Am I A Tyrant?

The point is still being missed. IT doesnt' determine IT equipment use, management determines such policies. Just do the job which includes providing meaningful data and information to management as it relates to your functionality

We use Lightspeed Total Traffic Control to block content ( it is more granular than Sonic wall ). We block sites that are a total waste of business bandwidth like ads and music. We also block sites that are dangerous to the health of the network and the computers themselves. Since we implemented this we have seen a dramatic decrease in spyware. This policy has allowed us to make more efficent use of bandwidth.

I have also ran into problems relating to this issue. And this is my reasoning. It is correct that IT is not responsible for determining who is allowed to see what. That is the responsibility of the HR Dept. or who ever manages that aspect in your company. However, it is the responsibility of IT to keep the computer systems up and in working order. To do this, precautions need to be taken into consideration for viruses, spyware, and other problems that can arise through the internet. Because of this, IT must restrict sites that could case harm to the network. It is also the responsibility of IT for the network to run as smooth as possible. Listening to the radio, watching streaming video, etc. will slow down the speed of the network and cause loss of productivity (not to mention fustration) for the other users.

You are no where near a tyrant, you are just trying to do your job. At my company, I have to hold a 98% uptime. There is no way it would be possible if the users had free access to the internet.

You still miss the point, you aren't the determiner of what is 'right and what is wrong'

Do you have the responsibility and authority to make policy? They are not your policies.

Implementing filters using your best judgement is rarely going to win you brownie points. Instead, more often than not you wind up taking a beating.

One way to approach the situation, without installing any more filters, is to indicate to management that users are complaining about slow response. Explain that you will monitor network usage and illustrate (charts/graphs) how much (percentage-wise) is going for "other than strictly work-related activities". Approach management with this information. Indicate that one solution is to block this non-work-related traffic during work hours (not popular -- doesn't win them any brownie points with employees as you found out). Another solution is to prioritize "work-related traffic" by purchasing a traffic shaper (Packeteer, etc.). Yet another option is to purchase more bandwidth. Be prepared to present costs and implementation timeframes with these options when you present your traffic study findings.

If they say "that's fine, leave it alone," then move on to step two. For users complaining that the net is still too slow, refer them up the management chain. That will either stop the complaining or get management's attention to revisit your options.

Finally, you should re-visit your security policy with management and get some clarification. Suggest modifying it.

Make a business case for the cost of non work-related web surfing, and ask for someone else of equal authority to make a business case for allowing the surfing (morale, productivity, recruitment of out-of-the-box thinkers, etc.) Give both cases to the CEO and sleep well carrying out the decision he/she makes.

If they want to surf, log it to show overall percent of bandwidth and associated cost. If they complain about speed, request money for more bandwith and present the usage data again. They can;t have it both ways - the squeeze is no on you personally - people want something for nothing, and they can't have it. If the company wants to buy a T3 for surfing stock trade sites, that's their decision.

Why - well as I've also been labelled just such for upholding company policy - also control freak was the other label.

However, the serious answer is no you aren't being unreasonable. So long as you have the written policy documentation to back you up, then I'd just keep referring whoever back to that. So long as it isn't the company owner or head honcho, you should be ok.

It is the responsibility of everyone NOT in management to carry out the policy OF management.

For example in our IS/IT department it is our responsibility to give good solid information to management so they can make sound decisions. They then give us policies that make sense, and it's our responsibility to carry out those policies - whether we agree with them or not. If we don't then there's the opportunity to discuss them if the management is reasonable, and go elsewhere if not.

In this case our policy is to be conservative and if there's any question on the website being visited then it's blocked. Not only is there a band-width issue, but also the amount of time some folks spend surfing is outrageous!

Our surfing spy software provides us with a report, and we have regular meetings with management to tell them who's surfing where. It's all legal because every employee is methodically reminded that the equipment they are using belongs to the company, as does their time. If they want to check on boat part orders during lunch that's okay - but not porn, gambling, etc.

We've even had legal research our liability in allowing that type of surfing to go on, and we're ONLY protected because of our strict policies.

Yes, I have been tasked with keeping the internet / network safe from whatever I can. This however seemed to go to far. My biggest upset was that there wasn't a, "in the future" conversation. It went from doing what I was doing to, "How dare you do it?"

Live and Learn I Guess.

I feel that if our main job is that of IT/IS, then we can't spend our time policing employees, especially those in other departments. If policies are in place then that's the best leg we have to stand on. We have to rely on other Dept heads and Mgrs to police their employees. this kind of 'Lockdown' will only get bigger and consume a lot of your time than you want it to. The Internet is always changing and sites will always change, die, and be newly created.
Do you want to spend valuable resources monitoring this? If employees fail to do thier jobs because of this that's on them and thier boss not us.

I see the point of overstepping my bounds, but my bounds were never set. This action is what set them. I do at this point have a plan of action to gather data and report back with suggestions.

We too use a content filter to block certain categories of web sites or file types. How we got around the complaints is we made our Top Level Managment decide what is allowed and what isn't. If someone thinks they need access to a certain site for business reasons then they have to plea their case to them, not IS. IS is subject to the same rules everyone else is and complaining to IS won't do any good. We don't make the rules, we just enforce them. My advice is to get your managment to be the rule makers, not IS. And communication regarding the policies, should come from them, not IS. This will stop a lot of the complaints.

