Avoiding crashes, meltdowns and security issues by managing employee Web use

Steven Vicinanza, CEO, BlueWave Computing

A joint study by Salary.com and America Online found that Web surfing was the No. 1 way employees found to waste time at work. Another found that 70 percent of workers regularly use the Web at work for personal browsing. Between keeping up their Facebook pages, tweeting on Twitter, watching the latest viral video on YouTube, and checking their stock portfolios, it’s a wonder that some employees have time left over to complete their work assignments.
Smart Business spoke with Dr. Steven Vicinanza at BlueWave Computing on how companies can address this issue.
What is considered personal browsing?
Using the Internet for activities that are non-work related. While many employers feel that some discretionary personal use of the Internet at work is acceptable, it can become a real problem when employees spend so much time on the Internet that it impacts their work productivity. Browsing for personal use can include online shopping, banking and bill payment, travel planning, sports, news, personal e-mail, gambling and social networking.
Is productivity loss the only issue?
Direct productivity loss is a major concern, however, even more worrisome are the security issues and numerous computer problems caused when employees download software from Web sites that contain viruses, spyware, malware and Trojans that slow down computers, destroy data, release sensitive information and give hackers free reign over the corporate network. The costs of information breach and system remediation can be many times more than the direct productivity loss. Despite anti-virus applications, we come across many situations where computers need to be completely wiped clean due to employees downloading harmful software from the Internet.
Employees can unwittingly clog up your network bandwidth by watching or downloading videos and music — and at the same time create a legal liability. One company was forced to pay $1 million to The Recording Industry Association of America over an employee who downloaded copyrighted music files onto a corporate server, which were then shared out over the Internet.
What is the best way to manage this?
The best place to start is by raising awareness of your company’s expectations. There are three basic methods companies use to address employee Web usage.
Define what is acceptable: A first step is to define what is acceptable in your workplace. The best way to do this is to draft what is called an acceptable Internet use policy and get all employees to sign it. You can outline if and when employees may use the Internet for personal use and what restrictions you want to put on when (e.g. lunch hours) and what is acceptable. You can work with a human resources professional or attorney to draft a suitable document. If your needs are simple and you want to get something in place quickly, try looking up examples of usage policies on Google that you can tailor to suit your needs. The usage policy will spell out the company’s expectations about what workers can and can’t do using company computers on company time. This is without doubt a must have, and a necessary starting point for implementing more stringent measures.
Web filtering: Once you have set expectations, you may want to remove temptation by blocking certain types of sites such as gambling or adult-oriented sites. Web filtering software will allow you to do just that. Using special software that selectively blocks Web usage, you can exert a high degree of control over what content is blocked, for whom and when. You can specify, for example, that employees may never access adult-oriented sites while at the same time allowing shopping and travel sites during lunch hours only.
The most sophisticated filtering tools offer the highest degree of control and are fairly easy to set up and maintain. Most come with annual subscriptions to constantly updated category lists that enable you to effectively block by category instead of having to enter the name of each website to be blocked. Many can also monitor usage.
Monitoring usage: Many companies, especially larger ones, take a step beyond simply filtering and actively track what their employees are doing at their individual computers. Be careful though as monitoring may be perceived as an intrusion on workers’ privacy —so approach this with some degree of caution and consider your company’s culture.
There are several technical methods for implementing usage monitoring. Some employers use software that’s installed on each computer, which allows them to monitor what the employee is doing both in real time and retrospectively. The downside to this approach is that monitoring the usage is fairly intensive and you are generally looking at the individual actions, which are not summarized at a management level. However, this can be especially useful if you have concerns about unethical behavior of specific employees as it allows you to view everything they are doing, including what they are typing into their browser-based e-mails.
Instead of monitoring each individual computer, an alternative method is to use a product that sits on the network and monitors all traffic. This can be a standalone appliance, a proxy server or software that is integrated into your firewall. These tools can show what sites are being visited and by whom. You can see it in a summarized form or drill down to the individual workstation level.
Which approach is best?
At a minimum, you will want to put the acceptable use policy into place to outline your expectations. Anything beyond that will require careful consideration of your company culture, the nature of the work being done, and the expectations of the work force. If you are a lawyer with a small law firm you would probably forego filtering or monitoring. If you run a call center with 100 hourly workers you might use both. Regardless of what you decide, you should see greater productivity, faster Internet access and fewer computer problems.
Steven Vicinanza, Ph.D., is CEO of BlueWave Computing LLC. For more information, visit www.bluewave-computing.com.