Slashdot Log In
Managing Personal Electronics and Software In the Workplace
Posted by
timothy
on Tue Sep 30, 2008 11:00 AM
from the sterility-vs.-chaos dept.
from the sterility-vs.-chaos dept.
darien writes "Last night Symantec hosted a round-table discussion on the topic of consumer devices in the workplace. John Brigden, Symantec's senior VP for EMEA, pointed out that regardless of the policies businesses may lay down, individuals will always try to use their favorite gadgets and websites at work. Reminds me of when I worked in IT support: no matter how many times we told users they weren't allowed to install ICQ, or to connect their personal laptops to the corporate network, they insisted on doing it. Frequently they even asked us to help them do it."
Related Stories
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Technologies are a part of life now... (Score:5, Insightful)
You have to shore these up with human controls: enforced policies, employee agreements, and the like.
This is a human problem caused by our adaptation to technology in our entire lives. Should the computer have been a device you only run into at work, the draconian idea of 'you may only do what we say' may have stuck. But since people get to experience life outside this kind of control, they're going to crave it everywhere.
And resisting it is mostly just frustrating everyone.
Now, I'm not saying you have to support every oddball app on the planet. I would recommend you have an 'approved software' list, and back that software up with support. Saying 'that is not supported, use this' is far better than locking things down, from my experience.
Focus on the wetware, not the software and hardware...
Good luck with that. (Score:4, Funny)
Good luck with that.
Since you seem to believe that setting one limit is unenforceable, why do you believe that setting a different limit is enforceable?
You cannot use IM app X because:
a. You are not allowed to use IM at work.
b. You are only allowed to use IM app Y (which does not connect to the service you want to use).
And, from TFA:
Why do so many people see "No" as "reactive"? You can evaluate new technology and new products and determine that they present security issues that outweigh their benefits.
In just about every other aspect of business this would be a non-issue. You don't allow people to replace the phone system with their own phone that is incompatible with your PBX but it's okay because they can just call the phone company and run a POTS line to their cubicle.
While they wait for that, they'll fire up a deep fryer in their cubicle and make up a batch of donuts for everyone.
Parent
Re:Good luck with that. (Score:5, Insightful)
I think this is one of those things where you need to identify the work environment you are in. I have worked in banking. It the operation division, what you said would be absolutely true. No second chances. If you went over to corporate, you'd find a more lax attitude. Whether you like it or agree with it, that is the way it was.
If you go to a smaller company, you will probably see an even laxer attitude. The policies vary greatly depending on the organization.
Parent
Re: (Score:3, Informative)
Now, if they'd be willing to take a pay cut so IT could afford a few more employees who would handle iTunes problems and such ... say ... $100 a month ... each.
Nah. I'd rather just be given the appropriate access to fix that stuff myself and get rid of IT altogether.
Re: (Score:2)
Indeed, as well as every 3 months somebody publishes a study to say that "evil lusers" are doing bad things sometimes to be more productive and sometimes to slack off. Unfortunately, like many things in life it is a sliding scale rather than a one size fits all solution. Sure block the pr0n, day-trading, ebay side business managing clowns, but for $deity's sake don't set the default home page to the bloated ass corp intranet portal. If I fire up a browser window to read some html documentation or to check a
Re:Technologies are a part of life now... (Score:5, Funny)
I assume the 20 minutes you spent writing this post was on your break and not listed on your timesheet as "continuing technical education".
Parent
Re: (Score:3, Insightful)
If you don;t like it, take a pay cut and go work for the other guy...
Funny thing is, you run a shop like that, and when you need that developer to work 80 hours a week for the next 3 weeks to get a project done on time, and he says "Hell no! I get paid for 40, and you make absolutely sure you get that 40 out of me. Why should I give you anything extra?"
So, you fire them, and your project tanks.
Then they get a job elsewhere, where they are free to do whatever, but have deadlines. They meet every deadline at their new job and still have the freedom to enjoy their life. Th
Re: (Score:3, Insightful)
If you're working in an environment where complete security is essential and staff can't be trusted, and there is no possibility of fixing the latter problem, then perhaps that sort of measure is justified. Anyone working in such an environment probably accepts that as part of the nature of their job anyway.
On the other hand, it is currently 20:15 where I am, and I am goofing off reading Slashdot for a few minutes while waiting to make sure a build and test run gets going OK overnight. Would I still be here
ISeekYou (Score:4, Funny)
No matter how many times we told users they weren't allowed to install ICQ
Ahhh, 1998 was a great year, wasn't it?
