Please create an account to participate in the Slashdot moderation system

 


Forgot your password?
Close
typodupeerror
×
Security IT

One-Third of Employees Violate Company IT Policies 320

Posted by Zonk from the yeah-but-they-were-all-bad dept.
BaCa writes with a link indicating that a survey of white collar US workers shows that something like a third of all employees break IT policies. Of those, almost a sixth actually used P2P technologies from their work PCs. Overall, the survey indicates workers aren't overly concerned about any kind of security: "The telephone survey found that 65% of white-collar professionals are either not very concerned or not concerned at all about their privacy when using a workplace computer. A surprising 63% are not very concerned or are not concerned at all about the security of their information while at work. Additionally, most employees have the misconception that these behaviors pose little to no risk to their companies."
This discussion has been archived. No new comments can be posted.

One-Third of Employees Violate Company IT Policies More

One-Third of Employees Violate Company IT Policies

Comments Filter:

  • I don't believe it (Score:5, Insightful)

    by stoolpigeon ( 454276 ) * <bittercode@gmail> on Wednesday October 31, 2007 @03:40PM (#21188499) Homepage Journal
    I'm guessing a more accurate headline would be: One-Third of Employees Admit to Violating Company IT Policies
     
    The rest just didn't let on - because there is no way the number is that low. Or they didn't outright lie, they just didn't even know they had violated company policies.

    • Re:I don't believe it (Score:5, Funny)

      by vertinox ( 846076 ) on Wednesday October 31, 2007 @03:52PM (#21188623)
      Or they didn't outright lie, they just didn't even know they had violated company policies.

      I don't know how many times a conversation went like this:

      Me: Whats your user name?
      User: Its u2343 and my password is "bobspassword"!
      Me: Wait! ARRRRRGH! Don't tell me that! I'm not supposed to know your password, I just wanted your user name!

      • Re: (Score:3, Funny)

        by Anonymous Coward

        Me: Wait! ARRRRRGH! Don't tell me that! I'm not supposed to know your password, I just wanted your user name!


        Me: Sigh. Please change your password. Please don't share your password with anyone, including IT staff.
        User: Ok, now I changed it to 'bobspassword2'.
        Me: ARRRRG!

        • User: Ok, now I changed it to 'bobspassword2'.

          Me: Sorry, we can't both know your password, so I changed it.
          User: To what?
          Me: If I told you, then we'd both know it wouldn't we? yuk yuk yuk
          User: [grumbling] Okay, I'll change it, but I won't tell you this time.
          Me: Okay, it's temporary though, and will force you to change it when you log in, ready?
          User: *sigh* ready.
          Me: [mumble: random, okay] a;@#aslkdfQQQ$@$#%faWerrr@!!a;lskd1.

          Nobody, but nobody leaves their password as the one I give them. Few tell me twice.

    • Re: (Score:3, Insightful)

      by Otter ( 3800 )
      Also, if I'd been surveyed as to whether checking webmail is "risky", I'd also have said that it isn't. It's certainly not "risky" on the level that downloading and running some P2P application is; it's not even dangerous on the level that requiring 20 different, complex, constantly changed passwords is.

      • Re:I don't believe it (Score:5, Insightful)

        by ewhenn ( 647989 ) on Wednesday October 31, 2007 @04:41PM (#21189273)

        it's not even dangerous on the level that requiring 20 different, complex, constantly changed passwords is.



        Personally, I find that this constand password actually *lowers* security. I would like to present myself as an example. We have to change our passwords to something with 3 of 4 items (CAPS,lowercase,numbers, and Special characters). We are required to change our password monthly. So instead of having a nice secure password like "jd%2MdEP!7rqA" that I can remember say... once a year.. I just do something like "Aotepad1"..next month "Botepad1"...next month "Cotepad1" so I can remember the damn thing. Each application requires it's own password, so requireing the average user to constantly change them is going to make them go with poor password choices instead of strong ones.

        Sometimes too much "security" is weaker security.

    • Re: (Score:2, Insightful)

      by dnormant ( 806535 )
      What's sad where I work is it's the helpdesk and desktop administrators that are the worst. We have Websense to block the inappropriate web sites. Then they learned they could VPN in and that basically goes around Websense. Now they're tying up my firewall AND my VPN router.

