Slashdot Mirror
Businesses Struggle To Control Social Networking
Lucas123 writes "Businesses in highly regulated industries are trying to strike a balance between workers who use social networking sites such as Twitter, Facebook, and LinkedIn to communicate, and trying to satisfy federal requirements to monitor, capture, and audit all forms of electronic communications. As with instant messaging a decade ago, corporations are first blocking all access to the applications, and then considering what tools may be available to control them in the future. A cottage industry is being built around software that can not only control access to social networking websites but also ensure conversations over those websites can be stored for electronic discovery purposes."
Aren't these people supposed to be, you know, working?
'Loose' is when your pants are three sizes too big. 'Lose' is when you misuse 'loose'.
From TFA:
Seriously. What idiot wants his financial transactions posted on FaceBook?
I mean there are enough almost trivial ways to hide information in pretty much any channel when the 2 parties get to meet up before hand to agree a protocol.
I'd almost ask why the even try.
"hi, mike, what time's the meeting today" or "Morning,how're the kids" can carry enough information to let someone game the system.
Social networking just adds a few bands.
Hm. I wonder if we perhaps need to rethink the difference between communication and documentation. The current rule seems to be that in regulated industries, any electronic document is subject to documentation/retention requirements. However this comes from an old model, where documents were somehow "official". So things like face-to-face conversations, or telephone calls, were not required to be recorded and archived. But anything written on paper was supposed to be archived to create a paper-trail, and because these were the "official documents".
In a modern world, some electronic documents (PDFs, word processor documents, emails, etc.) have taken the place of "official paper documents", and other electronic communications (instant messaging, social networking sites, etc.) have taken the place of the less-formal communication modes. (Obviously phones and face-to-face conversations still exist, also.)
On the one hand, it seems like the more documentation we can retain in regulated industries, the better off we are. (In case of negligence or malfeasance, it makes it possible to assign blame, bring people to justice, avoid repeating mistakes, etc.) On the other hand, as long as we are allowing some communication modes to be informal or undocumented, then allowing other modes that are also undocumented doesn't seem to change much. (People who want to have secret conversations will surely find a way to do it.)
I'm not sure what the right answer is. But I'm not convinced that making all electronic modes of communication subject to the same level of recording/documentation/archiving really makes sense.
Stockbrokers with smartphones. Ain't going to stop 'em.
To paraphrase Process Leia, The more you tighten your grip, the more slips thru your fingers.
Where I work (the stuff I do when not commenting on Slashdot), they're in the process of trying to harness LinkedIn to increase sales, however, alot of people have difficulty with the concept. The old model consisted of cold calls and "walking the streets". The new hustle is e-mails and add me as your friend.
Trying to teach a fifty year old salesman what his granddaughter does with ease is almost baffling.
Management pondered with the concept of controlling everything but I recommended harnessing it rather then controlling it - it is the only way.
Websense can suck it.
I want to delete my account but Slashdot doesn't allow it.
The reason for the documention (and control that such requires) is to keep the company on the right side of the law.
Being able to show the EXACT communication that took place can save a lot of money in fines.
The DoD has been struggling with this same issues as well, they recently issued guidance that opened up social media on their networks.
http://socialmedia.defense.gov/index.php/2010/02/26/dod-official-policy-on-newsocial-media/
If you think you're special because you can do that to get around a block then you are confused. If you can use this sort of workaround then your admins are either idiots or don't actually want to stop you, they just want you to go out of your way enough that its obvious you were breaking the rules.
Either way, you aren't special.
Persistent Volume manager for Kubernetes - https://github.com/dwimsey/openshift-pvmanager
http://www.computerworld.com/s/article/print/9176439/Social_networking_boosts_legal_regulatory_compliance_headaches?taxonomyName=Financial+Services&taxonomyId=130
Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
Meh, when done right, it just looks like a long ssl and/or vpn tunnel session.
You really cannot do much to filter/firewall this sort of bypass for the technical user. Unless you allow whitelist-only access to https/ssl sites and/or force corporate-only machine access with corporate-installed SSL CAs that decrypt SSL traffic and re-encrypted (putting the corporate proxy as a man-in-the-middle) you have no way to stop this.
The real trick is blocking all "leaking" dns and apps. Socks leaks badly, as does flash, java and many other plugins. Just firewalling all outbound traffic except your tunnel works, but will require a dedicated machine.
http to a remote proxy over openvpn (ssl) is a bit more efficient than socks over ssh and clearly better than socks over ssh over ssl.