26

What should I do about this user? The user is:

  • Downloading pornography
  • Attempting unauthorized access
  • Running hacking software
  • Sending unsolicited email
  • Installing software / tampering with the system
  • etc

This is intended as a generic answer for employee behavioral problems, a la Can you help me with my software licensing question?

I could see where acceptable use issues are a touch out of scope for SF, however it is one of those things most sysadmins will run into. I don't want to keep rewriting similar answers.

Community
  • 1
Tim Brigham
  • 15,465
  • 7
  • 72
  • 113
  • 21
    In my view, as long as the employee is productive and doesn't bother others (doesn't listen to porn with his speakers on high volume), there's no harm done, I would never go out of my way to report someone like that. I highly condemn "sweatshop" type of working enviroments with strong "moral" policies. We are all humans. I've seen places where the Internet is almost completely blocked, just terrible. – ToastMan Oct 21 '11 at 17:26
  • 1
    @timbrigham It's great to have another sys admin agree with me :-) Can't stand the "stick-up-the-ass" types :-( (Btw, if they're running hacking software, it's a totally different story, in that case you should crucify the user, he's f'ing with your network, that's a nish-nish) – ToastMan Oct 21 '11 at 17:38
  • 17
    @ToastMan That doesn't really fit with your earlier statement. How about an employee that's productive, doesn't bother others, and happens to be running a botnet from their workstation? If they're not eating into bandwidth in a detrimental way, they conform to your test - but they are placing the business in significant legal risk. Acceptable use policies aren't just about pornography and morality. – Shane Madden Oct 21 '11 at 18:15
  • 1
    I'm with ToastMan. As long as the user isn't doing something that can harm the network and he's not getting any complaints. The looking at porn usually get's complaint from co-workers I would imagine, but the things like Hacking Software, E-mail, and unauthorized access are something that should be dealt with because that affects the entire network. Hell it could just be that his system is infected with something nasty that's causing some of those behaviors. – Nicholas Oct 21 '11 at 20:14
  • 1
    Silly question, but do you have an AUP, and is the employee aware of it? If so, make HR or their manager aware of the problem, if it really is a problem. – Phil Lello Oct 21 '11 at 22:28
  • 6
    @ToastMan the "moral" and productivity issues are only part of it. Porn site often contain malware. Unauthorized software and hacking tools often compromise the stability of the systems and/or network and could possibly leave a backdoor or leave the system vulnerable to attack. This type of behavior is also a security concern and puts the corporation at great risk regardless of whether the employee is productive or bothers others. – BZink Oct 21 '11 at 22:55
  • 8
    It's also a risk to the business on sexual harassment grounds. – ceejayoz Oct 22 '11 at 03:10
  • @BZink: correct me if I'm wrong, but if he watches porno under Linux there are no malware/viruses at all. Just put this user under a stable and efficient OS ;) – Olivier Pons Oct 28 '11 at 07:38

8 Answers8

31

When it comes down to it most of us are just systems administrators.

We might be the ones to spot bad behavior and even sometimes called upon to help resolve situations. It is not our job to police or enforce employee behavior.

That being said having strong tools at your company’s disposal to address behavior issues as they come up is critical. Once a breach of policy occurs it is a HR question on how to deal with it. Provide them your documentation and let them do their thing. Wait to provide them whatever technical support is needed.

If you are in the situation that your company does not have an AUP or it needs revision this summary reflects a lot of research. It should provide you some guidance in getting started.

A good AUP should cover the following subjects.

  • One user per ID / Password - if someone uses your account you are liable.
  • One location for each password - don't use your work password outside.
  • Handling of personally identifiable / confidential data
  • Handling of media (CD, USB stick, etc)
  • What information can be transferred and to whom
  • Session locking - your screen locks so your account can't be misused.
  • Monitoring for email, file system utilization, web access
  • Personal use of business systems
  • Legal violations (copyright, hacking attempts, etc)
  • Attempts to bypass internal security controls
  • How violations are responded to - up to and including termination and legal action

EDIT - as DKNUCKLES points out it is necessary to follow the standard chain of command for these issues. Just because I was supposed to take them straight to the head of HR doesn't mean that is what your organization does.

Tim Brigham
  • 15,465
  • 7
  • 72
  • 113
21

Yes...because downloading porn is 100% safe. Running programs like metasploit won't ever crash a server. Because sending unsolicited emails won't raise question about the companies reputation and standards. And because installing unknown, third party software won't ever be malicious or cause security issues.

IMO, if I was in your shoes I would want that person gone. What happens down the line when they gets busted for something and then you're in the scope now because of the "Why didn't you report this?" aspect. Now it looks like you can't do your job. Unless you work for Vivid Entertainment I would say the unacceptable barrier was crossed long ago.

ZazenSec
  • 330
  • 1
  • 4
9

I think that as long as the actions have no direct impact on the ability for you to maintain the network/connectivity, this is not an issue for a sysadmin to resolve. As the other answer indicates, this is an HR (or some such) issue.