Hello RRosca,

The espn thing isn't so much because of over use, although there is one guy in sr. mngt that is constantly looking over the stuff. It is more so the use of ESPN's Bottom Line sports ticker. It has several different pieces of software in it and it constantly receiving data.

I am now trying to find the balance. I see both sides of the scale here.

This just goes to show the arrogance of people who believe work is just an extension of their household ISP. I believe if you are at work you are there to work not surf the net. If they continue to complain I believe a notice from the head of the company explaining their job does not consist of checking the PGA scores unless of course they work for the Golf department at a sports network and are reporting those totals as part of their job. As far as buying their nicknacks at work I believe that would be reason enough for a reprimand for lack of doing what they are actually paid to do, like their job perhaps.

You mention that 5-10 people are listening to Internet Radio. How much bandwidth does that take up, and how much bandwidth do you have? If it is causing your network to be too bogged down, then you need to do something about it. If not, you could be hampering productivity of the workers for no reason.

You mentioned that you got viruses on your network. Were the e-mails that caused it from the person's work associates? If so, then locking them down won't do anything. You have to make sure your mail server is secure. Make sure it can't be used to forward other people's spam and make sure it has proper virus filters on it. And, regularly send out e-mails warning people of impending attacks and dangers. Teach them to avoid virus laden e-mails.

You can put people's home directories on shared drives and lock their workstations from loading unauthorized software. You can also put virus protection on the machines that also looks for spamware and other malware. And when people complain of something messing up their system, have a standard pristine user setup that you can slap over theirs. After a while, they will figure out that messing around on the Internet will cause all their "favorites" to disappear and extra software to be unloaded, if they aren't careful.

And, by all means, install personal firewalls on each machine to keep out known attacks, in addition to a network firewall. This might help prevent the spread of malware in your system when one becomes infected.

There is actually a lot of freedom you can give the employees, if you design your network properly. And, people spend so much time at work, that it is beneficial to give them some leeway. It keeps them at their desks longer without burning out.

IT has to keep up. Employees aren't expendable and loyalty must be rewarded. If any policy makes employees frustrated, angry or annoyed and you get management support to further your rule of network nazi, you won't be helping your company or your fellow employee. I think the point if IT in the modern world is to help people do their jobs by providing the tools and maintenance to keep them happy. The extra toner and long distance bills and a wee bit of congestion on the network isn't worth alienating even one profitable employee. The last numbers I've looked at indicate that each employee produces just over 4x the profits of all their expenses. So basically if an employee gets paid 50gs and they bring in 250gs worth of profits, the additional phone use really shouldn't be an issue at all. Especially when people are now expected to arrive early, work through lunch and stay late into the evenings to get projects completed. If I was your manager, I'd ask you one question, "What are you doing to annoy my five top producers in this company?
The second thing you need to realize is that your job is a "professional service" to the company. And similar to a doctor, you can provide advice like "quit smoking". But don't feel alienated or angry when people don't quit. And don't try to "get them fired" You are supposed to be "above" all of the chaois in the office, an objective service professional. If bandwidth suffers make a case to get more of it. Take the employees side so that management can get more value out of them. If they want to make long distance calls on the companies free IP long distance system, surf the internet at blazing speeds or print on your coolest printer, that should all be encouraged so that they will feel like they owe the company something in return. Especially in this day and age when people take two years to train and cost an average of 250,000 to do it. If even one employee stays in their job for an additional year because your made it easy for them to stay... your salary has been worth it to the company. Get faster computers, faster printers and an IP long distance system to minimize the costs to the company and give the most valued asset any company has free reign to get their jobs done.

Time for the folks in the company to accept responsibility, especially those in management. Sounds like your doing all the right things, the company I work for, UPS, is much more restrictive than you are. Your managers have no idea what restriction is! Anyway, as an IT tech I fully appreciate your desire to please your users while keeping the net environment safe. But it is all so difficult when dealing with ignorant baboons who dont want to become educated on your issues, they just want what they want. (Good luck)

But it is not so much that looking at Porn would get me fired, as divorce and separated from my two best friends. :-)

Someone in your company is responsible for total security, find them and get them involved. The problem with a security policy is the approval chain. I have found that in many small organization IT is responsible for IT security but IT has a boss too. All policies must have up managements approval. If you have received these sign off's, then forward all resquested for more access to the appreiate management office and have them copy you on all official responses. Remember if someone brings a virus into the system and the company goes off-line you are the one who will loose your job and probably not the responsible person another words get out of the middle.

Like all jobs that require security, IT is not a democracy. Set the policy and stick by it. I'm a network security manager in the Army. My CO doesn't like not being able to check his sport pages, but oh well. It's either let everyone do what they want and there goes security, or suck it up, do your job, and surf when you get home. Keep up the good work Gulsath.

It is not ITs responsibility to determine what people are doing at their desks. Site blocking doesn't even remotely fit into a legitimate security scheme, since it is not process driven.

