Business Case for Open Internet Access

Question

I'm a software engineer entering a company that has a history of being strongly authoritarian when it comes to computer, I.T., and networking choices. We have a corporate firewall with lots of filters and restrictions on it, and it makes for a lot of pain to do common things, like run programming tools that access the internet for downloads, or to use online chat applications that connect me with other developers around the world.

Have you seen, or written a business-focused justification for open internet access to increase developer or knowledge worker productivity? What arguments or evidence did you use?

Answer 1

I am an architect/developer. I have had to justify this for the past 10+ years.

Justification/Reasons:

• When looking for open source code I will often have to go to sites that are restricted by our internal proxy server.

• I also venture to "hacking" type sites which update on latest vulnerabilities and usually precede normal virus company warnings as well as give tips.

• Some downloads and extensions do not go pass proxy server.

• I search for things. I am not sure what websites will house those things, especially if I am out of the .com range (even then it is iffy). I don't know when I click on a new dev/code site if it won't have porn ads or girls in bikinis or whatever. When doing these searches usually I am at a "roadblock". If I am at a roadblock at work then either work stops or I go home or I move to another project (jumping from project to project is not productive most of the time).

• I also need to test things outside of our proxy servers. For instance if we have a website it might react different for intranet users vs. internet users. One of our developers might have put in an intranet address for some jquery or something like that and it causing internet users to have issues. Just lots of examples here.

Solution:

• I have a internet connection on top of my intranet from a local cable provider. Some other people with same requirements share this. This costs us about $100 a month and setting up the VLANs took about 2-3 hours.

• Anyone that has this uses an old PC to connect to the internet. It is a little inefficient because you have to move files via usb or something but not a big deal. This keeps people from downloading viruses and infecting other computers (we allow no communication between PCs across the internet VLAN).

• If not safe for work content appears from a site, we close site as quickly as possible and continue at home. Our VP talked to HR about this. Basically how we handle this is girls in bikinis is OK - given that you try to quickly handle the page or slide the advertisement out of browser screen. Any type of porn, nudity, or sexual act, you need to close website right away and make a concerted effort not to return to that site. (Some guys turn off flash and pictures in their browser to move past this but good luck navigating some sites with this turned off)

My take:

If your management wants you to be productive and work with a lot of open source applications/code/classes they have to understand that some of these sites will not be "safe for work" and may be blocked. As any developer knows, almost everything has been done before. So not finding something could possibly affect a project by weeks.

The chat part I am not sure about. I share lots of stuff and email works fine. I guess you could use your internet connection for chat but to me that is a different thing.

I think you need to sit down with your boss and explain the entire dilemma and solutions. Obviously when you are in heavy dev mode and you will need full access to everything, working from home or half days at home is the proper solution. But you need to make it really clear how debilitating it is to your performance not having access to everything you need at work.

Answer 2

Rules and restrictions

I've had the pleasure of working in education, small government, and companies that contract with the DOJ and DOD. I've personally been required and even advocated similarly dogmatic and overzealous measures over networks before.

It's absolutely true these filters are extremely inconvenient. Often requiring overhead to maintain as people in position X need a pinhole to access Y, Manager A wants website B locked down because people wasting time on it, etc.

Each company have different reasons this was necessary, but it usually boiled down to a mix of accessing things inappropriate at the work place, wasting time on websites that are of no benefit to work, and concern of malware from people who aren't cautious in their browsing.

I can say since most of these systems log who tried to access what when they got blocked it's both amazing and appalling the sorts of stuff people will do on the company dime. For us we usually turned the filter to just monitor to build a case to actually turn it on. I can say every single time we had people accessing porn, gambling sites, trolling around websites like rotton, somethingawful, and 4chan. Plus a variety of sites that deal in flash games, or otherwise have no redeeming value at work.

It improves company wide productivity

In my experience this has always resulted in an improvement in overall productivity. Even though individuals are effected by being able to access helpful tutorials on youtube, etc. Often the time people waste doing stuff they aren't supposed to be doing far exceeds that of the additional time incurred having to figure things out without these assets.

In a perfect world these filters would be unnecessary, but I can promise you everytime I've turned on a proxy to monitor traffic before going live it was staggering the things people would do on the company network.

Malware is just too dangerous

For a sophisticated user safe browsing is easy enough where it's pretty unlikely you'll get bitten by malware, the problem is most users don't know how to protect themselves from going to the wrong places and risking getting bitten by whatever the newest piece of malware is. Antivirus helps, but new zero day bugs come out daily and it only takes one virus to spread over your network to destroy any time benefit from not having the filters up.

