Your server is spewing spam on the Internet. Have a nice holiday.
The CIO was headed to his brother-in-law's house on the Friday before Christmas, expecting to have a nice, relaxing weekend. Instead, his hosted e-mail provider called on the cell phone: the company had contracted the Stration virus, and it was spewing spam all over the Internet. The company could no longer send or receive e-mail since it was already on the blacklists.
And oh, happy Christmas.
This is not, alas, a hypothetical example. I watched the debacle unfold from the periphery, complete with the IT manager running over to the office on Saturday to literally unplug network cables from each computer. I watched the CIO discover that the virus came in-house either through a personal laptop or because someone checked personal e-mail from work and (you'd think they'd know better by now) opened an attachment. Over the course of the holiday week, the CIO changed the corporate policies on e-mail and computer use from "recommendations" to "breaking these rules is a firing offense."
The result, for the employees, is that everything is locked down. If you work at that firm, you can no longer use instant messaging, you can't check your personal e-mail from work, and you can't bring in a home laptop for the kid to play with while Mommy is working.
From a security perspective, I understand the rules perfectly. Certainly, I understand why the CIO finally got the security-religion, and he probably did the right thing. On the other hand, I've been in companies where everything is locked down so tightly that the overwhelming feeling is "the company doesn't trust me!" In point of fact, it's less that the company distrusts its employees (even though some of them really are naive enough to click on things they shouldn't) but that they distrust the bad guys who are willing to bring down a corporate network over the holiday, just so they can send out more spam. But do the workers see it that way?
I think we all have a visceral reaction to the perception of "too much control," however, and it can't be good for morale. Early in my career, while I worked my way through programming school, I was an Accounting Clerk II in a sea of desks (we didn't even rate cubes). Employees weren't permitted to make a personal phone call except during lunch or our twice-daily 15-minute breaks. And believe me, we watched the second hand for the clock to hit 10:00. (Harley, the Repair Accounting supervisor, would loom over you at 10:14:45, so there was good reason for the clock-watching.) As you might imagine, I hated to be treated as though I was a prisoner, allowed fresh air for 30 minutes a day.
Surely, any CIO or manager who has to institute serious security for the company contemplates these things. But where do you draw the line between "treat employees with respect, and educate them to practice Safe Hex" and "lock down everything to protect the company's assets"? How do you decide where to draw it?
Previous Post: Towards sanity in software project estimation: a chat with Steve McConnellNext Post: Absolutely the Expert
Most Discussed Posts
Cloud computing has emerged as one of the most significant game changers to hit the technology landscape in the past 20 years. With this massive expansion of the cloud, the perception of the IT organization is shifting from a utility player to a change agent. This eBook breaks down five ways progressive organizations are using cloud-based IT Management solutions to help drive innovation and become more strategic, including: adding visibility and analytics, speeding up time-to-value, lowering costs, improving prioritization, and providing a blueprint for future cloud deployments.
Read the white paper to see how IBM helped Citigroup deliver new services and enhancements to their 200 million customers faster.
There are 3 ways to modernize legacy applications: rewrite completely, acquire packaged solutions or migrate existing code. This paper explains why it's best to migrate and how IBM® Rational® software can help.
Accommodating specific lines of business can result in a hybrid ecosystem of applications and servers. The resulting complexity of this architecture makes for an environment that is costly to maintain and difficult to change when addressing new challenges.
This whitepaper will help you to define a mobile device passcode policy. Security managers must attempt to reconcile two opposing goals. They must: 1) create a passcode policy that is strong enough to protect the device if it is lost or stolen, while: 2) not annoying users with needless length or complexity.
This whitepaper, authored by The Radicati Group, looks at the key reasons organizations should consider moving to a cloud-based archiving solution. Email archiving solutions enable organizations to store, monitor, and collect electronic data exchanged by their users to comply with internal policies and regulations.
ATERNITY will showcase a 30-minute demo on how Fortune 500 companies are leveraging its award-winning FPI Platform to deliver a user-centric approach to Proactive IT Management.
For businesses to move forward and tap into the ever-expanding universe of Internet users and network-enabled devices, it's critical to learn how to make the transition to IPv6. Learn the critical steps your organization must take to make a seamless transition-and keep your business world connected.
Learn how IT teams can protect against spear phishing tactics. Harry Sverdlove, chief technology officer of Bit9 offers a frank discussion about spear phishing - the most common technique used in today's advanced attacks.
Learn how to build a solid business case for your migration to Red Hat Enterprise Linux so you can run leaner, innovate faster, be more flexible and own the New Now.
Social media isn't about you; it's about everything around you. As you consider how your customers want to communicate with you, social media is something that can't be ignored. But what should your strategy be? Is social media "just another channel?" What kind of a plan makes sense for your contact center and for your customers? Join our experts as they share their insight and research results.
Hardware tokens were a popular method of strong authentication in past years but the cumbersome provisioning and distribution tasks, high support requirements and replacement costs have limited their growth. The additional log-in steps that hardware tokens require and the resulting user frustrations have limited adoption and make them impractical for larger scale partner and customer applications.
Sponsored Links
