Employee Monitoring 274
CWmike writes "Michael Workman, an associate professor at the Florida Institute of Technology's Nathan M. Bisk College of Business, estimates that monitoring responsibilities take up at least 20% of the average IT manager's time. Yet most IT professionals never expected they'd be asked to police their colleagues and co-workers in quite this way. How do they feel about this growing responsibility? Workman says he sees a split among tech workers. Those who specialize in security issues feel that it's a valid part of IT's job. But those who have more of a generalist's role, such as network administrators, often don't like it. Computerworld contributor Tam Harbert found a wide variety of viewpoints from IT managers, ranging from discomfort at having to 'babysit' employees to righteous beliefs about 'protecting the integrity of the system.'"
Know when (Score:4, Funny)
Re:Know when (Score:5, Informative)
Re:Know when (Score:4, Insightful)
As an IT Security professional, I need to be acutely aware of the risks the company can expose itself to.
"Those who specialize in security issues feel that it's a valid part of IT's job."
And, we're done here.
Re: (Score:3, Insightful)
So a Slashdotter claims that part of his workload involves being "acutely aware" of all the various kinds of porn out there, and that trolling coworkers files for instances of such constitutes a "valid part" of his job, and you say we're done here?
Come on! This warrants at least one +5 Funny comment.
Re: (Score:2)
If I worked in IT then I would:
- Use a program to filter-out requests for playboy.com and other porn sites
- Allow streaming of radio, but impose a limit equal to Dialup speeds (i.e. 64k or less) so people don't clog the network
That's it. It's not difficult. Is it?
Re: (Score:3, Interesting)
You make sound as if Internet monitoring is the only sort of monitoring being done these days. Many big corporations now keep logs of files that have been executed, and some even install keyloggers and computer forensics software.
So it isn't even just a matter of porn or file downloads or webmail. They're tracking everything done on the computer. I wonder just how useful that tracking can be, considering the huge volume of data on any network of significant size.
Re:Know when (Score:5, Interesting)
Re:Know when (Score:5, Interesting)
As a security professional in a VERY large company, you'd be amazed how many people go to porn sites on work computers. For some people, it seems like porn is like an addiction. They crave that "stimulation" so badly that they can't wait until they're somewhere else, or perhaps they don't have a computer at home, or perhaps the only computer at home is in a public area where other people can see what they're doing. There are many reasons why someone would chose to do something like that at work.
They also don't seem to believe the warning on the computer when they log in every morning telling them that we ARE monitoring their activities.
The problem is that new sites pop up all of the time, so trying to block them is like the old "whack a mole" game at the carnival.
I found one company-issued laptop with 16GB of porn videos, including kiddie porn. That was immediately turned over to the proper authorities and, if my information is correct, the former employee is now in prison.
Re:Know when (Score:4, Insightful)
putting people to prison for downloading porn, even child porn, what a fucked up society.
Re: (Score:2)
It may not have been porn. It may have something risque, or marked LSFW or NSFW without actually being *porn*.
Re:Know when (Score:4, Funny)
I used to have to browse porn at work - I worked on a porn links directory...
I also had to monitor employees in case they visited accountancy or crochet pattern sites, the filthy beggars!
Re: (Score:2)
Re: (Score:2)
To be honest, given the choice between browing porn and almost any job in the world, browing porn is going to be more interesting.
Re: (Score:2)
Many years ago I worked for a company and we had a rather out-dated computer system. I finally convinced them to upgrade, but we still didn't have internet (which would have helped tie the different locations together for billing purposes, etc). We had a simple batch file to backup on a Zip disk one specific directory each day (which had billing information, etc in it) which was sent offsite each day and we had an employee get busted for porn because he saved it into that specific directory. Why? Well, I do
Re:Know when (Score:4, Insightful)
Total BS (Score:5, Insightful)
You know, I'm SO sick of the total bullshit line of reasoning that people like you keep giving for gross violations of our privacy, not to mention keeping people like me from doing my job.
Okay, so your company has a policy of not allowing me to browse porn on the Internet, woohoo. Why is it that you jump to the conclusion that the only way to make sure this doesn't happen is to monitor every single web site that I browse? Why can't you just have a policy of, hey, if management has some reason to think that KingSkippus might be up to something, then look for something fishy?
Ponder this. I'm pretty sure that my company also wouldn't like me browsing porn magazines at work. They'd probably get quite irate if, in the middle of the day, I pulled a Hustler out and started flipping through those oh-so-sweet pages. So is the only answer now to have security guards posted at every door to pore through all of my possessions as I come and go, making sure that I have no porn in my physical possessions? I also carry a 4 GB USB drive everywhere I go with some basic troubleshooting tools and electronic copies of documents that I like to have on me at all times. Every time I enter the building, should I be strip searched and, when such a thing is found, every file inspected to make sure that I don't have dirty pictures on it?
No, the whole "We must monitor EVERYTHING!" is just a BS policy made because people like you get off on your power trip.
Legally, it's really simple. You create a policy that says that if you're caught browsing porn on the Internet, you get fired. Managers back it up with action by, when people are caught browsing porn, they fire the person who was doing it. There's no need for stupid ass content filters, treating everyone like they're 13 year olds, to ensure this policy, any more than there's a need for strip searches or searches of all physicial possessions. If a company gets sued--and make no mistake, they will get sued no matter what policy they have--they show the judge the policy and their record of upholding it, and that's that.
