Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Security IT

IT Departments Are A Security Risk 282

Posted by Zonk from the just-let-rome-burn-already dept.
stlhawkeye writes "An article at Information Week asks the question - is your IT department a security risk? The thesis of the article is that rank-and-file employees will tend to engage in dangerous/insecure/irresponsible computing and internet behavior if they know that there's an IT department to clean up the mess. 'That confidence,' says the article,'leads workers to do risky, even stupid, things at work, such as opening questionable e-mail messages or clicking on unknown Web site links.' Employee education and training doesn't help, either: '[S]ome workers slough off responsibility for even knowing about threats. Workers in larger companies don't worry about being educated. Big company employees just don't see security as their responsibility.'"
This discussion has been archived. No new comments can be posted.

IT Departments Are A Security Risk More

IT Departments Are A Security Risk

Comments Filter:

  • Different Interpretation (Score:4, Interesting)

    by fembots ( 753724 ) on Thursday September 15, 2005 @04:50PM (#13570698) Homepage
    I read the summary as if IT Department itself is a security risk, because they have the highest level of access to everything on the network, and one wee mistake, such as failure to lock an unattended admin pc, inappropriate disposal of a backup tape, a misconfigured spam filter and whatnot can easily knock out the company for at least a few hours or cause great harms.

    Having said that, it's also true that computer users protected by a competent IT Department do get spoiled and when they're out with a laptop, they can easily be infected on a dial-up. It's like kids with over-protective parents will likely to get hurt/scammed/killed more easily when they're alone.

    This naturally leads to the most important discussion in the article, i.e. user education. And I believe in order to really get the message through, IT Department needs to have some sort of security drill (like fire drill, annoying but everybody gets the idea after several attempts).

    For example, if a user clicked on an obvious suspicious link (spoofed by yours truly IT Department of course), his computer will be taken away for "maintenance" for a week, and he'll be assigned to another area of the office with a crappy machine. This way, not only does he suffer from his action, others will know why he is working at the "Concentration Cubicle".
    • Good punishment idea, but I'm not sure it'll catch on... What company would go for the idea of willfully lowering productivity?

      • Re:Different Interpretation (Score:5, Insightful)

        by BVis ( 267028 ) on Thursday September 15, 2005 @08:29PM (#13572290)
        What company would go for the idea of willfully lowering productivity?
        What company would stand for allowing their employees to waste company time and resources on Weatherbug and porn and warez?

        Yes, it would negatively impact productivity in the short term, but in the long term, one of two things would happen: Either the "repeat offenders" would change their behavior, or their productivity would be reduced to the point where they became redundant.

        Of course, this is in the fantasy world where IT workers are actually allowed to do their jobs (keeping the computers running smoothly and enhancing profitability for the company by improving efficiency), and where anyone in management can see beyond this quarter.

    • Wallet Inspector (Score:3, Funny)

      by Anonymous Coward
      "It's like kids with over-protective parents will likely to get hurt/scammed/killed more easily when they're alone."

      Homer: Guys, believe me, I didn't mean to get you expelled.
      Nerd 3: Oh, don't worry, Mr. Simpson, we can take care of ourselves.
      Snake appears, holding out his hand]
      Snake: Uh, wallet inspector.
      Nerd 1: Oh, here ya go. [All three give him their wallets] I believe
      that's all in order.
      Snake: Huh ho! I can't _believe_ that worked.
      Homer: [realization dawning] Heyy...that's not the wallet inspector!

      ht [snpp.com]

    • Re:Different Interpretation (Score:5, Insightful)

      by wwest4 ( 183559 ) on Thursday September 15, 2005 @05:11PM (#13570868)
      > I read the summary as if IT Department itself is a security risk

      Your instincts are right. The article underrepresents this idea. An unchecked IT staff is the single greatest security risk a company typically has. Admins who don't check backups, who are not beholden to SLAs, who see themselves as excepted from policy, who are not externally required to maintain security, or who make cavalier changes are much worse than all but the most malevolent/careless users.

      User education is a good idea, but it's still largely up to IT. That's our job, because we are in the best position to do it. If we don't at the very least prominently publish a policy and make it accessible (to a reasonable degree), we can't very well expect the user to intuit and follow it.

      The whole concentration cubicle/punitive response idea is just stupid (it's unethical and it wouldn't work), but your other points are good.
    • I, too, had a different thought about the content of this article when I read the title. My supervisor and myself just had a discussion about the failings of large and cumbersome IT deparments. As with most large and cumbersome organizations, they tend to perpetuate problems to maximize IT department resource requirements. For instance, when one of our internal applications gains a new feature, but consequently develops about 15 new bugs, we have to issue a ticket for correction not for the feature that is

    • Re:Different Interpretation (Score:3, Insightful)

      by Anonymous Coward
      The IT department is a risk, the same as the accounting department, or the managers, or any other department is a risk. In order to accomplish anything, people have to have enough authority to do their job, and that authority comes with a risk. That's why you hire competant professionals and you put procedures in place. That's also why you need to enforce procedures, as much as everyone hates it. Remember the accountant that bought way too much stock?

