Slashdot Log In
One-Third of Employees Violate Company IT Policies
Posted by
Zonk
on Wed Oct 31, 2007 03:39 PM
from the yeah-but-they-were-all-bad dept.
from the yeah-but-they-were-all-bad dept.
BaCa writes with a link indicating that a survey of white collar US workers shows that something like a third of all employees break IT policies. Of those, almost a sixth actually used P2P technologies from their work PCs. Overall, the survey indicates workers aren't overly concerned about any kind of security: "The telephone survey found that 65% of white-collar professionals are either not very concerned or not concerned at all about their privacy when using a workplace computer. A surprising 63% are not very concerned or are not concerned at all about the security of their information while at work. Additionally, most employees have the misconception that these behaviors pose little to no risk to their companies."
Related Stories
Submission: One-third of employees violate company IT policies by Anonymous Coward
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
I don't believe it (Score:5, Insightful)
The rest just didn't let on - because there is no way the number is that low. Or they didn't outright lie, they just didn't even know they had violated company policies.
Re:I don't believe it (Score:5, Funny)
I don't know how many times a conversation went like this:
Me: Whats your user name?
User: Its u2343 and my password is "bobspassword"!
Me: Wait! ARRRRRGH! Don't tell me that! I'm not supposed to know your password, I just wanted your user name!
Parent
Re: (Score:3, Funny)
Me: Wait! ARRRRRGH! Don't tell me that! I'm not supposed to know your password, I just wanted your user name!
Me: Sigh. Please change your password. Please don't share your password with anyone, including IT staff.
User: Ok, now I changed it to 'bobspassword2'.
Me: ARRRRG!
Re:I don't believe it - bofh handbook reply (Score:3, Funny)
User: Ok, now I changed it to 'bobspassword2'.
Me: Sorry, we can't both know your password, so I changed it.
User: To what?
Me: If I told you, then we'd both know it wouldn't we? yuk yuk yuk
User: [grumbling] Okay, I'll change it, but I won't tell you this time.
Me: Okay, it's temporary though, and will force you to change it when you log in, ready?
User: *sigh* ready.
Me: [mumble: random, okay] a;@#aslkdfQQQ$@$#%faWerrr@!!a;lskd1.
Nobody, but nobody leaves their password as the one I give them. Few tell me twice.
Re: (Score:3, Insightful)
Re:I don't believe it (Score:5, Insightful)
Parent
Re:I don't believe it (Score:5, Insightful)
Silly to think of things that trivial can count, but there are reasonable reasons for them. The problem is that they are all general and not focused on if the person intended to violate them. I would not be surprised if one third of people knowingly violated their company policy.
Parent
Re:I don't believe it (Score:5, Funny)
Parent
Re: (Score:2, Insightful)
Re:I don't believe it (Score:4, Interesting)
I often need third-party libraries when I'm developing my software so I just get them off the Internet (sometimes virus checking them if I remember). If I followed the rules to the letter, I wouldn't download the libraries. But I don't follow them, so by using this software that nobody is "approving" I'm breaking the rules.
But when did our security manager review the source code for Windows XP to make sure it's OK?
Parent
Re: (Score:3, Insightful)
-- From the late Rear Admiral Grace L. Hopper, founder of commercial computing and lead developer of the original COmmon Business-Oriented Language compiler.
Sometimes you have to lead.
Re: (Score:3, Funny)
Re: (Score:3, Insightful)
That's because you are, as you say, mere mortals ;)
And this is why I said you're a mere mortal. As a sysadmin it is i
Re:I don't believe it (Score:5, Insightful)
In this case, virus checking is the least of your worries. If you're including those third-party libraries in your software, you need to be getting them approved by your legal department to make sure you're not creating huge copyright violations.
Parent
Re: (Score:3, Funny)
Re:I don't believe it (Score:4, Insightful)
Parent
really? (Score:2)
Only one third? (Score:2)
Perhaps you've got it backwards and only 1/3 don't violate IT policies. And even that sounds light.
of course (Score:2, Insightful)
Seriously though, for most people, unless they know there's a risk of being fired if they don't comply, chances are that they're not going to care about corporate IT policies. Most companies don't actual police them, so what benefit do they have in following them?
While people should be responsible enough to do what their job requires, it falls back on the corporate IT folks to make sure their policies are enforced.
Re:of course (Score:4, Insightful)
Parent
Lol (Score:5, Funny)
In other news, one sixth of one third of all IT admins are stupid enough to not block P2P traffic on their networks.
Re:Lol (Score:5, Funny)
Parent
Re:Lol (Score:5, Interesting)
It's quite hard to block p2p traffic explicitly while leaving other protocols open. P2P traffic moves in a number of arbitrary ports and uses a lot of protocols. New protocols are coming and going regularly. L7 packet filtering helps with the common protocols but if they are also using encryption you've got bugger all chance of blocking them totally.
I was playing cat and mouse for a while. Block Kazaa and they move to Emule. Block that and they move to torrent. Block that and they start using gnutella. The game goes on and on.
