educating users

Im mailing this to myself at work, to distribute to the users on my network. With ISA sever up and running, it would be very easy to restrict internet access by group or individual user, only allow access to certain sites that are essential. That would really suck. Ive already had to limit the attachments somewhat. It would be a shame to have to restrict them further. But the director of MIS is really getting fed up with us having to chase virus’s down, not to mention they make us look bad.

Any suggestions in this area would be appreciated.


---------------------------------------------------------------------------------------

Email, Web at Work - Is the Free Lunch Over?
Mon Mar 18, 9:25 AM ET

By Bernhard Warner, European Internet Correspondent
LONDON (Reuters) - Brace yourselves, corporate drones: one of the last bastions of work place relief -- sneaking in some online shopping or snickering over an email joke -- could be destined for universal banishment.

Major corporations are increasingly classifying employee email and Internet privileges as potential security hazards, distractions or worse, costly legal dangers in the making.
As a result, companies are considering dramatically curtailing, or even abolishing completely the freedoms, on which employees have grown increasingly reliant over the past few years.
To hear some of the more ardent computer security advocates tell it, the days of sneaking in some online shopping on company time, mass-emailing your pals a Flash-powered shoot-'em-up game or even downloading screensavers could be a thing of the past.

"It is drastic and painful," Raimund Genes, European president of anti-virus software manufacturer Trend Micro, told Reuters. "But I think it is necessary for the future."
The objective is clear, security advisers say.

A healthy dose of IT prevention can eradicate debilitating email-borne worms and limit the likeliness of employees using their speedy desktop Net connection to download copyright-protected tunes, thus triggering a lawsuit.

WHEN FIREWALLS JUST WON'T DO

"The message is: 'I'm afraid you'll have to do it after hours at home, which is where you should be doing it in the first place,"' said Mikko Hypponen, manager of anti-virus research for Finish-based F-Secure Corp.

Hypponen added some Fortune 100 companies are looking to step up security measures beyond firewalls, which bar access to sites with racy or inflammatory content. They are looking to ban Internet usage for all but select, authorized personnel.

The biggest developments are around email prevention, experts say. Elaborate content filtering software, which can run upwards of $30,000 to install, can block all but the tamest incoming emails, and most attachments, said Trend Micro's Genes.
Corporations, particularly those that were stung hard by the wave of virus and worm attacks during the past two years, are considering it a top priority.
"We started full email and Web surfing prevention as a safety initiative in 1999," a chief security officer at one of Germany's largest employers, an energy firm, told Reuters.

ALPHABET SOUP OF RESTRICTIONS
For many employees at the company, Web surfing is confined to specially designated PCs, and the email server has been tailored to intercept incoming emails which contain a range of file attachments, he said.

Among the nearly 100 email attachments outlawed by the company are: screen savers, digital greeting cards, and the ubiquitous ".exe," or executable file, a standard format needed to run most computer applications and a common target for virus authors.

The security officer said employees are gradually adjusting to the strict policy. It has already scored points with management though, he said, as no virus or worm has infiltrated the firm's defenses during the past three years.

for full story:

http://story.news.yahoo.com/news?tmp...y_dc_1&cid=582

You do what you have to do. Some may not like it but if the head cheese says that the company time and computers are to be used for company business then thats the way it is. As a small business owner myself I know that I would be choked if my employees were getting viruses through their emails and I would soon put a stop to them surfing the net. As it is right now Im lucky that the computers are just used for the business and any email is put through an email virus scanner. I dont envy you having to implement changes but explain to the rest that unless they are more responsible in the way they use the net and email then you will have to restrict their access. Most will be more careful if they know why and what will happen if their not, let them know that it is up to them to be able to keep the access to the net. This way you are not the heavy and if they contine to screw up then shut them down :argue: :idea:

Losing a priviledge that you have been given is always a problem. Employees tend to view their email and Internet access as a normal part of the job and not as a priviledge.

First, the email side of it ...

Personally, I'm limiting my personal email use at work to the minimum, simply because I have been changing companies, so my work email address is not a good address to reach me.

I think Lostit44 is on one track that can help, user education. However, you will need to consider a set of follow-up steps, because some users will not be willing to listen. Difficult as it is, after a period of education, users who continue to receive non-work related emails and attachments should be talked to directly. However, this means some form of email monitoring, which is a privacy issue. Your company would need to make clear beforehand that all email can be monitored. Unfortunately, that's what you will need to do with some users.

Also, you would probably want to restrict access to the web-based email providers such as Hotmail (after all, would you trust Microsoft to have an up-to-date virusscanner checking attachments?) or Yahoo. My previous employer did that, it was a pain at first, but you get used to it and the number of viruses received diminished quite a bit.

Next, the Internet surfing ...

I think that the Web can be a great tool to support work activities. However, a lot of time can also be wasted on it. One thing you can consider is site filtering to deny access to porn, gambling and other "sinful" sites.
(Wired just ran an article on that: Filters Block 'Sinful Six'
)

Although employees might grumble, they will be happier with access in a limited way based on a rational set of restrictions than no access at all.

You're better off not creating separate users with web access. This would create tension and jalousy in the company. It can also lead to abuse as people try to use other people's accounts or computers just to be able to access things.

Anyway, to resume all this:

Educate them and consider the use of some selective site blocking. And have management remind them that company time is not made for personal web surfing.

Cheers,

BrainStop

PS = And if it doesn't work, you can always start to monitor all traffic that passes through your proxy and firewall and then have a chat with users who abuse resources .... :zap: