Security

Ask something
Discussion Locked

Does your organization filter Internet access for users?

0 helpful
21 replies

by jasonhiner

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

A new TechRepublic poll asks, "Does your organization filter Internet access for your users?

Yes, we filter access for all users
Yes, we filter access for some users
No, we don't filter access for any users"

Do you filter your Internet access, and if so, what kind of stuff do you filter out? Porn? Sports? News? Video?

21 replies

by rick_b

We filter all our web traffic both for security and content. Our content filters cover porn, hate sites, gambling, online gaming, file sharing software and a few others.
Our main goals are 1. Protect the network and 2.Create a none hostile environment for all employees.

by maevinn

Everyone is filtered. Excluded are all sites that are clearly not work related--gaming sites, most forums, Ebay, etc. Heck, everyone posting 'tinyur' leaves me out of the loop until I get home. Also on the filter are public email accounts--hotmail, yahoo, etc. Apparently some study revealed that most network infections were the result of someone checking web based email accounts.

by jcyran

Is anyone else blocking the public email accounts? Anyone familiar with the mentioned study? Any fall out from blocking these?

by roger99a

We filter all users but some are filtered differently. The people who can get me fired are protected locally using hosts files and IE secure zones. Normal staff go through a proxy filter to block spyware, external email sites and a lot of other crap in addition to the other protections.

by nicknielsen

Users are granted web access on an as-needed basis and must log throught the firewall for access. After that, certain functions or sites are blocked, although there seems to be no rhyme or reason. For example, FTP capability is only available only to certain corporate employees; contractors (me!) are blocked. I have to leave the store to find a wireless hot spot so I can download the files to support the store. :^0

Isn't life wonderful? :p

by slipperywhale

This is a protocol in progress. Generally I feel that staff should be able to do as they wish. Visiting dodgy websites should be covered under a Code of Conduct instead of prevented by me. I explain to people why they shouldn't install software without clearing it with me, and why dodgy websites (generally 'free' music or software cracks etc.) are a problem for the network. I do feel that there is a freedom issue here, however, and I also feel strongly that it is a good thing if staff can have access to a high quality network with good machines for personal use for a little of their time in the office (then they don't need a home computer - yipee, resource use reduced). However there are obvious problems, and I have had some extra work because of having to rebuild horrendously infected machines. Clearly a balance is required here. I can't claim to have found it, but if I can run the network without any blocking then I feel I will have done my job. The time may come one day when I need to make my job easier and apply some restrictions but, make no mistake, that would be for my benefit and not for the benefit of the organisation as a whole (unless it becomes impossible to run the network in this fashion).

by slipperywhale

...there are only about 40-50 (depending on how many have recently been made redundant), and half as many again overseas using exchange services only. So it is much easier to manage at that size, and also easier to see what people are up to. I wouldn't easily get away with this approach with a larger network, I don't think, but still think it's worth trying for.

by newsletters

This question made me wonder, of all the ways to filter content, what method does your place of employment use?

Another similar question to the original one: How do you DETERMINE what to filter? For example, we found that the major problem was people spending time checking their personal web-based email--a time-waster and also a way to circumvent our own mail filtering--so we blocked that. Also, WHO makes the final decision? The director or the entire IT staff, or members of the staff? The CEO?

by rsexton

The University I work at just implemented "qualifying" in addition to filtering. If someone attempts to use a wireless computer on campus, their system is checked for the presence of up-to-date Antivirus software, and if it's a Windows machine, that its Windows Updates are current. If not, the only place they can surf to is an appropriate location to download necessary software/updates.

by sql_joe

We filter anything that has the word "game" or "gambling" in it, plus all the usual porn and chat stuff, but its okay to go to NASCAR sites, Fantasy Football sites (which is gambling, gotta wonder), shopping sites, and pretty anywhere else you want to go, especially if it involves hunting or sports. Oh, most History sites are blocked as well...apparently we don't value education in this company.

by slipperywhale

Something odd occurs to me here. Although if I was told to do something by management then (after argument/discussion etc.) I would clearly have to do it. But noone has ever even mentioned this issue to me, and I have pretty much worked it out myself, with some IT contractors who do system admin work for us. So it is my (informal) policy that is applied. An unusual, but quite nice, position.

by gooder

...from your previous post, your policy is not to filter?

Surely that's the default state of any internet connection, and why home PCs are the greatest victims.

As the resident IT experts isn't it our job to point out the risks to the company network and recommend countermeasures? I include staff time-wasting as well as technical issues.

Even if you are covered by anti-virus, etc. letting staff browse just anything is risky. In my mind that says "filter before something nasty happens"!

by gooder

Our network is roughly 100PCs, a few servers, etc. Most of it on one site.

