End User Ignorance - How long will we cope?

As many of you already know, I am a senior network security engineer for a Government entity. Over the years, I have watched the landscape of the industry and it’s subsets grow and change. The maturity of the internet, corporate acceptance of firewalls, new protocols, high speed technology and the list goes on and on.

Even though many new technologies have been introduced, some things have remained relatively unchanged. One thing is the basic methods used to access data. Everyone understands the concept of logging in. We do it at home, at work, at the ATM and basically everywhere life takes us. So why is it, after logging in has become a normal part of our lives, do we still allow end users to claim ignorance when we see them doing inappropriate things while logged in?

Over the past two years, my team and I have watched project leaders design applications under the premise that end users are operating on the same intelligence level as the common house fly. Applications were crippled because of the misconception. While management continued to operate with this mindset, our team, along with other IT groups tried pleading our case, but it fell on deaf ears.

My team and I decided to see exactly how smart end users are. I placed Websense, a content filtering enterprise solution, in place and sent out an organization-wide policy. More or less, it is exactly what people would expect. No porn, gambling, hate or other sites that could pose a legal issue for the entity. Can anyone guess what we observed over the past year?

The very same end users who are thought to be of sub human intelligence proved the exact opposite. These people tried everything from searching for generic IDs to obscure their identity, switching IP addresses to test the ACLs, trying sites by IP instead of FQDN, proxy server searches, keyword searches for generic terms used to beat content filters and the list goes on.

Let's look at one example that I find very interesting. Take the word, “twixys”. Now, this word wouldn’t appear as a trigger in very many content filters yet these people know to search for gay porn images using common or nonsense words like this. The previous example isn’t a real word used to search for porn. If anyone wants a real list, speak to me in private. The idea is that they A) Know that this will defeat (most) content filters (not mine). B) They know where to go in order to find word lists that associate for the content they want to see.

After watching this behavior by people of all backgrounds, professions and age, we concluded that end users know that corporate (or Govt.) culture allows them to claim ignorance and this will absolve them of any responsibility for their actions. We presented our findings to a council that we report to and we were given the green light to implement a policy that is virtually unheard of in Government.

“The end user shall be held responsible for *any* activities that transpire while the said end user’s account is logged in.”

That’s right. Responsibility has been placed on the shoulders of the end user. The only exception is when proof can be presented to show that the account was indeed in control of another user. To date, this has never come up.

Six months ago, we spent 60% of our time smacking the hands of end users who all seemed to know that ignorance set them free. Fast forward to today. We now spend 9% of our time smacking hands only this time we do it with a baseball bat laced with nails. End users understand that claiming technology ignorance no longer flies and they also understand that for the first time, they will be held accountable.

LESSONS LEARNED BY MANAGEMENT
====================================
1) End users have been using the same basic computer skillset for more than a decade.
2) Holding end users responsible for their account and its use/misuse is *very* effective.
3) Designing next generation apps can be done with greater emphasis on functionality instead of end user limitations.

Although this write up is relatively short, the content is extremely valuable. I hope that others out there can put it to good use. Keep in mind that I had to sanitize a great deal if information before I posted this but the lessons are 100% intact.

--TH13

I couldnt agree more .. end users should be responsible and they should not be able to claim ignorance, they all sign the procedures and protocols (rules) of the domain before getting the log on. (by signing they acknowledge what they can and cannot do)

so if they disobey the rules they should be held accountable

I couldn't agree more!! Bravo!

Quote:

---

Originally posted here by fyrewall
I couldnt agree more .. end users should be responsible and they should not be able to claim ignorance, they all sign the procedures and protocols (rules) of the domain before getting the log on. (by signing they acknowledge what they can and cannot do)

so if they disobey the rules they should be held accountable

---

Exactly - that's how things are done here at my work. All employees who are granted access to our networks are required to sign acceptable use policies and such, and any time those policies are not followed punishment is enforced. Punishments can be loss of network access; some have even been fired over misuse of the policies. As TH13 has noted, making the end user accountable for everything is a very effective method.

