FUIT: An ongoing series about how users are getting around your company's policies (even YOUR company)

Hey.. I thought we chose "fuit" because it is latin for "he was," as in, "because he works for IT, he was in charge--but he's not anymore." :)

en.wiktionary.org/.../fuit

I prefer Gabes listing, i can hear the gen Y's saying it now, trying to stick it to the old man.

Look, I don't deny the possibly of what you guys are talking about with FUIT.  But I have to take exception to some of it....

"They know about Dropbox, gmail, usb drives, LogMeIn, and Slingboxes, too. What they don't know is at their fingertips via a web search in seconds."

Eh, the average user is lucky to know about half those things, and is very unlikely to know about most/all of them.  As far as web searches, they typically aren't good enough at crafting a search to actually find the info (they don't know the right words to use, ect).

"They also know about TCP ports, firewalls, WiFi, MiFis, cloud apps, antivirus programs, and different web browsers."

Please tell me you're joking. They basically know what AV programs are, a decent percentage might know about alternative browsers.  But TCP ports, firewalls, wifi, mifi's,...  no...no they don't.  They barely know that they're using wifi at home, and almost never know how to correctly set it up (or setup devices to use it).   They certainly do not know anything useful about tcp ports or firewalls.  For the most part, the things they do know are not useful for circumventing IT controls at work.

I'm not saying that all of these things can't potentially be an exploitable opening, because sure, they could.  But 95% of the time, it won't be.  Also, any decent sized company with compliance/regulatory issues can, and often will, block access to a lot of those cloud apps (gmail, dropbox, facebook, ect).  And all it takes is one incident of seeing a user send data inappropriately offsite, to get that site blocked also.

Now, users need the tools to get their jobs done.  New functionality shouldn't be auto-denied just because IT hasn't used it before.  But there are legitimate compliance, regulatory, and security reasons to stop some of it.  On the flip side, there's not always a clear benefit to allowing it.  There's typically a lot of support overhead that multiplies quickly when you start allowing any 'ol device on your network, and allow them to do whatever with it.  In the end, the consumerization of IT equals higher cost, and less control over your corporate data.  That's not a good tradeoff for everyone to make.

I could easily push this into a case for VDI or hosted sessions for users that prevent them taking/using data(content) in THEIR environment.

I see less and less of the argument for offline use from users - when the very things they are using to circumvent IT are ONLINE ACCESS TOOLS !!

Like I said, I'm not arguing that it's impossible.  But I've met a lot of these 20 something's coming into the workforce (worked at a university).  They're noticeably more "comfortable" with tech, but they are not that much more tech savy in general.  They're moderately better with the internet, and they're very into their phones...but that's mostly it.  And most of the things they might "show their coworkers" can be blocked one way or another.

Either way, we're debating the wrong argument here.  It's irrelevant whether or not all outside leakage of data can be stopped.  As always, you can pretty easily stop 90% of it, but that last 10% gets difficult.  The real question is, why should IT/Corp management encourage processes & policies that make it easier for it to happen?  All this consumerization seems to be founded on the premise that data security should just be ignored, and hopefully everything will just work out.

Maybe once vmware's phone/tablet hypervisor sees the light of day I'll change my mind.  But even then, it's a consumer device, but the sensitive half is still being locked down, just like corp environments have always been (at least at well-run places).

I'm all for evaluating new ways of getting things done, but it's not ok to say "screw security", just because it's a hassle, or unpopular.  Once someone finds a way meld the two together, hurray for everyone. (I think we're 25% of the way there with remote desktops delivered to tablets/phones)

@Gabe - your age bias is showing. I am 55, an EE, bought my fist PC (an IBM XT) in 82, after owning an Appe II an a host of board level products, taught networking at the local community college, was a beta tester of windows NT, yet also currently own a slingbox, iPad, android phone, and a wealth of other gadgets. Don't let my gray hair fool you into thinking I don't know a thing or 2 about the way networks work or how to get around IT controls. I was a Director of IT for years as well as working in the trenches. Don't think that because I am the old sales guy down the hall that I haven't put together some sophisticated Checkpoint firewall rules, or rebuild routing tables, or designed some of the products you take for granted today. And oh, by the way, my 10 closest buds all are gray hairs as well and have significantly more technical expertise than I have. So get off your high horse regarding 'living with technology like someone in their 30's has' - your ignorance and bias are showing.

@Jim Steinbacher. I would argue that you are by no means an average employee. Yeah, ok, you're 55. My dad's 70, and he's pretty good with computers, but he went out of his way to learn it. On the other hand, my neighbour is 45 and doesn't have a bloody clue, because she doesn't care to know. The fact that you were a Director of IT - I would say - precludes you from the group of employees that Gabe is talking about.