IT policies will, inevitably, involve restricting or “blocking” various Internet services from employees. However, it is imperative that these policies have built-in flexibility. Furthermore, IT and business staff need to have open, frank communication about circumstances where an exception to the policy is simply necessary.
The alternative is that business staff will bend the rules anyway, and attempt to side-step your organisation’s security mechanisms.
Even quickly skimming the article ‘Ten Things Your IT Department Won’t Tell You’ (http://online.wsj.com/article/SB118539543272477927.html?mod=fpa_mostpop), you can easily predict that at least some of your employees are engaging in conduct such as smuggling software onto corporate computer systems, exposing sensitive information to the public Internet, deleting valuable audit trails, and generally risking the integrity of your organisation’s data.
Luckily, the answer is easy: flexible IT policies. Strict, inflexible policies make staff staff feel they must take matters into their own hands and circumvent your organisation’s online protection. Flexible policies focused on the real objectives of security and data integrity will help you lead your staff to engage in conversation with your IT department, and maintain best-practice electronic security.
I’d rather spend a relatively short time re-working our IT policies, than have to explain to our key stakeholders why their confidential information was leaked through an unofficial channel created by a frustrated employee.