I know I'll get a lot of flack for this in the IT community, but stop and think for a minute. For any of you old enough to remember pre-internet days, how were these things handled before we had the internet? There is nothing out there that wasn't available BEFORE the internet came to the workplace. The internet is just a medium. The content has always been out there. It is management's job to police people's behavior. It is IT's job to keep the equipment running.

ALWAYS REMEMBER! IT is a SERVICE to the company, not the companys' reason for being. Cease to become a service, and you could find yourself sitting on the curb with the accountants.

Consideration of the number users depends on WHY a certain restriction is being implemented. If bandwidth considerations are involved than certainly the number of users vs. bandwith will drive the decision.

On the other hand if "this is simply not something you should do on work time," then ovbiously # of employees is irrelevant. Beware, because the filtering of "non business related sites" can get out of hand.

Human Resources may have an initiative to help with work-life balance, and be doing things like contracting with a company to do oil changes in the parking lot, pick up and deliver dry cleaning etc. to ease the "errand burden" on busy employees. At the same time IT may block access to 1-800-flowers.com or gift shopping sites. IT, driven by by different measurements, doesn't have the head-set as HR, leading to this ironic state of affairs.

Clear and simple. I err on the side of giving people relatively free reign over where they want to surf. As long as everyone is aware of the organizations Internet surfing policy, he should not assume responsibility for what they do. Those who violate the policy should be held accountable, but each employee should have the freedom to surf. Of course, restricting access to gambling and porn sites is something entirely different. I don't think anyone would disagree with restricting access to those types of websites.

Let me ask you this, are you financially or legal responsible for administrating internet use (policy) within your company? If you answered yes to either of these, then no, your not a tyrant. If you answer to someone else, a supervisor and/or CIO, and you made these changes with out their consent or knowledge, then yes, because it wasn?t your call to make.

Having said that, for right or wrong, about a half-dozen of my associates have initiated a ?white list? policy to protect their companies. Basically all sites are blocked unless you clear it with CIO, CEO, CFO, etc?. As a regular employee, you would go to your supervisor and request access to a certain site or service, they would submit it to the appropriate officer and if a business reason can be given for allowing access to that site, then it?s allowed, if not, Sorry. The decision to allow or disallow stays with the policy makers. IT only implements those decisions.

BTW: AOL for example is blocked because too many people were using it as a proxy.

Lots of banter here about policy. Every company should have a
written policy covering Electronic Transmission and
Communication Resources. That policy, like all the policies
governing the workplace, should (a) be in writing, (b) be
discussed with each employee, (c) be given to each employee,
(d) employees should be required to acknowledge in writing
their receipt and understanding of the policy. Then, like all
policies governing employees, supervisors and managers are
responsible for seeing that employees for whom they are
responsible, follow the policies.

Trying to enforce this from IT is not smart. If a
subordinate of mine was violating a policy, I wouldn't welcome
IT trying to discipline him or her. Management should write a
strong policy and then tell ALL managers to enforce it or ask HR
for help. HR should be working hand-in-hand with line and
staff managers to resolve issues like this.

If any of you IT gurus would like to see a written policy that has
been in place for over 5 years, let me know.

- HR guy

I feel your pain--I went through this years ago, but before it became an issue, I sat down with our HR people and talked about the filtering technology. When I told them that we could block based on potentially offensive content and that the vendor made those category decisions, HR was all for it.

We block based on the categories of gambling, adult content, and web-based email. The last of these, web-based emails, was the only call that IT made. The decision to block web-based email was a technical one--we don't have the mechanisms in place to scan web-based email, so we block the sites.

To make a long story short (TOO LATE!!), I would put the decision of what to block in the hands of HR. This gives you a bit of a shield when users complain, and it really is an HR function.

It sounds like part of your job description is to keep the office's network up and running for business use. That means security is your responsibility. I used to have the attitude that Internet access should be free & unrestricted. Between worms, viruses and music download lawsuits, I've come to the realization that that if you want a safe network, you need to restrict. Anyone who complains that it's unfair is either naive or selfish. I don't go into other managers departments and help myself to their resources for my personal use. If it's not for business use, don't waste my (and your) time asking for access. Of course I explain very nicely why that 'free' game site is blocked (security), but blocked it shall remain. The only thing I add is that if, after explaining the costs and risks of allowing employees to have unfettered access, your boss, or someone else farther up the chain of command says "I don't care, just do it." then try and get the directive in writing and do it. And keep your fingers crossed.

I believe that it is the right of the employer to determine and dictate internet access within their company because the access uses company assets, which includes employee time. Employees have a choice. I control mine and have many clients that do the same. There is a direct cost/benefit ratio associated with the need (and luxury) of doing "business over the net."

I worked at a place where you had to get approved for internet access by your supervisor. Then it makes excessive use to be a matter handled by your immediate supervisor. Having limited users cuts down on potential bandwith useage and also potential system infections.

Everyone had company email, but cruising the web was not automatically a right.

My thought is that if internet access is not needed for the job, then the user's complaint is kind of frivilous. You are not entitled to web internet access as part of your job becaue there is a PC on your desk. Streaming sports scores? Unless somehow part of the job, they are probably not needed.

