Am I A Tyrant?

I think you may have suddenly sprung total restriction on a workplace that had been pretty happy go lucky up until that point...which does make you a bit of a tyrant in your co-workers eyes.

I find that it's better to prepare users gently for a slow lock down any time you try to make the network more secure and stable. First, you should let employees/co-workers know that they are being monitored and that the results of this monitoring is being analyzed. Remind them nicely that freeware and spyware - like free toolbars and email enhancements - are slowing down their computers and their internet surfing experience.

The first thing you will notice after this is a reduction in use/abuse. As you notice the offenders stop streaming music, lock it down. When they uninstall AIM, block it. Lock them down a little further each week, always explaining to them how much bandwith they are saving by using old fashioned radios and by removing HotBar from their system.

Little, by little....lock 'em down - nicely. It's taken me years of slow steady changes just to get my users on totally secure passwords...and they've hardly noticed !

of company resources? I wonder if your co-workers would agree.

The fact is that everyone spends a little time at work doing things that might not be the absolute best use of their time - including reading postings like this one.

Thanks Rick for your explaination. You said what I was thinking as I read several of these posts.

Unless you are told by upper management, it is not your place to implement policy, rather inform management of what is going on, who is making the complaint and what they are complaining about. If management does nothing, I would request more bandwidth and let them explain to the share holders why the overhead is X% higher this quarter than last.

Jut be sure to document EVERYTHING! You may trust your boss but you need to CYA!

It sounds like your blocked/restricted web access policy is reasonable. Perhaps what you lacked was adequate communication with your users? I have found that >most< people will respect policies such as internet/web restrictions if they understand why it is necessary. The average user does not understand that listening to live radio over the web can slow down the entire network for everyone.

In our organization, the HR department determines the level of blocked or restricted sites. Although, most employees think the IT department is one who sets these limits. Any requested changes have to go through HR. Our blocked/restricted sites are also based on our internet use and security policies, and high bandwidth use sites are blocked.

Stand your ground, but back it up with the reasons behind the policy. Get support from managment and let them defend the policy for you.

I am accused of being the Gestapo, but when I see the most frequently visited web site and bandwidth hog is a non business related site, and it is one person. I block it. I have not had a complaint yet. What are they going to do go complain to their manger ?I can?t get to my dating site at work??

this is BS....i experience the same thing at my work place. Here you are trying to make employees more productive which is what i would thing management would...then you are told the opposite...nothing pisses me off more than when i am directed to do something and then when i do it people become upset.

employers can be held accountable where your employees surf to.

We are discussing work-related equipement, and use of it on company time.

Well, DUH!! If you're at work and using company equipement, what are you doing listening to the radio or buying fishing gear? If you don't have enough to keep you occupied, perhaps your job can be cut!

This would be the approach I would use. If I am at work, I am working. That's what I'm paid for. If I'm not working, then I shouldn't be paid.

Company owned equipement is not there for entertainment. It is for use on company business. What more do you need to tell people?

If senior management is goofing around on company time, can they expect the other employees to work? If you're at work, then work.

Tell them that they will set the tone for the rest of the work force. If they goof off, so will all the rest of the employees.

I used to work in a credit union, we never has workstations that could access the internet.

only one system in the entire branch was able to access, and then only on dial-up. ( assistant manager's workstation )

Work is for work, not play. If you want to open up shopping during lunch you can use Websense to put rules in place based on time of day and type of group that someone might be a part of. There is a great report too in that basically reports to upper management how much any one or all person are costing them on a daily basis by surfing the web. I have used this solution to actually get someone fired for surfing porn.

Well i agree on what you say about the users as being a thread to the systems secyrity but IT deciding what is and what is not secure is a little bit too much.
First of all IT are users somewhere so they "suffer" the same constraints.I will have a direct question "Is Yahoo

Well I agree on what you say about the users as being a thread to the systems security but IT deciding what is and what is not secure is a little bit too much.
First of all IT are users somewhere so they "suffer" the same constraints. It sounds like they are the owners of all just because they can make the connection.
Try to see IT under the "all the same" light in a company and the problem will be minimized.
Hiding behind the company's policies is not fair and doesn?t solve the problem.

