Understanding Employee Conduct Trends

Fri, 2007-01-26 11:05

Back in December, I wrote a series of three blogs untitled: For Us or Against Us." I promised a few more posts on some new perspectives on cyber ethics and possible solutions.

But before I get to possible solutions, I want to show you a government (publicly reported) example of employees deliberately going around various controls, such as web content filtering. I've heard hundreds of private ones from around the country that I can't share, but details from a public audit report will suffice to show why I’m concerned.

Whenever CISOs try to lead in any area of security, we inevitably run up against a certain amount of resistance from the enterprise culture that isn’t yet convinced that there is a problem that needs changing. While the majority of government employees tend to view auditors with a great deal of skepticism, most veteran CISOs have learned that they can, at times, also be our friends. It can be an uncomfortable liaison, but often a necessary one to improve enterprise security. There have been several situations in which audit findings have enabled us to get a task accomplished that we previously failed to implement due to a perceived lack of priority or need from the business side.

The area of cyber ethics is no exception. Perhaps you’re not ready to accept that this is a real issue yet. Are you thinking this must be something unique to somebody else’s government or business? Look no further than the recently issued Department of Interior Inspector General's Report which reveals “flagrant misuse of the web.”

Here’s a quote from the report:

“The value of BOR’s Internet website monitoring and blocking software is questionable. We discovered a volume of continuing inappropriate Internet occurrences, which suggests that some employees are able to circumvent controls used by the software program.”

OIG investigators were able to access both pornographic and gambling sites on three of the department’s four main computer systems, notwithstanding the presence of content filtering and blocking tools.

One disclaimer before I comment on this report. I’m no longer in the federal government, and I’m in no way connected to the Department of Interior. (I was at NSA in the 1980s). However, I believe that this report could have been written about other federal, state, or local government situations. In other words, I think that at least some of the "circumvent" behavior is fairly common.

Why are people doing this? CSOs generally think: “the answer is complicated,” so we try not to go there. It’s not our job to look at root causes that involve moral questions. Or is it? Some have hidden behind, “all I do is report the facts, and HR decides their fate.”

And what gets reported? Everything? Equally? It’s natural for security staff to be comfortable, maybe even enjoy, reporting certain violators. The ones that have lied to us and/or broken serious laws are easy to convict, but just like the police, some “nice” people are never given that speeding ticket. We’re not supposed to judge motives, just send it all to HR. But …

Perhaps you have people going around controls, but it’s tough to keep up with all the latest shenanigans on the Internet. Maybe none of this is going on in your large enterprise. I seriously doubt that. Bottom line – we put controls in place to enforce policy, and sometimes staff are deliberately or “just slightly” violating those controls. Tolerating misdeeds is wrong, but not everyone is Hitler, right? What harm did they really cause?

You’ve now entered the somewhat fuzzy world of 21^st century employee conduct. While there’s no single answer to the “why” question, there are some interesting perspectives that can help CSOs address this problem. Next, I’ll give you my views on the new world of cyber ethics, some hard to answer questions – and why most honest CISOs struggle to enforce this area.

buy a link »

Reader Feedback

Thu, 2007-04-26 01:23

Discordance is the term used

By Anonymous

Discordance is the term used to describe the extent to cartoon sex which people differ from the simpsons xxx usual biological and xxx stories psychosocial types described above. Some discordances naruto xxx are biological, such as when the sex of the disney porn chromosomes (genetic sex) does not match the sex of the external genitalia (anatomic sex) sexy soundarya - this is known as intersex. Discordances between the biological and indian porn psychosocial levels (such as when the gender identity does not perfect ass match the anatomic sex) or between the various psychosocial ass parade levels (such as when the gender my sisters hot friend role does not match the my friends hot mom gender identity) are even more common, but xxx proposal less well understood.

CSO

Blogs

Post new comment

Security Directions: A Virtual Conference

Protecting PII: How to Work with IT to Manage Risk

CSO Corporate Partners

Digital ID World