      It gets worse, though. Try working at a company who doesn
    • I agree with the concept of "punishing" repeat offenders, but I doubt you'll get much support from department managers with your idea of issuing them a crappy machine. I would imagine you'd get more traction with department managers by informing them their employee has repeatedly subjected the company's sensitive data to risk, and should future incidents occur, this would be grounds for disciplinary action (up to and including termination). This of course depends on your company having established securi

    • Re:Different Interpretation (Score:4, Interesting)

      by techno-vampire ( 666512 ) on Thursday September 15, 2005 @06:35PM (#13571580) Homepage
      This way, not only does he suffer from his action, others will know why he is working at the "Concentration Cubicle."

      I had a diffrent idea. Each project, each department, each work group has a budget. If the costs of having IT clean up a mess that shouldn't have happened come out of that budget, people will get more carefull, fast. If they don't, then the ones causing the loss of funds will get marked down on their reviews, and possibly fired for their lack of cautiion and the problem goes away when they do.

    • For example, if a user clicked on an obvious suspicious link (spoofed by yours truly IT Department of course), his computer will be taken away for "maintenance" for a week, and he'll be assigned to another area of the office with a crappy machine. This way, not only does he suffer from his action, others will know why he is working at the "Concentration Cubicle".

      Yeah, nothing helps employee morale quite like feeling as though their in a Dilbert comic strip.

      Can you imagine having a friend come home from

    • Re:Different Interpretation (Score:5, Insightful)

      by NDPTAL85 ( 260093 ) on Thursday September 15, 2005 @07:29PM (#13571947)
      Wow. With your comment you sum up the real problem with IT depts. You assume you are even on the same level of importance with those you serve, let alone superior.

      You are not there to "grant" the privledge of computing. You are there to "support" it. The people who do the actual work of the company are the ones who bring the money in. So if they want to open risky attachments, then fine. Harden your network to brace for that and be done with the issue.
      • While you're going to get modslapped for that as I have in the past, I'm putting my karma on the line to say I agree with you, and until most SysAdmins get this into their skull, IT folk will continue to be snubbed.

        At the moment I work at a fisheries in the country. I'm the only SA within 50 miles of here. I can't afford to be stuck up like I used to be, because I'd be the only one here that thinks I'm more important. I understand I'm not, and it makes people much easier to get along with.

      • Re:Different Interpretation (Score:5, Interesting)

        by Pharmboy ( 216950 ) on Thursday September 15, 2005 @08:16PM (#13572217) Journal
        Personally, I think you have to have a little more respect for the IT dept. that to just say they are there to "support" IT.

        They are there to support IT as it applies to work, but not to remove spyware and viruses because employees visit porn or other inappropriate sites. Over 90% of the problems we have with computers is related to activities that are within acceptable policies, such as roaming around on the wrong kinds of sites. One of the problems is that employees see their computer as "their computer", and not a tool for their use, but owned by the company.

        A perfect example: I get many complaints from employees that they do not have speakers on their computers. There is NO task we do that requires sound. The only possible use they could have for speakers is unauthorized uses of the computers.

        I do everything I can to ignore other uses as long as it does not cause problems. Go ahead, read news, research stocks, as long as you are smart enough to avoid problem sites. Getting 1000 spam mails a day? Likely using company email for personal reasons, and I shouldn't have to support that.

        Actions that have no consequences are often repeated. The only cure is accountability for employees who use their computers for non-business related activity.

      • Re:Different Interpretation (Score:5, Informative)

        by QuestorTapes ( 663783 ) on Thursday September 15, 2005 @08:26PM (#13572268)
        > You are not there to "grant" the privledge of computing. You are there to "support" it.

        Good point, although you stated it more bluntly than I would have.

        > The people who do the actual work of the company are the ones who bring the money in.

        True, although sometimes this is the IT staff.

        > So if they want to open risky attachments, then fine. Harden your network to brace for that and be done with the issue.

        The management at most firms I know would not agree with this. It's not enough to harden the network. Users who open risky attachments can lose data from their local drives which is difficult or impossible to replace. Even if the network prevents infection, a great deal of damage can still be done.

        I feel that IT support and IT security decision making need to be separate functions. Support people are not the right ones to restrict the actions of the staff, but sometimes it is necessary to do so. And sometimes the people who need to be restricted are the IT support staff.
      • In supporting computing, you have to make sure the computing environment is going to work for a company. This means the IT department DOES need to implement some kind of control - allowing everyone to download and install anything they like is NOT supporting computing, it'll end up destroying productivity (through the machines getting pwned). To effectively support business computing needs, you also have to inject some realism into the sometimes bizarre requests of staff. Yes - you *must* accomodate them in

  • High school janitors (Score:3, Insightful)

    by uits ( 792760 ) on Thursday September 15, 2005 @04:53PM (#13570724)
    This is the same reasoning we used to use in high school when we'd drop our wrappers on the floor, spill soda and walk away...they get paid to clean it up, we're doing them a FAVOR by ensuring their job security.