Providing bandwidth useage reports to management will let them decide if they want to limit access more. Let the management decide policy, and you implement what they decide.

I agree with first getting management approval before beginning site blocking, getting approval on how the users will be notified etc. so that there are no surprises if people start groaning.

If you are a public company then Sarbanes-Oxley says you have an obligation to insure integrity in your systems. You can not insure integrity in your systems if people just surf willy-nilly. The risk is too great. Yes the company owns the computers and you have a responsibility to protect them. It's only the Senior Management that go to jail when compliance is ignored. You might pass that along. Good Luck

For starters, your watching the company expenses, the same as personal phone useage. Also, you need to lock out the normal hate/violence/pornagraphy sites. If you allow total free acess to the web, your company could find itself in the soup if an employee uses their aceess to send unwanted xrated e-mails to other employees . Same with hate/violence. Check with the HR dept for your backup

Gulsath,

The decision has already been made for you. You are simply enforcing it (which it is your right to do).

It is entirely inappropriate for people to access some types of sites at work. In the same way that companies are liable for sexual harrassment that happens at the office party, they are liable if employees are exposed to porn or hate at work. Casual exposure to these things, whether they're on the monitor or on the wall, must be prevented if you are to enforce people's rights.

So, you are just complying with law when you block porn or hate (or anything that violates human rights).

As for the other stuff, it's more touchy. Some incidental web use is ok, just like it's ok to call your wife on the company phone. You have to watch for excessive use, which means monitoring surfing time and setting reasonable thresholds. Surfing at lunch or on break should be allowed.

This is what my company does.

I can certainly understand your frustration and those of the employees.

It appears from this very brief synopsis that your company has not done a very good job of communicating I/T's responsibilities. If indeed they have communicated that part of I/T's responsibility is to enforce corporate policies in the use of corporate computer equipment, your actions are justified to restrict access in alignment with the corporate policies.

Morally speaking though, I would find it very difficult to accept your individual enforcement as the best approach for the company. There are quite a few very good informational sites that will get blocked.

If we just examine the News sites available, we can certainly understand the disconnect. Some News sites are "Fair and Balanced" while others lean one way or another. Each individual has there own interpretation of which News reporting style they feel is the right one (Excluding the Naked News site that we all know wouldn't fit in any corporate policies). How can I accept your decision to provide the right access viewpoint to the information I feel is needed to allow my business organization to make the right business decisions?

Ideally, reversing the access method provides:
- The most control
- Eliminates most controversy
- Allows for strict adherence to corporate policies

All that is needed is to block all sites and only allow exceptions which have been submitted via request form (Of course, you can start with a limited list of open sites). You can still use the Filter sources to identify information about the sites. Someone or some team ultimately needs to review the information and determine whether it complies with corporate policies.

Don't forget also to re-evaluate sites since the domains could end up be transferred to other less reputable uses.

Now, we've created a relatively large organization just to regulate the Internet access. Most companies aren't going to really care to invest that much time and effort (ultimately, money) into making sure employees comply with the corporate policy. At least not to the detail that I've just iterated.

Companies are looking for that balance that keeps the employees working, completing their task, and generating value, while keeping the company from being involved in law suits. They don't want to have to be involved in a law suit because someone saw something indecent on someone's screen or someone pirated some software or copyrighted material. That costs them money as well as resources. The company has to develop corporate policies to protect themselves.

If companies are going to include limiting statements in corporate policies, they should be required to enforce them; otherwise, change the policy to indicate the level of restrictions the company is willing to enforce.

If companies are going to include limiting statements in corporate policies, they should stand behind the entities they have given the responsibility of enforcing those policies.

The next "SOX": corporate failure to enforce documented policies.

I am in the same boat with you. I have a host sonic wall and 12 remote sites all with sonic wall. I have been with this company for a year as there IT Manager. I am the only one in the IT department. When I started people were using internet radio, downloading what ever they wanted and there was on policy at all. After being here for a month 1 user got a virus, thank god my 6 servers did not get infected but a hand full of other machines in our network did. That employee thought it was funny. Nothing was done to him but I can say that now I am 1 of the most hated people in the company and I really dont care. MY job and YOUR job is to protect our network from this happening. I documented and showed the company CEO, General Manager, and Operations Manager how much money was being lost by letting people do what they want and suck up bandwidth. Not to mention the time that could of been lost because an idiot thought it was funny that he infected a hand full of systems. You wont be popular but you have to protect the network. Its our job.

I would rather hear the complaints and jeers than to be fired for having the proverbial screen door on the submarine (netsec-wise).

What the heck are the employees doing surfing the net anyway? I understand there is down time, I understand there is such a thing called "lunch" or "breaks". But if the employees understand the primacy of their work and the importance of your job TO PROTECT THEIR WORK, then they should stop whining.

Dont do a typical i'm GOD in IT and go totally over the top!

Communication is everything.
I manage a realatively small network of 80 users. EVERY one of the users know that they can pretty much do or go where they please... except no porn vids or any high bandwidth action.

Break the rules... written warning.

