Slashdot Log In
Telecommuting Backlash
Posted by
ScuttleMonkey
on Tue Jun 20, 2006 05:37 PM
from the blame-game dept.
from the blame-game dept.
coondoggie writes to tell us that advocates of the telecommute have stood up against recent finger pointing based on recent telecommuter screw ups. One of the more notable screw up was the recent loss of many veteran's personal information by a VA employee. From the article: "Despite years of growing acceptance, telework still has such detractors. 'The No. 1 challenge is cultural inertia. It's motivating the middle managers, teaching them a new way of doing work,' O'Keeffe says. 'It's the Luddite mentality that we need to change.'"
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
The problem isn't telecommuting (Score:5, Insightful)
Re:The problem isn't telecommuting (Score:5, Insightful)
I think it really is about telecommuting, and laptop computers. More and more, sensitive data is portable, and more people are taking advantage of that to move sensitive data from "secure" environments to "convenient" environments.
Having some asshat steal a computer full of data doesn't really happen that often to people who keep their computers locked in an office at their employer's campus.
Parent
Re:The problem isn't telecommuting (Score:5, Insightful)
My employer mandates that the encryption feature of our notebooks be used. But it's a PITA, especially if your drive gets corrupted. To counter that we have an on-line backup system that takes a daily image (file by file, not binary image of the disk, for obvious space savings possibilities) of your drive and stores it whenever you are in the plant. While you are off-plant you are still secure because of the encryption. If we lost a notebook we could lose billions of dollars (assuming it's the right notebook). Shit, the data on mine is worth ~$75-100M.
The headlines should read: MegaCorp loses notebook with customer data on it. Company issues this statement: "This is a non-issue, the notebook was encrypted with a system that meets XYZ standard, it will take no less than 200 years for the system to be cracked."
And the statement should be true.
-nB
Parent
Re:The problem isn't telecommuting (Score:5, Funny)
Parent
Re:The problem isn't telecommuting (Score:5, Insightful)
Have fun with:
2 proxies
3 NAT layers
1 terminal server (which I suppose is another proxy).
My real point was that there is not a reason for theft of a notebook to be an IP asset issue. If I can "safely" take my data with me, then why not customer data in the same method?
the answer is simple: most companies think their IP is worth more than customer records. If they would simply make the statement:
{IP += CustomerRecords};
then there would be no issue, as you would see the data locked up tight.
-nB
Parent
Re:The problem isn't telecommuting (Score:5, Funny)
By the way, for making your 1361st comment on Slashdot, you win a free USB drive. Where do I send it?
Parent
Re:The problem isn't telecommuting (Score:5, Funny)
2 PO Boxes
3 Foreign countries
A customer's secret, illegal account in the Cayman Islands
Parent
Re:The problem isn't telecommuting (Score:5, Funny)
Oh crap, I shouldn't have said it's a secret.
Oh crap, I definately shouldn't have said it's illegal.
Parent
Re:The problem isn't telecommuting (Score:5, Insightful)
Parent
Re:The problem isn't telecommuting (Score:4, Funny)
It's security that makes people cry, especially when a part is cut out of it with a knife.
Parent
Re:The problem isn't telecommuting (Score:5, Funny)
Just for fun I did a GROUP BY query grouping who tested posted for what drug by SIC code, in descending frequency. The pattern was: Construction Workers, Marijuana and Cocaine, far and away #1. Second: employees of the school system, alcohol. Everything else was kinda scattered all over the map. I think that rather than demonstrating what kinds of people take what drugs, it demonstrates who gets hassled the most by the drug policies.
Parent
Re:The problem isn't telecommuting (Score:5, Insightful)
Oops, the laptop that was stolen had the PGP password written on a post-it-note. Or it was the guys' daughters' college fund account number. Or they were logged in while working at a coffee shop, got up to use the bathroom, and came back to an empty table. Or a corporate spy stole it once, put on a keylogger, and then steals it again. Ask the police how private your fingerprints are. Does your boss put retina scanners on all company laptops? Can you be sure that nobody with data access would be dumb enough to keep any of that info on their USB drive or a CDR? Are you using strong crypt on your swap space? What do your bosses do to make 100% sure that nobody is printing out information on their home deskjet and leaving the printouts in the recycle bin on thursday morning? Are you so sure that there aren't moles in your office that you'll let a billion dollars juts walk out the front door? If your data is really as valuable as you say it is, then you need to have the working assumption that someone out there is going to pull some James Bond style shit to get at it, they're not going to stop at "aw shucks, they *encrypted* it!" A password is relatively easy to bribe someone out of. If they never have to show up on site to access the data, then that's all they'll ever need.