Simple solution, stop trying to ban devices (Score:5, Insightful)
Companies need to start looking at WHY their employee's want to connect personal devices to coporate systems. If its just so that they can import calenders, contact lists, etc into their PDA or calender at home then set up systems to allow it. If its to take confidential materials out of the office to work on at home (since how many people actually work a 40 hour week anymore), then set up proper encryption protocals to allow this but at the same time minimize the risks associated with data being lost.
Remember the best way to get somebody to do something is to tell them they are not allowed to.
Re: (Score:2)
I agree completely. Blanket bans on all devices or software beyond the bare minimum ITS wants to support is going to do nothing but create circumventions. A lot of that circumvention will be done as surreptitiously as possible, probably improving the chances of problems down the road.
A better approach is probably to allow employees to request exceptions, with explanation. For example, my personal laptop is currently plugged into my office. I do a lot of work on it and it travels with me when I go to mee
Not a problem (Score:5, Insightful)
We block certain website groups (adult, gambling, games, etc) by default and everyone must go through our proxy to the outside world. Web logs are checked throughout the day and those who try 30 different ways to get to boobsgonewild.com are reported.
Most people have only User permissions so they can't install something and we regularly do sweeps of unapproved software on those people who do have admin privileges. I'm the one who generally gets the call to remove the software. We also check for firewalls on PCs and other software which can potentially bypass our firewall or hide the user.
As far as electronics are concerned, the worst we have are people using fans or heaters, depending on the season.
Not sure what the big deal is. These are just basic network security measures which any decent admin should do and have set up.
Re:Not a problem (Score:5, Insightful)
I don't see why some IT departments bother to block web sites. It is a double-edged sword, and both edges cut against the company.
On one hand, if employees are visiting porn sites on company time, they should be fired. Setup a proxy, trap it, and get them out of there. Don't block them, and keep an unhappy unproductive employee around.
Second, if small things like checking the sports scores, or stocks, or news is what keeps them happy at work, then don't waste resources trying to stop them. Their boss has measures to determine if an employee is wasting time - let those measures work. If you want to keep logs of how often they do it, then fine. But don't try to block them because ultimately you can't. You can't stop them from talking about it at the water cooler or checking the scores on their cell phones, or bringing in magazines and newspapers. It isn't the IT departments job to police social behavior in the office. That's their boss's job. Often times these types of activities lead to comradery like the after-work fantasy football league. It bonds the employees and makes them more stable.
Parent
Re:Not a problem (Score:4, Informative)
Absolutely agree. However, working for the government, the union will not let you just fire someone. You have to document everything from now til Tuesday, give them a warning, note it in their file, THEN bring action at which point the union makes all kinds of excuses for why the person shouldn't be fired.
I know for a fact that there was someone who, every day, was trying to get to dozens of different adult sites for 20 minutes at a time. Supposedly it was all documented and set on to the higher ups but the guy still has a job. Whether it wasn't pursued or the union found an excuse to keep the guy, I don't know. If it were up to me, anyone trying for more than five minutes should get auto-fired. No appeal.
It's one thing to accidentally type in a wrong address or click a link without looking (I did that recently) but the logs will clearly show you left the link quickly once you realized your mistake. It's another to see the same person day after day trying to get to slutsrus.com.
We don't block those kind of sites. SI, MarketWatch, CNN are all perfectly accessible. Even overseas web sites are accessible. I look at two Japanese sites and the BBC and there is someone here who checks a Chinese-language site daily. The only ones we do block are what are considered time wasters (games, chat rooms, etc).
Some places are more strict, others more permissive. It all depends on the agency. I think the policy in place here strikes a good balance between letting people check news and such while limiting time wasters.
Parent
Re: (Score:3, Insightful)
I guess I'm lucky to work for a more enlightened company. Our policy is simple: we're all adults with a job to do, and as long as you do it efficiently without causing problems, nothing else really matters. Honestly, I'd hate working for your employer and probably wouldn't last a month.
Re: (Score:3, Funny)
Hmm (Score:3, Funny)
Looking around my desk I see the following electronic widgets that are mine rather than the companies:
A pair of DEC Shark computers.
A Sparc based luggable.
Coffee percolator.
Blender.
As long as I got them checked out for electrical safety the system support people here were fine with it, and this is nothing as compared to some of the stuff I saw at a big dot.com that likes exclamation marks. One guy had a pinball machine in his cube, and another had a large tropical fish bubbling away while percolators were everywhere.