I find that because i am reasonable users dont take advantage the same. We really dont have these bandwidth issues.

I like that phrase. So do most corporate executives.

The IT Department has a "fiduciary responsibility" to maintain the organizations computer assets. This includes limiting (and terminating) non-business related use and abuse of those assets.

Legitimate needs can be addressed. And those wishing to access non-business related sites can always submit a request for approval.

Stand your ground and consider the consequence of failing to safeguard your system. When a virus takes down the network, or a hacker trashes your data, the first head to roll will be in IT for failing to secure the system.

Wow....People spend more time at work, live at work, kind of ridiculous statement huh? Spend 8 hours at work and 16 at home (give or take a few).

Simply put and as harsh as it sounds, people don't live at work. They are hired to do a job, and are paid compensation for that job. If they want to check sports scores, etc., then buy a newspaper or a radio for their desk (like me and millions of other people). If they want to shop EBay, then let them buy their own computer and do it from home. People aren't paid to surf the web, or shop EBay, to download whatever they choose.

When the people here start in with "it's my computer, etc." I remind them that unless they've paid for the computer, the software, and the bandwidth, then it belongs to the company and that the company dictiates what the computer is used for or not used for. It people aren't happy with the policy, then go work elsewhere.

Here at my job, i'm an AutoCAD Draftsmans and the IT guy, we have a 768 cable modem line and 15 workstations. There hasn't been any problems with our lax IT policiies, but if the company ever wanted to clamp down, then it's they're right to do so.

Working from home isn't a viable option for the most part. If you're paid to work 8 hours a day, and you do it from home, just how many hours of that 8 hours are "you" on EBay, surfing the web, watching the soaps and game shows, visiting the p... sites, etc? If you want to work from home, then quit your job and create your own company so you can work from home. But of course that means you'd have to buy all of the equipment, software, and bandwidth.... Hmmm wonder how much surfing and downloading you'd be doing on "your" company's time?

So DC_GUY, if you think that you have to live in "our" office building you can always quit your job that is so demanding on your life. If you worked for me, with that attitude, you wouldn't have to worry about it, because you wouldn't be "living" in my "****ing office building."

Well it is IT's job to ensure the safety and security of the network. Now, using your theory, if Joe or Jane Blow surfed to the "All The Free Porn You Could Ever Want" website and downloaded any number of trojans, worms, etc., then I guess that it wouldn't be IT's concern with the network when it goes down, huh?

I think many of the suggestions made here have been right on target! Security is NOTHING to skimp on and the "better safe than sorry" adage is applicable.

I would add one thing - use the adage for yourself. IF senior management INSISTS on letting people surf, I would seriously consider going to an attorney and getting a contract written up that you're not responsible for what happens to the network due to employee abuse of the internet. If senior management doesn't sign it, WALK!! They're setting you up for something that could be very nasty.

Spyware, malware, keyloggers....any stolen information will land squarely on your shoulders.

Good luck!!

At my company, we block the basic stuff: porn, hate sites, and weapons. There are a large number of exceptions currently as no group listing in a SonicWall is perfect.

We do monitor the SonicWall logs for usage trends and may report excessive usage to departmental Supervisors if requested. We as an IT department will not act as the enforcement arm of the internet cops for my company. If an employee is surfing excessive, that is between him/her and their superviser.

I'd love to be a fly on the wall when the FBI comes streaming through the company doors and seizes every piece of IT equipment because they tracked down some Kiddy-porn employee to your company and they're standing in front of the "IT nazi" asking an enormous amount of questions.

If you're doing your job and doing the "right thing" then you won't be looking for a new job, the idiot who spent 7 of his 8 hours at work surfing the net, etc., would be.

You don't list much about yourself other than IT/LAN, but I would bet that your mid-20s, probably don't have any certs to speak of, and expect the world to bow down to you, including the company you work for. If you're more than this I would be utterly surprised.

Applause!!!!!!!!!!!!!!!!

I have similar issue as well. I had to set up the new firewall which now people are not able to do some of the thing they were able to do. I also like you did restriction per our internet policy......I was the bad guy (gal) I like you stated that it was per our policy (which they all read and signed). Just to let you know people do not like change but they will get over it.

I work with the users and do a lot of compromising to make everyone happy, but still not go out side of our company policy.

It sounds like it is time to goto the members/stockholders and have them set the policy.

If you're not blocking this type of stuff, you're probably hurting your company. I'm sure there is some sort of policy in place to use computing resources for company business only, right? If there isn't, there should be.

I get annoyed at some of the things that get blocked where I work (like personal yahoo mail, games, blogger, etc), but I understand why it's done. Not everyone is a responsible user and you typically have to assume most of the people you support are not responsible users.

Make sure you cover your posterior is anyone above you asks you to unblock anything!

If you are trying to keep a bunch of hourly workers from not doing their job, then I suppose you are justified.

However, if you are working in a professional orgranization, then you are treating them like they cannot manage their own time, which means you are WRONG!

Your network users are your personal customers. While you need to protect them from others (and potentially themselves), you need to keep them informed and on side. A bulk mail-out explaining the policy and why it is necessary is useful. We are planning to block all sites, then allow any business sites and common sites, eg banking and home shopping, then others on a case by case basis.