I defy you to actually cite these throngs of "all sorts of lawsuits from sexual harrassment to violation of ethics laws," especially the ones where the court found a company liable because they didn't have a content filter in place with people like you watching everything everyone is doing instead of enforcing the policy when violations were reasonably found Big Brother-style. As long as we're talking anecdotally, you know who I've heard does the most browsing of porn on the Internet? High-level management. True story: at the company where I work, most of the executives have been given explicit exemption from our content filters. As for the "ethics laws" joke, discover the wonderful world of "situational ethics" [publicradio.org] and then explain to how you're protecting a company that deliberately puts a clause that says, "From time to time, the firm may waive certain provisions of this Code" in its Code.
The truth of the matter is that my company spends WAY more on content filters and salaries for people to set them up and monitor them, not to mention the cost to the business when they break and the Internet becomes completely unavailable, than it would on bogus lawsuits that would have been brought anyway. The whole "you need content filtering to protect you" is a scam perpetrated by content filtering companies and people like you who would probably lose your job if management figured out the truth and actually cared. (And, more importantly, did their job of dealing with these issues instead of foisting them on the IT group.)
Back in the mid-90s, my boss read an article that explained about how login scripts could be used on Windows 3.11 to do things like delete Solitaire and Minesweeper and replace the desktop background with a forced company standard. The next thing I
Security people... (Score:5, Insightful)
Sorry for the double post, but I did want to say a few more important things.
I don't mean to imply that all IT security people are on power trips. I know a lot of them, and my job has me working with them a lot. Most are fine, upstanding, ethical people. A lot don't like doing what they are mandated to do by their corporate overlords. Most only do so as much as they have to.
But they're a bit like cops, as most cops are fine, upstanding, ethical people. Still, there are a few who really get off on how much access and control they have, and they use it every chance they get. They're the ones who like to brag to me, "Watch how I can access this random Schmo's desktop. See? They don't even know I'm doing it!"
I'm also not pretending like there should be zero interference with the network. I'm painfully aware of the problems that viruses, trojans, worms, phishing scams, etc. pose. The only reason I would ever advocate having a content filter is for that purpose only, blocking sites that are literally dangerous to be accessing, stuff like malware sites. I'm also for virus scanning, as that's a necessary evil as some people still do stupid things and not 100% of security threats can be caught.
What I object to, though, is this philosophy that we have to protect companies from people wasting valuable time or productivity. That's not IT's job, that's management's job. If I want to check my e-mail from work, there's no reason why I shouldn't be able to check my damn e-mail. I also carry a smart phone and an iPad, so you really can't keep from from checking my e-mail anyway. (Or for that matter, goofing off with the many, many games that are available to me. Or for that matter, even--gasp!--browsing porn!)
I'm just sick of companies spending stupid amounts of money to save pennies in productivity and grossly violate people's reasonable expectation of privacy. It's not right, and given the GP's defense of such policies, it sounds like he has already drunk the corporate kool-aid.
Re: (Score:2)
I would never work for such a company. It blows my mind how anyone would. It must be that because of all the click-through EULAs, we're conditioned to dismiss any legal stipulations and just figure, "Eh, it'll probably never happen to me." And largely, that is true. (I'm speaking mostly of Americans when I reference this dismissive attitude.)
Dude, get a grip! (Score:4, Insightful)
No, the whole "We must monitor EVERYTHING!" is just a BS policy made because people like you get off on your power trip.
For some? Sure. There are always going to be petty bureaucrats who enjoy power-trips.
But that's hardly the only reason for that type of policy. Here are a few I know of off the top of my head:
As you may be able to tell, I have been responsible for setting up some such monitoring at my company in the past (though it has since fallen into disuse, largely because we laid off 3/4 of the employees...). Though I have no problem with a certain amount of incidental web browsing, there were people who were spending essentially the entire day streaming video (which clobbers our relatively small pipe), browsing MySpace, or playing Flash games. And yes, a couple who would browse porn. (And then there were the one or two who would download games to install onto their computers which turned out to be viruses. So we'd have to clean their computers and explain that that was bad. And then they'd go and install the same bloody virus-ridden game. Again.) It's one thing to poke around a little—or post on Slashdot—but when there's urgent business that needs doing, and it's not happening because you're goofing off...I mean, yeah, that's an issue for HR, eventually, but it seems to me that it is IT's responsibility to at least take basic, reasonable steps to see that those specific temptations are not available.
Dan Aris
Re: (Score:3, Interesting)
Re: (Score:2)
I agree with most of your post (and maybe it is just because I don't care for solitaire), but I do have a pet peeve with solitaire. I find it annoying when I run across employees who have almost full internet access (gambling filtered and probably porn) sitting there playing solitaire.
It just seems like you could be doing something more interesting or productive for your personal life (e.g. reading a blog that you would otherwise spend your free time at home reading, reading the news, paying bills, etc...)