Excellent post TH13! It's interesting how upper managment will "listen" when they are backed up against a wall! :D We have implemented similar polocies where I work and have integrated them into the company code of conduct which every employee agrees to and signs.

catman

I've wondered about this for a while, and I have a (slightly) different opinion.

There are two aspects to the end user's responsibilities:
- the actual use of the network
- the time he spends on that network

The time he spends on that network is something the end user can be held responsible for: if the corporate agreement states that you're supposed to be working while at work, the end user could be held responsible if he spends work time doing something else. If a user is surfing news-sites all day, he could be nailed down: he's supposed to be working, not surfing (let's assume that the user doesn't work for a press agency...). There is no "work" reason for him to be on news sites.
The same rules apply in this case as they do for people who play poker all day with their co-workers.

But if the network settings allow him to surf to news sites, can he be held responsible for that?
If my corporate network allows me to download games and my personal work-computer allows me to install them (due to the incompetence/negligence of the admin), can I be held responsible for downloading and installing those games? In my opinion: no. I can be held responsible for playing those games since I'm supposed to be working, but for downloading and installing them?

The end result is the same: people are doing stuff they're not supposed to be doing. But my reasoning is a little different, I guess...

It of course all changes when users are deliberately trying to circumvent security measures...

I almost agree with you negative and I have the same approach to developing rules that can be enforced. For instance I fall under regulatory compliance with the FDIC. Their best practices say a password should not be made up of dictionary words. Well in my network there is NO way to enforce that through technology I currently deploy; therefore if I state in a policy something that cannot be enforced then the peeps will do it regardless and I have a policy that is a joke. In fact when regulators come and look to see people ignoring the policy, that is much worse in my opinion than simply not stating that passwords will never be made up of dictionary words. This is different in the case that I will be inspected for policy compliance, which is a huge counter-productive pain in the ass.

Having said that very confusing paragraph, I then go on with this issue and your games example: If the policy is clear that games will not be tolerated and that is communicated, then i don't have a problem holding the end user responsible. In fact I take the approach horse mentions and I state in policy a catch all, kind of my own CYA. The end user is responsible, sure there are many circumstances where the fault will fall on IT but there has to be a device where abusers can be dealt with. I even go so far as to say, end users are responsible to ensure THEY have backups of their important files. If they feel the heat a little, they are less likely perhaps to download that copy of Dig Dug. I believe if you have no way of blocking Texas Hold'em (my abusers love that card game) or you block one and they find another, and you say "You are not to play card games during work from this point on" and they still do it anyway because "they can" then they are responsible, just like the smoker who refuses to use the smoking area and smokes where ever they please because there isn't a fence and a lock around the area. (another of my issues)

It's about damned time!

Good job thehorse13...

I've encountered this myself before, and understand what a pain in the arse it can be. It's good to know that someone has tken the time to put the users in their places.

Line 1 of our AUP

"This is a business network and is to be used for business purposes only"

I call it a "catch all". Play games, read personal email, surf shopping sites etc. and I catch you then you need to present a _business_ reason for the activity. If you can't then I will assist you in any way I can in finding the door. In several of the other policy items further down I even go as far as to say, "If this is not clear or you are uncertain see rule 1 above".

Yes, wherever I can I have technological enforcement but with some 4 billion web pages out there there isn't a web filter that can get them all right all the time.

I also have one advantage over many here. If I say "this should be so" my management buy in right away and if the users whine too much they respond with "Talk to Tiger Shark". You'd be surprised how few direct complaints I get..... (heh, maybe I should start calling myself Tiger Shark here, it might divert those last few whines..... ;))

Nice post Hoss.

Neg,

Yes, the points you make are perfectly valid, only I didn't cover that aspect in my post. As the security team, we *still* must create rules to prevent users from doing things that are harmful to themselves. We think of it much like child locks on cabinet doors. If a child is able to get to something behind the door that will hurt him/her, then we, (the "parents") are responsible.