I can say personally I've seen two companies get bit bad by malware. One was through going to places on the internet one should avoid at the office, the other was an infected USB key. Both cases cost the companies hundreds of thousands to millions of dollars as they were effectively shut down. IT had to take the network offline and go system to system cleaning the viruses off before putting them back on the network. One company this took the company of ~200 offline for almost 6 hours. the other it was effectively two full days.

Sure the filter can't fully prevent such a scenario, but it only takes one such occurrence to out weigh the benefit of having no filters.

Successful negotiation to be on the "lax filter" group

That said, in one of these companies we had a marketing department that the filters proved detrimental as some of the sites we really needed to filter from most people were the exact sites they needed to promote on.

They were able to come up with a list of about two dozen sites they needed access to in order to be effective. After some back and forth we decided to give them their own group. These filters are actually pretty good where sites are categorized by why they would be blocked porn, criminal, games, entertainment, malware, etc. What we did is for the marketing group we relaxed the rules a great deal, porn, malware, etc were still blocked, but we opened up categories that had sites on their list. (which actually was only opening up two groups of something like 18)

Turning off the filters entirely was just deemed too dangerous. Not to mention as I said before overall productivity improved despite the impact caused by some useful sites getting blocked.

Moral

I know someone will probably go. "I would never work for this sort of company" or "They probably have high turn over" the first is by all means your choice, but I can say we didn't see a notable impact in employee retention from before / after we put filters in place.

Answer 3

I'll warn you that you are "Fighting Uphill" on this one. In the last 18 months, we've seen data breaches that have cost companies in the hundreds of millions of dollars (Sony, Target, Home Depot, etc.), and the CryptoLocker ransom attacks are a very serious ongoing threat, too.

And, unfortunately, IT is held liable for everybody else's action at once, so you end up with the "Junior High Hall Monitor" approach: You set the security for the worst-behaving person in the company, and make everyone else live by that.

I currently live on both sides of this fence. I'm in charge of all tech for my company. I am a developer, but IT admin comes under my department, as well.

Your best approach is going to be this:

1. You need a separate, less-restricted network for development. All your dev machines should be here.
2. You need "Corporate" machines to be able to do company email, intranet, whatever, in the secured network.

Tell IT that the "Corporate" machines can be the old/slow systems no one else wants, as you're not going to be doing much with them. They will probably be fairly open to that idea.

This has several advantages:

• The budget hit is going to be fairly small - essentially only labor. You're not asking for new gear.
• You are respecting IT's need to lock down some networks. They should be on your side if you show them that deference.
• You're working towards a solution, not starting a turf war.

Good luck!

Answer 4

This is a (possibly snarky [sorry!]) revision of RualStorage's answer. I wrote it up to get it out of my head, and to clarify some of my thinking. Leaving it here as an alternative set of thought...and in case it helps others.

Open Access

These filters are extremely inconvenient, requiring overhead to maintain and expertise to request specific exceptions.

Each company have different reasons for imagining this was necessary, usually alarmism about inappropriate or time-wasting websites, and the belief that malware comes from incautious browsing. While you can often find people accessing porn, gambling sites, trolling around websites like rotton, somethingawful, and 4chan or playing flash games, web filtering doesn't prevent people from goofing off at work, it just redirects those efforts into other channels that may be equally unhealthy or unsafe.

It doesn't improve company wide productivity

While removing unapproved and work unrelated traffic from the company network is often accomplished by using web filtering, most filters are incomplete and other sources of distraction are always available. Eliminating quick and easy forms of distraction often has the adverse effect of making workers need to go away from their desks to take a break or to spend extra time routing around the breakage, causing extra distraction rather than reducing it.

Malware is unpreventable

For a sophisticated user safe browsing is easy enough where it's pretty unlikely you'll get bitten by malware, and antivirus helps, but new zero day bugs come out daily and attackers have found many ways of working around the limitations imposed by corporate proxies and firewalls. In todays environment, most companies are already infected broadly with malware and are forced to triage which infections are most pernicious, reducing employee productivity for a small gain in malware production is hard to justify. Malware protection and data integrity need to be designed to be comprehensive despite open access rather than rely on the tenuous protection of a proxy.

The middle ground of an lax-access group

While it is not always possible for a company to make a sweeping move towards opening up internet access in one swoop, providing employees a by-request open access group can provide a middle ground that can allow use of internet services to engaged employees who request more service, and still leave the default as somewhat restricted to address the concerns of nervous managers who have read the alarmist reporting of computer breaches in the mainstream press.