      I already block all p2p, now I'm going to have to block music and video sites too. I don't care what is appropriate or what isn't, I'm tired of my boss asking me why the Interweb is slow.

      It sucks being the bad guy but I like my job.

      • Re: (Score:2)

        by COMON$ ( 806135 ) *
        Your firewall should allow for rule schedules, obviously there is no need for you "techs" to vpn during work hours unless they are in the field. Or just disable VPN from behind the NAT. From one natzi admin to another the IT staff will always be your worst customers at policy compliance.

    • Re: (Score:2)

      by COMON$ ( 806135 ) *
      Because if you are a good admin, the use is incapable of violating your policies. Outbound port locks, packet monitoring, AD policies....ahhhh to be a natzi but who has that kind of time ;)

    • Re:I don't believe it (Score:5, Insightful)

      by GreyyGuy ( 91753 ) on Wednesday October 31, 2007 @08:19PM (#21191445)
      Exactly. Between email retention policies, internet usage, and everything else, I would not be surprised if over 90% of people have violated them. Check your yahoo email at work? Violated company policy. Plugged in a USB drive or your iPod? Probably violated company policy. Installed non-approved software? Anything from IM software to Open Office to spyware checker to p2p software. Violated company policy. Sent your friend/spouse/significant other/family member and email from your work account? Violated company policy. Viewed something risque online at work? Even if not intended, that probably violated company policy.

      Silly to think of things that trivial can count, but there are reasonable reasons for them. The problem is that they are all general and not focused on if the person intended to violate them. I would not be surprised if one third of people knowingly violated their company policy.
  • only a third?
  • Bullshit. Maybe 1/3 are dumb enough to cop to it.

    Perhaps you've got it backwards and only 1/3 don't violate IT policies. And even that sounds light.

    • Re: (Score:2)

      by ivan256 ( 17499 )
      1/3 admit to it.... The other 2/3rds don't even know what the policies are in the first place.

      • Re: (Score:2)

        by arivanov ( 12034 )
        1/3 admit
        1/3 lie
        1/3 does not give a f**k

        About right by the look of it.

        Not that IT does not deserve it.

        Any stupid, prudish, paranoid or sometimes outright insane request can become a policy item in a matter of minutes.

        Example (happened to me). A new HR director comes in horrified wanting to talk to you how do you dare not having a content filter to stop inappropriate content from being viewed.

        The usual IT professional goes and implements it straight away. The fact that nobody is viewing it in the first place

    • Re: (Score:2)

      by dbIII ( 701233 )
      It really depends on how tight the policies are, how congested the link is, and if they are aware of how much logging is going on. Do to problems with communications infrastructure in Australia I can't get as fast a link at work as many users have at home. A side effect is they run their p2p stuff at home and if they do it at work they just get a polite visit and get told there isn't enough bandwidth. Multiple slow links only spread the pain they don't reduce it much. If there is just a resource based p

  • of course (Score:2, Insightful)

    by Vanden ( 103995 )
    I think most of us could've told them that without all of the silly research.

    Seriously though, for most people, unless they know there's a risk of being fired if they don't comply, chances are that they're not going to care about corporate IT policies. Most companies don't actual police them, so what benefit do they have in following them?

    While people should be responsible enough to do what their job requires, it falls back on the corporate IT folks to make sure their policies are enforced.

    • Re:of course (Score:4, Insightful)

      by Aetuneo ( 1130295 ) on Wednesday October 31, 2007 @06:08PM (#21190201) Homepage
      So most people realize, on some level, that the purpose of many of these rules is to make the people administering the network feel safer? For example, if you a company is sued by the RIAA/MPAA on the basis of someone on their network downloading music/movies illegally, they would have the protection of that being against their policies, so they can either fire that person for violating the policies, or pass on the lawsuit (for example, suing that person in turn). Thus, if you know what you are doing, it doesn't matter if it is against the rules unless attention is drawn to it - and unless it is harmful, the worst that would happen is probably a slap on the wrist, and perhaps not even that.

  • Lol (Score:5, Funny)

    by jayhawk88 ( 160512 ) <jayhawk88@gmail.com> on Wednesday October 31, 2007 @03:48PM (#21188579)
    Of those, almost a sixth actually used P2P technologies from their work PCs.