Only users with business reasons get access to the Internet (on work PCs - we have 2 PCs in the canteen for personal use). Nobody is allowed hacking, violent, porn, tasteless, etc. as I prefer prevention to cure, and it aligns with the dignity at work policy. Anything that steals bandwidth (radio, video) is also restricted.

Approved users are grouped into low, medium, high.
Low only allows access to industry-related sites, the weather, education, and online phonebooks.
Medium is as above, plus research, business, marketing, news, IT, travel, vehicles, government, health, etc.
High is as above, plus shopping, social, sports, entertainment, etc.

The canteen PCs are even higher, but still don't get the potentially dodgy categories. These are the only PCs allowed access to web-based email (they are easy to rebuild!).

There is also a "tight" group restricted to a handful of specified websites rather than the preset categories. This is mostly for the manual worker areas where tracing abusers is more difficult due to shared logins!

The IT dept has the most open access (excluding porn, etc), but it is a small team that knows I'll pounce on them if they took the mickey with the trust given them!

A recent survey around heads of departments and directors asked if the filters were too tight or too loose. They all said they were about right, so no changes required.

I think the provision of the canteen PCs deals nicely with any gripes from staff about the restrictions, and also gives a free service to our manual workers who don't even have a business PC.

by jneilson

The computers at my company aren't blocked. Everyone here seems to know what is off limits.

by rrmayer

Yes, we filter access for all users and we have not had to reinstall operating systems due to unauthorized internet activity. Our bandwidth availability has increased by 25% to 50%. The filters enforce our internet/email policies.

by wesley.lal

No, we don't filter access for any users. Its basically a free for all, but no torrents! Mirc is considered a collaboration tool in our policy.

by slipperywhale

I agree with jneilson about the fact that staff know what they can and cannot visit. I think we all know what shouldn?t be permitted. However I do disagree with the policy of preventing use of internet mail etc. (talking from a non technical point of view here) since I feel that a proportion of the working day is well used in checking news, becoming generally better informed and, if required, doing personal emails (in any case I use my personal email for quite a few work related issues ? testing, subscriptions etc.). Can anyone explain to me exactly what the risks of a filterless network are to me? I have had a couple of instances of having to rebuild because of infections caused by visiting either porn sites or software crack sites, but the consequences have never been more severe than that. Am I at risk of more serious dammage (eg to data on the network drives)? We run Sophos anti-virus on the server and PCs, Pure Message (email filtering software) on the exchange server and Windows Defender on the PCs.

Noting Gooder?s comments, I?m not sure that I have the resources (we are a small charity with too much work to cope with, most of the time) to have multiple levels of security settings.

Do you think that my policy of no filtering is likely to get us into more trouble than the occassional rebuild?

by gooder

The only problem with virus and spyware protection is the delay between a new "nasty" and the update that covers it. There are always horror stories like the recent one about a vector graphics exploit which Microsoft released a patch for (eventually). Apparently porn sites took advantage of this bug very quickly. Because it loaded from the website a mail filter wouldn?t have helped. Blocking certain types of site, or alternatively only allowing certain sites, helps you plug this last hole in your defences.

It comes down to time (yours) and money (your employers). If you don't mind rebuilding PCs when a naughty user browses porn that's ok, but what impact did it have on your day, and the users day? What happens when those couple of rebuilds become a whole department because they've all looked at a "funny website" somebody's mate recommended? Worst case you come in one Monday to find all your PCs have been sending spam emails out through your (traceable) Internet connection all weekend, bypassing your filtered Exchange server altogether?

Can you balance the savings of not using a filter against the potential risks? If a filter costs twice as much as your time spent rebuilding PCs, plus the users downtime, plus delays to other projects while you do it, then it?s cheaper not to get one. Going beyond financials to quality of service, staff time-wasting, and company reputation it?s not so clear-cut.

If the boss asks, can you show your decision not to filter was a considered one? If you've gone through the exercise and have some facts and figures to wave at them, then you?re ok.

I have no idea how likely these nightmare scenarios are by the way! I just see filtering as an insurance policy. Whether you just use it just for safety or also help managers stop time-wasting depends on company culture.

Cheers!

by slipperywhale

That all sounds reasonable, Gooder, I must say. Perhaps the time has come. Particularly convinced by many staff looking at the same site one day and knackering a whole groups of PCs instantly.

Amusingly enough the porn surfer in question was my boss! An interesting situation there, I must say. He took to leaning over his machine when I was working on it to say 'have you found what the problem was'. 'Er, think I'm getting there' was all I could say, under the circumstances (or rather, I decided not to open the debate with him).

I suspect some basic filter would be a good idea for us, based on the discussions here. Now to implement it, I suppose (although part of me is curious to discover how soon aforesaid boss does reoffend in this way...).

Thanks for your help. Have a good day.

This discussion is closed to new replies.