Web Slackers Put On Notice

By RUTRELL YASIN

IT managers are refining their tactics and implementing more sophisticated tools to deal with a nagging problem: employee abuse of Web privileges.

Concerned about diminished productivity and legal liabilities associated with inappropriate Internet use, a growing number of companies are establishing or clarifying policies to define what's acceptable and what's not, according to an InternetWeek Research survey of 104 IT managers.

"We frown on the misuse of company assets and have put in very stringent policies," said George Brandt, a business manager at San Francisco TV station KBHK/UPN 44.

The company not only is concerned about lost productivity, he said, but also is leery of lawsuits that could arise from employees being exposed to an inappropriate Web site on a colleague's screen. The station used a template from Elron Software to write its Web-usage policy.

KBHK and other companies are installing new monitoring and content security software to regulate usage and enforce those policies, including "kinder, gentler" tools to help educate users. The goal: Keep slackers in line without hamstringing power users.

For instance, RuleSpace Inc.'s Web Traffic Control is a tool that uses artificial intelligence to analyze a Web page's text, images and network associations to identify its contents, rather than relying on lists of already identified URLs or keywords. If the page is deemed inappropriate, the software either blocks access or advises the user not to proceed based on modes set by management.

Internet Products Inc. in two weeks will introduce iPrism, another new approach to Internet monitoring. The hardware-software server appliance not only does Web filtering, but also lets IT control Internet services such as streaming media and FTP. The product, which can be installed into the network without impacting existing servers or devices, automatically identifies and monitors all user access requests and provides customizable reports to track specific users. iPrism is to be available by subscription for 67 cents per workstation per month based on 250 workstations.

In some cases, companies have established policies that aren't too well defined. Content Technologies Inc. in two weeks will roll out a new version of its content security software, called MIMEsweeper Policy Plus, that helps business managers write Web-usage policies in alignment with their company processes.

This product activity comes as companies are publicly acknowledging that they're taking severe measures against Internet abusers. Xerox Corp., for example, revealed earlier this month that it has fired more than 40 employees over the past year for inappropriate use of the Web, including excessive surfing of pornography and gambling sites.

The abuses were detected during routine monitoring of the network using commercial monitoring and content security tools, said Mike Gerdes, manager of information security at Xerox. He wouldn't identify the specific products.

The employees violated a Web-usage policy Xerox established in 1997. Other users have been disciplined, but these were the only firings--a tiny fraction of Xerox's 80,000 employees worldwide, Gerdes said. "Termination is not our first level of defense," he said. "These were excessive abuses, not casual use on non-Xerox sites."

By 2001, 75 percent of companies with more than 1,000 employees will have Internet usage policies and will routinely monitor for compliance, according to the Gartner Group.

Indeed, 45 percent of IT managers surveyed by InternetWeek said they established an Internet usage policy specifically to combat inappropriate Web use. Overall, 73 percent have usage policies, and of those that don't, 61 percent say they will within 12 months.

Forty-three percent of the respondents said IT management is responsible for writing their companies' Internet usage policies, while 21 percent said senior business management wrote their policies.

But an overzealous policy can be just as harmful as a nonexistent one, companies pointed out.

Xerox employees use the Web for research, to forge closer ties with customers and to communicate with suppliers, Gerdes said. "We spent a lot of time crafting a policy that does not restrict use of a vital tool for general business," he said.

Brandt concurred, citing an instance where stringent blocking hampered the TV station's art department from doing its job. The department manages the station's Web site, and in that capacity the art/production staff searches the Web for graphics.

The department has an arrangement with a drug-enforcement agency to tap its content for the KBHK/UPN 44 site, Brandt explained. However, the Elron Internet Manager software the station uses was programmed to block sites with the word "drug," so the department couldn't go to the partner's Web site to pick up its logo.

As a result, the station's IT department had to reprogram the software to make an exception for certain users. "Elron has a dictionary. If there are x number of occurrences of a particular word, you can block access to that site," Brandt said. "But it also lets you create your own dictionary so you can monitor stock sites, triple-X sites or drug sites."

After establishing a policy, the best deterrent to inappropriate Web site usage is employee education, said Eric Schmidt, an IS manager at law firm Brickler & Eckler.

"We're not trying to play Big Brother, so a good policy allows for some limited personal use," said Schmidt, who is using Internet Manager to monitor Web usage among 270 employees. "To be honest, we haven't had a problem because of the education factor. A lot of companies are throwing up Web sites" and opening up Internet access without educating users about what is appropriate use.

American Fast Freight uses Content Technologies' MIMEsweeper along with its firewall to monitor e-mail content and Web usage that is unrelated to work. What constitutes inappropriate usage for the freight shipper?

If a user is generating 30 MB of HTTP traffic per day, that may raise an eyebrow, said Jeff LePage, director of MIS. But the user could be researching product information on the Web, so IT would track which sites the user visited to determine whether they are consistent with legitimate work-related tasks, LePage said.

On the Internet usage side, however, Web surfing is a gray area. For instance, American Fast Freight users can go to the Wall Street Journal or Yahoo sites to check stock prices. But they're not allowed to customize home pages to view stock tickers.

MIMEsweeper has also helped the company control non-work-related e-mail. Prior to e-mail monitoring, which was implemented a year ago, 20 percent to 30 percent of American Fast Freight's messages weren't work-related; now, it is down to 2 percent, LePage said.

To help companies quantify the cost of inappropriate Web usage, Telco Research offers TRU Access Manager, which automatically collects data on Web site usage in real time and provides alarms to IT managers that tip off abuses. An IT manager can schedule times for the software to report on the collected data, and the program then generates reports via e-mail or log files.

It's not just Web surfing that companies are trying to combat. Xerox is concerned about the impact on network bandwidth of conferencing and downloading of multimedia files--especially at branch offices or remote sites.

If a user downloads the latest version of Microsoft Office over the network instead of using a CD, he can adversely impact network performance. Such a download could include 80 MB to 100 MB of data, Gerdes said. "It will be increasingly difficult for IT managers to control network usage," he added.

Research: Internet Usage Policies
Forty-five percent of respondents are using Internet usage policies to combat inappropriate use of the Internet. Check out our findings on other Web policy usage issues.