When your data is valuable enough that people would REALLY want to steal it, people, not protocols and passwords, are the big problem. When you let people just walk out of your office with company secrets, you're not just increasing the size of the problem, you're adding entire DIMENSIONS to it. People get lazy about things that they have to do every day. Lab Chemists and Biologists have horrible cancer incidence rates because they eventually get lax with safety procedures, even though they know better than anyone on the planet how dangerous what they're doing is. The human brain is set up in such a way that something it encounters every day without visible harm stops registering as "threat" pretty fast. No matter how rigorously you try to follow standard XYZ at the office, people will get lazy when they're looking over some work in front of the TV.
Parent
Re:The problem isn't telecommuting (Score:3, Insightful)
Re:The problem isn't telecommuting (Score:5, Insightful)
No, the companies give away the working computers with all the data on them when they are obsolete.
More and more, sensitive data is portable, and more people are taking advantage of that to move sensitive data from "secure" environments to "convenient" environments.
A VPN into a corporate network then a terminal session would fix most of the complaints. Have them work directly from the server and there are no problems. Have the VPN client check that the firewall and virus software is installed, running, and up to date and there are fewer holes. If you are really worried about it, toss more money at it and make a non-split-tunneled hardware VPN from the homes of those that will be going in, then use locked down terminal services. They won't be able to get anything from the Internet without the protections that everyone else in the office has, and no data will be ever put on the local computer.
I can think of lots of ways to make these just about as secure as those at the office. The problem isn't figuring out how to make them secure. The problem is getting executive buy-in and end-user compliance.
Parent
Re:The problem isn't telecommuting (Score:5, Informative)
This means that when a sheriff recently left his laptop in an unlocked police car and it was stolen, there was nothing sensitive on it.
This isn't that different from how I've been telecommuting for a long time. I use my laptop to connect up to the corporate VPN and then connect via remote desktop to a machine I have configured for myself at the home office, where I do all my actual work.
Parent
Re:The problem isn't telecommuting (Score:5, Funny)
UN Inspectors are going to find that thief, because that thief has URANIUM TESTICLES. Stealing a laptop from an unlocked police car? Holy shit.
Parent
Re:The problem isn't telecommuting (Score:4, Funny)
Parent
Re:The problem isn't telecommuting (Score:3, Insightful)
I still recall a dumpster loaded full of blue bar computer printouts covered in student grades outside the main campus registrar's office. and that was thirty some years ago...
It has NOTHING to do with telecommute, NOTHING to do with security, it has EVERYTHING to do with butinsky bureaucracy and government gimme. When, as a cultur
Re:The problem isn't telecommuting (Score:3, Insightful)
Tell that to AIG. Reported 2 days ago...Fun News Link [usatoday.com] Outside of the VA lately the breaches have been from smash and grabs like this one. As an I.T. security guy, the first thing I look for when doing an assement is the physical security of home and especially branch offices. I'm not really disagreeing with you, just pointing out that one c
Re:The problem isn't telecommuting (Score:5, Insightful)
Consider yourself lucky to have never experienced two floors (dozens of employees) of locked PC's and laptops removed overnight... more than once. In my experience it isn't someone but some group and they know what they are after and they have tools. Yes, most criminals are stupid, but many are organized and professional.
What's the bigger payoff?
a) single telecommuter setup in home where there is someone that is around most of the time
b) office space with dozens of systems guarded by the lowest price bid security firm/system
Parent
Re:The problem isn't telecommuting (Score:5, Insightful)
I both agree and disagree. On one hand, the problem IS bad security practice. It's possible to telecommute safely. On the other hand, the simple truth is that telecommuting opens up new attack vectors. Your data can now be attacked on your system at home, before the VPN is up. It can also be stolen more easily; security on your average office building is better than on your average house.
On the other hand, THIS particular problem could have been avoided by simply using some encryption. Clearly, those who take home confidential data without encrypting it are morons. Some of you are now parting company with me over my allegedly elitist attitude but let's face it, people have been encrypting messages for hundreds (thousands?) of years. This is not a new concept. A user taking home confidential data should be asking themselves how they can protect that data. Anyone who doesn't ask that (in our litigious society, especially) deserves what they get, because they're stupid.