As a IT Manager I know clients can get high and mighty about what they feel is acceptable. Unfortunately, their interpretation of acceptable and my own does not match up. You are doing what most people do not even consider. AND!!! You are accepting accountability for your job by making sure that there is no "funny business" on your network.
It is difficult to lay down the law to your peers but when we have commitments to a job we must commit to them

I can understand not wanting people to be surfing the web when they should be working, but what about during their lunch hour? I usually eat lunch at my desk and visit some humor sites and message forums. They certainly don't eat any significant bandwidth, and I'm not downloading porn. What's wrong with that?

In a manner of speaking, I am the company, we all are. If we don't do our jobs right, then there's no company.

Internet access at work is not a right, it's a privledge, shy of it actually being needed to do your job. So if you've got streaming radio going then you're stealing bandwidth from the company. Spend $10 and go buy a radio for your desk. If you want to surf the net and Ebay, do it at lunch whe you're not stealing time from the company.

Unless people are on salary, if they work after five, then they're going to be looking for OT. And if the "work isn't quite done" then maybe they shouldn't have spent so much time surfing the net and EBay during the time they were supposed to be working.

Let's see to answer you "IT by default" statement. I'm the IT guy and AutoCAD draftsman becuase to have an IT department in our company wouldn't be cost effective. Between myself and one of our engineers, we handle 20 PCs and 2 servers, plus our "pay the bills-billing hours" positions. How about I've been working with/on computers since 1983. Been through the entire gambit of OSs. And oh yes, I'm CNE and A+ certified. Have been for 7 years. One course shy of my MCNE. Have two MCSE courses under my belt as well, so how about you "dude"?

I resigned from a System Administrator II position prior to coming to this job. Couldn't take all the backstabbing/politicing in such a big company anymore. In that position (hmmm, get this, 5 remote locations for you huh?) I was responsible for 72 servers located throughout the state. With an abundance of CISCO routers & switches, starting with the 1600 and moving on up in models. We were connected to them through fiber, dial-up, satelite, microwave, yada-yada-yada. I provided 100% hardware support, and shy of the normal "forgot my password" type helpdesk calls, I was responsible for 100% of the software support.

And as an IT it is your responsibility to enforce company policy when it comes to IT.

I am a DBA and am trying to send a file to an ftp site of a vendor but I can't because of the restrictions in place at our site. I understand the need to secure access and stop unauthorized use but now I have to go track down a network analyst or a security analyst and have them tweak this or that, wasting valuable time and frustrating the heck out of me!

Unless credit unions have changed radically, major decisions are being made by a board of directors and/or at annual membership meetings.

This is a policy problem; I would try to get the board to address the problem or pass it on to the members. Since this is something that the board won't want members to know about, they will probably address it as a side item in a regular meeting.

And please tell me you don't work for "DownEast" FCU!

Exactly

I am a consultant for a tril law firm. They do not want anyone going to non-related work sites, shopping or simply browsing. New users do what they want on the pc. When approached to do a usage policy for new empolyees they refuse saying the really do not want to be a cop. They finally agreed to change the bowser to one that locks down only to the authorized favorites.

I will be installing this today. By the time I have completed all installations, my guess is that they will say it is too restrictive and start pulling specific users off the browser and allowing total surfing and shopping again. Many of these users are the ones that abuse the system.

When those users get into trouble and say that they have problems, the powers to be say "I have seen people surfing during work hours to unrelated sites" we will go down the same exact road again. Explaining to the users you cannot surf these sites during work hours; new users respond "OH? I did not know that!" old users say "I need to get there."

Everyone simply wants their cake and to eat it too......This time its not on my shoulders for not bringing it to the attention of the powers. They turned down the usage policy as well as restricted abusive users. But paid for it to be addressed.

If your firm wants you to be a PUPPET and only act when they instruct! then get that in writting! Make sure you have documents to back it up (people forget). In your own mind remember your getting paid and if they want to wast their money then it might as well be in your pocket!

There has been much good advice given already, so I just want to add a little perspective from the outside looking in.

1) CYA. If your Credit Union is goofing up this badly on such a simple issue, what else is going on that could bring down the company? You should be prepared to bail on a moments notice. Start interviewing for a better position NOW, whether you plan to take it or not. At least you will be in practice interviewing when it becomes truly necessary.

2) You might have a fiduciary responsibility. I know you are just a part of management, not a company officer, but still... If the Credit Union collapses due to data theft through YOUR insecure network, who goes to jail? Whos reputation is ruined? Who won't be able to get another job in the IT or Financial fields?

