Security, user access, login and reporting. How do you mentally adjust for the negative aspects of security management?

Question

Employees get laid off, do stupid things (like peek at a porn site), talk about personally offensive/suggestive subjects on IM & email. As IT Manager, I am tasked to lock user accounts, change passwords, and compile IM and email summaries for management.

Don't get me wrong, I don't have monitors on every machine. I am usually triggered by management to perform these tasks as I don't have enough time already (not enough time to waste on poking through browser caches or history).

I am sometime rattled or very upset by the things I am asked to do or find and have to report and act on. How do you handle it?

Answer 1

Not to be rude, but suck it up. Your the IT Manager, part of your job is to snoop on what employees are doing when someone in management feels that it is warranted. If you aren't up for the job, then perhaps it isn't the correct job for you.

And I'm sure this will make few fairly unpopular around here for a while.

Answer 2

I wasn't an IT manager, but usually the guy they asked to do discovery. Here's how I handled it.

• I work for the organization.
• The organization has a right to protect itself. We're not just talking about intellectual property, but also potential lawsuits.
• Employees are properly informed about what they can and cannot do. They sign a document indicating that they understand those things. If they didn't read that document, that's not something I can control.
• In order to protect itself, sometimes the organization has to investigate.
• Someone has to do that investigation.
• It needs to be done right.
• It needs to be done by a person with integrity.
• I believe I fit those qualifications.
• If the organization finds something out of compliance, failure to take action can open the organization up to trouble. For instance, if the organization knew an employee was accessing porn and did nothing about it...
• If the organization refuses to act, gets busted, pays a huge fine, I may end up being unemployed.
• I want to stay employed. Therefore, it's in my best interests to do the job right.
• If at any time the organization asks me to do something I feel is unethical or illegal, I have the choice to walk away. In the case of something illegal, I have the responsibility to report it.

And that's what it amounts to. If you aren't comfortable doing the work, you need to walk away. Otherwise, do the best job possible, handle it with the utmost of integrity, and see that the organization receives the information or service it needs to protect itself (so long as it is ethical and not illegal).

Answer 3

You can't let your feelings get involved about it. One can always voice an objection to the people who want the information, but in the end anything done on a company computer on company time...is company information.

Answer 4

Your job is to tend the systems of your employer. Laws do vary by country, but in the United States, any computer equipment purchased by the employer is their property and can be used as they see fit. This is not exactly a wonderful way to look at things, but that's the way it is. That being said...

Your reputation and integrity are the keys to the kingdom. So here you are, having to handle something that, for any employee, is pretty much less-than-tasteful, but you should continue to do with with your reputation and integrity intact. Because when you are guarding all of your employer's trade secrets, processes, knowledge, communications, and even bank balances, integrity is what will allow you to work around these things.

As far as dealing with the unpleasant side of it...yes, it does bother many people. The trick is to remember that you are managing your employer's machines - not yours. You are entrusted with protecting and managing their systems, and while you put your blood, sweat, and tears into making them viable, it's still your employer's equipment at the end of the day.

Another way to look at it - this is a management issue. Your job is to provide services to the company, not manage the employees. If management wants to just enforce rules but not remind their employees of the rules, that's their choice - although it is (admittedly) a detriment to the company and employee morale.

Answer 5

I had to do this for a while. Wish I could replay some of the interesting (anonymous) voice mails that I received during that time. It sucked, to be sure. The last thing I wanted to be was a baby-sitter.

I had things anywhere from overzealous daytraders to fantasy football junkies to RAS users dialed in to surf porn to internal desktop users (sigh) surfing child porn (pre-filtering days). It was mostly people I didn't know but every once in a while I ran across someone that I did now which was the worst part of it.

On a reactive note, you are, as Denny said, the IT manager. This part of the job sucks. There is no getting around it. The company has to protect itself, its resources, and its reputation and thus will be asking for reports. Sorry, but this is just a fact of life and is no different than any other form of policing. You will run into stupid people, it is inevitable. If you let the stupidity overwhelm you then you will have a very short tenure in the position you're in.

On a proactive note, you are the IT manager. Try to help be a solution to the problem instead of letting yourself be dragged down by the problem. Begin or, more hopefully by this point in IT land, continue the awareness campaign that THINGS ARE MONITORED! Tell your company's associates what is being monitored, what is being logged, and work with HR to set standards. Get this information across clearly to new hires in orientation and new-hire info packets.

I wish to God that people would get it through their heads that they are being watched. Corporate America is not a commune....

Answer 6

since you're getting paid for it, what is the problem ? as they are paid to work, not to browse for porn or chit-chat on messengers

it's just a job :)

Answer 7

This can be an area of a real conflict of interest here. A lot of people have said "Its your job, suck it up" - but I feel you're perfectly within your rights to question what you do on a day to day basis.

In fact, the very act of questioning what you do, personally I feel makes you a better person. And the simple fact of the matter is that there's no right or wrong answer when it comes to your morality.

The only thing I can suggest is to talk over your situation with someone whome you trust. When I run into moral issues at work, I talk to my Pastor, or my Dad. Both of whome have a hell of a lot more life experience with these situations than I do. If you have a pastor, rabbi, guru, wife, girlfriend, boyfriend, bff, anyone who knows you well, I would strongly suggest talking to them about it.

And the fact may be that if you're not comfortably using your powers in these ways, then perhaps Mr Denny is correct - this is not the job for you. I've come close to leaving jobs because I felt that what I was being asked to do, whilst legal, went against my personal beliefs.

And at the end of the day, the only person that your are accountable for is yourself.

Answer 8

Many companies need to do these things from a legal viewpoint (and productivity viewpoint), so nothing wrong in it. If it is part of a job profile, then there is nothing bad about doing it or feeling upset over doing it. Don't put yourself thru a guilt trip over what you are doing right.

I have worked in companies where lots of employees spend the first hour every morning, catching up on their personal email, reading news or digging it. To be honest, this is not fair to the company either, as most people are most fresh when they come to work and can get good amount of stuff done in first few hours.

Rather then feel bad about it, I would suggest, that over lunch or coffee breaks, you be vocal with your co-workers and employees, that you do this as per management instructions. and this is part of your job responsibility. This will help employees be aware about the monitoring and lead to reduced incorrect usage of company resources, and cause a increase in productivity. Maybe the management will hear about your attitude thru someone, and be pleased with you!

but no matter what don't feel guilty or be upset over it.

Answer 9

I know where you are coming from, but I have to say that your feelings of guilt are misplaced. My take on this issue is pretty simple.

1- I have my job and the users have their jobs. At times the policing duties are distasteful, but they are only required because of user transgressions. I recognize that those duties will (at times) make me other than popular.

2- Any negative consequences to a user are not because of the monitoring or reporting. The consequences happen because the user has violated law, policy or common sense.

3- I have a responsibility to myself and to the company to do my job with integrity and to the best of my ability. If I am doing that, I can sleep at night.

4- I don't go to work to make friends. In fact, I keep some detachment for just this reason.

Answer 10

I've had to do it on a number of occasions too (up to and including handing staff member's PCs over to the cops for forensic analysis), and the only way is to emotionally distance yourself from the situation. It's something you either learn to do or you don't.

It doesn't make it any more pleasant though, but bottom line is that rules are there for a reason and the actions of one person could very well end up compromising the availability of services for everyone else - even if it's something as minor as sucking up all of your bandwidth with Youtube sessions.

Answer 11

If someone does something wrong they need to be pulled into line or disciplined. If it is part of your job to gather the evidence then do so. If you do your job with honour and dignity there is nothing to feel bad about.