I don't expect everyone to know how to keep data secure. I DO expect them to care enough about it to seek the advice of someone who DOES know.
Parent
Re:The problem isn't telecommuting (Score:3, Insightful)
Of course the potential also exists for viruses or trojans to affect the data over the VPN.
One could even argue that since these same problems could potentially exist on the local lan at the office (installing bad stuff on the machines (again, bad security)) that having it over a vpn is safer since it's not an always-on link.
Bottom line- good security and not allowing people to take things home/offload data (part of good securit
Re:Deserve what they get? (Score:4, Informative)
Don't make light of this, a number of people got really badly in trouble over this. As a measure of how seriously the gov't takes the situation, it is rare for any civil servant to actually get fired. In spite of the reforms of Jimmy Carter's days, it is still difficult to fire gov't employees. You'd better have your 'i's dotted and the t's crossed, too! Upper management hates to go that far, especially if the employee has over ten years in, and I think this guy had 11 or 12. Get fired like that, and you lose your pension and everything. So if they fired this guy, it's serious.
I work for another Department, and we take security very serious. ALL agency laptops are installed with a standard image using Ghost, an image that uses Pointsec to encrypt the entire hard drive. Yes, we take a performance hit, but to safeguard data, it's worth it. Users have no choice. It is installed before they get it, and when they are issued the unit, they are given the opportunity to set the password (at least 8 digits). If they forget it, they are told, the HD is toast, and must be reformatted. (not really, there are admin PWs we can use, but that makes them MUCH more careful!) They are warned not to store data on the HD, cause if the OS develops a problem, all we'll do is reimage it. We use an elaborate VPN system, with tokens, to allow employees to remotely connect. They don't need to keep data locally, and it is discouraged. With our setup, a lost laptop is just a lost item; a thief would have to reformat the HD to use the laptop. Our data is not accessable.
Parent
Re:The problem isn't telecommuting (Score:3, Insightful)
One aspect I've really seen neglected is providing a decent communication infrastructure. Software people use shared whiteboards a lot, yet it doesn't occur to companies that their telecommuters need whiteboard software. And then there's teleconferencing: the last big meeting I went to was m
Backlash for security? (Score:4, Insightful)
It's possible to set up secure connections between a telecommuter's computer and a secure server. Encrypted tunnels for VPN or something like that. Encrypt data on the laptop hard drive - if you even permit sensitive data to be stored there at all.
But until government and corporations are seriously committed to taking the measures necessary to keep private data secure, incidents like this will keep happening, whether it's due to a stolen telecommuting laptop or a server that gets broken into.
What finger pointing? (Score:4, Interesting)
the article says it all! (Score:5, Insightful)
On what grounds are you going to detract from telecommuting in that statement? Every worker I know a)has a latop and b)moves it around. I don't think any of us would call ourselves telecommuters in any sense of the word. The fact we take work home, on 'theivable' media isn't an argument against telecommuting, it's an argument for us not taking work home!
I know there are telecommuters on
The next question for me is, who is this backlash against?
Re:the article says it all! (Score:3, Insightful)
Of course the pay wasn't great and the work wasn't interesting, but my evenings and weekends were my own...
Telecommuting (Score:5, Insightful)
In my last job I telecommuted for a good 3-5 months until I left. The company had excellent policies and security. There wasn't a single reported incident of data theft from our division in the two-and-a-half years I was there. I was definitely more productive, and I was also better able to plan around illness, holidays, and emegencies.
It's all about good policy. A company without telecommuters is still insecure if it has a crap IT Risk policy.
VPN in / Tunnel in.. use Treminal Servers!!! (Score:3, Insightful)
It can happen in an office building to (Score:5, Insightful)
The real problem (Score:3, Funny)
Re:The real problem (Score:3, Funny)
hogwash! That is a security issue, not slave issue (Score:3, Insightful)
I telecommute from around the world and work directly off machines via SSH, so even if my laptop is stolen, nothing confidential or work-related can be compromised.
Of coarse, if you're IT/Network security policies allow telecommuters to actually work ON their own hd's, then that is your fault for having a flawed IT/Network security policy.