    • Re:High school janitors (Score:4, Interesting)

      by E8086 ( 698978 ) on Thursday September 15, 2005 @06:24PM (#13571508)
      yes, that makes PERFECT sense
      No, it's not ensuring their job security. The interaction with the end users/students is the least important part of their job. I don't know what else high school janitors have to do, maybe disinfect every classroom and fix broken things, there are probably enough routine daily tasks that ensure them keeping their job, no it doesn't include the occasional spilled soda and dropped candy bar. IT staff has to deal with maintaining everything the end users/common office minions doesn't even know exists. I'm sure your IT staff wouldn't like it when the testing of the latest piece of major software or windows patches or new thing that might make the standard drive image crash has to be put off because some fool of an intern in marketing got some virus and/or spyware while goofing off playing some flash game instead of doing whatever marketing does and they loose a day cleaning up after them. Don't confuse network operations(IT) with a HelpDesk or damage control. Even then their main reason for being there is to be experts on and help with the company's mission critical applications, not virus/spyware removal. What happens when someone finds a way to setup a rouge WAP? Depending on the size of the company it might take a while to find and that's possible to happen in companies with and without IT depts.

      You could enforce a "the Internet is a privlage" policy. In most cases all your average employee needs is access to the corporate network for internal email and whatever resources they job requires and maybe a select few sites of affiliates/partners/clients which can be allowed by firewall. When a virus is traced back to someone, instead of giving them a slower machine and possibly lowering productivity cut off their Internet access, it will raise their productivity by removing the big distraction that is the Internet.
  • It was not rare in the past, that the IT guys themselves were the thread to the company.

    Quite often they served the company's bandwith for warez exchange, as we all know... ;)

  • Ah yes, (Score:3, Insightful)

    by Anonymous Coward on Thursday September 15, 2005 @04:54PM (#13570733)
    The thesis of the article is that rank-and-file employees will tend to engage in dangerous/insecure/irresponsible computing and internet behavior if they know that there's an IT department to clean up the mess.

    I see... just as the Fire Department is a fire risk, hospitals increase reckless activity, having a police force causes crime, etc.

    How brilliant the author of this article must be to draw such an unusual conclusion!

    • Re:Ah yes, (Score:3, Funny)

      by ndansmith ( 582590 )
      I see... just as the Fire Department is a fire risk . . .

      Of course it is. What do you think firemen are supposed to do? Put out fires? It's pointless now that every house is fireproofed!

      </Fahrenheit 451>
    • I don't think the article is trying to show that a company with an IT department has worse security than a company without one (though the /. article seems to interpret it that way). I think that, in the same sense, you're right about hospitals, police, etc. Think how much more careful you would be about locking up your house if there was nobody to report robberies to, or how much less likely you'd be to take up bungee jumping knowing there isn't a hospital to fix you up.

    • I see... just as the Fire Department is a fire risk, hospitals increase reckless activity, having a police force causes crime, etc.

      There's a flaw in your analogy. The fire department is there to save my ass when my own property is threatened. The police are there to deal with threats to my stuff or my person.

      When I'm at work on the company's equipment, and the company is paying an entire IT department to maintain that equipment, do I give a shit about it? No, that's their JOB, and it's easily repaire

  • Solution in three easy steps: (Score:5, Funny)

    by Anonymous Crowhead ( 577505 ) on Thursday September 15, 2005 @04:55PM (#13570744)
    1. Get rid of IT department
    2. Let company infrastructure rot
    3. Rehire IT department

    Sounds like a management decision to me.
    • 1. Get rid of IT department
      2. Let company infrastructure rot
      3. Rehire IT department

      Dogbert, is that you?

    • Re:Solution in three easy steps: (Score:4, Interesting)

      by lullabud ( 679893 ) on Thursday September 15, 2005 @06:30PM (#13571552)
      That's pretty much how it works. That's how it was for me during a takeover at one of my pervious empoyers. They fired everybody except the head IT guy, at a 24 hour operation of 200 or so employees. Our systems were all getting messed up and nobody had any permissions to even defrag, scandisk or clean out temp files. We had permission to run two applications, one of which was the calculator. I nearly got fired for finding a workaround in the security in order to repair our workstations so we could get some work done. ...actually, now that I think about it, one of my workarounds involved l0pht, but that's beside the point.

  • Comment removed (Score:4, Interesting)

    by account_deleted ( 4530225 ) on Thursday September 15, 2005 @04:57PM (#13570760)
    Comment removed based on user account deletion
    • Punish the user for bad behavior, and they'll eventually stop.

      That's hard to do if the user is your supervisor, upper managment, or your customer. It's not like you can tell the Excec-VP of marketing "No! Don't do that!" and smack their hand when they are set on doing it and demand they be allowed to do what they want to do. The better solution is to give a good argument against it and then try to avoid getting blamed when their continued actions.

