Wall Street Journal post Raises Ire of IT Security Pros

A recent Wall Street Journal post by Vauhini Vara, Ten Things Your IT Department Won't Tell You, provided suggestions for doing an end-around your IT department. As you might expect, the topics centered around Internet and email use, as well as the introduction of unapproved software.

1. sending oversized files
2. using unapproved software
3. visiting blocked websites
4. covering where you've been
5. searching for work documents from home
6. storing work files on-line
7. keeping web emails private
8. accessing work email remotely
9. accessing personal email on your PDA
10. how to look like you're working

As you can imagine, this article created quite a furor in the IT security community. Michael Farnum felt the Journal needs a smack upside the head. Tim Wagner, commenting on Mike's post, saw the Wall Street Journal article as an opportunity to reinforce the need for awareness training.

I probably appreciate Kai Roer's response the most of those I've seen. He said, "if your employer have policies and rules in place, you are not only asked to follow them, you have accepted to follow them."

Later, he added, "When journalists do put forward tips on how to break the rules, it certainly makes our work harder. Still, it does not take journalists to make people lazy. The fact remains - security requires the management to take control, and the employees to abide the policies."

The Wall Street Journal, in my mind, has done a disservice to their readers in publishing this article. Most of the people reading the Journal work in large, enterprise environments. If you look at this selfishly from the point of view of just one individual it might not seem like such a huge deal, but if you have thousands of employees all deciding to do any of these, you've created a litany of problems for co-workers, IT, and, eventually, the company itself.

Contributed by Mark Tordoff 

Comments

[Kai Roer]

Hi Mark,
You are spot on with your remark about enterprises. The more people who have access to your systems, the larger the challenge. I am a strong believer in education - but with people who do not care, or go against the rules, there is not much to do for any of us.
K