M
Re: (Score:2)
Ponder this. I'm pretty sure that my company also wouldn't like me browsing porn magazines at work. They'd probably get quite irate if, in the middle of the day, I pulled a Hustler out and started flipping through those oh-so-sweet pages. So is the only answer now to have security guards posted at every door to pore through all of my possessions as I come and go, making sure that I have no porn in my physical possessions?
IT Security Policies regarding porn sites have nothing to do with the content. Maybe Legal has a problem with it, but Information Security is more worried about what comes with those sites, and how difficult they are to blacklist (and sometimes whitelisted sites get purchased and re-purposed):
Porn Sites More Infected Than Thought http://it.slashdot.org/article.pl?sid=10/06/12/1712223 [slashdot.org]
Over a Third of the Internet Is Pornographic http://idle.slashdot.org/article.pl?sid=10/06/16/1722258 [slashdot.org]
Re: (Score:2)
Absolutely fantastic post.
I was a sysadmin in a past life and know/work with a number of others. I see this kind of thing all the time even amongst those who are free software advocates. It seems no matter who you are, it takes significant effort to give up power once you've attained it. It's really unfortunate and I don't have a good answer for how to change it. A lot of it seems to be tied up in hard feelings between individuals or groups and not being willing to de-escalate the control war. Sadly in
Re:Total BS (Score:4, Interesting)
Another true story. At my company, I sit close to the guys who monitor the content filters. They have connections to their computers outside the proxies, directly on the Internet. I see them all the time accessing their personal Gmail accounts, which is blatantly against the company's security policy. It's a bit like the police officers I see all the time driving 70 MPH on the 55 MPH-speed limit Interstate, or driving through red lights. Who watches the watchers? Oh yeah, that would be nobody. Oh, don't worry though, I'm sure they're browsing "responsibly" and don't need watching.
This happens daily at our company. In fact, I had a manager approach me and ask if she could have the same tool that I use for remote access to assist users and fix things. I flat out told her "no." She sniffed and walked away. The hubris of corporate America is astounding. Management mentality is still very much caught in "industrial revolution" mode of thinking where employees need constant micromanaging. Has it occured to anyone, that human beings hate micromanagement? Micromanagement is a moral destroyer and encourages rank and file employees to be mindless automatons. I often wonder why someone wants to become a manager. I think it is to gain more freedom to make decisions so they are less of an automaton. Many managers also forget from whence they came.
Re: (Score:3, Funny)
My company has a very strict policy as well. You're expected as a condition of employment to acknowledge that you may end up
Re: (Score:3, Insightful)
"For example I only talk to people when their porn viewing habits get so strange that it started to expose the company to all sorts of lawsuits."
This thread is worthless without pics!
Give the IT Tools to the HR People (Score:3, Insightful)
The average, typical IT tech lacks the "touch" when it comes to employee monitoring. Give the monitoring tools, or reports from such, to the HR guys, whose ultimate responsibility this should be.
Employee monitoring is in the position today where web page creation was 15-20 years ago. It was an "IT Function," because the tools were new and computer-y. Eight million "blink" tags and six hundred thousand animated "under construction" GIFs later, the tools made their way over to the Marketing and Creative Se
Re: (Score:2)
You're right about having to know when to police people. Where I work, there are only two times IT gets into monitoring employee's network access:
1. Troubleshooting a problem, at the employee's own request
2. After Human Resources calls us and tells us there may be an issue.
People in general are naturally inquisitive and there are those amongst the IT crowd that may poke their noses in where they don't belong. This raises not only privacy issues, but ethical and security issues as well, which is why the ru
Panopticon is here to stay (Score:5, Insightful)
Society is growing used to more extensive monitoring overall. We monitor our babies with webcams. The webcams are then used in schools to monitor class rooms and playgrounds. When we grow up, we rename them security cameras and appoint low wage individuals as our watchmen.
In some areas of the world such as the UK, computers are already being used to analyze the images from the security cameras. Storage capacity grows, and data gathered from the image analysis are stored for a lifetime. They can be used to enhance the analysis of your children's children. The ones which protests are considered suspicious with "something to hide". The ruling class are the only ones exempt from monitoring.
In the next step, computers are used to analyse images from private bedrooms and bathrooms. After all, who needs to worry about privacy when it's only a computer watching. It's all about protecting us from the boogey man. Think of the children!
Resistance is futile. You will be monitored.
Re: (Score:2)
You forgot to mention the nanobots that will be swimming through our blood vessels.
Employee monitoring is not really new (Score:5, Insightful)
TFA raises a slightly different issue: when one employee is asked to monitor the others. Sysadmins should not be asked to take on the responsibility of watching employees; that is a manager's responsibility. If the manager is not technically competent to monitor computer use, then there is a question of why that person is managing people who use computers for their work -- the manager should be competent with the equipment.
Re: (Score:2)
But it's still usually a bad idea (Score:5, Insightful)
When it comes to being employed, though, bosses and managers have always watched their employees to some degree -- that is, of course, the purpose of being the boss.
No, it's not. The purpose of being a boss is to set direction for and co-ordinate those who work under you, so that the individual contributions all advance the overall plans.
There is a certain type of person who does think that being the boss is primarily a power trip/disciplinary role. Such people usually live in middle management in large companies, because they are basically a waste of space. Small companies can't afford to have the dead weight, and large companies won't promote them to a level where they can do any serious damage but usually have too much bureaucracy to effectively detect and fire them.