Quote:

---

Yes, wherever I can I have technological enforcement but with some 4 billion web pages out there there isn't a web filter that can get them all right all the time.

---

Too right mate, content filtering is not even close to doing a great job. Each week I see hundred of un-categorized web sites and a few false postives. Like the Federal Reserve categorized as a gambling site. :) Sure they catch alot, but they leave alot open as well. unless you go to the extremes and block all sites and adapt rules to manually allow sites as they pop up. I like the "user" is responsible idea.

The only question I pose is how much tolerence do you place on the end users? We all have done it, you're bored or maybe you havin been bustin your butt for a few hours and you're now ahead of schedule and you feel like just crusin around the web for a while.Or playin a few hands of poker or whatever. If you as the admin notice this at that time are you going to inforce the policy to the full extent? Are you going to say something to them and let it go? Maybe you would allow them some time to continue because you know this person and you like them while another might be doing the same but you do not know them.

So the only thought I have on this (because I fully agree with TH13 on every aspect) is after you have the policy in place, are you going to back it up all the time? Or half the time? I know if it was me and I caught a friend wlooking at porn on my network I would go to them, pull them aside say that this was his freebee and after this he was going to be in trouble. If it was someone I didn't know I would do the same, pull them aside and talk to them, however I would make sure to give more of a big brother impression in hopes of installing a degree of paranoia. I hope this is making sense, I haven't yet worked as a admin so I am not experianced the problems who folks have. It is all hear say. Perhaps if I was in a adminstrative position I would not think of it this way. However I know I would be thinking about fairness to the users. Not just to some but to all of them while still fully inforcing the policeis I had set forth.

Horsey > the reason that I mentioned those things is that I'm working on the new FAQ and I saw something related in the JUPM AUP (one of these days, someone is going to slap me for referring to that AUP)...

Quote:

---

You will not attempt to access any protected sections of the sites or Forums, nor make use of any hacks, cracks, bug exploits, etc. to bypass or modify the features of the forum software at any Jupitermedia site.

---

If the admins by accident would remove the Addicts-protection and non-eligible people would access Addicts (either by accident, or deliberately), those users, by "attempting to access any protected section of the Forum", would technically be breaking a rule, and JUPM could ban them for breaking that rule. Would they be banned for the actual entering of the Addicts forum, or would they be banned because they're "circumventing security measures"?

What I'm trying to say: in this case, it's is clearly an admin-error, but still the user could be punished (banned) for it.

If Addicts-protection would be removed (without notice), you'd see some different reactions:
- Users that know they're not supposed to be in Addicts and wouldn't even try clicking the Addicts section, even if the news would leak.
- Users that know they're not supposed to be in Addicts, find out that the protection has been removed, and just snoop around a little.
- Users that know they're not supposed to be in Addicts but try anyways on a daily basis.
- Users that end up in Addicts by accident.

Technically, the three last groups of users could be banned ("fired"), but it wouldn't exactly be equally fair for all of them...

I swear there's a point somewhere in this post :D

Hatebreed:

Here's an example of my one and only warning:-

Quote:

---

During a routine check your name appeared near the top of the list of internet users in XXXXXXXX. Upon reviewing the log files I find it rather difficult to pin down much that I can categorically state is work related. To remind you of the Acceptable Use Policy that I have emailed to you every three months since your arrival at DWP:-

“This is a business network and is to be used for business purposes only.”

Please try to curtail your internet use to comply with the policy.

I tend to only give one “friendly reminder”……

Thank you for your cooperation

---

This particular lady didn't find my friendly warning sufficient. Having waited a month before checking the usage again I still found her at the top of the list. She appeared to be running her real estate business on the side. Needless to say she now has plenty of time to do her real estate stuff in the privacy of her own home.