      Sucks to work for a company like that, but sometimes you have
    • Love to.

      Don't have the authority to refuse to help.

      Find another solution or better empower your IT team.
    • If you get punched in the face every time you drop a cigarrette butt on the ground, you're going to stop dropping them. The same principle should apply here.

      Thanks a million. I just got fired for punching a co-worker in the face for not understanding the inner workings of sendmail.
    • Punching them in the face is probably against company policy.

      Maybe zapping them with a spray bottle?

  • This wouldn't explain ... (Score:5, Insightful)

    by subsoniq ( 652203 ) on Thursday September 15, 2005 @04:58PM (#13570769)
    Why Home users get into so much trouble. I don't think it's because they feel they can ignore security due to the existance of an IT department to clean up their mess, I feel it's because they try to think of this technology like any other technology, a blackbox that you push a few buttons and turn a few dials, something that is completely harmless.

    Our company has consequences for stupid user action, up to and including employment termination, so uers are "motivated" to learn the dangers that might confront them and how to avoid them.

  • IT departments are dangerous if arrogant (Score:5, Insightful)

    by Shivetya ( 243324 ) on Thursday September 15, 2005 @04:59PM (#13570782) Homepage Journal
    I can't count how many times each DAY that I hear and/or see someone in IT doing something they would scream at a "user" for doing.

    It is plain and simple arrogance. From trash talking users to mocking auditors I see it all. Best yet is all the work done to keep users from doing something bad is amazingly and commoningly thwarted on the machines of the same IT staff.

    In charge of security administation, most likely to bend the rules too.

    Yeah there are good IT departments and I am not say where I work doesn't have a good one. Parts are very good but it isn't hard to find rules bent somewhere at any one time. If not for someone whose title begins with a "C" then its for someone in favor.

    It doesn't help when you have so many different system types that you cannot find a single auditing company capable of covering them all. Of course it doesn't help when you don't take advantage of the opportunity SOX did provide and instead keep business as usual, just documented.
    • I can't count how many times each DAY that I hear and/or see someone in IT doing something they would scream at a "user" for doing.

      You have not given us any examples, but this may well be perfectly rational behaviour. The rules for when it is an is not safe to do a particular thing can be quite complex, and it is not reasonable to expect an end user to be familiar with all of them - they have another job they need to worry about. For example, an IT department will often tell people never to open attachmen

    • I agree (Score:2, Insightful)

      by schoolisdeath ( 864649 )
      On your arrogance comment. I was on the IT side of things for around 8 years in 4 different places (including a university) where I was, or was a part of the IT department. We all did things that we would have reimaged a user's computer for. On a daily basis. With one of my co-workers at the univ., I legitimately reimaged (it had died from misuse) more times than any user. wow. Now I'm IT Audit at a big 4 firm... and I see that the IT departments I worked at were actually good. I hear a lot of the ar
    • Some of that is justifiable. You don't give a 4 year old a set of sharp scissors to cut his construction paper, you give him a set of those stamped safety scissors. But then YOU aren't going to use those safety scissors are you? Of course not.

      Here I sit, drinking a tall glass of milk, setting it down 5" from my laptop. I would never advise an 'average user' to do this, because average users are klutzes and when they dump a can of pepsi into their laptop's keyboard I'll be the one that gets to fix it, so

  • Sounds reasonable (Score:4, Insightful)

    by maromig ( 217629 ) <[maromig] [at] [yahoo.com]> on Thursday September 15, 2005 @04:59PM (#13570784)
    Any time a groups gets into the role of over-functioning for another, the other group starts to under-function. This isn't limited to IT and corporations. It would explain, among other things, why the poorest and most dependent folks in NO, were not more proactive with their own future in that disaster, instead waiting on the Government and charities to over-function for them. That choice was much more risky for them than just getting out of town earlier like many others decided to do on their own.
    • A huge percentage of the "poorest and most dependent" folks in NO *couldn't* leave. They are disabled, elderly, and rely on the minimal amount of aid offered to survive that only shows up at the beginning of every month -- that's *why* they are the "poorest and most dependent" in the first place.

      They wouldn't own (probably can't even drive) cars, so they couldn't drive themselves out, were likely too physically disabled to evacuate on foot, and the hurricane hit at a time of the month when they lacked the

  • WTF? (Score:2, Insightful)

    by dmccarty ( 152630 )
    Breaking news: Guardrails are responsible for more car crashes. People feel more confident when they see a guardrail and crash into it.

    Uh, is this article serious? Do employees throw their trash all over because there's a janitorial staff to clean it up? Does it mean that companies don't need anyone to clean up?

    I doubt it.

  • It's true, I suppose (Score:4, Funny)

    by Otter ( 3800 ) on Thursday September 15, 2005 @05:01PM (#13570792) Journal
    I'm definitely motivated to stay out of trouble in order to keep them the hell out of my computer...