3) Document, document, document. The network, what your bosses have been telling you, load factors, etc. As someone else said, have hard data when you go to Senior Management to get the policy enforced.

4) Involve the Corporate Council. As a member of Management, you can involve them to explain to you the ramifications of Sarbanes-Oxley, the Patriot Act, and other legislation relating to data security at a financial institution. Have the Council outline in plain English, the legal duties you have toward network security, and the legal consequinces of a willful failure to enforce that security.

4) Work within the system. Take the legal opinions from the CC, the hard data you acquired on bandwidth usage, virus and malware attack frequency and severity, costs, etc. to your direct supervisor and enlist his/her help to climb the ladder all the way to the CEO.

5) If you get shot down by the CEO, take the next decent job that comes along, get your own money, 401k, stock, etc OUT of that company and leave in a hurry.

6) After getting comfortable in your new job, call the office of the Comptroller of the Currency and file a Whistleblower affadavit. You will be protecting the innocent members of the Credit Union from disaster and the loss of their savings. You'll also be protecting me from an increase in my income taxes to help pay for the collapse of your Credit Union!

Good luck.

As a business owner, and as an employee in the past for both small and large companies, I can see both sides of the fence. I think your company might consider some sort of reward system for employees who have met certain goals -- i.e. allow them to surf during certain hours and use extra bandwidth for internet radio, sports ticker and other bandwidth purposes as their reward; or if they want such services and you'all do not want to use a reward system, charge them for it through a reduction in salary, and make it part of their overall "employee benefit package"...but give them a choice.

I think you're doing the right thing, as long as the "head" of the company...and your manager, has set the parameters. If so, there is no reason why anyone should be laying into you at all! I suggest you have your manager or the person you report to settle the issue -- as I'm sure this decision was not yours alone. Next time someone says anything to you, say "go see Manager's Name"! Good luck!

>Your network users are your personal customers

NO, they're NOT! A "customer" is someone who has the willingness and ability to PAY. Users are USERS plain and simple.. And THEY don't run the house, the people paying the bills do.. It's NOT their network, they are USERS on it...

>A bulk mail-out explaining the policy
>and why it is necessary is useful. We
>are planning to block all sites, then
>allow any business sites and common
>sites, eg banking and home shopping, then >others on a case by case basis.

More 'touchy-feely' crap, trying not to offend those whose 'feelings' don't relate to BUSINESS anyway.. How many mailouts, briefings, 'awareness training' sessions do we have to put on, or go through, before everyone admits that they *already* know it! 'Playing' dumb won't cut it. The same people who are trying to surf this stuff AT WORK are the same people who won't surf it from home, or let their kids surf it because they KNOW the risks..

They were made aware of the policy when they came to work there (weren't they?).. "Common sense" says that if it isn't work-related their position is indefensible.

The resources are there to do WORK which generates revenue from PAYING customers! If the customers can't trust that the business is sound, that their data is secure, and that your business is trustworthy, they vote with their dollars and take their business elsewhere. Then, there's no work location to surf from.

IT's job is to enable the enterprise to do what it needs to in order to generate revenue. It's not about whether you're liked or not! You can be the friendliest unemployed person they've ever seen and that won't help anyone... BUT, if management has lost their backbone, and won't sponsor, or back a policy enabling the network to be protected, YOU are between a rock and a hard place, and the rocks will fall on YOU when the roof caves in.. Buff your resume, do what you can, and run to save yourself!!

By all means, go over their heads!! Then you can use ITeachers services to further your education after they can you.

You didn't disappoint me. I'm used to your double-speak you use to try and justify your desire to rule the world.

"I didn't say the new connection did not have a speed problem because it was more reliable." Oh, then disregard the following quote.

"We recently changed our ISP from a local cable non-business access to a Verizon 768K line. Now my users are complaining about speed. This is simply not true, there is no issue with bandwidth, in fact it's more reliable."

"Until this point, decision making about our content was my responsiblilty." Ok, so now it isn't. Wipe the tears away, suck it up and get back to work.

In my position I'm, at least on a weekly basis, participating in streaming webcasts to help me perform my job better. Why is it any different for people in other positions?

"By the way, even in my little hick company we do 8 T1s to deal with and Citrix coming soon, but thanks for raising yourself up so high."