    In other news, one sixth of one third of all IT admins are stupid enough to not block P2P traffic on their networks.
    • They say "actually" like it's so unbelievable.

      I regularly use bittorrent to download work-related files at work. And it's not against IT policy at all. Imagine that.

    • Re:Lol (Score:5, Funny)

      by QuantumRiff ( 120817 ) on Wednesday October 31, 2007 @05:33PM (#21189845)
      And what percentage of the people the called actually responded to the survey? I would kick my users if I found they took time out of the day to talk on the phone about how they break policy (and security) over the phone to a stranger doing a "survey".

    • Re:Lol (Score:5, Interesting)

      by thegrassyknowl ( 762218 ) on Wednesday October 31, 2007 @06:46PM (#21190575)

      In other news, one sixth of one third of all IT admins are stupid enough to not block P2P traffic on their networks.

      It's quite hard to block p2p traffic explicitly while leaving other protocols open. P2P traffic moves in a number of arbitrary ports and uses a lot of protocols. New protocols are coming and going regularly. L7 packet filtering helps with the common protocols but if they are also using encryption you've got bugger all chance of blocking them totally.

      I was playing cat and mouse for a while. Block Kazaa and they move to Emule. Block that and they move to torrent. Block that and they start using gnutella. The game goes on and on.

      The only way I've found to reliably block all p2p and other things without major hassles in the firewall is to block everything, install a proxy server for HTTP, HTTPS and FTP and then only punch out ports from trusted machines and with good valid reasons from people (and a paper trail for those reasons). eg, the PBX can talk to our upstream SIP provider, the mail server can speak port 25 to the outside world but nobody else can and my desktop PC has rsync access to our ISPs file mirror.

      I have procedures in place to get things like torrents because they occasionally have legitimate uses. I have one machine that only I have a user account on. If someone thinks a torrent is useful and related to work they can ask me to get that torrent for them. It keeps them from running clients on their own PCs and still allows them to get files if needed. Half the time they just want torrents of files like Linux distros that are available on our ISP's mirror at no data charge to us.

      With all that security comes problems. The boss wants to violate his own Internet policy (bittorrent for movies and all that) and the new firewall stops him from doing it. He has a personal email account he insists on checking with pop3 but can't now because that's blocked. There are no end of complaints about how all these violating things that used to be possible now aren't. For many admins there is a lot of pressure from management to not block things because the managers want to have a free run. Not every IT person is gutsy enough to stand up and say "no fucking way".

      • Re:Lol (Score:4, Insightful)

        by vux984 ( 928602 ) on Thursday November 01, 2007 @03:45AM (#21193985)
        Not every IT person is gutsy enough to stand up and say "no fucking way".

        Not every IT person should. IT is a service industry. They need to make sure they are providing the service that is actually desired.

        Downloading torrents is a pig on bandwidth, but unless bandwidth is cramped. So what?

        Downloading from external email accounts may carry greater virus risks, but they are going to pick up the messages when they get the laptop home anyway, so the machine comes in infected tomorrow instead of this afternoon. Or they'll pick it up through some webmail account somewhere that you haven't blocked. Or they'll hook up their laptop to their cellphone/pda.

        Some IT departments should say "no fucking way". But in a lot of them IT is supposed to simply be providing a secure reliable functional network. That doesn't necessarily mean locking it it down so hard that its reliability reaches 5 9s, and its so secure even the users can't get in half the time, while functionality is at the bare minimum specified in an SLA, while IT pats itself on the back for a job well done.

        Meanwhile half the staff have resorted to personal laptops/pdas and cellular data plans because they can't get email from important customers through the company mail server, and they can't access web content they need through the company network without jumping through stupid hoops each and every time... and IT just stands around saying "no fucking way".

        For every PHB manager drawing up pointless re-org charts and misusing buzzwords, and marketing moron promsing perpetual motion machines and obsessing over what color they should be, there is an IT-admin somewhere very effectively ensuring his network is as hostile, unfriendly, and as unusable as possible to the people trying to use it.

        Like I said, Some IT departments should say "no fucking way". Some environments and situations DO demand that. But many of them say that a hell of a lot more often than is remotely justifiable.