  • Just wonderful... (Score:2, Funny)

    by kex ( 752312 ) *
    from TFA:
    "One in three (34 percent) of U.S. users and more than one in four of those in Germany (29 percent) and Japan (28 percent) admitted they clicked on suspicious links or opened iffy e-mail because the computer equipment wasn't theirs."

    Now I have to figure out which 4 out of the 12 guys on my mobile force need their laptop replaced with an etch-a-sketch. Time to send out some ebay spoof emails and see who responds...

  • Hot potato (Score:5, Interesting)

    by SuperBanana ( 662181 ) on Thursday September 15, 2005 @05:05PM (#13570823)
    The thesis of the article is that rank-and-file employees will tend to engage in dangerous/insecure/irresponsible computing and internet behavior if they know that there's an IT department to clean up the mess.

    After almost a decade in IT, I can tell you why there is this expectation. When it comes to fuckups, IT is usually the last guy to get the hot potato, and they're expected to save the day.

    Any time a user screws up, the IT department is EXPECTED to save the day by upper management. If they don't, it is (rarely) the fault of the employee, it's the fault of the IT department for not anticipating such a need, or not being available at a second's notice, or simply not being able to save someone else's bacon. Often times we're asked to perform miracles.

    It sounds reasonable, until you cross professions. Someone drives off the company driveway, crashes their car into a tree, car bursts into flames. Do the facilities people get in trouble for not ancticipating the employee who leaned over to pick up his cell phone off the floor while driving, and failed to install a nice big inflatable barrier along all the roads? Of course not. Yet IT departments are expected to back up everything known to man, expected to resurrect deleted+overwritten files...

    Another example- it's 4:55pm and Fedex comes at 5 to pick up a package that is going to The Big Client. The employee has procrastinated working on it, and goes to print at 4:57. There's something wrong with the printer or their system. Guess whose emergency it becomes? Guess who gets screamed at on the telephone? Guess who gets reamed by the CEO because the package didn't go out? Usually the IT department. "Why was the printer broken? Why couldn't you fix it?"....not, "Bob, why did you wait until 5 minutes before your deadline?"

    • exactly why im trying so hard to get out of IT. I've been in IT coming up on 20 years. Who wants to be the scape goat and take the blame all the time? Do the executives think I'm a toady? I realized awhile ago that I am a paid bitch and that is never going to change the way management trends are going.

      Besides now that computers are as normal as a phone they are a tool that we innovator types can use to take things to the next level. The internet has opened the door to so many new professional and the permut
    • Mod parent up!

      Somebody should collect those stories and write a book about all the absurdities that the IT has to take every day. I mean, not like the BOFH stories - true stories.

      I could write the first ten chapters.
    • why don't you develop some proactive way of making sure it's working? People expect their computing environment to be utility-grade. Failures of the environment should be about as common as power failures. Most IT environments fall far short of the utility-grade mark.
      • why don't you develop some proactive way of making sure it's working? People expect their computing environment to be utility-grade. Failures of the environment should be about as common as power failures. Most IT environments fall far short of the utility-grade mark.

        His example was about a f*cked-up printer. What do you think what happened? Toner went empty in the middle of a print. Paper jam. Do you think that this guy can prevent that?

        That is actually what he was talking about: people, who think th
        • Toner running out? Most definitely predictable (most business printers will indicate low toner before they run out).

          Paper jam? Not. And clearly defensible, especially if the rest of your IT group's shit is together.

          I've been in IT for 22 years and in large environments in most of them. Utility-grade computing is hard, but achievable. If you don't think so, you either need to find a good mentor or a new line of work.
          • I was in IT for about 14 years, not as long as you, but I've seen it all.

            Sometimes, the IT department is heavily understaffed (two persons, when there should be four or five), because of the lack of budget.

            If you're 22 years in IT, you should know exactly, what the OP means, or maybe you are 22 years at the same overstaffed, overpaid IT department of a very huge company. You know, what I mean. :-)

            You're nitpicking about his specific printer example. Sure, a good printer tells you, when the toner is
          • Utility grade computing is easy as hell if you have the money for it. Who are you kidding?

            It's when you get the IT department squeezed into leasing crap copier/printers (for example) that the infrastructure starts to degrade. And you can only have 1, because 2 is a waste compared to flying sales-douches all over the country to wine and dine people who won't buy anything anyway. And suddenly all the execs need $5k Vaio laptops so they look good at meetings, but IT can't get $2000/year to send the backup t
      • Failures of the environment should be about as common as power failures.

        Except:
        Users load the wrong paper in the wrong tray, mix up the color stix in the Phasor, etc. To be sure you could hire extra heads to do these things proactivly (sp?), but you don't have the budget for that. If you rely on the users to notify you then you are back where you started. Usually the user who thinks they know what they are doing are the ones who don't and fsck it up.

        In the case of the power line, the system protects its
    • "Do the facilities people get in trouble for not ancticipating the employee who leaned over to pick up his cell phone off the floor while driving, and failed to install a nice big inflatable barrier along all the roads? Of course not." ...and yet poor road design is one of the greatest contributory factors to road deaths (alongside pubs serving drivers drink).

