Security

All companys large or small need to have one. Employees need to read it ask questions and sign off on it. I have been a contractor for four years and worked full time a three. I have seen employees fired for sending off color jokes(racial, sexual or company related) a boss being let go for child porn, a girl for taking work home and that work exactly being used at another company.
One contractor I worked with sold company computers on Ebay, the sale made it's way back to the company. A person who worked in the mail room brought in a great buy and wanted the IT department to check it out.
Set a policy and have evey one sign it, it will save the company alot in the long run.
Let people know it is a company computer and everything done with it is the companys. And as such is to be used only for the company business.
And boy are you going to get complaints:)

Very interesting post, but perhaps some industry findings from this years CSI/FBI computer crime survey would provide more help than personal experiences:

Some of the Key Findings of this years report are:

Virus attacks continue as the source of the
greatest financial losses. Unauthorized access,
however, showed a dramatic cost increase and
replaced denial of service as the second most
significant contributor to computer crime losses
during the past year.

The percentage of organizations reporting com-puter
intrusions to law enforcement has contin-ued
its multi-year decline. The key reason cited
for not reporting intrusions to law enforcement
is the concern for negative publicity.

Unauthorized use of computer systems has in-creased
slightly according to the respondents.
However, the survey respondents reported that
the total dollar amount of financial losses result-ing
from cybercrime is decreasing. Given that
the total number of respondents to the survey
has dramatically increased, the survey shows a
dramatic decrease in average total losses per re-spondent.
Two specific areas (unauthorized ac-cess
to information and theft of proprietary
information) did show significant increases in
average loss per respondent.

Web site incidents have increased dramatically.

This in itself should help support and justify good, sound policies and practices. Reduce the risk of being the victim of a crime and sometimes a bit worse is the publicity which may result.

For the complete report you can download it from the Computer Security Institute's Web site at: http://www.gocsi.com/

> ?But we know our people. We trust them. We?d never have problems like that.?

Statistics shows, that only 10-20% attacks come from the outside. Everything else is an inside job.

Every bank auditor will tell you, that you can trust no one, that popular, seemingly honest people often prove to be corrupt, and that it's sometimes hard to imagine what are people capable of. You can't fool around, when the money is at stake.

You can't possibly be sure there will never be any problems. **** happens. And when it does, would you like to be responsible for it? If you have access to certain resources, and something, anything goes wrong there for whatever reason, you'll find yourself under scrutiny. You could even be blamed for something you haven't perpetrated. So, you wouldn't want an access to resources you don't really need, would you?

I wish I could do this.

Unfortunately, I also work in a smallish firm (~30 people total, and we likely aren't going to get any bigger) with the same mind-set.

I'm the IT Manager, by title, but I may as well be called IT Staff. The partners of the firm have stated that, I'm not allowed to even BLOCK known bad sites because we have night-typists that are "allowed" to do as they please while waiting for work. While the personal stuff while waiting is fine, (I really don't care if people are doing their work, that's not my job, that's the Managing Partner's/HR's) I keep finding installs of (and HOW they are installed, I have no idea, noone runs on Admin accounts) download-helpers, spyware, "install this to buy from us"-crap, etc.

We also don't have passwords on any computers except the Partners'. And even that was painful to implement. They don't even password protect their screensavers because they don't want to type it in when they come back 2 hours later! (And 98% of the firm doesn't bother to reboot, nevermind shut down.) "But what if someone needs to log into their machine?!" Then you call down here and you ask me. Or you log into the Novell server using your password, etc.

The funny thing about all these "policies" forced upon me (isn't it supposed to be the other way 'round?), is that this is a LAW firm. One would think that the appeals to "What if this happens" would phase them...

Good luck on this one, I hope you have better success than I have. But in my experience, if they don't want to give up "luxury", they just aren't going to.