Trust is a prerequisite for any employment relationship. If you don't trust the people working for you to do what they are supposed to without routine monitoring, then you have bigger problems than whether the monitoring itself is justified. Indeed, one could make a reasonable argument that routine monitoring implies a breakdown in the fundamental trust relationship between employer and employee, which would itself be immediate grounds for a constructive dismissal lawsuit in this country.
I can understand running automated tools to prevent, say, leakage of sensitive data. I can understand running automated tools to scan incoming data for viruses. This sort of thing is, sadly, reasonable for protection and sometimes necessary for legal/regulatory compliance in the modern world. However, it should rarely if ever disrupt an employee going about their business, and no-one else should be directly involved unless a problem is detected.
I can understand general performance monitoring. Recognising staff who do well is valuable. Helping (not attacking) staff who underperform is valuable. Firing staff who underperform and cannot improve is, unfortunately, sometimes necessary. But none of this stuff requires intrusive, minute-by-minute monitoring and recording of the kind we're discussing here.
The only time direct, intrusive monitoring is used should be when there is already a credible level of evidence of serious wrong-doing, and confronting the employee about that wrong-doing directly would prevent proper investigation. And in those circumstances, I tend to ask why the company is letting some next-line-up manager or IT/HR goon do the intrusive work. If it's that serious, the higher-ups should be calling the authorities, or at the very least passing a case file to internal security/legal staff who are required to handle the investigation with suitable discretion and a lot of accountability.
Re: (Score:2)
The only time direct, intrusive monitoring is used should be when there is already a credible level of evidence of serious wrong-doing,
I strongly disagree. Any time there's any evidence that you're not doing your job, "intrusive" monitoring is justified. It's your manager's job to know if you're doing your job. A lot of IT work is indistinguishable from fucking off without monitoring.
Re:Employee monitoring is not really new (Score:4, Interesting)
If the manager is not technically competent to monitor computer use, then there is a question of why that person is managing people who use computers for their work -- the manager should be competent with the equipment.
That's a bit much. The accounting manager should be able to keep up with the latest ways to hide computer usage? Does that mean the most able computer user should be the head of each department regardless of ability to manage that department? Also, aren't the guys trying to hide stuff more likely to become the most compentent user therefore allowing them to be the "boss". Of course that means as you go up the the chain of the company it just keeps being more and more technically superior people, regardless of ability to do the job.
No, I'll stick with the idea that the department manager should know his specific job better than anyone. That includes the IT Manager, and he should be ultimately responsible for all computer usage.
Re: (Score:2)
Re: (Score:2)
The main issue here is:
At work, my ass basically belongs to my boss. I do work, he pays me. He can check if I do my work. I would prefer that he informs me if our IT guys also monitor me - but I am aware that this is possible.
At home, my ass belongs to me. And I don't need to have a government that checks me. I pay them (tax), I vote for them, and I will check them rather than them spying on me.
It's vitally important to differentiate between the two situations, or you may end up either without a job or with
Not new, but certainly different nowadays (Score:2)
I disagree. It's the function of a security professional. It's the function of someone who has no axe to grind with the employee, who can be impartial, and who, at best, moves in an entirely different world from the employee. Las Vegas casino security employees don't, for example, fraternize with the frontline employees.
Monitoring needs to be fair for a whole bunch of reasons that sho
Re: (Score:2)
In the next step, computers are used to analyse images from private bedrooms and bathrooms. After all, who needs to worry about privacy when it's only a computer watching. It's all about protecting us from the boogey man. Think of the children!
Resistance is futile. You will be monitored.
Some people do that now, and you can buy the videos on line. :)
Re: (Score:2)
Society is growing used to more extensive monitoring overall. We monitor our babies with webcams. The webcams are then used in schools to monitor class rooms and playgrounds. When we grow up, we rename them security cameras and appoint low wage individuals as our watchmen. In some areas of the world such as the UK, computers are already being used to analyze the images from the security cameras. Storage capacity grows, and data gathered from the image analysis are stored for a lifetime. They can be used to enhance the analysis of your children's children. The ones which protests are considered suspicious with "something to hide". The ruling class are the only ones exempt from monitoring. In the next step, computers are used to analyse images from private bedrooms and bathrooms. After all, who needs to worry about privacy when it's only a computer watching. It's all about protecting us from the boogey man. Think of the children!
Resistance is futile. You will be monitored.
Fear is an amazingly powerful controller. Why do you think the news/government tries to mention terrorism as much as it can? A state of fear keeps people generally in a blind obedience to totalitarian inroads. I cannot help but think that the movie, V for Vendetta, is a scarily astute observation/political commentary to what fear and blind following does to a society. Mix that with strong religious overtones and you have the tools for manipulation of the masses.
You have to. (Score:5, Insightful)
"He goes through the logs to see if there's anything in there that needs to be exposed or discussed." Activity related to porn, gambling or hate speech automatically raises red flags, he says.
He once caught an employee who was engaged in criminal activity involving intellectual property that could have resulted in a big financial loss for the company.