    • Re:Hot potato (Score:3, Insightful)

      by Fulcrum of Evil ( 560260 )

      Guess who gets reamed by the CEO because the package didn't go out? Usually the IT department. "Why was the printer broken? Why couldn't you fix it?"....not, "Bob, why did you wait until 5 minutes before your deadline?"

      Sure boss, I fixed the printer. It took 15 minutes because I had to go downstairs to get more toner. Bob missed the pickup, but oddly enough, wasn't around to trot the package down to the fedex shop that was open until 6.

    • "The employee has procrastinated working on it, and goes to print at 4:57. There's something wrong with the printer or their system."

      "It's the best lock money can buy, but it has one flaw, the door has to be closed!" -Seinfeld

      The problems need to be better compared to things the average person can understand.

      "It's the best printer money can buy, it's only flaw is that there needs to be paper in the tray."
      It's no more the job of IT to keep the printers full than it is to keep the supply closet stocked with p
  • The IT department is clearly a security risk, let me explain. The IT folks have the ability to hit all the dangerous smut portals (without getting logged) and are thus are more likely to download the root kits that are often served up at some of the shadier bukkake portals (I wouldn't know...wink, wink) and thus infect the corporate lan. Management knows taking bigger risks could lead to bigger rewards. So, that's why they keep those smut-hungry IT workers around.

  • Tradeoffs (Score:4, Interesting)

    by publius_ovidius ( 870895 ) on Thursday September 15, 2005 @05:07PM (#13570842) Homepage Journal

    What the article doesn't point out is the obvious tradeoff. By having an IT department to manage risk, companies enjoy lower risk but the risk profile changes. IT departments will routinely reghost machines with unauthorized software and that, arguably, is a strong benefit. Once users lose enough data from having not backed up their machine prior to it being reghosted, they learn to backup their data more frequently or not install unauthorized software (assuming they have the administrative rights to install that software in the first place.)

    What that means, generally, is that problems from unauthorized software will be minimized and other problems will be magnified in comparison. I note that the author of that article didn't offer a solution to this perceived problem.

    Perhaps a deeper problem is that IT security represents, to the company, what an economist would refer to as a "public good." Your department will enjoy the protection of powerful firewalls, anti-virus protection and locked down machines even if the costs are not applied directly to your department's budget. As a result, I've frequently seen business departments argue against increased funding for IT security in the mistaken belief that the potentially negative impact on their budget will hurt them. They somehow believe that if they do not pay for the security directly, the IT department will magically find other solutions for those problems.

    Only increased employee education about the dangers inherent in their actions seems to be a viable method of reducing this problem.

  • Only one way to fix it: (Score:4, Insightful)

    by Anonymous Coward on Thursday September 15, 2005 @05:11PM (#13570869)
    Education and consequences.

    Nobody takes security seriously because regular staff thinks that the IT guys are there to clean up the messes when they occur. What they don't understand is that the IT department is not there to be a janitor or babysitter. The IT department is there to provide the information infrastructure to enable the company and to ensure the company's information security. That doesn't necessarily include end users.

    My personal philosophy is that end-users should be punished severely for security breaches. Sure the IT department will fix the problem, but the person who clicked on the link (or opened the email) needs to pay a price for their behaviour, otherwise they will continue to do it. Nearly every company has an IT AUP. Nearly every company says that you can be disciplined, including termination of employement, for violating the policy. Yet I have never worked at a company where day-to-day infractions (even those with security risks associated with them) were punished. Sure, every once in awhile someone gets fired for surfing porn, or when their misuse of the system affects their ability to work (goofing off online for hours), but who gets fired for forwarding chain letters with flash animations in them? Nobody.

    This absolutely has to change. If you had a receptionist who let random strangers in to wander the halls of your building she would be disciplined and probably sacked. If you have a receptionist who forwards chain letters, clicks on suspicious links, downloads spyware and causes virus infections, the odds are nothing will happen to her.

    Company officers think Information Security means securing the company with a firewall and looking out for hack attempts. They still don't take Information Security seriously, and until they do the rank-and-file won't either.

    Education alone is not going to do it. Education that is reinforced with consequences will.
    • AC says: "My personal philosophy is that end-users should be punished severely for security breaches. "

      I have found, working in various IT departments, that if your users know they will get whacked for having caught a virus, they will never report the virus until it is hurting them worse than IT will. In that case, the virus has spread through other machines and the mess is bigger to clean up.

  • Depends on Enforcement (Score:4, Informative)

    by sstamps ( 39313 ) on Thursday September 15, 2005 @05:13PM (#13570895) Homepage
    I worked as a contractor to a large soft drink company some years back, and their corporate culture made it hard to fire most employees. However, they took improper computer / network use seriously and included it in their corporate code of conduct. Violating the CoC was about the only way you as an employee there could get fired, and they followed it. They even had security walk an upper management person out the door the day his little escapades took down a large segment of the network in his building.