  • What they don't say (Score:5, Interesting)

    by kpainter ( 901021 ) on Wednesday October 31, 2007 @03:48PM (#21188583)
    There are a lot of really stupid IT policies out there that, in the name of security, in fact merely hinder getting work done. I am not talking about P2P. Giving a developer a workstation with a user account with no administrator privileges on Windows is among them.

    • Re: (Score:2, Insightful)

      by ruewan ( 952328 )
      I agree with you totally. There have been so many times that stupid policies made it difficult for me to get my work done. It is often easier to find ways around the security than to go through the proper channels. I had to do that a lot in my last job.

    • Re:What they don't say (Score:5, Insightful)

      by moderatorrater ( 1095745 ) on Wednesday October 31, 2007 @04:03PM (#21188793)
      What I've noticed more of is that there's the "Company IT Policy" (tm) and the actual acceptable use policy. On paper you're not allowed to put any personal files on the computer, browse any non-work-related sites, or use a messenger client. In reality, you can bring in your own music or any work-related programs as long as you take the flak for illegal things, browse sites but only for a reasonable amount of time, and the same for messenger.

      • Re:What they don't say (Score:4, Insightful)

        by Kjella ( 173770 ) on Wednesday October 31, 2007 @08:16PM (#21191421) Homepage
        It's really quite simple - a company is in it for the money. IT policies are there because they save money by not dealing with all sorts of crap. As long as you get your work done and don't create trouble for your coworkers, IT support, the legal department or anyone else most people are willing to overlook things. Note I said overlook, not back down. Don't challenge them or blatantly disregard them, or they have to come down hard on you to make sure everyone knows who has the final say. You have to convince them you're not what I'd call "dangerously competent" - skilled enough to mess around a lot, clueless enough to fuck it all up.
    • That's the situation I'm in right now. IT Security where I work is very good at what they do, to the point of approaching "unplugged, in a box, encased in concrete, and in a locked vault" secure. Unfortunately, the machines are also about that useful.
    • "Giving a developer a workstation with a user account with no administrator privileges on Windows is among them."

      Why would you give a developer a domain system with administrative purposes?

      Why not a domain system with a local account that has admin that he can use when testing.. or require development work to be done in a VM session where they control their own permissions?

      Why subject the security of the whole network to one user's practices?

      I don't want to have to continuously troubleshoot why a system is
    • I think it fair to say that IT policies are not there no be enforced all the time. They are there to give IT staff the tools to manage the system effectively and prevent excesses.

      For example the last place I worked at, the official line was "no personal use" but it was deemed OK to download a few mp3s or a Fedora ISO image here and there, thansfer your photos to flickr etc, but they stomped down hard on the guy who used approx 1/3 of the network bandwidth to download DVDs for his home viewing (and to give t

    • Re: (Score:3, Informative)

      by l0b0 ( 803611 )

      Even worse is that once you break one of the unreasonable policies (no admin logon on a developer machine, say), it's hard to keep any respect for the more reasonable ones. A bit of trust and leniency would go a long way toward respect. You could for example tell employees that they should avoid spending a lot of bandwidth during peak hours, and give people plenty warning if they're hogging all the gas.

      Oh, and help them out a little by hinting about things like KeePass [keepass.info] for passwords, TrueCrypt [truecrypt.org] for sensitiv

  • When Policies are set by PHB's and you need to bypass them to get work done then that is something that should be fixed. Also another thing is password rules that make people write there pass word down on paper are worse then passwords that don't have as many limits on them.
    • Pick something you can remember. The simplest way to have mixed case, alpha numeric password with punctuation, is a sentence that you can remember. "Today, a coffee cost $1.99 + TAX!" Secure, simple to remember, and passes all the validation you want to throw at it.
      • And what about the rules saying that you have to change your pass word and you can't use part of your last few passwords.
        • "And what about the rules saying that you have to change your pass word and you can't use part of your last few passwords."

          typically to stop people from using "password1, password12, password123" or "password1, password2, password3"?

      • Re:When Policies are set by PHB's and you need to (Score:5, Funny)

        by Otter ( 3800 ) on Wednesday October 31, 2007 @04:17PM (#21188991) Journal
        "Today, a coffee cost $1.99 + TAX!"

