End User Ignorance - How long will we cope?

Quote:

---

Yes, wherever I can I have technological enforcement but with some 4 billion web pages out there there isn't a web filter that can get them all right all the time.

---

Too right mate, content filtering is not even close to doing a great job. Each week I see hundred of un-categorized web sites and a few false postives. Like the Federal Reserve categorized as a gambling site. :) Sure they catch alot, but they leave alot open as well. unless you go to the extremes and block all sites and adapt rules to manually allow sites as they pop up. I like the "user" is responsible idea.

The only question I pose is how much tolerence do you place on the end users? We all have done it, you're bored or maybe you havin been bustin your butt for a few hours and you're now ahead of schedule and you feel like just crusin around the web for a while.Or playin a few hands of poker or whatever. If you as the admin notice this at that time are you going to inforce the policy to the full extent? Are you going to say something to them and let it go? Maybe you would allow them some time to continue because you know this person and you like them while another might be doing the same but you do not know them.

So the only thought I have on this (because I fully agree with TH13 on every aspect) is after you have the policy in place, are you going to back it up all the time? Or half the time? I know if it was me and I caught a friend wlooking at porn on my network I would go to them, pull them aside say that this was his freebee and after this he was going to be in trouble. If it was someone I didn't know I would do the same, pull them aside and talk to them, however I would make sure to give more of a big brother impression in hopes of installing a degree of paranoia. I hope this is making sense, I haven't yet worked as a admin so I am not experianced the problems who folks have. It is all hear say. Perhaps if I was in a adminstrative position I would not think of it this way. However I know I would be thinking about fairness to the users. Not just to some but to all of them while still fully inforcing the policeis I had set forth.

Horsey > the reason that I mentioned those things is that I'm working on the new FAQ and I saw something related in the JUPM AUP (one of these days, someone is going to slap me for referring to that AUP)...

Quote:

---

You will not attempt to access any protected sections of the sites or Forums, nor make use of any hacks, cracks, bug exploits, etc. to bypass or modify the features of the forum software at any Jupitermedia site.

---

If the admins by accident would remove the Addicts-protection and non-eligible people would access Addicts (either by accident, or deliberately), those users, by "attempting to access any protected section of the Forum", would technically be breaking a rule, and JUPM could ban them for breaking that rule. Would they be banned for the actual entering of the Addicts forum, or would they be banned because they're "circumventing security measures"?

What I'm trying to say: in this case, it's is clearly an admin-error, but still the user could be punished (banned) for it.

If Addicts-protection would be removed (without notice), you'd see some different reactions:
- Users that know they're not supposed to be in Addicts and wouldn't even try clicking the Addicts section, even if the news would leak.
- Users that know they're not supposed to be in Addicts, find out that the protection has been removed, and just snoop around a little.
- Users that know they're not supposed to be in Addicts but try anyways on a daily basis.
- Users that end up in Addicts by accident.

Technically, the three last groups of users could be banned ("fired"), but it wouldn't exactly be equally fair for all of them...

I swear there's a point somewhere in this post :D

Hatebreed:

Here's an example of my one and only warning:-

Quote:

---

During a routine check your name appeared near the top of the list of internet users in XXXXXXXX. Upon reviewing the log files I find it rather difficult to pin down much that I can categorically state is work related. To remind you of the Acceptable Use Policy that I have emailed to you every three months since your arrival at DWP:-

“This is a business network and is to be used for business purposes only.”

Please try to curtail your internet use to comply with the policy.

I tend to only give one “friendly reminder”……

Thank you for your cooperation

---

This particular lady didn't find my friendly warning sufficient. Having waited a month before checking the usage again I still found her at the top of the list. She appeared to be running her real estate business on the side. Needless to say she now has plenty of time to do her real estate stuff in the privacy of her own home.

That's an "admin" error, Tiger: you guys don't pay her enough. If you would pay her enough, she wouldn't "have to" run a real estate business on the side. I bet that would hold up in court :D

Neg:

I don't employ them or issue them their workload..... my job is to "shepherd" them.... ;)

Policy provides a means for action. I am not as strict as Tiger. We have some downtime here and it's ok. Like Negative says, admin rights may be accidently removed or some other non-intentional thing. That does break the rules but there can be leeway there. There almost has to be, but in my job. If I accidently remove access controls the risk to the company is SERIOUS. Thus accidental or not, legal action could be brought down on the company. So in my case, my ass would be fired or in the slammer depending on the outcome. What policy does is provide a means to terminate or do whatever with the guy that does intentionally remove Jup. Media access control. Without it there is no ground for Jup or you to stand on.

Also in your case Negative those users are customers. That is VERY different. My customer web site get's hammered with crap all the time. That's why I outsource it's security so they can monitor it 24/7 in real time, and they try to get into boyfriend accounts etc. and they break the user agreeement sometimes. So what, when they cross the line and do something illegal is when I get involved. If you had an admin accessing controls on a web site owned by your company one he has no normal interaction then you would not take the same view. :)

Let me mention this as I feel it is valid to the overall thread.

A formal security team has only existed in my facility for just under two years. You can imagine the mountain of poop we had/have to deal with. In that time, we have installed enforcement mechanisms and also the levers to pull via policy. We have developed what we feel is a water tight policy group (acceptable use, confidentiality, security policy). The wheels of Govt. turn slowly, especially when sweeping changes are going to be made. All of our policies are "living" documents that will continue to evolve as our environment does.

We want to be sure that every means of enforcement is available to us. When it comes to non business surfing, we are still pretty liberal in that news sites, ebay, etc. are still accessable. We are concerned with the big three: 1) Sexual Harassment 2) Private info leak 3) Litigation. As long as we are able to keep these at bay, we are happy - for now.

We implemented a similar policy a few years ago after an audit revealed that more than 95% of PCs in one facility had at pr0n on them. These folks were emailing them around. Users went to great lengths to hide their activities, but to no avail. As I used to tell my students when I was teaching, you may be smart, but I'm smarter.

I usually give users a friendly reminder when I see something amiss. Usually something like, "I see you've reached the top 10 list of internet users. Be aware also that your usage is logged and log files *are* looked at. That's probably not a good thing when management sees you're surfing match.com all day."

We take the dirty Harry approach.

"Do we have log files loaded with horrible info on your or not? Feel lucky punk?"


LOL.

:)