    Thus, as far as I have seen, it is all about not only having a good IT department, but having good company policies and proper enforcement to support it.
  • . As someone who supports several large companies networks, I've seen both kinds. Some companies just don't care. They think that network problems due to careless, idiot users is just par for the course. They will just continue to pay to have you constantly fix problems that wouldn't be problems if they fired a person or two for screwing things up. Then you have companies that set limits from the get go. The network crew isn't there to pick up after them. In fact they are there to tell the boss who's cau
    • I must be one of the few people who work in a secure environment. We have security rules drilled into our heads routinely, and to a lot of us they're just common sense. Yes, there are people in IT who install unauthorized shareware, but if anyone introduces a virus to the network, whether in IT or not, it's easy to find out where it originated. That person is then made a spectacle of (only as a side effect) by the response staff as they lock down the person's workspace and haul away their PC like it was rad

  • Laziness (Score:4, Insightful)

    by Nuttles1 ( 578165 ) on Thursday September 15, 2005 @05:16PM (#13570914)
    At first I was going to post a comment that maybe workers are to busy to worry about security so they leave it to IT to fix problems, but I thought about it and came to the conclusion if somone really is too busy then they won't have time for SPAM type email or for surfing.

    So, I thought about it some more and came to the conclusion that it may simply be because of laziness. I work in a group of 12 programmers, 6 of which are either naturally tech savy or keep up with tech. These people have no issues with viruses and stuff like that. The others, the programmers who have been programming the same programming language, in the same industry, in the same one or two programs for 10+ years(granted there are some programmers with 10+ experiance and are not like this but most of them are) haven't read a technical book or done anything but the absolute bare mininum to get by for years and years. If 50% of programmers who SHOULD know better are too lazy to know exactly what they are doing when they are at a computer, what hope do IT departments have with people who think that there job is strictly whatever (accounting, being a doctor, being a pharmacist, etc) and the computers are for IT/Geeks. Too many people do not take pride in everything they do. They are content with being good enough. They are Lazy.

  • Personal Accountability Is Just No Longer Stylish (Score:4, Insightful)

    by ScentCone ( 795499 ) on Thursday September 15, 2005 @05:17PM (#13570918)
    The problem is that the behavioral culture at work is exactly the same as it is everywhere else. People can't stand hardship, complexity, accountability, or even just the discomfort that comes from having to think for a moment. It shows up in how they drive, how they bank, how they prepare for bad weather, how they marry, how they study for exams, and how they surf. And to the extent that the largess of our economy allows for it to keep happening, it just keeps happening.

    The crazy thing is that most of the reasons I've seen for stupid-IT-end-users getting the axe (the ultimate behavior modification) have nothing to do with their poor security-related behavior, but rather for the things they've done that might offend someone. You know:

    "Well, of course we'll reset your cracked password again. But when you get back to the field office, be sure to tell Bob that he's probably going to lose his job over that whole Carmen Electra desktop wallpaper thing."
  • ... but not until you slip me some cash.

    On the serious side, with access to everything typed in or emailed in trustworthy competant people who are more worried about everything running well than personal gain with some sort of check or balance should be the default.

  • Aren't the users security risks?
  • This is the same kind of logic that people use to claim air bags don't make people safer. The argument is that people will drive more dangerously if they know they have an airbag to save them.

    The problem of course in both these cases is that no one is adding up the benefit of both protection schemes. Of course if you don't also look at the added security that an IT department provides, and only look at potential problems it's going to look like "IT departments are a security risk". Shame on Information W
  • Plenty of offices have janitors, yet I don't see people throwing shit all over the floor and saying "let the janitor worry about it", they use the trash cans/paper recycling containers.

    I think the problem isnt complacentcy, it is lack of education -- no one asks the janitor "what is the trash can for?" but all the time the IT guys feild questions at that level of stupidity...and worse -- THEY ACCEPTT IT!!!

  • Blaming is a part of the problem (Score:4, Interesting)

    by msblack ( 191749 ) on Thursday September 15, 2005 @05:39PM (#13571090)
    The article is rather light on backing and employs weak logic to reach its conclusions. It also relies on some tired urban legends or scapegoating when it compares sloughy users to renters:

    ...akin to the difference between how renters feel about their apartments and home owners think of their homes.

    These tired ownership society attitudes assume actions result from a lack of vested interest while discounting the training issues.

    Other postings in this topic lament being on the receiving end of the blame game. Get used to life because there are many situations where others will shift responsibility to high-horse IT employees who, like most others, are not immune to accusations. A little dialog can go far in diffusing the following situation:

    [BOSS] John couldn't get that package out to big client yesterday. Why was the printer down?

    [IT] Equipment sometimes fails and we put in 110% to keep things running.

    [BOSS] Yeah, we lost a million-dollar contract due to your incompetence.

    [IT] I suppose it would be fair to ask why Marketing waited until 4:55 to make their print out?