Re: (Score:2)
DEC, Sparc? (Score:3, Funny)
Some possible solutions. (Score:2)
To solve the issue of personal laptops being connected to the corporate network, there needs to be some kind of server software where every approved device's MAC address is registered. When a non-approved device is connected, it will not be assigned an IP address by the DHCP server. This will cut 90% of the devices from ever being connected, since most lusers have no idea about MAC addresses, IP addresses, DHCP, and the fact that they can manually assign an IP address if they know the proper range. This doe
Re:Some possible solutions. (Score:5, Insightful)
...since most lusers have no idea about...
you set up all computers used by lusers to boot
What kind of attitude is this? You come-off as a condescending PHB. All the other stuff is good but damn. That just put a bad taste in my mouth.
Parent
At work, supposed to be working... (Score:2, Insightful)
I know when I am at work, I am supposed to be working. Nevertheless, there really doesn't need to be an all or nothing policy as it improves employee morale to allow some personal flexibility in the workplace. I know my company tries very hard to lock things down, and yet does allow some off-topic internet browsing (Slashdot, right now for example) and the occasional personal telephone call. They are, however, quick to remind us that the electronic networks to which we connect are a) company property and b)
Lock down ports and whitelist allowed MAC IDs (Score:2)
Re: (Score:2)
Associating MAC addresses with specific switches and addresses on the DHCP server is precisely how my place does things. It means that even if someone does sneak in their laptop, plugging it into a network socket is going to result in no connection. Compare that to when I was on site as a consultant at a very large investment bank last year - they had personal wireless access points and laptops all over company network. Some of the company access points were unsecured while the personal ones were brought in
People are still talking about this? (Score:2)
Ten years ago it was a topic, has anything changed recently that makes this a less exhausted subject? Whoever thought up this "round table" idea doesn't have enough to do I guess.
Failure to lock down machine = users WILL install. (Score:2)
"Reminds me of when I worked in IT support: no matter how many times we told users they weren't allowed to install ICQ, or to connect their personal laptops to the corporate network, they insisted on doing it. Frequently they even asked us to help them do it."
1. Users WILL attempt to install stuff
2. If they can't, they will eventually give up
However, if they manage, then they will push for more and more stuff, and demand support for stuff they never should of installed in the first place.
Surely they should
Re: (Score:3, Insightful)
Solution (Score:2)
3G Modem (O2): EUR19.00 + EUR20.00 per month
Problem solved.
Oh jeeze (Score:2)
It's like Prohibition - Unenforcable (Score:5, Insightful)
The same kind of thing applies in a corporation. You don't want to lower morale, and you especially don't want employees to lose respect for your policies. That certainly poses more risk to the success of an organization than connecting your iPhone to the wifi network.
Maybe a better solution would be investing in IT infrastructure.
Re: (Score:3, Interesting)
The same kind of thing applies in a corporation. You don't want to lower morale, and you especially don't want employees to lose respect for your policies. That certainly poses more risk to the success of an organization than connecting your iPhone to the wifi network.
Maybe a better solution would be investing in IT infrastructure.
It's a bit awkward in IT. Hey, it's always a bit awkward.
You let everyone install anything they like and do whatever they want -> Congratulations, you've just been picked for BSA Raid of the Month! (In some countries, directors are criminally liable so you have to take it seriously) With extra interest from the PRS if MP3 files are found!
You let nobody install anything -> well, the implications depend entirely on the role of the end user. If the PC is being used by someone in a call centre, this i
Mostly the fault of IT (Score:4, Interesting)
When IT doesn't serve the users, the users have to be their own IT. Users are bad at it and it causes problems.
The answer is to stop saying NO when users ask for reasonable (non-harmful) things. Help the users instead of trying to make your own job easier.
Let me guess... (Score:2)
Solution: Give them a VM (Score:5, Interesting)
Just give them VMPlayer and a XP/SP3 image that is only like 5 gigs and they can install whatever they want.
Then lock down the the company machine.
If something goes wrong with the VM, just give them a new one. Sorry, but there is no support other than that. If they lose stuff in the VM, then that's not your problem.
It's time to get tough (Score:5, Interesting)
We're already there in the UK Financial Services industry. Earlier this year, the FSA (our financial regulator) issued a report on best practice [fsa.gov.uk] that, amongst other things, recommends that
If you're in the industry and doing less, expect regulatory sanctions if anything goes wrong. It's time to get tough on slack security.