The only way I've found to reliably block all p2p and other things without major hassles in the firewall is to block everything, install a proxy server for HTTP, HTTPS and FTP and then only punch out ports from trusted machines and with good valid reasons from people (and a paper trail for those reasons). eg, the PBX can talk to our upstream SIP provider, the mail server can speak port 25 to the outside world but nobody else can and my desktop PC has rsync access to our ISPs file mirror.
I have procedures in place to get things like torrents because they occasionally have legitimate uses. I have one machine that only I have a user account on. If someone thinks a torrent is useful and related to work they can ask me to get that torrent for them. It keeps them from running clients on their own PCs and still allows them to get files if needed. Half the time they just want torrents of files like Linux distros that are available on our ISP's mirror at no data charge to us.
With all that security comes problems. The boss wants to violate his own Internet policy (bittorrent for movies and all that) and the new firewall stops him from doing it. He has a personal email account he insists on checking with pop3 but can't now because that's blocked. There are no end of complaints about how all these violating things that used to be possible now aren't. For many admins there is a lot of pressure from management to not block things because the managers want to have a free run. Not every IT person is gutsy enough to stand up and say "no fucking way".
Parent
Re:Lol (Score:4, Insightful)
Not every IT person should. IT is a service industry. They need to make sure they are providing the service that is actually desired.
Downloading torrents is a pig on bandwidth, but unless bandwidth is cramped. So what?
Downloading from external email accounts may carry greater virus risks, but they are going to pick up the messages when they get the laptop home anyway, so the machine comes in infected tomorrow instead of this afternoon. Or they'll pick it up through some webmail account somewhere that you haven't blocked. Or they'll hook up their laptop to their cellphone/pda.
Some IT departments should say "no fucking way". But in a lot of them IT is supposed to simply be providing a secure reliable functional network. That doesn't necessarily mean locking it it down so hard that its reliability reaches 5 9s, and its so secure even the users can't get in half the time, while functionality is at the bare minimum specified in an SLA, while IT pats itself on the back for a job well done.
Meanwhile half the staff have resorted to personal laptops/pdas and cellular data plans because they can't get email from important customers through the company mail server, and they can't access web content they need through the company network without jumping through stupid hoops each and every time... and IT just stands around saying "no fucking way".
For every PHB manager drawing up pointless re-org charts and misusing buzzwords, and marketing moron promsing perpetual motion machines and obsessing over what color they should be, there is an IT-admin somewhere very effectively ensuring his network is as hostile, unfriendly, and as unusable as possible to the people trying to use it.
Like I said, Some IT departments should say "no fucking way". Some environments and situations DO demand that. But many of them say that a hell of a lot more often than is remotely justifiable.
Parent
What they don't say (Score:5, Interesting)
Re: (Score:2, Insightful)
Re:What they don't say (Score:5, Insightful)
Parent
Re:What they don't say (Score:4, Insightful)
Parent
The reason for IT policies (Score:3, Interesting)
For example the last place I worked at, the official line was "no personal use" but it was deemed OK to download a few mp3s or a Fedora ISO image here and there, thansfer your photos to flickr etc, but they stomped down hard on the guy who used approx 1/3 of the network bandwidth to download DVDs for his home viewing (and to give t
Re: (Score:3, Informative)
Even worse is that once you break one of the unreasonable policies (no admin logon on a developer machine, say), it's hard to keep any respect for the more reasonable ones. A bit of trust and leniency would go a long way toward respect. You could for example tell employees that they should avoid spending a lot of bandwidth during peak hours, and give people plenty warning if they're hogging all the gas.
Oh, and help them out a little by hinting about things like KeePass [keepass.info] for passwords, TrueCrypt [truecrypt.org] for sensitiv
Developers... (Score:3, Interesting)
When Policies are set by PHB's and you need to by. (Score:2)
Re:When Policies are set by PHB's and you need to (Score:3, Informative)
Re:When Policies are set by PHB's and you need to (Score:5, Funny)
And is that the phrase for the for the dental plan password, the diversity training registration password, or the office supply purchasing password? Or an older phrase for one of them, as each one needs to be changed (out of sync!) 6 times a year.
Parent
Unreasonable Policies (Score:5, Insightful)
Re: (Score:3, Interesting)
Virus's successfully deployed to my desktop over the last 5 years: 3 (apparently from laptops plugged into the network without being scanned). The PDF's would have deployed if I had been not been suspicous of getting a PDF from a stranger.
Virus's through hotmail in the last 7 years: 0
Virus's through gmail in the last 2 years: 0
Virus's through through Yahoo in the last 3 years: 0
---
Documents that were not documents BLOCKED by c
And then there is 1/3 ordered to violate.. (Score:5, Interesting)
I think it's more like... (Score:2)
It's a cat and mouse game with IT (Score:5, Insightful)
Traffic filters=>TOR
etc. etc.
But the real problems are still caused by moron employees who double click on an attachment they got via email. Just happened again last week. The problem isn't people who don't adhere to policies, it's employees who don't have a clue.
And what's wrong with reading Slashdot while you're slacking off with a coffee for a couple of minutes? I'd consider an employer a slave driver if they have a problem with that.
