Posted on 08/29/2006 10:44:08 AM PDT by ShadowAce
Recently, I overheard an IT professional complaining about her users. Veronica's company has 300 employees, many of whom would have been called "paper pushers" in an earlier era. Some of those employees download software and install it on their computers, and it often causes havoc for the support staff. Veronica's specific rant was about screensavers (some of which carry a payload of spyware, making it a security issue as well as a support problem), but it could have been any sort of application.
Veronica had looked at a $10,000 hardware solution, but even that required 10 hours a week for system maintenance, to keep up with permissions and such. That didn't sound like a great option. But she didn't know what else to do.
Veronica isn't alone. Other IT administrators have to make choices like this every day. How much should you control? And how do you control it?
On the one hand, you may believe, a company's computers are its assets, and employees have no business changing the way the equipment works. On the other hand, the last thing an IT department wants to do is to prevent people from being productive on the job. Computers are tools that are supposed to enable those employees to get work done, which may occasionally include the use of a not-yet-blessed application.
And then there's the human element of corporate life, and the resentment of apparently arbitrary rules. They wonder: why is it more important to prevent people from customizing their computers than it is to personalize their cubicles?
After corresponding with a few hundred professional IT workers and managers, I found that the philosophical and management questions are harder to answer than the technological solutions. We'll get to suggested tech answers in a bit—for Windows, Linux, and Macintosh—but any IT administrator who wants to create a computing environment that's both fair and secure needs to first address the... well, let's call them the emotional and ethical issues.
Whom Do You Trust?
Long before an IT manager decides on a technology or administrative approach, she has to decide how much autonomy users ought to have. Or, specifically, how much autonomy each kind of user ought to have; university students are presumably less trustworthy and tech-savvy than are engineers, and salespeople appear to be at the bottom of the heap. (Dire experiments have been hatched by a bored sales person in a hotel room when he has nothing else to do.) Another issue is the business environment; you'd expect a bank to be more security- paranoid than a chain of dry cleaning stores.
As you might expect, opinions vary widely on this subject, depending on the respondent's own personal stance and the requirements of the business.
"[B]usiness needs to get done and people need software to accomplish that business. Once the 'us versus them' wall of 'can't have badge and gun' mentality is thrown up then you have lost the support of the business," says Michael Schiebel, the Lead Investigator at a Midwest Fortune 100 financial services company. "Our job is to help the business succeed efficiently and safely. So all software must be viewed in the light of business use; if it increases productivity then our job is to make it a standard."
Whose PC Is It Anyway?
One important consideration is that the computer is not the employee's PC. It isn't. Says Schiebel, "The PC is company equipment the same as pencils, paper, chairs, desks, buildings etc. The employee has no right to privacy while using that equipment and should treat it with the same respect they would give if they borrowed their friend's car. The level of respect the employee shows the PC and other company equipment speaks entire paragraphs about their morals and ethics. The business should use this information to decide what kinds of people it wants representing the company to its customers."
For many IT shops, the hand controlling permissible user installations has a light touch. They're happy to trust the users to do the right thing—and then the IT department copes with the consequences.
Most users really don't need more applications than the company provides, say some administrators. According to one, "Most people either don't install outside software or are satisfied with the normal low-profile stuff that doesn't attract a manager's attention, and the ones who install a lot of stuff (e.g., developers and QA staff) mostly know enough not to cause any problems."
However, users who do install applications may not be aware of software licensing issues. That's not merely a matter of conscious piracy. Some applications are free for personal use but require paid registration when used in a corporate environment. Will every user know the difference?
That's not a minor concern. Ian is a security specialist who works in the transportation industry; he was involved in his company's development of the global client and server loads for a decade. As Ian points out, "Companies forget that freeware is normally free for personal use—not for use inside a company—and they are required to have some sort of license (users are too aware of freeware products for home use and bring them in with out telling people). With the litigious nature of the world, companies should be covering their exposure by making it clear that only company-issued and -approved software should be used on company machines, and that the user is responsible if litigation starts."
Also, it's now common for employees to take the company laptop home in order to telecommute or to respond to work needs while on the road, far beyond the old-fashioned 40-hour work week. If your firm enables Internet access for only certain approved sites, then the employee—who's working on your behalf for the rest of the weekend—won't be able to do things like home banking, paying credit card bills or placing an Amazon order, which, in the past, they had to take time off work to do. Whatever solution you come up with, it will have to acknowledge and deal with these complications.
Will They Revolt?
A technically easy answer is for IT to control all computers in the organization, and allow for no exceptions. That sounds good on paper, but it rarely works in reality. First, it doesn't work, because some users are indeed exceptional (particularly technical staff such as programmers). Plus, employees can be resentful that the company doesn't trust them. And it's time consuming.