That's an "admin" error, Tiger: you guys don't pay her enough. If you would pay her enough, she wouldn't "have to" run a real estate business on the side. I bet that would hold up in court :D

Neg:

I don't employ them or issue them their workload..... my job is to "shepherd" them.... ;)

Policy provides a means for action. I am not as strict as Tiger. We have some downtime here and it's ok. Like Negative says, admin rights may be accidently removed or some other non-intentional thing. That does break the rules but there can be leeway there. There almost has to be, but in my job. If I accidently remove access controls the risk to the company is SERIOUS. Thus accidental or not, legal action could be brought down on the company. So in my case, my ass would be fired or in the slammer depending on the outcome. What policy does is provide a means to terminate or do whatever with the guy that does intentionally remove Jup. Media access control. Without it there is no ground for Jup or you to stand on.

Also in your case Negative those users are customers. That is VERY different. My customer web site get's hammered with crap all the time. That's why I outsource it's security so they can monitor it 24/7 in real time, and they try to get into boyfriend accounts etc. and they break the user agreeement sometimes. So what, when they cross the line and do something illegal is when I get involved. If you had an admin accessing controls on a web site owned by your company one he has no normal interaction then you would not take the same view. :)

Let me mention this as I feel it is valid to the overall thread.

A formal security team has only existed in my facility for just under two years. You can imagine the mountain of poop we had/have to deal with. In that time, we have installed enforcement mechanisms and also the levers to pull via policy. We have developed what we feel is a water tight policy group (acceptable use, confidentiality, security policy). The wheels of Govt. turn slowly, especially when sweeping changes are going to be made. All of our policies are "living" documents that will continue to evolve as our environment does.

We want to be sure that every means of enforcement is available to us. When it comes to non business surfing, we are still pretty liberal in that news sites, ebay, etc. are still accessable. We are concerned with the big three: 1) Sexual Harassment 2) Private info leak 3) Litigation. As long as we are able to keep these at bay, we are happy - for now.

We implemented a similar policy a few years ago after an audit revealed that more than 95% of PCs in one facility had at pr0n on them. These folks were emailing them around. Users went to great lengths to hide their activities, but to no avail. As I used to tell my students when I was teaching, you may be smart, but I'm smarter.

I usually give users a friendly reminder when I see something amiss. Usually something like, "I see you've reached the top 10 list of internet users. Be aware also that your usage is logged and log files *are* looked at. That's probably not a good thing when management sees you're surfing match.com all day."

We take the dirty Harry approach.

"Do we have log files loaded with horrible info on your or not? Feel lucky punk?"


LOL.

:)

This has been an interesting topic for me for quite some time, I have worked at several places where the AUP, pretty much said if it doesn't have anything to do with your job, you better not be caught on the site.

While I do agree that people doing other things at work, is counter productive. There are bigger things that should be thought of when you see that log that says, all the things that people are doing to get around.

I would personally think, that the important thing would, not be how much someone trys but if they actually succeed. This is kind of off topic but, I just see that if you are a corporation and have so many users trying to access off Network places, i.e. Ebay and other sites. Then maybe there should be a small clause in the AUP, for such acts.

Tiger I understand your side, (Damnit your here to work, and work you shall.) The issue I am wondering is, is it truly intelligent to limit access to business projects only. I mean think about it, what does it hurt for someone to use the companies equipment to check there real estate business. Though I understand it is not what she is there for it, still dawns upon me that if there were a small clause to include. Something like.

"While, the connection and access that you are given here is, meant to be used, for company work, you are given small leeway(sp) to do other things, these include but, are not limited to, checking the weather, checking your off network email account. Things that will not be tolerated and will result in immediadate displinary actions are, being caught on pr0n sites, (add whatever the hell else.)"

Oh well just my thought on the entire thing, though I find the gvt. thing really funny, because TH13, the office and area you work in that is the policy but with my Gvt. experience, that is not the case, and probably won't be for a very long time. Main reason is, it just tends to be the case the Users are really idiots, I have seen users that don't know how to turn a computer on. (I am serious, the dumbass woman didn't have any idea how to turn it on.)

Oh well...

I would love to see that policy started and run on military servers, or networks. I don't think there is a chance in hell, that will fly.