        And is that the phrase for the for the dental plan password, the diversity training registration password, or the office supply purchasing password? Or an older phrase for one of them, as each one needs to be changed (out of sync!) 6 times a year.

        • Re: (Score:2)

          by Gibble ( 514795 )
          You can't remember more than one password? And honestly, isn't it easier to remember several phrase than several cryptic password like "41!ap*17ARK"?

          I'm just suggesting, a simple solution to strong passwords that are also easy to remember.

          As a side note, if there are three systems, keep the passwords the same, while they may get out of sync, you should only need to remember a couple at a time.

          If IT hasn't bothered to integrate the systems to use a single login, they aren't going to bother checking that eac

      • Re: (Score:2)

        by CBravo ( 35450 )
        Oh come on. I have to type it every 20 minutes because I cannot get putty to save things in the registry to aid automated login. I keep it short and stupid, like the security regime.

        Passwords like ASDF12#$ and Welcome22@@ are easy on my wrists.
    • Some people forget their username even if it is their first name a space and their surname. You really can't blame password policy on the people that write it down, in these days of ATM cards people should be able to remember short passwords. What annoys me the most in this area is people that choose long complex passwords and stick a bit of paper with that password to their laptop.

  • Unreasonable Policies (Score:5, Insightful)

    by bazald ( 886779 ) <bazald@@@zenipex...com> on Wednesday October 31, 2007 @03:50PM (#21188609) Homepage
    Some policies just aren't reasonable or well thought out. This article is clearly blowing the issue out of perspective by not separating out different behaviors.

    Checking personal e-mail from a work computer-- 73% of those who have done this at work believe it is not risky, despite the fact that they could unknowingly download a virus that infects the corporate network.
    Wow, really? I'll stick to those corporate virus-free e-mail accounts from now on. Are they also completely free of spam? That would be nice too.

    • Re: (Score:3, Interesting)

      by Maxo-Texas ( 864189 )
      Virus's through Outlook in the last 5 years: over 20 (including 7 PDF's this week)
      Virus's successfully deployed to my desktop over the last 5 years: 3 (apparently from laptops plugged into the network without being scanned). The PDF's would have deployed if I had been not been suspicous of getting a PDF from a stranger.
      Virus's through hotmail in the last 7 years: 0
      Virus's through gmail in the last 2 years: 0
      Virus's through through Yahoo in the last 3 years: 0

      ---
      Documents that were not documents BLOCKED by c

    • Re: (Score:2)

      by Kjella ( 173770 )
      Personally I think that one has about 99% to do with employees wasting time and 1% with to do with security. Most serious companies I know have a virus scanner running on downloaded files, which I assume is the same one running on e-mail attachments. It's just part of my job to download executables from time to time, and usually I'm allowed to even from companies blocking webmail...

    • Re: (Score:2)

      by UdoKeir ( 239957 )
      A friend of mine who worked for a major bank had webmail blocked by her IT dept. They claimed it was for Y2K reasons. I couldn't begin to explain what was wrong with that excuse.

      My company's IT dept blocks HTML attachments in email to "prevent viruses". They appear ignorant of the fact that email can be formatted with HTML, or indeed that I have a little program on my desktop designed specifically for downloading HTML files direct from the web.

    • Re: (Score:2, Insightful)

      by WK2 ( 1072560 )

      Some policies just aren't reasonable or well thought out.

      Exactly. Most corporate policy lists are like U.S. laws. Excessively numerous and impossible to follow. If you tried, you might get fired not completing your work at the speed of your co-workers. When I was young and naive, a manager actually told me that I can't follow all the policies, and that I just had to do my best to obey what I could, and not get caught for the rest.

      I've heard it said that corporate policy exists so that management can poi

    • Wow, really? I'll stick to those corporate virus-free e-mail accounts from now on. Are they also completely free of spam? That would be nice too.

      Actually the email at the corporation I work at is. We run a Barracuda Spam Firewall in front of the email servers and nothing comes in without going through it. I tweaked the settings in the thing and now it filters out 75% of all email coming in. This doesn't take into account the emails the server never sees because it drops connections that are spamming it t

    • My old employer "mandated" (poorly) the use of the corporate logo as desktop wallpaper. That's the sort of policy I'll cheerfully bypass with a great big grin on my face.