Either way, this is FUD for anti-telecommutism.
security issues aside... (Score:5, Insightful)
Re:security issues aside... (Score:5, Insightful)
Anyway, I think the best thing is a good mix of tele and in the office work. For me, I like to tele in the morning from home where I have my dual monitors, my espresso maker, my clean air, etc. It allows me to work solid in the morning right after getting up until I start to lose focus. I'm usually at my highest focus right after waking up. If I waste that time showering and driving, I'll just sit around at work.
So I work in the morning from home and when the focus starts to fade I save all and sync up, and then go shower and commute. I spend about the same amount of hours working but FEWER hours in the car, etc. becuase the traffic is lighter at 10:30 than at 7:30. Plus there's fuel savings, etc. And I don't have to go in every day--sometimes you get on a roll and don't need to go to the office to stay motivated to work.
There are some jobs that need you to be there: anything physical obviously (factory worker, garbageman, etc.). In my opinion, most meetings are bullshit though. Sending an email is usually enough to get it across. But I think some people need meetings to make them feel like they are part of a family. I'm like a hitman, a contractor, BOFH style, so I just do what I do.
What really bugs me is when I get PICNIC calls from the office (usually the same couple of people) who demand I come in and make their computer run faster or reconnect the cable they kicked out of the wall. Oh well, I bill extra for those.
Parent
Re:security issues aside... (Score:4, Interesting)
Parent
Questioning a basic assumptions (Score:4, Insightful)
Re:Questioning a basic assumptions (Score:4, Insightful)
Face-to-face can be a big waste of time. Meetings, water cooler chat, and so on tend to be more exercises in shoulder rubbing than productivity. They may increase or decrease employees' effectiveness.
I totally agree that high-tech tools are a waste of time. Email is great when the rubber hits the road, phone calls are fine for brainstorming, and conference calls with a shared spreadsheet or ppt presentation or whatever are just fine for meetings.
The real issue with telecommuting is the tendency -- perceived or real -- to goof off. So I guess if you're running a sweatshop, it is bad; if you're running an operation with employees who are mature and motivated to see the operation succeed, telecommuting can be good.
Parent
Telecommuting is a cornerstone of geek culture... (Score:5, Funny)
Oh yeah, the VA loss was just an accident... (Score:4, Insightful)
Re:Oh yeah, the VA loss was just an accident... (Score:5, Informative)
Insightful, eh? How about "uninformed".
From MSNBC [msn.com]: So no, this wasn't just "dumb luck". It was an accident waiting to happen.
Parent
Giving up on telecommuting (Score:5, Interesting)
People are resistant on working in ways to accomodate telelcommuting. People will wait for me to visit the office..even if thats many weeks - rather than pick up the phone.
I also find that when people want to play politics - you are at a severe disadvantage when telecomuting.
Every time management changes you have to reconvince them its viable and I have decided over all that
Thats despite the fact that I work in an IT department for a large vibrant and successful company that prides itself on its forward thinking.
So after 5 years - Im giving up - not for technical reasons.. which I have been able to manage one way or another - but because the culture - even in IT is just not accepting of telecommuters and in fact disdvantages them.
Not an excuse to take private customer info home (Score:4, Insightful)
Telecommuting is not a slam dunk (Score:4, Insightful)
"Telework" is entirely implicated in the VA case (Score:5, Insightful)
Telecommuting has drawbacks. The number one issue is that the home is not usually a good environment for work. This includes issues of safety and data security. Operations are at risk if you do not take sufficient precautions.
One interesting solution to this is thin client computing. I've experimented with Sun Ray thin clients [sun.com] that connect over a broadband connection back to a server. No data is stored on the thin client. All it really transmits is pixels and keyboard and mouse clicks (encrypted, too). That's the right way to approach this. Never store data away from the people paid to protect it (then make sure those people do a good job).
Think of the rainforest (Score:5, Interesting)
This is not about telecommuting (Score:4, Insightful)
It's about walking around, in any circumstance, with megs of sensitive information on a portable device that isn't encrypted. Whether it's a desktop, laptop, USB device, external hard drive, PDA, cell phone or iPod. It's really about non-existent data security policies, data security audits of vendors handling sensitive customer and employee data and, above all, it's about no accountability in government or private industry for mishandling sensitive information.
When companies are liable for millions in damages for lost privacy act data, you'll see change bordering on a religious revival. Until then, it's just the masses whining.