When I was in Kuwait we had a similiar problem with the lonely guys in tent city. They would go to their work stations and night and 'take care of business'

First we would warn them, just them. We figure 'sure they signed the agreement, but they are horny...lets not come down on them too hard'

After that we found that humiliation in front of their supervisors, supervisor's supervisors worked the best. We would just call them in, and show all of them what that person had be surfing, and show the log times from the PDC to prove it.


I'm not sure how this would translate to the civilian world, but it worked great for us.

Whizz:

Quote:

---

what does it hurt for someone to use the companies equipment to check there real estate business

---

Four hours a day????? That's akin to theft insofar as my company is paying her to work for her yet she is working for herself. Not to mention my bandwidth.

More importantly companies are firing people for offense x and when the firee finds out that someone else committed the same offense and only got warned they sue.... And guess what, they win. Thus when we put a policy in place we have to be able to show that we apply it across the board with the same consequences to all. Thus when the policy says "work network for business purposes only" and don't fire this gal for running her real estate business from work then we can't really fire the person for surfing the pr0n all day can we? Surfing legal pr0n is, after all, _legal_.

Besides, a good firing for breaking my policies tends to put those users that were straying back into line for a while.... ;)

To put all this into perspective. I don't stop people from reading the news, sending silly greetings cards, checking the sports scores etc. Our web filter is pretty reasonable, (porn, hate speech, hacking, kids sites etc.), most of the categories are left open. What I do is go and look at the "biggest hitters" from each location every month or so. If you are up there with the high usage workers, (we have some people who _work_ 6-7 hours a day on the net), I look through where you go. If you have been abusing my system then you get my warning that is also saved to a folder in my inbox. In any subsequent month if you are still a big hitter and your name is in the folder I copy the original with a note to your supervisor. If your supervisor doesn't fire you and you are still there next month I cut your internet and email and let you explain to your boss why you can't do your work...... They generally are fired at that point....

All this reminds me...... Time to run those reports..... ;)

Quote:

---

Originally posted here by Tiger Shark
I also have one advantage over many here. If I say "this should be so" my management buy in right away and if the users whine too much they respond with "Talk to Tiger Shark". You'd be surprised how few direct complaints I get..... (heh, maybe I should start calling myself Tiger Shark here, it might divert those last few whines..... ;))

---

Ha!

I have the same advantage. Although I am a very nice guy, and genuinely try to help people, I am also a 6'2", 205 lb, heavily tattooed ex-Special Operations soldier who has the evil glare thing down to a science. Neither users nor my team ever complain to me about my decisions directly. :D

Quote:

---

I am also a 6'2", 205 lb, heavily tattooed ex-Special Operations soldier who has the evil glare thing down to a science.

---

Other than the size and the tattoos we share similar characteristics.... :cool:

It's a definite advantage..... I was also once asked "Where do you work, Building Maintenance?". I replied "Yes"...... I love it when people underestimate me..... ;) They expect the IT staff to be a bunch of pencil necked geeks..... Comes as a bit of a shock when I walk into their orientation......

Quote:

---

Thus when we put a policy in place we have to be able to show that we apply it across the board with the same consequences to all

---

*cough* except for us IT higher ups *cough* Is it fair? :D

I'd like to take a slightly different angle and dig a little deeper into the user mentality. Using my own experiences and a few quotes from Office Space (which I believe is one of the greatest movies to portray the typical office worker mentality), I think can I better explain why people defy rules and surf during work hours irregardless of warnings.

Quote:

---

it's a problem of motivation. If I work my ass out, I don't see an extra dime!

---

self-explanitory and very true. I've felt this way very often at my old job and found myself thinking "f**k the boss, I'm ahead of my work and I'm going to relax and enjoy some chat".

Quote:

---

Ambition is not necessarily good and mediocrity is not necessarily bad

---

I was always told, good work will be promptly punished with more work. I'll be damned if that isn't the god aweful truth. When I was a programmer, I used to allocate my time wisely. I would generally get ahead on all my projects, and leave around 1-2 hours to jerk around towards the afternoon. Here's the key, I never let my boss know just how far ahead of my work schedule that I was. This lead him to believe I was just competent enough to do the work on schedule and left me all kinds of time to email my buddies, play online games and chat.

