Internet Filtering Risk from Your Company’s Browsers

Posted by arlene

The good news about web and download risks, as compared to e-mail, is that a much greater level of control is possible for your company without imposing unduly on perceived privacy rights of employees. With downloads, third party materials are being limited, filtered, and even monitored—the employees are just recipients. Technological tools for watching or blocking Web sites and downloads are available and easy to use, albeit with some caveats.

Whatever approach your company takes, from open browsing to a carefully configured proxy server (hardware and software that can keep all but specific Web sites from loading at the desktop), a policy should be a major part of your tool set. Here are elements to keep in the forefront of your company’s plans:

1 What business purposes do you wish to achieve by giving employees Web and/or FTP access? This may differ among groups of workers: internal analysts may need broader access to news and information Web sites, IT staff will need easy download ability for updates and technical support, and inventory managers may have to do business-to-business transactions online. You may also be combining outside Internet access with documents or programs available on your company’s corporate intranet, including human resources documents that must be available to every employee.

2 How much bandwidth can you afford? The smaller the total Internet “pipeline” being shared by your staff, the more limited are the downloads and graphic-intensive or video-filled Web sites. You may wish to restrict large downloads to after hours, or arrange all file transfers above a certain size through the IT staff, who can balance bandwidth needs. Remember to calculate not only the outside bandwidth load, but how employee Internet use may slow down your internal network—too much browsing could interfere with printing or application servers sharing the same Ethernet wiring.

3 Do you want to monitor employee Web use, and if so, do you have the human and technological resources? While the software for capturing site requests is fairly easy to operate, the log files generated can be huge. Finding the right tools to parse and digest the files for easy sorting can be a drain on an already overworked IT or HR department.

4 What software will you provide to your users? From a risk management perspective, your choice of browser or file transfer software will be driven by the level of controls each product gives you. If you want to block certain sites or customize the interface, find the browser that meets your needs best. You may be able to acquire or create custom versions of browsers through value-added resellers or consultants.

5 What software and controls are others in your industry using, and what have been their experiences? As with e-mail software, shared knowledge can lead to combined negotiation power with vendors.

6 What will your company do when its policies are disobeyed? If the company may be liable for a copyright infringement or harassment suit, or even costly bad publicity, a harsh response may be merited. Merely wasting time by following a personal stock portfolio, though, could simply warrant a spoken warning or an internal note in an HR folder.

If a staffer objects to company monitoring or restrictions, remind the employee that the company would not be expected to allow everyone free use of a television, video game console, and library of magazines along with an ever-present group of friends. The company provides the privilege of Internet access; it can also exercise the right to remove it.

Possibly related posts: (automatically generated)
Internet Filtering Risk from Your Company’s Browsers

• Intrusion Detection (Stateful Inspection)
• The Rights and Risks of computer network E-mail Monitoring
• Identifying and Establishing the Best E-mail Network Architecture
• Inexpensive Firewalls for SOHO Environments
• Basic Ethics of Online Marketing Part 4
• Should You Pursue Your Attacker?
• Small Business Ecommerce: Security is not just about payment
• Exposure from Employees' Use of E-mail
• Data Project Plan Note part 2
• Take the Pain out of Innovation Part 1