Many years ago, I was in the company's server room talking to a buddy and he mentioned that an employee was taking up quite a bit of drive space - with porn. The guy had a problem. All you need is one guy with a problem like that to download some kiddie porn and your business will be shut down and you go to jail - over an employee with a problem. The guy I mentioned was talked to and I think he was asked to resign.
Observers say IT managers can expect to be asked to take on even more monitoring duties, such are reviewing video surveillance, examining text messages, tracking employee location by GPS or listening in on social media.
That's going too far. Come on - a Stalinist company?!?
Larger companies have started to hire third-party firms to monitor what's said about them in the blogosphere and on social media sites, but in many midsize and small companies, this duty could fall to IT.
That's also going too far. It's one thing what an employee does on company time and with company's resources, but they do on their own time - as long as it's legal shouldn't be a company's business.
Re: (Score:3, Interesting)
Re:You have to. (Score:5, Insightful)
All you need is one guy with a problem like that to download some kiddie porn and your business will be shut down and you go to jail
I want to challenge this. This has been posted 10+ times in this discussion with nothing to back it up. Why would the activities of an individual in the company result in shutting down the company and sending anyone to jail? That makes no sense.
On a related note: This is how EULAs come to exist. Someone assumes that they might be liable for some action someone else performs. So they try to get around it by making you agree to some big contract that waives liability. Over time the EULA grows, filled with such legal fallacies until it becomes 20 pages of legaleeze. In reality, there never was any liability in the first place.
Waste of time (Score:5, Insightful)
Most frequently I'm asked to look at log files or email and tell employers things that I simply cannot know. I can tell them that an employee didn't log in to their PC until 10am, but I have no way of knowing when they actually arrived at work.
Re: (Score:3, Insightful)
As I tell my customers when they ask, "You can't fix behavioral issues with technology." If employees want to waste time instead of working, they can surf the web or send chain emails. Take that away, they can play solitaire. Take that away, they can gab around the water cooler or stare into space and day-dream. Blocking porn and gambling sites is probably a good idea for liability purposes, but I can't see that it helps productivity. Most frequently I'm asked to look at log files or email and tell employers things that I simply cannot know. I can tell them that an employee didn't log in to their PC until 10am, but I have no way of knowing when they actually arrived at work.
I don't know, if the banned slashdot I would probably be working on a programming problem. On the other hand if they hadn't banned orgasm.com i'd ......
Re:Waste of time (Score:5, Insightful)
I have a friend whose employer actually encourages him to read
Where do you work? (Score:3, Insightful)
Unless you are working for a fortune 500 company whose image is often worth more than its current product line up, who cares? The only filters I have ever ran at a company I did IT for was for a list of of words that included, Lolita, Child Porn, Underage, No-nude and Preteen. We caught one contractor during the 8 months I worked there and it was his personal laptop, so we contacted the FBI. He was arrested on suspicion and they found enough Child Porn on his home computers that we never heard about him again, I moved before it could be brought to trial.
People surf porn at work that is just going to happen, if there work does not suffer and they are adults it is far more worthwhile to spend time worrying about security which can get you in real trouble.
Re: (Score:2)
People surf porn at work that is just going to happen, if there work does not suffer and they are adults it is far more worthwhile to spend time worrying about security which can get you in real trouble.
Even if you're careful you can get caught out by a "goatse" type link on slashdot, or once even on a supplier's technical support forum.
As an IT Manager for a small company (Score:4, Interesting)
Re: (Score:2)
Yet, they're talking about what if it became part of your job. Why do you care "personally" about your network? It's the company's network. You don't consider Facebook as a potentially dangerous site to visit?
Re:As an IT Manager for a small company (Score:5, Insightful)
I consider it my network (and care about it), because of two reasons. First, I'm responsible for maintaining it. So when someone else fucks it up, I have to fix it (at whatever cost, whenever it's needed). Second, because I'm responsible for it, so if it goes down it looks bad upon me (Even if it was someone else's problem). I may be a rare bread in recent times, but I actually care about what I do and the way I am perceived to others (with regards to my work at least). If people can't do work because my network is having problems, that's my fault. So to save myself the potential hassle, I take proactive measures.
I don't consider Facebook dangers. I do consider pages that are linked to by Facebook dangerous. But if I black listed any site that linked to dangerous content, I'd have to take away the entire internet. And I don't consider it my place to tell users what sites are valid for business reasons and those that are not. Some people do use Facebook for actual work (some of us do research on people, so sometimes they do need to visit Facebook, Linkedin, Twitter, etc)...
Re: (Score:2)
Its your job if HR or security asks you to do it.
Re: (Score:2)
Re: (Score:2)
Not been out of college very long have you? Refusing to do reasonable duties as requested by management will make it a short career for you.
Good luck in your next job and don't bother applying to work for me.
Re: (Score:3, Informative)
Where do you get that? I never said I was refusing to do a reasonable duty. What I said was that I am unable to do a duty that requires me to make decisions that I am not empowered to make. I've been asked more than once to do things that I was not empowered to do (either by company policy, or by my direct boss's direction), and each time that situation came up, I negotiated it into a raise and an increase in
Re: (Score:2)
Once you are asked by management that oversees that area of the company you are instantly empowered. ( perhaps not qualified, but that isn't relevant anymore in the world ).
Good for you that your direct management allows you to renegotiate salary with added responsibility, but that doesn't change what i was saying, refusal isn't an answer.