Embrace, don't extinguish (Score:4, Interesting)
no matter how many times we told users they weren't allowed to install ICQ, or to connect their personal laptops to the corporate network, they insisted on doing it.
We're not assholes about IT like you are apparently. We tell them "sure, bring in your personal laptops". The switches run 802.1x. If your computer hasn't been issued a certificate, you get an internet-only connection which blocks outbound SMTP, and monitors your traffic with SNORT. If it appears you have a virus or are passing bad traffic, you get blocked.
Re:Fire them! (Score:5, Insightful)
If they won't follow policy, you fire them! What's the problem? In this day and age, IT folks are easy to replace.
Think you can't? I beg to differ - I don't care who you are.
I think you need to meet somewhere in the middle. Employees expect some flexibility with their equipment, and yes there should be limitations on what you can or can not use on that equipment, but a blanket statement like "Don't follow the policy-fired" isn't what is really being asked here.
How do you find a good position for where the policy and employee desires meet? I certainly wouldn't work for a company that refused to even consider installing certain programs or the use of certain 'gadgets'.
An example of this is that how certain 'closed' or camera restricted areas are modifying their policies and training so that people can carry their cell phones with them since they nearly all have built in cameras. IE: in areas where you are already allowed to carry a cell phone, you take a special training course and then are allowed to use a cell phone that has a built in camera. There are still restrictions, but it recognizes that it is hard to find a phone w/o a camera.
The result was that you ended up with VPs and such who couldn't pick the cell phone they wanted because the stores didn't carry them without cameras. And if you don't care that a VP wants to pick a certain phone, and the only rationale you can come up with is "It's policy" Then perhaps it is you that should be worried that IT folks are easy to replace.
Parent
Re:Fire them! (Score:5, Insightful)
That's a nice theory, but unless you work in fast food high turnover is not a good thing. It's very expensive to find and train qualified people, so dumping them for minor things like this is unwise.
Parent
Re:Fire them! (Score:5, Insightful)
That's a nice theory, but unless you work in fast food high turnover is not a good thing. It's very expensive to find and train qualified people, so dumping them for minor things like this is unwise.
Pretty much.
It is much easier (and cheaper) to restrict things, but give employees the ability to request certain features, programs, or support for gadgets. It does take time to evaluate those requests, but it is certainly cheaper than replacing an unhappy employee or one that needs to get around the blocks because there is no method to request acess. When you make the decision, it is also helpful to explain in a dept or company wide letter why the program or gadget is blocked. Do not install "XYZ" will only get you so far. Do not install "XYZ" because it has a known security flaw that we cannot allow on our system, will give you a much better response.
Parent
Re:Fire them! (Score:5, Insightful)
Cos yes, the bright minds at my working place have a blanket ban that prevents downloading every damn
And of course they also ban every IM program available, even if using it actually would save time and improve productivity, cos we won't have to send a freaking internal email (slow as hell, btw) to just give the other a job related url, a block of code, or whatever.
Yes, I know I should just tell my boss "hey, can't do it, go and tell IT their policy sucks bigtime". But my boss answer is "download it at home and bring it back in your usb". And since I'm not going to spend my free time downloading things for my job, I just circumvent their stupid policies.
So before blindly defending a strict IT policy, make sure it actually makes sense.
Parent
Re:Fire them! (Score:4, Insightful)
You're assuming that if you ban IM, people will be more productive. I don't think that's true: they'll just find something else to be unproductive with.
Workers need time off besides lunch and coffee breaks. Either way you'll get the unproductiveness, either through sloppy work at the end of the day or by them having their mini breaks. If that time is spent chatting to their girlfriends, that's fine.
On the other hand, when they are being productive, they can easily save time by sending bits of code or whatever through IM. This increases their productivity.
I don't see the problem, except for if I would find myself working for a person who is this restrictive about my life, I'd quit in a heartbeat.
Parent
Re:Fire them! (Score:5, Insightful)
I don't think anyone would question IT's value - just that when they get all self-indulgent like the obviously trolling grandparent... well, then.
You don't fire a guy for installing software - unless he's being malicious. And then you still don't fire him for installing software - you fire him for being malicious.
We used proxies to do our football pools while at work... after 10 years of doing it they suddenly installed a blocker. Did our manager know? Um, yeah, he was in the pool. Sure, we could have done the pool from home - but shouldn't work want me there? Old lab machines running Windows 95 suddenly stop working because some IT guy decides to put some policy enforcement agent on them that uses up the entire 32MB of RAM... doesn't put in RAM of course. We disable the program, computer fixed. As a result, the helpdesk guys refer people over to me when someone complains about a really slow ancient computer. IT one day caps our outgoing email size - tells us that "email is not suitable for large file transfer". Of course, they don't give us outward-facing FTP or anything else that is "suitable". Nice. So we buy space on a godaddy FTP server and use that until they get their act together.