Your not a tirant, but you shouldn't be involved in this. This is an HR issue and should be left at that. It is not our job to be the "Internet Police".

Well lets see, who really owns the hardware that users are surfing the internet on. Also who pays the bills for internet access. It seems that it the company, not the user's who own and are granting access. So long as the policy is followed consistently for all, from the CEO to the lowest worker, then I see no problem!

One finial note, I'm wondering about. Are the user's getting paid for the time they are spending surfing the internet. If so this sounds to me like a form of thievery at worst, or at a minimum a form of unrecognized benefits that your employee?s think they have an automatic and unqualified right to. It seems to me that if these employees don?t like the company?s policy then maybe they should find somewhere else to work; either on their own or at the company?s request.

I live & work in Canada, Winnipeg, MB. to be exact and although regulations may be printed and state that "employers can't have you work over 8 hours (even in salaried position)", it's not true. Employers seem to find a way to do whatever they can. If you punch a card then your OT is document and you must be paid for it but I am a salaried employee working in I.T. and have worked quite a bit of over time in my life, all unpaid. Reason being you have to, you're told that being a salaried employee comes with the understanding that you work O.T. and that your O.T. pay is included in your existing salary (which it isn't!)

Employment insurance is a government provided service to those employees who go on maternity leave or are laid off from work. If you quit your job or are fired, you aren't eligible for those benefits. If you complain to your employer that you work too many hours you may end up with more of the same. They don't come out & say that you must work it, they do "encourage" it and if you don't work the required OT, they will find someone else to do it. Employees are left in a position where if they speak up, they risk losing their job and if they don't speak up, they work countless hours of unpaid O.T. (evenings, weekends) Don't get me wrong, Canada is still one of the greatest countries in the world (our freedom, universal health care, impressive mat leaves for pregnant working women, better gun control laws, etc.etc) but it's not all roses either. I don't want to trash your post but I just want to let you know that it is inaccurate. Strictly speaking from experience.

Hello
Let me open with the following questions:
Do you keep track of everyone's telephone calls? Do you track the number of cigarette breaks an employee has?

Now, is it really IT's area of responsibility to determine what is blocked or not and what makes a 'business site'?

Sure there will be some misuse but that is for the manager to deal with. In a perfect world the manager would approach IT and ask for someone's workstation to be monitored for proof of misuse and then appropriate actions should be taken.

In larger businesses, it is commonly thought that IT people are power hungry and love to lord it over the other depts as a means of 'proving' their worth.

From a business point of view, having someone at their desk during their lunch break (admittedly surfing the net) is better than that person leaving the office to do it at an internet cafe (and potentially be unavailable for longer than the lunch break).

As I mentioned earlier, it is not IT's responsiblity to keep track of each employee and make sure they are working, I'll lay good odds on the fact that you do not know what each job role in the company does and what is requried.

I'll also lay good odds on your company having a zero tolerance for the Adult content sites and the like. So: If someone vies these sites that person gets sacked (forced to quit, asked to leave, whatever you want to call it - they're gone). Problem solved. Two or three people later nobody browses Adult content at work.

You don't have to be tyrant to work in the company's best interest (unless you get a salary bonus for the number of web sites that are restricted in which I say block it all!)

We block any sites involving games, porn, (or related items--depending on the classification of the web site)and VOLUNTARILY block sites for our employees based on their history with the site. Our CEO is a pastor--and we are a mental healthcare agency. One violation and out the door you go--and some days it doesn't even take a half an hour! We DO provide "open season" for GAME sites only for an hour prior to Normal Working Hours and an hour at COB along with the "lunchtime" break from 11 to 2. Then its back to work...and everyone is so glad that they HAVE a job here they're just grateful for a computer and internet use. We also monitor e-mail. Works for us...

Our company does this:
User accesses banned site.
User receives a page informing of this with details of the steps to follow (clickable link creating email with URL of banned site). This is sent to our HR department for OK / NO go of exclusion of the URL based on the reasons supplied by the user.
This has 2 benefits:
1) IT does not have the burden of making the decision of whether the site is OK for use.
2) The user has to really want the site for a valid reason, HR is not a department to burden with lightweight requests.

We have never had an issue with this approach in the 5 years of its operation.

Can you post it here? be good to have a look.

I am the IS Manager for a TAFE institute in Australia.
This problem has been with us for a long time and needs to be addressed in relation to the business continuity of the organisation and productivity of staff.
I have policies and procedures in place affecting both staff and students. Not only do we need to ensure that staff are productive and not spending hours on non work related internet, but we have a legal requirement to ensure that inappropriate material is not available to students or being accessed by staff.
There have been several legal cases against TAFE Colleges for not providing adequate protection.

What staff or students do away from the workplace is of no concern to me, but what they do whilst using our systems is of vital concern, as it should be for all IS Managers.

It is only our policies and procedures backed up by our security systems that provide us with any protection. (And support from our MD, CEO etc)

John S.

No, you are not. Sensoring the others is a bad idea.
If the employer does not hire responsible people, you cannot control them anyways. So, the issue is not restricting the access but communicating with the people.