For one administrator, company restrictions definitely get in the way of getting the work done. In her company, every time you need to change the font or install something for work purposes, you have to phone the helpdesk to log a call which is passed to desktop support. They phone you back within 48 hours, spend time looking at the software required, and eventually install it on the machine if it passes their security checks. Says the admin, "This may sound like a secure way to do things, however the time it takes to get an application approved—or worse, rejected—you've probably missed the deadline for the work you needed to do. You've cost who-knows-how-many man hours running around getting all the I's dotted and T's crossed on the forms to make an exception, not to mention the testing and signatures required by desktops. Ultimately it can take weeks to have a new application installed."
This administrator got around the issue by stating she needed to use ping and traceroute among other things as part of her daily work supporting Linux servers, and at the very least needed to run cmd.exe. "I now have full administrator access to my PC, and have therefore negated the security in place. I have also managed to obtain domain administrator access in very much the same way." So, let's take a look at some of the ways that IT staff address the problem.
Our solution was a signed contract to employees if they fubar the system we wipe it out no questions asked and don't save any data. And like someone else said it takes 10 minutes to ghost it back to how it was when they got it.
It's pretty tough to infect office furniture with a malicious product which can steal hundreds of man hours for which the company has paid or steal company owned data or expose the company infrastructure to attack.
I gotta say, I like your solution better than the arbitrary "I don't like ESPN.com so everyone who visits that site will be suspended" approach.
It's always good for a laugh now and then.
The potential is there, but in reality it just doesn't happen very often. With mandatory real-time virus scanning and anti-spyware, independent of local administrator status, that isn't very likely.
In practice, users breaking things outside of their own machine is very rare under this arrangement--remember, they're only administrators on their own machines--and doesn't justify the company-wide slowdown of IT-only administration for all Windows machines.
This frees the admins from having to do everything so they can focus on stuff that really need their attention. Users who aren't capable/comfortable installing their own mouse can always call an admin to do it, just like always. They just aren't forced to call him when they are able to handle it.
Interesting company IT consideration article :~)
I would require the IT group to repay the development hours destroyed by an indiscriminate act of "ghosting" a new image without any attempt to recover development files from the hard disk. The bill would be at customer billing rates for the value of the employee's labor that was destroyed. Help desk labor hours are about 10x lower than most of the software developers in my organization. Any late penalties for schedules misses caused would also be assessed to the IT organization that destroys the valuable data as an expedient use of their time. Loaded developer rates run $170 to $250 per hour.
"Ahlow? Oitee."
What's funny is that if the problems are solved by the new policies/software, the company will be able to get rid of some of the IT people who solved the problem. lol
No kidding! I couldn't believe I read that. If the employee doesn't "own" the computers or the work product on them, IT doesn't either. That work product belongs to the company and is not IT's to delete.
Trust me, relatively speaking; stupid users FAR outnumber stupid admins everyday of the week, and twice on Sunday.
And it IS the company's computer, if you have a need for expanded permissions, make your case, and live with the decision.
The company isn't in the business of reducing helpdesk calls.
And most likely, you company isn't in the business of answering helpdesk calls either, unless it's from a customer for a particular product or service.
I can't tell you the number of times I've had to clean computers from competing utilities, spyware, botware, malware, virus' you name it. All because windows defaulted to admin privledges for the enduser and the enduser wanted to load whatever flashing application, tool, screensaver or what have you that tickled their fancy.
Sorry, if I were your admin, you'd have to make a strong case for an application or expanded provledges, and then, if I granted such, you would be watched like a hawk.
I would say that a user visiting illegal sites from his work computer that open both the user and the company up to significant legal liability if caught outweighs hampering his "productivity".
If I had an employee visit those sites with my company's computer over my company's internet connection, I would want IT to kill his account until I were notified. Second time would be termination. I've seen how much IP violations can cost a company even if those violations were unintentional and were rectified before they were caught. Getting sued by Microsoft or Adobe for intentional piracy would put us out of business.
Better yet, add them to your proxy filter and bar them from even going there and redirect to a nice warning page.
NO p0rn, No Warez no iTunes, No FReeping... (opps!)
Get back to work!
I have a girl in my office that uses a 2.7ghz Celeron with 512 MB ram, it runs slower than the Pentium 266mhz with 128MB in the next room (Both run WinXP). The difference? She keeps downloading all kinds of crap. I'm about to take her off the network.
I'm kinda glad MY hole area doesn't send external emails either. Ouch.
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.