    [BOSS] Because they were putting in 14-hour days for the past week. The printer needs to be working during times of crisis.

    [IT] If it was so critical, we would have posted someone to continually monitor the printer had Marketing given us the heads up of their deadline.

    If you have an unreasonable boss, run fast. These blame throwing tirades are just that.

  • IT Departments securing thier own jobs (Score:3, Insightful)

    by Bryansix ( 761547 ) on Thursday September 15, 2005 @05:39PM (#13571096) Homepage
    Not only are IT Departments a serious security risk for both the reasons that they give a false sense of security to the end user and that a simple mistake on thier side can have grave consequences. They are also mostly around in an attempt at securing thier own jobs.

    It seems to me that 90% of all desktop maintenance could be performed by an informed end user. Instead IT locks down everyones computers and forces the end user to submit a request for help to do the most simple mundane things. These inlcude things like oh I don't know, installing the latest version of Java, Defraging your own hard drive, or changing the power management settings on your laptop. This is so demeaning to the end user that most give up and go with the flow. That is they see education in computers as useless since they can just pick up the phone and ask IT. So the very tactic that IT uses to secure thier jobs ensures that most end users are totally computer illiterate and therefore creates a serious security problem.

    • Re:IT Departments securing thier own jobs (Score:4, Insightful)

      by VoiceOfDarkness ( 915213 ) on Thursday September 15, 2005 @08:39PM (#13572337)
      90% of maintenance could be done by users but 90% of it would never get done because the average user could care less about system maintenance. Most IT staff are not trying to create job security by locking users out of doing things they are capable of. Most of us are trying to save our jobs by preventing users from horking the rest of the enterprise.

      Anyone who has ever had to lock down a Windows system to prevent malicious behaviour knows it isn't easy. Until XP you had to be full administrator just to renew your IP address. You still have to be full admin to run a defrag. 99% of users should never even have power user rights - not to mention admin rights - because they do not understand the consequences of their actions.

      Many of us spend days on end tweaking registry settings, file permissions and security policies to make the good stuff work seamlessly for (ungrateful) end users while blocking as much of the bad stuff as possible. Our reward? Being bashed at every opportunity because a user couldn't load the latest version of Flash when he surfed to Jib-Jab.
  • I have to say, I've been in more than a few IT departments that use their position and their management's ignorance to host everything from game servers to MP3 servers. Ordinary users can't even think of attempting these activities. It's great to be in IT!!! :D
  • what about the man-bites-dog scenerio where the techs should know better?

    What about the IT department that leaves your server's admin password on a piece of paper beside your server? About the busy support that tells the user the data on their boot-unrecoverable desktop is "gone, just gone. Here, let me get things started by reformatting for you!" Couple things I've seen. And a couple things that made me an enemy of that IT department when I pointed them out (and stepped between the tech and the reforma
  • Considering how easy it is to set up a web content filter and how few corporate IT departments bother to do that - I tend to agree with the headline that IT departments are security risks.

    If a user can click on something in a browser or email client and cause a security issue, then the problem is incompetence in the IT department.
  • ...because this is the same behavior that people will exhibit if there is a security guard working the desk downstairs. Anyone who makes it into the building has free reign to wander around and steal stuff if they have the right expression on thier face.

  • Same thesis, different department (Score:3, Insightful)

    by soft_guy ( 534437 ) on Thursday September 15, 2005 @06:44PM (#13571656)
    It is like saying that having a QA department lowers your quality. Sometimes true. Sometimes not.
  • I read the first paragraph - almost immediatly, I remembered a job offer:

    - System Administrator (network)
    - $7.25/hour. (That's right - below mimimum wage.)
    - Located in Navan (which is hard to reach by bus - taxing a car is an option, but only minimally.)

    The systems were alreahy infested with malware that generate popups. This is also a computer consulting company. (I'd love to name them, but was never given the name of the company.) This single example proves that hhe lack of IT department or equivalent
  • I run my LAN like Simon Travaglia's BOfH does.

    - Lock my machine and the server room doors when I leave for ANY reason
    - Only use Firefox
    - Mac OS X machine for work, fully-patched locked-down XP machine for admin stuff
    - Realtime antivirus on the Windows machine, plus HijackThis and Ad-Aware
    - Total and complete control of EVERYTHING on the LAN - if I don't personally approve it, it doesn't go on
    - VNC is on all my user machines (I told them it was for remote repairs. Let them believe it - I like watching J. Ran

  • It's the other way around (Score:3, Insightful)

    by Gary Destruction ( 683101 ) * on Thursday September 15, 2005 @08:25PM (#13572264) Journal
    It's not the IT department that's the problem. It's the higher ranking people that whine because their workstations lock after five minutes or because they have to enter their user name in after logging off or rebooting. But those people are so important that if they whine enough, they end up getting their way. Those are also the people that bitch because someone messed with their computer while they were away.

Slashdot Top Deals

To be is to program.

Close