Kenan Bektas

I am the ISO of a hospital. My age (27) has been enough of a challenge for people to accept. It was the bulk of my responsibility to revise, re-introduce and enforce Security policies relating to the internet and it's usage. The greif that I get becasue of the categories that I am blocking is unbeleivable. But working for a healthcare organization has it's own inheirent risks especially with the New federal HIPAA regulations.

Now, my security auditing and incident reporting is costing someone their job. I'm wondering if the user community will began to hate me or what...I mean no one liked this guy at all...but I hate to see someone lose there job.

I work for a school district so I have seen this scenerio many times. I also happen to be the IT person who has to deal with the filtering of content. When a request to block or allow something comes up, I usually refer them to their Director. If their Director approves it, I will make the change. There are some things that I think should not be allowed, but it is not my call, nor my problem. If they waste their time surfing the web and don't get their job done, it isn't my problem.
The thing to do is figure out who, in your organization, does have the authority and responsibility to make those calls and let him/her make the decision and you just carry out orders. That way if some one comes after you, you tell them that your boss requested it, take it up with him.

I think you definitely need to conserve your bandwidth for business and protect the network from potential malware.

That makes it your business.

In addition, there is the Gramm-Leach-Bliley Act and the Patriot Act that have a LOT to say about securing your infrastructure.

On the other side - almost every business has permitted small amounts of reasonable bandwidth usage when it is not work affecting ( the operative words are small and reasonable). If they make you the heavy it will affect your working relationships and it's not fair to anyone.

Your management needs to issue a memo that carefully explains the credit union policy and the business expectations. Then you can follow it.

If there is no explicit word (or memo better yet) from the top -- I would not put myself foolishly in the line of fire. IMHO

Mike Hawkins

You mention bandwidth complaints. I say let them at it , then when you get complaints ask them to put it in writing and direct it to the person who told you it was not IT's responsibility to directly control access.

Everytime you receive a complaint and detect who is using most of your bandwidth, make sure the company knows about this, ie it is not IT's issue but a company problem which IT has solved.

If you get heat from above over bandwidth performance, make sure you have some stats ready. Then inform them that basically it comes down to 2 choices, enforcing a "work related only" access policy or purchasing additional bandwidth to support internet radio etc

I'd thoroughly recommend anyone involved in IT Security Policy, whether in IT or Management, read the following amusing tale:

Outsourced IT staff fingered porn stash banker
By Lucy Sherriff
Published Tuesday 1st June 2004 15:28 GMT

Porn-surfing bank supremo Michael Soden was caught with his browser down last week by the very same staff he outsourced to HP at the start of his reign at the Bank of Ireland.

Soden hit the headlines last year in Ireland when staff took industrial action in protest of the department's shift to Hewlett Packard. Staff were unhappy about the prospect of becoming HP employees, as they had enjoyed considerable perks at the Bank of Ireland: favourable mortgage and loan deals for instance. Now it seems that he has been forced to resign thanks to the very department which he sent merrily on its way.
Click Here

Staff informed the bank that they had discovered pornography on Soden's machine on Wednesday last week, during routine maintenance. Soden resigned his post on Saturday, after the internal investigation into the discovery was leaked to the local press.

It would be disingenuous to suggest that the "routine maintenance" was anything other than that, but it's clear that Soden's machine was thoroughly attended to.

The outsourcing move was Soden's second high-profile decision after his appointment as chief executive. His first was to update the acceptable use policy that prohibits staff from accessing porn using company equipment. ?

If you have to ask the question, then yes, you probably ARE a "tyrant"! But so what?

You simply must do what you, in your professional opinion, think is best. Just leave yourself open to other's opinions. Then, decide and DO!

It's a case of something not being restricted from the start becoming something taken for granted, and as soon as you begin to correct the situation people feel offended because you're "punishing" them for "no good reason".
Unrestricted Inet access at work is a real time waster and causes a truck load of IT overhead due to malware, jokes and viruses brought on by such activity. Your average pen-pushing desktop user doesn't know a desktop "wallpaper" from a "screensaver" and these are the people that until now had unrestricted access to the destructive power of the Inet. As far as I'm concerned, your company should put the whining crowd in their place and not let you take the flak for something that was inevitable.

The Problem is that users dont understand, i have just installed a proxy server and filter on our business network. before it was totally unregulated, using a gateway, users had time to do there shopping, etc, which wasnt very efficient.

I didnt realise until i set up the filter how much un-work related internet access was going on.

I am very happy with the filter and basically, IT control the environment that the users operate in, I say to them if they want to do something specific then to contact IT.

At the end of the day, you will be the one who gets in trouble if any *.exe or dogdy files are downloaded.

Regards
Damian Hall
Network and Systems Developer

Sarbanes Oxley

The internet is no longer a luxury that only transports email and specific websites for businesses, it's constantly changing and there's no way for YOU to know what is and isn't business related.