Use the BUILT IN stuff in your laptop (Score:4, Informative)
What I don't understand is why people are not the built in features of laptops - ANY NEWER Laptops have a Power on password. Many newer ones even have HARD DRIVE passwords (so you can't swap out the drive to use it on another PC). Some even are coming with THUMB readers. Prevent thiefs - ALL laptops have docking stations or cable slots where it can be LOCKED down. If not locked down and not in use then put it in to a LOCKED cabinet. Also to NOT have it in the open cab of car (put it in the trunk - for the smash grab and dash thiefs) - also not good if it hits you in the back of the head in an accident..... Use a BREIFCASE or BACKPACK or CARYBAG that does not scream "I GOT A LAPTOP FOR YOU TO STEAL!" (these are all actual policies where I work).
Also you can secure your Email by always accessed it via VPN and by using IMAP based or HTTPS web based (and/or require RSA token access). Any Local "copy" in the email client is encrypted (We use PGP? or such). I don't telecommute - but I personally only use IMAP (when at work) or WEB BASED email clients (ie: Squirrelmail and such) for the last 12+ years. No chance if SOMEONE steals my PC and tries to look at my MAIL - I don't even have a PC based mail client (no spam bot using POP3 on MY email account - unless they use there own client-but then I have that port BLOCKED on my personal firewall). In 12 years I have not got infected by even ONE virus by email (I get a "hit" every couple of weeks with one - but getting fewer)...My ex-wife however insist on using a pop3 client and has gotten infected many times.
Also setup most business applications such they can be used via VPN and a local client or has a web based interface and/or Citrix/Termial Services or VMWare or such. Also provide Backup space on their servers for your "EXCEL" and "WORD" type of documents. A hot sync Software tool make this easy.
One big thing is adopting a software policy - ONLY install APPROVED software on any BUSINESS PC - no personal software or "free downloads" or demos. As well only approved "accessories" may be attached/used (ie: Thumb Drives and External drives etc). And by approved - I mean not by some "know nothing" boss or supervisor - but approved by IT and/or management who is in touch with what is acceptable and is safe to use. After all this is not your personal PC but own by your employer's. (like the "scattered" or "found" USB drives that was used at one BANK location - most was picked and pluged into the BANKS PCs by there own employees.)
Where I work they also PUSH all virus/spam/firewall and security fixes so your always up to date. They also adopted a PASSWORD policy where you have to change password often and not duplicated etc....
With a GOOD policy and ENFORCING it to protect everyone's butt and with a bit of free software and/or a bit of spending of money/time - a Stolen Laptop could means little to NOTHING in impacting a business - with the biggest being the replacement cost of the laptop and going though and wiping out and resetting any and all of the user's passwords (in case people "keep" a list of passwords on the PC or use "auto complete" or other password reminder tools....) and yes I now there is secure "password" tools out there that would be hard to defeat - at lease before they able to crack/hack it to it - you should have all you password reset.
A stolen laptop that causes problems for a business - they had set them selves up for failure to begin with - however the one of the WEEKEST parts is the employee them selves. It costs very little to make a POLICY, and to make minor changes in how people use there PC. Just remember to enforce it (MANUALLY spot checking if you have to - even "leak" out a rumor that it will happen before you do - I can just hear the hard drives going crazy when that gets around....), if you don't - a policy on paper means zilch (nothing) if people are not following it.
The problem is often bad telecommuters. (Score:4, Insightful)
I've had several jobs now where telecommuting wasn't allowed at all, by company policy.
Every once in a while I would have an "emergency," like a repair on the house, or a delivery of furniture, or whatever, and I would tell my boss that I would have to be at home, but that I would still be working. One time it was a Unix admin position, so it could be done from anywhere, especially since many of the servers were colocated or managed. Another time it was doing technical support for java deveopment teams for a major Swiss bank.
So you tell your boss that you can't be in the office anyway, so you'll do some work from home. Then, while you're home, kick ass. Get tons of stuff done. Most people in an office kick back and do the minimum amount of required work, so it isn't hard to show how productive you can be when working from home. Do it off and on, maybe when you're sick, maybe when you have a child emergency, whatever, but if you can come up with a legitimate excuse to be home, take it, and work your ass off.
A lot of times your manager will see that you're a very productive worker, and through some simple tactics you can work out a situation where you can increasingly avoid having to commute. I had an hour and a half train commute each way to the swiss bank gig, so it was worth doing some extra work to be able to sleep an extra hour and a half on occasion, and even if I worked an extra half hour at night, I was still done with work and home an hour earlier.