Quote:

---

That's my only real motivation is not to be hassled, that and the fear of losing my job. But you know, Bob, that will only make someone work just hard enough not to get fired

---

I used to feel, if I did enough work (to be on or ahead of schedule), I deserved some down time to relax and goof off. The more I was pressured into working, the less likely I was to do anything even remotely productive. The more threatened I felt, the more rebellious I became. I knew nothing at the time about computer security (as do most typical users) and could care less about spyware/trojans/viruses, etc. In my mind, that was the admins job...to protect the system (after all, that's what he was getting paid to do). So what is a little surfing going to hurt?, I thought. If they came after me, I felt they were being anal retentive *****s and didn't appreciate any work that I did do.

Quote:

---

Yeah, I just stare at my desk, but it looks like I'm working. I do that for probably another hour after lunch too, I'd say in a given week I probably only do about fifteen minutes of real, actual, work

---

Some days, there was just barely enough work to keep a lemming occupied let alone an entire staff of workers. And what to do? surf the internet! of course. This made sense to me and besides, there's nothing to do anyways, I thought.

This was during my early 20's. I'm now almost 30 and all the wiser to computer security. All those things my admin used to tell me back then, actually *make* sense now...almost 10 years later. Ironically enough, I'm thatguy now...the guy whose supposed to take care of the network, that's what I'm paid for, right? Funny thing is, if I met myself now, when I was 21-22 years old, I would have told me to f**k off and stop being such a tightwad about surfing the internet.
All I'm trying to do is offer a different perspective on maybe why some people disregard warnings and policies even at the expense of their own jobs. I've been on both ends of the stick. The idiot user and now the pain in the ass admin(only part-time thank god :D). Maybe the solution would be better incentives to work? bonuses for completing projects early? I don't know. I think the problems crosses many boundries, from users, to admins, to the how the company is ran, etc. Maybe coming down on users with policies and strict rules works, but could there be better ways of handling this issue from a non-techincal viewpoint?

Character is the measure of what you do when no one is looking. Unfortunately, there isn't much character left these days. We use technical methods where appropriate, however, we also use psychological methods as well.

I would compare your job, thehorse, to law enforcement. If I went out and robbed a store why should the police be accountable. The police are there to monitor and reduce the likelihood of crime.

Quote:

---

Originally posted here by strandedthinker
I would compare your job, thehorse, to law enforcement. If I went out and robbed a store why should the police be accountable. The police are there to monitor and reduce the likelihood of crime.

---

Thats being reactive though. Kind of locking the gate after the horse got out (no pun intended Horsie :D )
An admins job and the secrurity gurus job is to be proactive and lock the gate before the horse can escape.
By locking down the system and enforcing the AUP's the admin is trying to limit the liability to the system and prevent intrusion by adware/maleware, and the bad guys. Even though it is nice to be able to put a bad guy in jail. his job is to stop him before he can even commit the crime.

ISO: "Internet Security Officer" is (when I wear the hat) a sucky job, where a state or FED entity drags you in to an office to convict an employee of misuse.... As a consultant its a sucky job to compile the history and Caches that end up confirming the charge of "guilty" of un-authorized net access on the part of a state/Fed employee... I'm sure it happens in the private sector all the time, just never had to deal with that. As far as Gov't agencys go, it always ends in termination (at least in my experience). State governments don't tend to log much, so its the persons own machine that provides the "proof" the sad part is that anyone can get window washer 5.51 from kickme.to/FOSI oh well.... the whole (L)user thing can be kinda sad sometimes....

we never have a problem with users accessing sites they shouldn't - we just dont give them net access ;)

they have no need for it to complete their jobs so we dont allow them to use it - if they feel they need a piece of information that is not included for them in the internal network then they can ask their team leaders for it and that can then be supplied.

heh they dont even have email anymore - one of the first things that got taken away when we arrived

v_Ln

Speaking of being accountable for what happens when one's username is logged in, it is relatively easy to obtain another's user/pwd. It takes under 3 seconds to install & take off a hardware keyboard logger. This wouldn't really help w/ surfing since surfing is a lengthy activity & one is bound to be seen by someone, but if malicious user wanted to attempt a quick attack agains the network another one would be blamed. That is unless you have cameras or a good physical access policy.