IT is great - except when they aren't. Not everyone breaking the rules is someone you'd want to fire.
Parent
Re:Fire them! (Score:5, Interesting)
There doesn't need to be this rift between IT staff and the people they support, the two groups need to work together. At least, that's what my group does.
Parent
Re: (Score:3, Interesting)
The nice thing about IT people is that there are plenty of good ones, and you can afford to hire them and fire the idiots.
The joys of having linux administered for me by someone else:-)
Re:Fire them! (Score:5, Insightful)
Installing a potential attack vector like ICQ when you were asked not to should be grounds for firing.
No, it shouldn't.
Then again, why does IT let these people even have the ability to install software of any kind?
Exactly. The only reason we have IT is because the average person can't keep up with all of this stuff. If security and networking were easy, there wouldn't be an IT department. If IT wants all potential attack vectors ruled out, then they should do it by locking down the PC. If an otherwise good secretary clicks on an ICQ installer at some point, she sure as hell should NOT be fired.
Let me ask you - if you lose your ID badge, maybe leave it on the bus... should you be fired? After all, someone could use it to enter the building - it's a security risk that is all your fault, regardless of intent.
Parent
Re:Fire them! (Score:5, Insightful)
Problem is: you're dealing with real actual people that have real actual lives and interests. Your job is to secure IT infrastructure AND support your users. If you care only about your holy sanctified security, you're only doing one half of your job and if they manage to install software, you don't even perform that half properly.
People use ICQ at home all the time and somehow many of them manage to not get rootkitted and that's not out of sheer luck. So where's the problem in reproducing the same guidelines for your workplace that sane home users follow when using ICQ? There are peer-reviewed GPL'ed ICQ clients, remember?
And why is IT security on desktop machines so important? You control their web access, you control your servers and your data center is behind many layers of firewalling. The worst that could happen is a w32.Blaster outbreak among your workstations and that's going to happen only if you skimp on updates, scanners and internal firewalling.
So what? You have images to reinstall one machine in less than ten minutes. The poor little user who wrecked his machine by installing ICQ will be ashamed for weeks among his coworkers. You can BOFH them into oblivion later on, so why should anyone be fired then?
And then again this is not only about revenue-risk-tradeoffs but also because of company attitudes, company loyalty, trust between departments and an environment worth working in. After all, we all do 10 hour workdays sometimes and God help our office staff if they were confined to Word and Excel only then. We want them to actually like going to work, because that saves a ton of wage raises in the long run and reduces turnover by extreme percentages. If you annoy your users, you cost your company brownie points and raise turnovers. And high turnovers cost more than all ICQ desasters combined.
Parent
Re: (Score:3, Insightful)
Yeah, I know exactly what you mean. Honestly, I don't know why IT doesn't just lock down PCs as the default. None of this "make a business case" stuff to install something new - just have a half-competent IT guy okay the install and let the user's supervisor know that it's going on.
And sometimes people who fancy themselves competent make some mistakes (ahem, me, ahem). Like one time I was testing QNX (we used it on an embedded system) and I plugged it into the network with a fixed IP and it crashed a bunch
Re: (Score:3, Insightful)
Well, it seems like the useful number here is "how many IT guys could I fire if people followed the rules a little better". Are you sure you want management to have that number? I'd expect them to announce a policy, fire half the IT staff, and consider it a win. People wouldn't actually change their habits, of course, so it would be unpleasant all around.
Look up "Enumerating Badness". (Score:2)
The problem with depending upon anti-virus packages is that they are reactive. And their is a delay in them.
It is a LOT easier (and verifiable) to identify what SHOULD be on a machine and then remove everything else.
Which is why most decent IT shops lock down the machines so that new apps cannot be installed on them.
Re: (Score:3, Insightful)
It's interesting you should mention that, because it's Internet Explorer that is most widely known for having such serious 0-day exploits.
You know, the browser that you're usually required use instead of that untrustworthy, shifty, new comer, Firefox.
If "it might break someday" is your excuse for saying "no", you might as well shut the whole company down now, crawl into a deep bunker and hide until the day you die.
Unreasonable cowardice is not a virtue.