Some could argue if this is a reasonable request or not, but i would contend it is.
Re: (Score:2)
Perhaps in your company, but not in mine. In mine, there is a chain of command above me. My boss (CTO) and then the Owner of the company/CEO. Someone from outside that chain doesn't have a right (and this has been proven several times) to empower/remove power from my position. Otherwise you wind up with a situation where one person reports to 5 people, and how can you have effective management when there
Re: (Score:2)
Re: (Score:2)
Try that out in real life and you will find yourself out on the street in the unemployment line.
"Other duties as assigned" and refusal would be insubordination and lead to immediate termination.
Re: (Score:2)
Not your job to make sure they are working but from my stand point it is your job to collect and report who is. I liked it when my company wanted me to start monitoring users. I used it as a talking point to get a raise. I had to get a new cert to sell them on it but at least I was able to get something extra out of the added work.
But monitoring is so easy I don't see what the big deal is. Personally I like that the line between IT and Management is blurring. Usually means more pay and easier work.
it's a valid part of IT's job (Score:2)
Since today's job world is so intertwined with technology, yes, its now part of the job of IT.
Re: (Score:3, Interesting)
Passive monitoring is one thing -- if an IT worker sees something strange, like an employee storing many terabytes of porn on company computers, then of course that should be reported to the b
Re: (Score:3, Interesting)
Its not an accurate analogy to compare locomotive mechanics and IT staff. Using a airline, and stewardesses would be closer since train mechanics don't ride with the passengers
But that said, i don't care who you are, if management says you are to monitor, then its your job. Hell, if the says 'don't worry about the servers, go mop the floor', then that is your job for the day.
Re: (Score:2)
Sure, if your employment contract says you do anything your boss tells you. Lucky for me, I don't have the obviously-shitty job you do, and my job responsibilities are limited and are filed with HR.
Re: (Score:2)
If you honestly believe you can refuse to do a reasonable task assigned by management and not get fired ( with zero recourse ), you are deluding yourself.
The only place that might actually be true is if you are a member of a union. Other then that, if you try telling the boss to goto hell, don't let the door hit you on the way out.
Re: (Score:2)
BOFH (Score:3, Funny)
The real problem with official monitoring duties is that you have to send the results to management instead of the local newspaper, or maybe a television show [youtube.com].
when my budget is cut (Score:2)
and they hire some wanker to perform a six-figure vapor-job such as "business development" and I find his user/IP spending 5 hours out of the day on time-wasting sites, that's when I take the report to the COO. Don't hack and slash IT resources to let some slacker take up my bandwidth with car races on YouTube and 360.
underpaid (if only in my mind): check.
bitter on weekdays: check.
vindictive: check.
There's some paranoia at play, too. (Score:4, Interesting)
I worked IT at a mortgage company run by someone without much in the way of morals. He wanted a print-tracking solution to monitor who was printing and what they were printing. As it happens, I later worked for a company which provided this exact solution, but ultimately it didn't matter because what he wanted was something he didn't want to spend any actual money on, and at the time any solutions were resource-intensive for a file and print server running on a then-midline Pentium 166 MHz, so it would have required spending money on hardware upgrades, too.
He wanted this solution to protect his leads, which he was convinced were walking out the door from employees taking them and selling them to his competitors; ultimately, it was one of those cases of suspecting other people were doing exactly what he would have done in their situation. I suspect there's a fair amount of this attitude, and it's probably more common in smaller businesses than Fortune 500 companies, who are generally more interested in liability.
Productivity does not come with surveillance (Score:5, Insightful)
It comes with a worker's willingness to work for you. If he WANTS to actually work for you instead of just getting paid for spending time at your office, he will work. Else he will do a half assed job, surveillance or not.
If you give your employees freedom and the ability to actually enjoy working for you, they will be much more productive. Because they WANT to be productive. Because they WANT your company to be successful, because that means they can keep that job. Sure, you will always have the ones that slack off, and not putting an eye on them constantly sure gives them an easier way to do that. But their coworkers, the ones that actually want to work for you and do want your company to thrive because it means a good, enjoyable job for them, will quickly identify such slackers and they will do the surveillance for you. Peer pressure can be quite powerful, to the point where your slackers will quickly realize that it's not the boss but the other employees that get angry with him if he's not pulling his weight. Plus, you can do without the investment in cams and surveillance staff. Your workers will do that for you. For free.
It happens (Score:3, Insightful)
It happens, and if it's not done by IT monitoring just gets done elsewhere. The thing that baffles me is that people are surprised when it happens. All that being said they have much stronger laws on privacy in Europe than here in the US and you have to be aware of international laws for such things. You can rack up some pretty serious legal fines or jail time depending on what country your employee is working in, and even more if the data is brought back to the US (as we have horribly weak privacy laws). If your not careful you can readily have violations of HIPAA, SEC rules or SOX as well.
All that being said, when monitoring inevitably comes up, your job is never to say 'no'. If you do that they will simply find someone else and you will have damaged your career. Your job is to ensure that if it has to happen it happens in full compliance with the letter of the law and any special rules that affect your organization. You'd be surprised at the dollar amounts fines start at, it can easily be six figures. After presenting all the legal requirements to perform a given piece of monitoring to your management, don't be surprised if they back off altogether.