Quote:

---

Originally posted here by rabit
Speaking of being accountable for what happens when one's username is logged in, it is relatively easy to obtain another's user/pwd. It takes under 3 seconds to install & take off a hardware keyboard logger. This wouldn't really help w/ surfing since surfing is a lengthy activity & one is bound to be seen by someone, but if malicious user wanted to attempt a quick attack agains the network another one would be blamed. That is unless you have cameras or a good physical access policy.

---

It's even easier than that...most end users at work freely pass their password around even though they're told not to. I've seen countless have it written on something nearby (postit on the monitor, etc) and I've seen one place where users had to have their password and username written on paper taped to the underside of their keyboard.

All you have to do is look like you know what you're doing and Kevin Mitnick's trick of social engineering is all you have to do. They'll GIVE the information away.

And as far as security and AUP are concerned, it's a hypocritical situation when upper level execs have full access and no rules on them when everyone else does AND it gets even better when those execs/political leaders/etc just let everyone else use their machine if they can't reach a site that's blocked by the firewall. Bad news there considering it's a security threat as well as people seeing that person X has more than everyone else.

You know all the AUP talk aside, I use to just walk around with my "destructive packet filterers" (aka - scissors)in my hand and gently remind the engineers that if use my def gateway as their IP address and bring down the whole network again, they'll be pushing the remains of their vehicle home with a pink slip!!! hehehehe That always gets them.

Funny, the only people that really abused the privelege of network use were the ones that had hiring or firing ability. Does that seem strange to anyone? .... Nah.

Quote:

---

it's a hypocritical situation when upper level execs have full access and no rules on them

---

not where i work they dont - only the techs do ;)

v_Ln

The latest BOFH has something about this.... Not strictly relevant, but hey, gimme a break :D.
http://www.theregister.co.uk/2004/07...04_episode_22/

Cheers,
cgkanchi

Quote:

---

Originally posted here by KorpDeath
Funny, the only people that really abused the privelege of network use were the ones that had hiring or firing ability. Does that seem strange to anyone? .... Nah.

---

Funny, the only ones ever getting infected (virii etc) at work are the ones with hiring/firing ability..

Well and also a previously employed lamer..
I warned him once (on paper), warned him twice (again in writing) and the third time was the charm.. Say Bye Bye mr. Lamer !!

Hmmm,
A slightly different slant but I have had a slightly different experience from:

Quote:

---

Funny, the only ones ever getting infected (virii etc) at work are the ones with hiring/firing ability..

---

I think that there is an ageism/eliteism or whatever, culture.

I am used to the hirers & firers forwarding dodgy stuff to me to have a look at. Because I am over 50, I seem to be trusted..............now that is really pathetic (and dangerous too).

I strongly feel that it is an educational thing, as I am sure we all agree, but it is also a cultural thing, and that should come from the top.........like the Director/EVP level.

One of the main "gospels" that I preach (yeah, I know, "a voice crying in the Wilderness" :D ) is that it is not a stigma or shameful to receive an infected item............but it is if you open it and let it loose on the network.

just my slant

Quote:

---

"But how do we discipline questionable computer use?"


"The old fashioned way," I reply.


"Interviews, recommendations then dismissal?"


"No, I said the old fashioned way, not the slow way."


"What's the old fashioned way?"


"Threats, blackmail."

---

Now that sounds like a plan, doesn't it? D:

But then again, another bullet proof method would be to hire Gore as the main admin. Im sure he'll take care of things the 'right' way ;)

Cheers.