  • And then there is 1/3 ordered to violate.. (Score:5, Interesting)

    by Maxo-Texas ( 864189 ) on Wednesday October 31, 2007 @03:53PM (#21188643)
    by executives to make unrealistic deadlines which they decided without IT input.
  • I think it's more like 1 out of 100 of employees actually obey company IT policies. The more management or IT that you are the more that you are liable to freely break IT policies as well.

    • Re: (Score:2)

      by tftp ( 111690 )
      The sad part is that this one employee who does not do anything bad probably does not do anything good either. It is a completely bland person with no interests, no curiosity, and who is even afraid to do something minor and be responsible for that. This is the kind of person who warms his chair for 40 hours per week and collects a paycheck. There is place for those people - a security guard maybe, or a help desk operator, but not in positions that require open mind and power to make decisions.

  • It's a cat and mouse game with IT (Score:5, Insightful)

    by rrohbeck ( 944847 ) on Wednesday October 31, 2007 @03:55PM (#21188669)
    Blacklists=>Proxies
    Traffic filters=>TOR
    etc. etc.

    But the real problems are still caused by moron employees who double click on an attachment they got via email. Just happened again last week. The problem isn't people who don't adhere to policies, it's employees who don't have a clue.

    And what's wrong with reading Slashdot while you're slacking off with a coffee for a couple of minutes? I'd consider an employer a slave driver if they have a problem with that.
  • I would find it more interesting to know what policies are being broken, and what percentage of those are either extremely lame or actually downright dangerous to the company (I have a friend who is required to use IE and Outlook for example).

  • Hell, most companies aren't concerned... (Score:3, Interesting)

    by msauve ( 701917 ) on Wednesday October 31, 2007 @04:07PM (#21188845)
    with the privacy of their employees. Case in point, mine provides my Social Security number to third parties, against my express direction, with absolutely no business need, and in direct violation of their own written privacy policy.

  • Where I work... (Score:5, Interesting)

    by Toreo asesino ( 951231 ) on Wednesday October 31, 2007 @04:07PM (#21188847) Journal
    ...there's a very relaxed IT policy.

    Browse whenever you want, take whatever software you want home, check your email if you want, everyone's their own local admin, no audits.

    However, if you get caught with illegal software, miss a deadline because of blatant time-wasting, then you get fired (for continuous abuse). People work not because of policy, but because they want to do well and enjoy what they're doing.

    I happen to also work in one of the biggest names in IT too....not some small company. The policy works very well, as is evident from the company's success and the fact people rarely leave. That and brain-implants, anyhow.
  • In my experience, the "IT policies" of a company are generally so restrictively worded that they'll catch almost any individual at some point in time for a "policy violation." They are rarely enforced as a matter of practice or true benefit to the company's security and IT performance, but provide excellent leverage against employees who are under the hot lights for unfireable offenses. Simply whip out that pattern of browsing Myspace, whip out the IT policy, and have them sign their resignation letter righ
    • And that is the answer that most people miss. I would say that frequently, even if an employee wanted to follow policy, they could not because their jobs actually require them to violate the policies.

      This is not limited to IT policy though. At 2 of the last 3 jobs my wife had, she would be told by her manager that they didn't care how she got a new copy of documents dated three days early, but that she better do it. It was obviously an instruction to not only violate policy, but the law. Of course th
      • For your wife, the correct answer is:

        "I won't lie to you, but I also won't lie for you. I will not violate company policy. I will not violate the law. And, no, I will not resign."

        The manger, and possibly the entire company, is up the proverbial creek if your wife is let go for that statement and the stand it represents. Plus, you'd have grounds for a lawsuit. It's called "wrongful termination" in most places, and there are several variants of it. In this case, it would probably hinge on either the policy vi
  • How is checking your e-mail, downloading software or using P2P software "risky"? The number 1 rule for all corporate networks is that you lock down your network, at home the most someone could really do is install a bot and make you send out spam messages. At work, your machine should at least have a network-wide firewall, up-to-date antivirus if its a Windows machine, and an under-privileged account if its Windows or Linux. But if everyone switched to Linux, none of it would really be a problem. But seriou
  • It is bad, first because as mentioned, that number is low. Second because they violate them because they CAN. IT security is nearly as futile as the war on drugs. Its current incarnation does nothing to reduce the demand, nor does it adequately address the problem.

