured them. They're protected. They're both "safe" because of the protections, and completely disallowed from making any responsible decisions about their own machines, so they take zero responsibility.
You, sir, are the cause of your own user-troubles.
The company imposed some really screwed up policies on desktop configuration but they had a liberal telecommuting policy. So everyone did their serious work at home. They shoved their (IT mandated) Windows systems aside, used Linux and other FOSS applications, surfed the web, downloaded tunes, played WoW or whatever. As long as they got their work done, management was happy.
Strangely enough, the company was also heavily into a process standardization kick. I don;t think they ever confronted the fact that the work that was getting done could never have been accomplished with the 'IT Standard' tool suite. Too bad. A more open policy at work would allow them to capture best practices.
Have gnu, will travel.
Me: Sorry, we can't both know your password, so I changed it.
User: To what?
Me: If I told you, then we'd both know it wouldn't we? yuk yuk yuk
User: [grumbling] Okay, I'll change it, but I won't tell you this time.
Me: Okay, it's temporary though, and will force you to change it when you log in, ready?
User: *sigh* ready.
Me: [mumble: random, okay] a;@#aslkdfQQQ$@$#%faWerrr@!!a;lskd1.
Nobody, but nobody leaves their password as the one I give them. Few tell me twice.
Back in my day when we chiseled our bits into stone and sent them by mule train from village to village...