The corporate policy is basically a safeguard, like the speed limit sign on the highway. You don't cause a problem unless you grossly violate the posted speed. If someone is eating up all the bandwidth, you'll know, and management will know too, because "the internet is slow". Then management can decide what to do. For your part, you can offer ways to either shutdown the usage, or make it possible for this usage to not impede access to the internet(work WITH the employees).

Do your job, and that's securing the workstations against viruses and spyware they may get. And guess what, that virus may(and often does) come from "valid" corporate business.

If management defines what is and isn't work related, then you follow that definition. However, in your case the management has indicated that the definition is very hazy. So do as management says. But make sure your firewall is up to date, virus scanners on all computers are up to date. Make the corporate machines do their jobs, providing access to corporate data and the interenet is part of that.

Another analogy: restricting access to the internet in this day (unlike the 1990's) is like restricting what newspapers people bring in to work to read in their spare time, or keeping people from making ANY personal phone calls, or restricting what radio stations people can listen to, or keeping people from bringing their PDA's to work... Where does it end? It wouldn't. You aren't the police, just the road worker keeping the highway functioning.

If you have an established policy, and you have senior managers complaining about the policy, one thing you can do is to request clarifications or exceptions in writing from the policy from your management chain. Make them responsible for their decisions.

You could also, like, grant a temporary exception and log all the security violations and present them in the appropriate meeting. (A pivot chart would work well for this.) Be sure to have a slide showing the cost of all the non-work network activity (you could even mention lost productivity).

If you're not going to win the battle, put the senior managers onto a separate VLAN, set up QoS to allow them a certain amount of bandwidth for the non-work-related network activity, and leave it at that.

I'm sorry, but if your network is getting slowed by a ticker which only sends information every 40 seconds... there's a problem with your network! Those tickers barely send anything more than text, and shouldn't be a problem. The only "streaming" media I've seen hog bandwidth is video, streaming audio shouldn't be a problem. If you watch the actual bandwidth usage, you'll see that most internet radio runs at about 50kbps PEAK, but that on average (again, because only small chunks are downloaded at a time) it's actually averaged to about 20kbps. You should be able to handle about 40 "streams" before you see any real internet problems!

When I first got here they thought that people were streaming music and video and so they locked everything down... guess what, network was still slow, the real problem was a combination of bad server configuration and a switch wasn't performing correctly.

If you configure things correctly and educate people on how to use bandwidth efficiently, all will be good.

Once you demonstrate to the powers that be - and your co-workers if they participate in any kind of profit sharing plan - that the use of bandwith is an actual expense to the business, you will get their full support.

People tend to think of the internet as free and I beleive they should be allowed to check out the news or order something on Ebay on their lunch hours and shouldn't be restricted from reasonable use of company resources....as long as it doesn't cost the company money.

I addressed this in my company by monitoring and logging bandwith usage and presenting reports broken down by user and by category - ie internet radio, sports tickers, AIM, etc.. Instantly, people turned off things that got them ranked high on the list of offenders and I blocked them from being reinstalled. Then, I demonstrated to the company how much bandwith would be available for business purposes if all the non-essential usage was disallowed. This lead to the implementation of a usage policy.

Now, I routinely monitor and block anything that is non-business related that uses excessive amounts of bandwith.

I don't, however, prevent them from non-business internet activities that are not resources intensive. I truly believe that people should have a little fun at work and be allowed a little latitude as long as they are not cost the company money.

I would agree with many of the comments here. IT is usually responsible for control and utilization of the companies assets and is our responsibility.

I worked for a small startup and internet access was a god given right, if not, well, at least an employee entitlement.

The R&D manager was too busy trying to be the engineers buddy (which is where I had most of my problems) so the way I handled it was creating a list of major internet activities (IM, peer-to-peer, downloading, browsing, etc.) some pro-cons of each (collaboration, copyright infrigment, etc.) and schedule time during an executive meeting.

When I got called in it was basically here are the activities, here are your options, what is your tolerance for risk and spending (for faster i-net access) and let them set the standards.

After that I could open or lock things down according to their tolerance of $$$ and risk; if anyone had a problem I sent them to their manager. If it was a "Sr." Mgr and referred them to the minutes of the meeting and offered them the suggestion to add the item to the next meeting agenda, invite me and we could all rediscuss it or change the priorities.

This issue has always been used as a make work project for the IT Department. Why is this different from employee phone abuse? Or abuse of lunch breaks? OR abuse of vacation time? OR theft of the company aupply of stationery for little Johnny's use at school? It is a discipline problem that must be solved by supervisors and managers, not some egghead at a computer screen with no knowledge of the company business process. Too much time is already wasted trying to access URL's that are business related and blocked by an idiot piece of software that was sold as an all-inclusive security solution.

I agree with racote. Decisions as to how far internet access should be restricted, if at all, are for HR to decide, not IT. It should not be IT's responsibility to decide that users cannot access, for example, NFL sites, personal banking sites, or personal email sites. I submit that it should also be HR's call whether to block out porn sites (even though the pornsters will always be one step ahead of the IT guy who is trying to block them).

It's thier business, let them do it until legal or compliance tells you othterwise.
It is not IT's decision to choose what users see on the internet. Each department manager should be responsible for what their employess are using the internet for. Follow their lead and offer suggestions.