    In the workplace, the employer (owner of the IT infrastructure) has a duty to inform employees how the tool(s) are to be used and what is mis-use. Additionally, the stick and carrot method is not appropriate. If you catch your child using your fav
  • Two years ago I received an email from IT informing me that I was using the application Firefox and that a "major security vulnerability" had been discovered. They told me I had to use Internet Explorer as it was "much more secure".

    Whether or not IE was actually more secure on our network isn't really the point, but I still had a great laugh out of it. I simply updated Firefox and that took care of that, never heard from them again about it.
  • Shouldn't the headline be (in fewer words):

    "Consider the employees stupid enough about security that they describe, to a stranger on the phone, the ways that they make their company networks less secure. 1/3 of them also violate corporate IT policy."

    The real WTF is that *anyone* answered those questions on the phone.

  • So, (Score:4, Interesting)

    by no-body ( 127863 ) on Wednesday October 31, 2007 @04:17PM (#21188987)
    what is wrong here? Rules or people?

    Whenever rules are broken, something of the two is off.

    Remedies are not always adequate and can lead to more trouble.
    • Generally its the rules, sure you should be able to block "inappropriate" sites, but theres no need to block "time wasting" sites such as Myspace, Facebook, Digg, Slashdot or YouTube. If an employee can finish their work in 3 hours and no one can give him/her more work for say an hour, theres nothing wrong with them watching a few Youtube movies. The fact is most of these "content filters" end up being more harm then good because most of the IT staff doesn't even know how they work. And all it does is annoy

  • policy? (Score:5, Funny)

    by bigdavex ( 155746 ) on Wednesday October 31, 2007 @04:18PM (#21188993)
    I'm not supposed to post on internet forums.
  • One of the places that I worked as a contractor was rife with this type of abuse. I mentioned to one of the users that they were the cause of the problems; the response staggered me;

    "Its your job to keep the computers safe, not mine."

    Alas logic held no sway on their minds.

    • Re: (Score:2)

      by rossz ( 67331 )
      The user is absolutely 100% correct. Keep in mind this same person jumps in his car, hauls ass down the freeway at 90 MPH yapping on a cell phone, sipping his coffee, completely oblivious to his surroundings. Do you really expect that person to follow "policy" when he has already shown a complete disregard for the law and common safety principles?

      No, you can't shoot him in the head with a shotgun. The momentary feeling of satisfaction is followed by a serious downside.

      • No, you can't shoot him in the head with a shotgun. The momentary feeling of satisfaction is followed by a serious downside.

        Of course you can't. Why would you want to anyway? That's so easily tracible. What you do is put them in dummy mode, and then have them check the voltage on their power outlet using a pair of paper clips (among many other means of removing security risks against the system. What's that, you ask? You might get arrested for this too? Of course not, it's a matter of national security! If users can be permitted to let viruses and spyware run on their systems, possibly turning the entire company network into a

    • Its your job to keep the computers safe, not mine.

      That is true, it is your job not his. Like a mother's (typical gender role assignment coming up) job is to take care of a child. So when the child is playing in the street, she drags him inside and punishes him.

      So, keep the computers safe. He requested that you protect his web access with a whitelist and make him come to you everytime he wanted to open an e-mail attachment. Or that he not have the ability to change the C: drive (there is some software

  • Less legal mumbo-jumbo in employee agreements (Score:3, Insightful)

    by failedlogic ( 627314 ) on Wednesday October 31, 2007 @04:26PM (#21189081)
    I recall before a lot of companies had terms of network use, a few employees where I worked had been downloading games from warez servers because the company network was significantly faster than anything available at the time. I knew even the network admin was violating this. I very much felt like reporting it, but as an entry-level employee on their first job, 1) I would feel guilty with getting someone fired; 2) I didn't feel like testing management by reporting this and see myself get fired; 3) I didn't really understand the policy and didn't know what to do.

    I'll make clear that I wouldn't let this go today.

    My point in all this is, some people starting at the company may be aware of activities the admins themselves or other staff are performing which management may not be. My first job was relatively simple and well paid, I have had no beefs with the company. But our Acceptable-use policy book was some 20-30 pages long. This was about 10 years ago. I would rather have had a 1 page document, sign at bottom: I will not download virsues or warez, share company information or NDAs to outsiders, etc on company time. If I know another employee is doing so, please report anonymously to. Violators will be disciplined or fired.