Monitoring has it's place, I try to encourage managers to use monitoring tools like a surgeons knife, not a chainsaw. I've known of employee backlash that can cause significant employee relations damages to organizations when tools were used overly broadly. And for crying out loud, if your at work, assume your being monitored and work accordingly. Whether you telecommute or otherwise, you never work in a vacuum.
It's not part of a Security persons Job. (Score:2)
The security personnel are in charge of maintaining the health of the network and its related assets from a Security standpoint.
The problem with monitoring employees, is that you find people enforcing their own beliefs and requirements with what they think is inappropriate. That results in various personnel interpreting the rules differently, which is unfair to the people being monitored.
Also, its not our job to monitor what people do, its up to the management structure of those people to make sure they are
Summary is Redundant (Score:3, Interesting)
I realize it's a matter of perspective... hell I've filled both roles so I know how it goes. However, the "generalist network admin" is monitoring employee actions and behaviours already. If they're not, then they're not doing a very good job. The perspective difference comes in the fact that most of the time said generalist is doing reactive monitoring, not proactive. As a result, the network admin typically does not realize that someone is attempting to compromise systems until the attempt is already occurring. There is a certain amount of proactive monitoring that the generalist does, but it tends to be limited.
Proactive monitoring at the employees desktop or application level does sometimes tend to highlight trends in employee actions before they get anywhere in a compromise situation. That means that the good generalist with a wider scope will be able to predict much better that problems are or will be occurring and take appropriate actions.
Now, the upper management trend of monitoring just to see exactly what their employees are doing... this I also think is fair so long as the rules are advertised and applied evenly. Remember, we are at work doing a job because we can and do. We are using company resources to do so, and we are paid for our work. I'll leave the conversation about whether we're paid enough to the individual, but I would contest that the best paycheck you're going to get from the job is about the same or less than everyone else in your field and location are demanding. Economics at work.
There is a point at which the monitoring becomes too much. I know my web habits are monitored by my management but I feel I have nothing to hide. I can justify every site I visit and the length of time I spend on those sites because when I'm at work, I'm working. I save personal web surfing for breaks or lunchtime and my management understands there are a few personal websites I visit on a frequent basis. Like Slashdot. I have worked in a much stricter environment where they absolutely stated no personal web surfing at work, and that was also fine because I just found other things to do during break and lunch. Note that I was also far more likely to go out and take my 1 hour lunch because of this policy... my current work environment's policy of "personal stuff OK at lunchtime" means that typically I'm at my desk during lunch so if something comes up, I'm here.
Maybe I'm just getting old, but I think the summary and the article are making generalizations that cannot be supported in the real world. Even when I started out as a junior network admin some 20 years ago give or take I understood the need and desire for monitoring employees. Since I also owned my own business for a while, I know what that desire is like but recognize that there's a balance to be found between "big brother" and "free reign".
Some traditional solutions to monitoring... (Score:2)
This is really a non-issue. Every so often we hear that there's a new problem or new approach to solving a problem. Names change but solutions remain the same. Whether it's grid technology or cloud or distributed computing or what have you, the "paradigm" may change but many times the technology is relatively unchanged.
For monitoring employees the obvious solution, though perhaps no longer a "hot" tech, is to install SNMP on each employee. If privacy is a concern, ensure that SNMPDv3 is used. This solves no
Re: (Score:2)
Like all metrics, employee monitoring would be used as indicators to alert if there is indeed something unusual happening. Certainly many metrics are innocuous, but they allow the administrator to know to take a closer look. For example, if the alert triggers on "Dirty Pages" then it may indeed be as innocent as a Java overflow, but if the employee is continuously reading and dirtying pages, there's probably something worth investigating.
I see your point, and it is valid, but respectfully disagree.
You could take a more cynical view (Score:2)
Or one of several cynical views.
You could take the anti-monitoring view and just bury all but the most egregious stuff or whatever minimum is necessary to keep from looking like you're not doing your job, up to and including submarining the monitoring effort through "problems" with the monitoring setup that require constant upgrades, maintenance and activities that take you away from your "real" job and render monitoring semi-worthless. People you like could be quietly advised that their computer is being
management- be careful what you ask for... (Score:5, Interesting)
Greetings and Salutations....
A few years ago, one my my clients asked me to generate lists of the websites their employees had been on, and, how long they had spent on the sites. Since I run an in-house DNS server, not that hard to get. Well, I ran the reports for a few months, then, the project was quietly dropped. Why? It turned out that the only folks that spent significant amounts of time on porn sites and other non-business sites were the President of the company (who had ordered the reports) and his wife, the CFO of the company.
And THEY were burning a LOT of time on non-business related entertainment and shopping!
What was really amusing to me about this was that these two folks had the attitude that they were the only ones doing anything positive for the company, and, the employees were the enemy - and were spending all their time trying to steal time and resources away from the company, cutting down on profit margin!
Regards
Dave Mundt
Get the *real* security to do it. (Score:5, Funny)
At my last place, I'd often work a bit of overtime in the evenings, and I came to know the security guards quite well. I had to walk past the block they were based in, so I'd always pop in and say hello (and usually ended up chatting for an hour or more).