That being said, I believe that the game changes slightly if, for instance:

  • The user's sending of unsolicited mail can cause mail queueing on your outbound mailserver
  • the unsolicited mail, delivered through your SMTPd causes your SMTPd to be blacklisted, making you have to go through the motions of "begging" forgivness from the various SBL sites
  • Hacking attempts lead to breach of AUP notices from your link provider, or worse, cause retaliation attacks that bring your network to its knees.
  • etc...

These are cases where this user's abuse of resources has a direct impact on your job, which means you can quantify this as a measureable loss of money to your employer when you tally up how much effort from you, or your team, is required to maintain his/her habits. In this case, you would have to do something about this before you wind up becoming the person made responsible for this, and you "pay for it."

sandroid
  • 1,724
  • 12
  • 16
3

While the AUP suggestions are great, it is also important for the IT department to get from the HR department a clear enumeration of duties, such as what is to be reported, to whom, and when. So when you bust the boss for breaking the rules, you can refer to the policy you are bound to. Having this in your job description or policy removes from you the burden of being the tattletale: if you are legally bound to report issues, you can't be accused of doing it just because you don't like someone. If you are fired for reporting, you may be able to sue for wrongful termination if the policy demands that you report. If it's not policy, you may have no recourse.

Jonathan J
  • 584
  • 1
  • 5
  • 11
2

If you're a SysAdmin the onus is on you to inform the proper parties about the activities that are going on. At the end of the day, it's YOUR network and you're the one responsible for it's upkeep and optimization. I think in the instance of things like adult material, you can turn a blind eye. I mean we all have better things to do than condemn someone for that. Perhaps a professional courtesy saying something along the lines of "I don't care but management may frown upon that". Now if the traffic is illegal or detrimental to your network, then that's another story.

If you come across this behavior and dont report it, then be prepared to deal with the following questions asking you why you didn't notify anyone; saying you didn't know about it looks REALLY bad on you. After all, it is your job to maintain that network and those systems.

I agree that timbringham has the right idea with the AUP. That said, bring it up to your superior and ask them what the next course of action should be. They'll likely want some sort of documentation and proof that the illegal / AUP violation activity occurred so be prepared to provide them with logs / screen shots / whatever. Regardless of what the AUP says, people should have enough common sense to know they shouldn't be doing inappropriate things on company networks.

DKNUCKLES
  • 4,028
  • 9
  • 45
  • 60
  • 6
    "YOUR network", really? It seems that a number of sysadmins often think the network is theirs: it's not, it's the company's (or the institution's). – Bruno Oct 21 '11 at 17:46
  • 5
    @bruno Semantics. I think it's quite clear that I don't mean that you own the network, but rather it's your responsibility. Do you think people say "Where are the documents that the company owns by I maintain?" when they can't find their stuff, or "where are my documents?" – DKNUCKLES Oct 21 '11 at 17:50
  • 1
    @DKNUCKLES - good point about the chain of command. I'll update my answer to reflect accordingly. – Tim Brigham Oct 21 '11 at 17:59
1

Since you are in charge of the integrity of the network (well I assume that part) I would raise that issue with upper management based these points

  • Attempting unauthorized access
  • Running hacking software
  • Sending unsolicited email

Playing the "this could get us into legal problems" (read this could cost money to the company).

Then, when ask to investigate a bit further, you can raise the pornography thing...that should nail it.

Alex
  • 3,079
  • 20
  • 28
1

You are only helping him, by pointing out some serious issues!!! It does affect productivity and seems like his mind is wandering. I would have a casual chat and let him know ... that its not good, if he wants to watch porn he can do it at his home. Running hacking software is causing more headaches and disturbing others also when you send unsolicited emails.

No need to take it with the upper management, because he should know his mistake and that you gave him a chance to check himself.

This is totally wrong ----- ironic I am posting this from my office!

s3rv3r
  • 1
  • 1
1

Downloading pornography - just tell him face to face to stop doing that. tell him that if he wants to do that, get a cellular wireless network to do it on and dont use the business network.

Attempting unauthorized access - nothing wrong with trying. basically he is exposing problems in the network that the system admin didn't catch.

Running hacking software - thats ok also. there can be legitimate reasons for doing this, the most common of which is for "the learning experience". maybe this employee really wants to understand his environment better.

Sending unsolicited email - make the email log public so that everyone in the company can see who sends emails to what address. you can do this with a bash script cron.weekly job if your a system admin with a little skill.

Installing software / tampering with the system - remove their account or reduce their priveledges on the system without telling them. if they need access, let them ask.

djangofan
  • 4,172
  • 10
  • 45
  • 59
  • 4
    **Running hacking software - thats ok also. there can be legitimate reasons for doing this** - not if it hasn't been agreed by the business owner and the sysadmin notified, there can't be. The network is a business tool, not a free fire zone for salesmen who wish they were in that wired article on hackers they read last month and downloaded some t0t@lly k3wl scripts, and the sysadmin is responsible for the network's maintenance and operation. – Rob Moir Oct 24 '11 at 08:20