8 T-1s for the credit union? Great choice, especially for pricing scalability.
I bet you're as well-liked by the accounting department as you are by management and the end-users ;)

As for all the people making the, "Gulsath, it's your job to protect our money" comments. You should be alot more afraid of the M$ ATMs at his bank.

I don't consider a CU with 100 end users a hick company. My hick CU has 3 locations, in 2 towns, with a third of that many people.

If your intent is to block everything that is not work related, then in my opinion you are being a tyrant. The examples you listed were all valid for blocking, except perhaps internet radio. Every internet access policy that I have ever seen has made allowances for what may be considered personal use, such as checking the latest news while on a break/lunch, or checking on their kids at the schools website, basically anything that is not abusive in nature. Clearly (and I've seen this happen) anyone that wants to place a bet on an online gambling site is going way overboard. I think their should be some balance. I think allowing employees some leeway makes them more productive employees. If it becomes too restrictive then they spend the entire day thinking about the end of the day.

While the IT personnel are there to ensure a smooth running network, management has to consider business impact. If the company policy is written in such a way that there is room for interpretation between the IT staff and the end users, one of two (or both) things need to happen: 1) Cognizant authority should clarify the policy; 2) The policy needs to be rewritten so that there is no doubt as to the intent.

Bravo!

Threats to the network are truly a problem, however; there is no reason that users shouldn't be able to have reasonable access to the internet (outside of work related requirements)and the IT staff still have more than adequate safeguards in place to protect the network. Employers must consider quality of life of their employees. If they're treated like drones then they get the quality of work they get. I would venture to say that employees happy with their jobs are considerably more productive. Since most businesses exist to make money, I think the cost of a little bandwidth is probably insignificant compare to profits expected to be reaped.

If all or any of the things that you mention happen, they should pin it on him. Because users have access to the internet does not mean the network should be left unprotected. I do agree that anything in the form of policy should be in writing. All users should be aware of policy and the only way to make policy enforceable is to put it in writing.

It's interesting to see the range of views and how rigid some of the views are on the web surfing issue. I've been in the Defense industry where security requirements are consierably more stringent than corporate requirements for the last 26 years of my life. There have always been usage agreements which end users sign that specify what can and cannot be done on the network, but never has there been a restriction on surfing the net (other than porn and other inappropriate things).

It's amazing to me that someone who suggest having a lawyer draft an agreement between an employee and their boss. 1) Depending on the size of the organization they most likely have a legal team or at least a legal advisor. 2) What would be the motivation for the employer signing the agreement. 3) As a representative of the company I doubt this person would even have the authority to sign such an agreement. 4) What would be the motivation for keeping such a renegade employee on the payroll. Clearly they're not functioning as part of the team.

You clearly don't understand what a customer is. Paying bills has nothing to do with the classification. The company hired them to perform task that it cannot perform itself. Granted the employees don't make policy or pay bills, but they need to be able to do their jobs for the company to remain profitable. The internal IT staff is there to ensure that they can do their jobs. Period. They are the customer!

I agree that when you're supposed to be working you should be working, but most companies also have a policy on breaks. Breaks and lunch are authorized and are authorized for a reason... so that employees function at optimum efficiency. Some people are work-a-hololics and that's fine, but not justification to expect it from others. There have been so many studies done that show when employees are allowed little breaks or a few minutes to step away from work they are more productive.

Sounds like your organization has a reasonable policy in place and have done due diligence in ensuring employees are aware.

I had to go back and re-read his post when I read your reply. He never said anything about allowing employees to violate company policy. In fact he specifically states that violate company policy should be held accountable.

Some maturity in the responses will only add to the quality of the conversation. I agree with beahwolf, I admin a SurfConrol server, no rules, everyone can go where ever they want, we're all grown ups(or are suppose to be). I spit out reports at the end of every month and give it to Mgrs, Suprvsr, and even the President. If they see a problem they tell me to fix it. I told them from the start that did not want to be a Traffic Cop, I just report and let them decide. It's amazing how peoples' behaviour changes when they know they are being watched! It's an awesome study! I love it! (be nice now).

This can only be be considered misappropriation if it violates company policy. I don't think we're clear on what this company's policy is at this point. In any case most of the good companies have some degree of concern about quality of life of their employees. In the end if the company wants to let employees surf the web, it is their prerogative.