So much not said (Score:2)
Hell, most companies aren't concerned... (Score:3, Interesting)
Where I work... (Score:5, Interesting)
Browse whenever you want, take whatever software you want home, check your email if you want, everyone's their own local admin, no audits.
However, if you get caught with illegal software, miss a deadline because of blatant time-wasting, then you get fired (for continuous abuse). People work not because of policy, but because they want to do well and enjoy what they're doing.
I happen to also work in one of the biggest names in IT too....not some small company. The policy works very well, as is evident from the company's success and the fact people rarely leave. That and brain-implants, anyhow.
So, (Score:4, Interesting)
Whenever rules are broken, something of the two is off.
Remedies are not always adequate and can lead to more trouble.
policy? (Score:5, Funny)
Less legal mumbo-jumbo in employee agreements (Score:3, Insightful)
I'll make clear that I wouldn't let this go today.
My point in all this is, some people starting at the company may be aware of activities the admins themselves or other staff are performing which management may not be. My first job was relatively simple and well paid, I have had no beefs with the company. But our Acceptable-use policy book was some 20-30 pages long. This was about 10 years ago. I would rather have had a 1 page document, sign at bottom: I will not download virsues or warez, share company information or NDAs to outsiders, etc on company time. If I know another employee is doing so, please report anonymously to. Violators will be disciplined or fired.
Really, does it really need to be any longer than this or more complicated? It simplifies reporting and makes the issue and repercussions clear. Get the 20 page document too if you must. But the one-pager should be clear to *all* employees regardless of law degree. But help make it clear too, that if you mistype a domain and get a porn site, you shouldn't have to hide it and feel like someone is about to can you (e.g. whitehouse.com vs whitehouse.gov).
Let people browse! (Score:4, Insightful)
Simple Solution (Score:3, Interesting)
The company imposed some really screwed up policies on desktop configuration but they had a liberal telecommuting policy. So everyone did their serious work at home. They shoved their (IT mandated) Windows systems aside, used Linux and other FOSS applications, surfed the web, downloaded tunes, played WoW or whatever. As long as they got their work done, management was happy.
Strangely enough, the company was also heavily into a process standardization kick. I don;t think they ever confronted the fact that the work that was getting done could never have been accomplished with the 'IT Standard' tool suite. Too bad. A more open policy at work would allow them to capture best practices.
Re:most employees... (Score:5, Interesting)
I run the network for my mother's company for free, so I'm allowed whatever liberties I'd like in deciding policy instead of having it dictated by a boss. They've got over 20 machines, and they aren't formally assigned, so if one goes down it's not the end of the world, the employee can use one at another desk for awhile. Usually they use the same one every day though.
The experiment was this:
Four new employees. Four new Windows XP Professional PCs. All use Firefox for a browser and Thunderbird for e-mail, along with the proprietary manufacturing/sales app that they run their business with. Two machines got Symantec anti-virus, and the other two got no anti-virus. They were told that since we don't have a copy for that machine, they'll just have to be extra careful about what documents they open, and how they use their e-mail. (We really were out of licenses/subscriptions, which is how this started)
After three months, both of the AV-free PCs were completely fine, and one of the machines that had the anti-virus was running a botnet spammer (the outgoing spam was being blocked by the firewall). The most amazing bit though, was that the fear of not having anti-virus protection had stopped users of those two machines from doing most of the non-viral bad stuff that average windows users do. There was no proliferation of toolbars, no weatherbug.... They didn't even have realPlayer.
It's amazing what a false sense of security people get from running anti-virus software. They don't even realize that they still have to be careful because 0-day threats aren't in the latest virus definitions yet. They think they can do whatever they want, because they are protected.
The whole company has since gone anti-virus free on the desktop, and problem reports and performance complaints have dropped way down. Education and a healthy dose of respect for the evils of the world work better than any anti-virus on the market. And the cost savings are nice too.
(There is still some basic protection in place. All internet access is through a secured web proxy. Non-http traffic isn't allowed. Intrusion detection on the firewall, etc... And the servers are still scanned, AVG on the windows servers, chkrootkit on the linux servers.)
Parent
Re:most employees... (Score:5, Insightful)
You think virus protection protects your net work? You missed the entire point. Then you followed it up with a broken car analogy.
Perhaps you should try understanding what you do for a living instead of doing whatever some book and a whole bunch of marketing literature told you to do.
I check in on my machines and make sure they are working. I protect my networks, and make sure that if they *do* get infected they're not going to infect *your* network.
Judging by your comment, on the other hand, you merely install security-blanket style security software on your systems and think that makes you "responsible".
Users have no remorse because they are given zero responsibility. Why should they care if they fuck up your machines? You secured them. They're protected. They're both "safe" because of the protections, and completely disallowed from making any responsible decisions about their own machines, so they take zero responsibility.
You, sir, are the cause of your own user-troubles.
Parent
Re: (Score:3, Informative)
There are countless examples available, but lets just focus on one you provided: your 'unapproved' email client.
*YOU* are in the wrong. This is true if *YOU* are not paying for the hardware. This is true if you do not pay the support staff. It is not up to an employee to dictate what services a companies IT department will support -- that's up to management (hopefully with IT