How to stop a content filter becoming a career-shortening network component
- Reference: 1630398963
- News link: https://www.theregister.co.uk/2021/08/31/who_me/
- Source link:
"Lee", for that is not his name, told us of his time as an IT consultant in the Far East, working for a family-owned bank. The bank was extremely wary of this new-fangled internet thing and allowed a favoured few members of staff online, but not much else.
"We were hired by the head of IT and tasked with reviewing their information security posture," said Lee, "and it quickly became clear they needed something better than their simple firewall, to include content monitoring and logging, as well as the usual internal firewalls and other protections."
[2]
It was all straightforward stuff. A system was specified and a rule base prepared. The bank's IT team was sent off to procure the requisite bits and pieces and Lee got ready for the formal review of the set-up.
[3]
[4]
"Some weeks later we returned early one morning to conduct our certification review," said Lee, "and were met by a visibly nervous head of IT."
Odd.
[5]
The team worked through the checklist regardless, up to the point of reviewing the new firewall and content scanner. No problem! The IT boss showed them the shiny new server, lights ablaze. "There it is!" he proclaimed.
Er, right. However, Lee really needed to take a look at the configuration and logs as part of the review.
No dice. "That would not be… convenient," replied the head of IT. A translation for those unfamiliar with the customs of the region would be a flat "NO" (just without the offence that might have been caused).
[6]Hacking the computer with wirewraps and soldering irons: Just fix the issues as they come up, right?
[7]Scalpel! Superglue! This mouse won't fix its own ball
[8]Electrocution? All part of the service, sir!
[9]Undebug my heart: Using Cisco's IOS to take down capitalism – accidentally
What to do? Lunch, obviously!
The head of IT took Lee and co out for a splendid slap-up lunch where many adult beverages were consumed. And, lubricated by booze o'clock, the head of IT explained what was really going on.
[10]
"The bank's CFO, who was part of the owning family, had a predilection for visiting online live strip sites," Lee, who had remained relatively sober, recalled, "and would frequently do so from his desk using the bank's systems."
Nobody challenged him on this because his response was to simply fire the messenger and hire someone who knew to keep quiet.
However, if the content scanner was turned on then the IT department would have firm evidence and have to confront him. And all would then immediately lose their jobs.
Sure, the content scanner looked like it was running. The lights were on. But nobody had plugged it into the network since doing so would result in an abrupt shortening of careers for all concerned.
What to do?
One of Lee's colleagues came up with a solution that left everyone satisfied. A new, high-spec encrypted laptop replete with private internet connection separated from the bank's network was procured for the CFO.
The man's ego was subjected to some inflation with the explanation: as one of the biggest of cheeses, the information he dealt with was obviously super sensitive and so couldn't go anywhere near the network used by his underlings. Of course he needed something special, as befitted his exalted position.
With the CFO now happily, er, "browsing" on his own connection, the content scanner could then be properly fired up "and everyone was able to return to business as usual with their jobs intact."
Ever found yourself dodging the boss's blushes when something turned up that was most definitely... not convenient? Confess all with an email to [11]Who, Me? ®
Get our [12]Tech Resources
[1] https://www.theregister.com/Tag/who-me
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/columnists&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YS395a9Qth@KCNlvtA-WoQAAAMY&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/columnists&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YS395a9Qth@KCNlvtA-WoQAAAMY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/columnists&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YS395a9Qth@KCNlvtA-WoQAAAMY&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/columnists&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YS395a9Qth@KCNlvtA-WoQAAAMY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://www.theregister.com/2021/08/23/who_me/
[7] https://www.theregister.com/2021/08/16/who_me/
[8] https://www.theregister.com/2021/08/09/who_me/
[9] https://www.theregister.com/2021/08/02/who_me/
[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/columnists&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YS395a9Qth@KCNlvtA-WoQAAAMY&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[11] mailto:whome@theregister.com
[12] https://whitepapers.theregister.com/
SquidGuard Logs
For when you really didn't want to know about your boss's foot fetish porn ( true story, left shortly after )
Re: SquidGuard Logs
What about the right?
Re: SquidGuard Logs
If left shortly after, then right must have been first, shirley?
Re: SquidGuard Logs
I believe the middle leg was tugged first.
Not an IT issue.
"if the content scanner was turned on then the IT department would have firm evidence and have to confront him."
Why? It's not IT's role to police what people do/see, Information Security/IT's use of a content filter is to ensure that users cannot access/download any malicious or dangerous links/files, cannot leak data, or impact the performance of the internet link.
It's a purely HR issue as to what undesirable content is permitted or not, and they also have to deal with offenders.
Audits of branch offices also included compliance with local regulations. Given that some countries in the Middle East had (and probably still have) some rather strict anti-prawn laws, I had the "joy" of searching for such content on any local storage. And then delivering lists of files that better be deleted to their owners...
In the early 2000's, I was working for a large manufacturing company and helped with their roll-out of internet for everyone – up until then it had only been available for us in the IT ivory tower.
We ran a big information campaign – email, posters, training courses on browser use, acceptable use policy, yadda yadda yadda. One of the things we stressed was that all access was logged by IT, with full details of sites, addresses, user ID, etc.
One of my tasks was to setup and manage a proxy server and produce weekly usage reports for the IT manager to peruse. Not long after we went live, a certain username and dodgy looking URL kept appearing in the reports. Being a conscientious sort, I followed the link and landed on a hardcore BDSM site.
I showed my boss the site and the username of the frequenter. He decided, as it was still early days, to send out an email to all staff, reminding them that IT were logging ALL their online activity. No change, the same name and site kept coming up in the reports. The boss sent an email directly to the culprit, warning of consequences if the activity continued. It did.
In a final attempt to fix the problem, before getting HR involved, my boss arranged a face-to-face meeting with the user. He never disclosed the full details of their conversation, but when he returned from the meeting, me and the rest of the team were genuinely concerned for his health – his face was bright red and he was covered in sweat.
Apparently, the drop-dead-gorgeous, part time model, marketing assistant wasn’t phased in the slightest about her browsing habits being subject to scrutiny, and in fact complained that it wasn’t fair for her “stress relieving” internet activity to be restricted.
Shortly afterwards I was tasked with finding a more sophisticated proxy solution that could actually block sites, based on content.
Re: "That would not be... convenient"
The English also have very polite ways to say NO - in my experience.
In any case, I guess it's much harder to do anything about that sort of thing these days, what with so many people on their own connections w##king from home.