If executive management feels that you are overstepping your bounds by devising policy they are probably right. Network Admins nor IT managers have any business making policy. Their jobs are to enforce the policies that are handed down or recommend changes to policies they feel are ineffective.

In your first scenario, I agree that is blatant misuse of company resources, however it doesn't apply here. The individual concerned would most likely continue misusing company resources as long as he/she thought they could get away with it. Additionally, I wouldn't expect executive management to be printing to a general use printer. If by some odd chance they had to because the IT staff was more concerned about their payraises, I would expect management would be given a higher priority and therefore still should not have to wait.

If your second scenario were to occur I would think the help desk supervisor would be called ont the carpet. The supervisor has the ability to see how much time is spent on each call and the ability to compare that with the help desk logs to see how productive the help desk staff is being.

There is only a finite amount of resources in any organization, but that doesn't mean that finite amount is not sufficient enough to accomplish the mission and allow employees a little leeway.

I understand that there should be limits and fully support that. I also think that employees managers should be the final say in how productive their teams are. If employees get a free moment to check the latest news, so what. Perhaps I'm biased because I've never worked anywhere that has had such strict requirements as have been mentioned in this thread. Employees have always been free to surf the web as long as they are accomplishing the jobs they were hired to do, and as long as they weren't going somewhere considered to be inappropriate. In the places that I've been we've also not had the problems that most present as reasons for being so strict. To me that's proof positive that in a properly managed network users can surf a little and not do any harm. I think that based on some of the posts that I've read, some expect employees to be drones and have a blanket distrust of all end users. That's not fair to those who haven't and probably wont earn the distrust it.

...and this is probably the best way to handle this. The few that abuse can be dealt with and those that don't can continue doing their business.

until someone in higher authority establishes clear guidelines.

Dawg

I disagree with IT setting policy. They may be best qualified to recognize threats and to understand usage impact, but they are not qualified to understand the impact of their decisions on the business such as quality of life of employees. Ultimately all policies are intended to establish standards which will aid in enhancing the business operations. No policy is intended to be so rigid that there can't be exceptions in certain circumstances. Someone mentioned flowers in an earlier post. To carry that a little further, I'm willing to wager personnel at the highest levels of some of the largest organizations were online checking out flower prices, delivery, etc on or before Valentines day, as well as making dinner arrangements or whatever. Most rational people would not consider this an abuse. What if the IT staff prevented them from doing this? The phone is always a fallback, but how do you filter the phone? Is the policy different for phone usage? I'd be willing to bet that most of the posters that support extreme restrictions on internet access use company phones to make personal calls, even if it's only to call their spouse to say they'll be working late.

If the managers can have it then the end-users should also. The absence of a policy doesn't mean playing favorites to those higher in the food chain.

If the managers can have it then the end-users should also. The absence of a policy doesn't mean playing favorites to those higher in the food chain.

I think we all go home "every night." I think you're too focused on the single issue of restricting access (some responders are almost obsessive about restricting access) and as a result missing the bigger picture. I think we all agree that there are and should be boundaries, but complete isolation is not the answer. It was understood decades ago that happier employees are more productive employees. Businesses are in business to make money. Happy employees contribute to the efficent running of a business which goes to the bottom line--profits. Those that run the business understand (for the most part) the need to make employees comfortable. As stated if spending a few extra dollars for bandwidth will ultimately make employees more productive then... make it so. The profits will most likely far outweigh the cost of the bandwidth. I've stated before that I've never worked for an organization that restricted access to the internet. There have always been policies that spell out what acceptable usage is and employees signed letters which become part of their personnel files indicating that they understand the acceptable use policy. My point to this is that, with the proper safeguards in place the risks can be mitigated without playing traffic cop at every users workstation.

I think you missed the point DC_GUY was making. It's not the IT departments responsibility to determine is users are earning their pay. That is an issue between the employee, their manager, and HR. Management is responsible for establishing policy and the IT staff is responsible for implementing/enforcing those policies, and when necessary educating users.

Im currently studying to become a net admin. I see students all the time going to web sites/pages that ask for them to install different things, and I know this has to be a headache for the IT dept. to keep up with. So no, your not a tyrant, just trying to keep you and your people from working many extra hours reinitilizing alot of equipment due to "Joe" needing to see his baseball scores, and downloading the wrong stuff and hammering the system.