One-Third of Employees Violate Company IT Policies 320
BaCa writes with a link indicating that a survey of white collar US workers shows that something like a third of all employees break IT policies. Of those, almost a sixth actually used P2P technologies from their work PCs. Overall, the survey indicates workers aren't overly concerned about any kind of security: "The telephone survey found that 65% of white-collar professionals are either not very concerned or not concerned at all about their privacy when using a workplace computer. A surprising 63% are not very concerned or are not concerned at all about the security of their information while at work. Additionally, most employees have the misconception that these behaviors pose little to no risk to their companies."
What they don't say (Score:5, Interesting)
And then there is 1/3 ordered to violate.. (Score:5, Interesting)
Re:Unreasonable Policies (Score:3, Interesting)
Virus's successfully deployed to my desktop over the last 5 years: 3 (apparently from laptops plugged into the network without being scanned). The PDF's would have deployed if I had been not been suspicous of getting a PDF from a stranger.
Virus's through hotmail in the last 7 years: 0
Virus's through gmail in the last 2 years: 0
Virus's through through Yahoo in the last 3 years: 0
---
Documents that were not documents BLOCKED by corporate virus scanners: At least a dozen.
Re:I don't believe it (Score:4, Interesting)
I often need third-party libraries when I'm developing my software so I just get them off the Internet (sometimes virus checking them if I remember). If I followed the rules to the letter, I wouldn't download the libraries. But I don't follow them, so by using this software that nobody is "approving" I'm breaking the rules.
But when did our security manager review the source code for Windows XP to make sure it's OK?
Hell, most companies aren't concerned... (Score:3, Interesting)
Where I work... (Score:5, Interesting)
Browse whenever you want, take whatever software you want home, check your email if you want, everyone's their own local admin, no audits.
However, if you get caught with illegal software, miss a deadline because of blatant time-wasting, then you get fired (for continuous abuse). People work not because of policy, but because they want to do well and enjoy what they're doing.
I happen to also work in one of the biggest names in IT too....not some small company. The policy works very well, as is evident from the company's success and the fact people rarely leave. That and brain-implants, anyhow.
So, (Score:4, Interesting)
Whenever rules are broken, something of the two is off.
Remedies are not always adequate and can lead to more trouble.
Re:most employees... (Score:5, Interesting)
I run the network for my mother's company for free, so I'm allowed whatever liberties I'd like in deciding policy instead of having it dictated by a boss. They've got over 20 machines, and they aren't formally assigned, so if one goes down it's not the end of the world, the employee can use one at another desk for awhile. Usually they use the same one every day though.
The experiment was this:
Four new employees. Four new Windows XP Professional PCs. All use Firefox for a browser and Thunderbird for e-mail, along with the proprietary manufacturing/sales app that they run their business with. Two machines got Symantec anti-virus, and the other two got no anti-virus. They were told that since we don't have a copy for that machine, they'll just have to be extra careful about what documents they open, and how they use their e-mail. (We really were out of licenses/subscriptions, which is how this started)
After three months, both of the AV-free PCs were completely fine, and one of the machines that had the anti-virus was running a botnet spammer (the outgoing spam was being blocked by the firewall). The most amazing bit though, was that the fear of not having anti-virus protection had stopped users of those two machines from doing most of the non-viral bad stuff that average windows users do. There was no proliferation of toolbars, no weatherbug.... They didn't even have realPlayer.
It's amazing what a false sense of security people get from running anti-virus software. They don't even realize that they still have to be careful because 0-day threats aren't in the latest virus definitions yet. They think they can do whatever they want, because they are protected.
The whole company has since gone anti-virus free on the desktop, and problem reports and performance complaints have dropped way down. Education and a healthy dose of respect for the evils of the world work better than any anti-virus on the market. And the cost savings are nice too.
(There is still some basic protection in place. All internet access is through a secured web proxy. Non-http traffic isn't allowed. Intrusion detection on the firewall, etc... And the servers are still scanned, AVG on the windows servers, chkrootkit on the linux servers.)
The reason for IT policies (Score:3, Interesting)
For example the last place I worked at, the official line was "no personal use" but it was deemed OK to download a few mp3s or a Fedora ISO image here and there, thansfer your photos to flickr etc, but they stomped down hard on the guy who used approx 1/3 of the network bandwidth to download DVDs for his home viewing (and to give to his buddies etc). Printing a few tens of pages here and there for personal use was OK, but they stomped the the person who did a 5000 page print run for their club newsletter.
It comes down to "reasonable force".
Developers... (Score:3, Interesting)
Re:Lol (Score:5, Interesting)
It's quite hard to block p2p traffic explicitly while leaving other protocols open. P2P traffic moves in a number of arbitrary ports and uses a lot of protocols. New protocols are coming and going regularly. L7 packet filtering helps with the common protocols but if they are also using encryption you've got bugger all chance of blocking them totally.
I was playing cat and mouse for a while. Block Kazaa and they move to Emule. Block that and they move to torrent. Block that and they start using gnutella. The game goes on and on.
The only way I've found to reliably block all p2p and other things without major hassles in the firewall is to block everything, install a proxy server for HTTP, HTTPS and FTP and then only punch out ports from trusted machines and with good valid reasons from people (and a paper trail for those reasons). eg, the PBX can talk to our upstream SIP provider, the mail server can speak port 25 to the outside world but nobody else can and my desktop PC has rsync access to our ISPs file mirror.
I have procedures in place to get things like torrents because they occasionally have legitimate uses. I have one machine that only I have a user account on. If someone thinks a torrent is useful and related to work they can ask me to get that torrent for them. It keeps them from running clients on their own PCs and still allows them to get files if needed. Half the time they just want torrents of files like Linux distros that are available on our ISP's mirror at no data charge to us.
With all that security comes problems. The boss wants to violate his own Internet policy (bittorrent for movies and all that) and the new firewall stops him from doing it. He has a personal email account he insists on checking with pop3 but can't now because that's blocked. There are no end of complaints about how all these violating things that used to be possible now aren't. For many admins there is a lot of pressure from management to not block things because the managers want to have a free run. Not every IT person is gutsy enough to stand up and say "no fucking way".
Simple Solution (Score:3, Interesting)
The company imposed some really screwed up policies on desktop configuration but they had a liberal telecommuting policy. So everyone did their serious work at home. They shoved their (IT mandated) Windows systems aside, used Linux and other FOSS applications, surfed the web, downloaded tunes, played WoW or whatever. As long as they got their work done, management was happy.
Strangely enough, the company was also heavily into a process standardization kick. I don;t think they ever confronted the fact that the work that was getting done could never have been accomplished with the 'IT Standard' tool suite. Too bad. A more open policy at work would allow them to capture best practices.