By contrast, there was some shiny-suit type in that same building who, if he even acknowledged the guard's existence, would give him (and me) a filthy look and keep walking. Naturally, one guard started wondering what use this guy was... and filmed him through the window, from the CCTV camera on the opposite building. For an hour. On overtime. Surfing porn. I didn't see Shiny-Suit Guy after that.
Moral: if you're going to misbehave at work, keep Security sweet :)
Re:Get the *real* security to do it. (Score:5, Informative)
After becoming pals with the security guard at my building, the guard related to me a moment when she was watching the parking garage cam, and noticed that the director of marketing was busy going Lewinsky on a member (pun thoroughly intended) of the board of directors. Certainly it explained how she got the job, since skill in marketing clearly had nothing to do with it.
If you want to know what is actually going on in a company, the 3 groups of people you need access to are the admins (who can watch people's computer use), the security guards (who can watch people's physical activities), and the bookkeepers (who know where the money and therefor the power is going).
Re: (Score:3, Interesting)
This is the anti-Unix approach (Score:2, Offtopic)
To quote Doug Gwyn, "UNIX was not designed to stop its users from doing stupid things, as that would also stop them from doing clever things."
In Unix, one of the design principle is that you can do anything, even something insecure and stupid, but we can always find out what you did and whack you over the head.
Auditing what your users do so you can diagnose an error later is roughly O(n) with the number of errors. Predicting what users should be allowed to do and granting them permissions is maybe O(n
Well I consider myself lucky and blessed then... (Score:3, Insightful)
They treat us as well paid professionals and expect results from us. We are supposed to deliver on agreed deadlines and we usually do. So, if I read Slashdot from time to time, check the news or chat to my wife here and there for a few minutes, and it does not affect my productivity (i.e. I'm not doing my job to the standard or above expected of me in this company) then no one sees it as a problem.
It's only in rare instances when people don't perform satisfactorily that questions arise how are they spending their time and what is wrong in general (but still no one monitors them even then).
I find this freedom really helps with the moral of the people, the sense of trust in you as individual it provides, and it liberates you to be creative. If you have an issue with this much freedom and could not control yourself and spend ALL your time online playing games and looking at porn, then you probably should be monitored and you most likely would not get though our interview process anyway.
As a matter of fact I don't think I could work for a company that does not treat me as a responsible adult and a professional. Imagine if hospitals monitored their doctors to make sure they are not checking personal email or make sure they are not telling nebulous lies to their patients? It's kind of the same.
Listen to the BOFH (Score:2, Funny)
As a one-person IT department (Score:2)
At the same time, I lose many hours each week troubleshooting issues caused by users who mi
It's the job of a security officer (Score:2)
Ideally it's not the job of the IT guys but that of a trained and outsourced security officer. A large security company has all the routine and resources to maintain this operation, and a reputation to uphold.
Plus the guards are actually very unlikely to go rogue, to comment on what they have seen, or to be the worst culprits themselves.
You can have the regular IT crew keep an eye the security staff if you feel the need.
Monitoring employees off hour (Score:2)
How does this work? I don't get how companies would 1) know what your blog or social network ID is, and 2) how would they have access to it?
Re: (Score:3, Insightful)
Monitoring other employees computer usage - one of the many non value adding tasks that have found their way into large corporations. It ranks up their with human resource departments!
Not quite. It doesn't have such a negative impact on other people's productivity
Re: (Score:2)
Re: (Score:2)
Pictures...or it didn't happen!
Re: (Score:2)
Was the question "is this guy a loser"? I've had to answer that question in similar circumstances.
Re:Please do (Score:5, Insightful)
Re: (Score:2, Insightful)
we pretend to work; they pretend to pay us
Unless our paychecks (and the money we get when we cash them in) are a figment of our collective imagination, there is strong physical evidence that suggest they indeed do pay us. Maybe not in imaginary worlds, but certainly in the real one.
Re:Please do (Score:4, Insightful)
we need a -1 *WHOOOSH* mod
Re: (Score:2)
You are correct. I thought about it AFTER I hit submit. Please to forgive.
Re: (Score:2)
They pretend to pay is correct, because it's such a small fraction of our creative productivity's worth.
Re: (Score:2, Informative)
What the hell are you going to do with gold when the zombie apocalypse comes?
Bludgeon the zombies with the gold, classy and effective.
Re: (Score:3, Informative)
Re: (Score:2)
What the hell are you going to do with gold when the zombie apocalypse comes?
Bludgeon the zombies with the gold, classy and effective.
Given that gold is one of the softest metals available, I take issue with "effective". Sure, Zombie's brittle bones will shatter if hit with a log of fresh goat cheese, but what happens if you accidentally connect with a Non-Zombie Item (NZI)? The NZI will wreck your Zombie Defense System (ZDS), and then welcome to the Great Zombie Army (GZA)...
Re: (Score:2)
A brick sized amount of gold is around 40 pounds.
Yes it's soft, but it's super dense. If you can make a hollow sledgehammer out of something strong then fill it with gold, you could bludgeon someone's head off in one good smack.
Re: (Score:3, Informative)
It's called fiat currency. What that basically means is money has value only because people say it does. "That's a good deal" is a daily example of this.