    Really, does it really need to be any longer than this or more complicated? It simplifies reporting and makes the issue and repercussions clear. Get the 20 page document too if you must. But the one-pager should be clear to *all* employees regardless of law degree. But help make it clear too, that if you mistype a domain and get a porn site, you shouldn't have to hide it and feel like someone is about to can you (e.g. whitehouse.com vs whitehouse.gov).
  • Seems like a violation of security policy to take an unsolicited call asking questions about security for a purported "Survey". Did any participant actually check the credentials of the person conducting the survey before giving answers about the security of their enterprise?

    So anyone who answers to the survey (not just the 1/3 who said yes) is in violation of policy.
  • Hmm, I think reading /. violates my employer's IT Policies. :P
  • 100% breaking IT policy is more accurate estimate ;-)
    Never set stupid policy and none want to break it!
  • I am not sure what is wrong with P2P. I use it to distribute the VMware images on my site with the blessing of my employer, since it actually saves bandwidth.
  • There are rules, like the 70mph speed limit or no surfing Slashdot, which are usually ignored unless someone needs a reason to fire you.

    Then there are RULES, like not killing people and not using office computers to plot the overthrow of corporate executives, that will get you fired no matter what.

    Most people are smart enough to know rules from RULES. Those that don't get the corporate Darwin award.
  • I would have thought it was much higher. IT policies everywhere I've seen are regarded like speeding limits; absolutely meaningless, except when somebody official is watching you.

    The typical response by IT is to make the policies more restrictive and impractical, which, of course, makes adherence to them even less likely.

  • And in other news

    And while they won't admit it, 74% of all IT staff routinely violate the rules they force the rest of the staff to live under

    Not that I would do such a thing, but....I've heard stories... :)

  • Let people browse! (Score:4, Insightful)

    by $criptah ( 467422 ) on Wednesday October 31, 2007 @05:31PM (#21189829) Homepage
    If you are reading this thread at work, you're probably violating the policy as well. Has anybody actually read the employee handbooks given out on your first day of work? I have never worked for a company where IT stuff did not violate policies to a greater degree. Sure, soccer mom / accountant Jane may look at the news site or shop at gap.com during work hours, but Billy, the director or IT, can run as many P2P applications from the QA lab. I have constantly heard IT engineers bragging about yet another wonderful Quake 3 lunch. It is nothing wrong to have some fun at work, but ordering extra-beefy hardware only for specific individuals so they can play Quake may not sit right with a CFO. What about all that licensed software that magically ends up being installed at home? The about box reads that it is licensed to Some Company while it is being used for personal purposes. Things like this happen all the time. Hell, I had a co-worker who did not mind browsing pr0n and personals online at work. He even bragged about it. Noticed how I stated things in the past tense :) Stupid policies make people break the laws. Just like teenagers love liquoring up despite the fact that it is illegal, white collar professionals like their news sites and forums. There is nothing you can do about it. In fact, if I were a boss, I would encourage people to relax and take breaks once in a while. I seriously see no harm if Johnny-work-all-night-to-meet-deadline takes 10 minutes and reads his Slashdot. As long as work is getting done, who gives a shit about what people do when they have a spare minute.

  • Simple Solution (Score:3, Interesting)

    by PPH ( 736903 ) on Wednesday October 31, 2007 @09:24PM (#21191887)
    Back when I worked for an outfit that had a real constricted sphincter IT policy, the solution was simple: telecommute.

    The company imposed some really screwed up policies on desktop configuration but they had a liberal telecommuting policy. So everyone did their serious work at home. They shoved their (IT mandated) Windows systems aside, used Linux and other FOSS applications, surfed the web, downloaded tunes, played WoW or whatever. As long as they got their work done, management was happy.

    Strangely enough, the company was also heavily into a process standardization kick. I don;t think they ever confronted the fact that the work that was getting done could never have been accomplished with the 'IT Standard' tool suite. Too bad. A more open policy at work would allow them to capture best practices.

Slashdot Top Deals

"I'm a mean green mother from outer space" -- Audrey II, The Little Shop of Horrors

Close