Question

Imagine that you work for an organization that has no Internet use policy; employees use the Internet in whatever way they want using company-owned personal computers (PCs). Could this cause a problem for the organization?

Discuss the following IT security policies and the level of protection each policy provides in the context of your assigned scenario:

• Internet use policy
• External device use policy
• Employee Identity (ID) policy
• Computer use policy

Answer 1

Yes, this definitely cause the problem for organization. The problem lies in the fact that the internet habits of staff outside of work are now clear and present inside of their day to day working environment.

1. Security risks

An employee browsing potentially dangerous websites without control can open your business to an array of security risks, such as viruses, trojans, spyware – the list goes on.

2. Legal liability

If you have copyrighted information, such as software, music, videos, even photo’s on your business network, your business could be legally liable for it. Even if an employee downloaded it onto the network without your knowledge or permission, the business, basically the directors could be legally liable

3. Waste of bandwidth

Your internet connections are typically the main artery for your business, the main communication line between your business, its customers, and its suppliers. If your employees are downloading non-work related files, listening to music or watching the news then you’ll be paying for that. What do you do when people say that internet browsing is slow? You typically put your hand in your pocket to ‘upgrade the line’.

4. Reduced productivity

Your employees’ browsing the internet during work time costs your business money. The average employee spends 15 minutes of time browsing the internet during working time (excluding breaks) for non-business related purposes. This may not seem much but that’s 10 hours a day for a 40 computer-based employee company.

INTERNET USE POLICY:

This Sample Internet Usage Policy applies to all employees of <company> who have access to computers and the Internet to be used in the performance of their work. Use of the Internet by employees of <company> is permitted and encouraged where such use supports the goals and objectives of the business. However, access to the Internet through <company> is a privilege and all employees must adhere to the policies concerning Computer, Email and Internet usage. Violation of these policies could result in disciplinary and/or legal action leading up to and including termination of employment. Employees may also be held personally liable for damages caused by any violations of this policy. All employees are required to acknowledge receipt and confirm that they have understood and agree to abide by the rules hereunder.

EXTERNAL DEVICE USE POLICY:

This is a good and necessary policy for any organization. External device policy means employees are not allowed to use externaldevices like flash drive, memory card, CDs and DVDs in the business area. Because thereis a chance to steal the organization's data through USB’s or while using external devices virus can attack into company systems.

EMPLOYEE IDENTITY POLICY:

The importance of an employee identity policy is to indicate that you are an employe the company. Usually ID cards are issued to employees upon employmentn Idoctrination. It also helps in differentiation people as employees and visitors, so th all unauthorized persons are kept away from certain places/sections in the company. It is also an important aspect of security and integrity of the company.

COMPUTER USE POLICY:

Employee Computer Use Policy outlines a policy for an employer to adopt regarding the use of computers in the office by employees and the use of company supplied computers and software services. The policy restricts certain computer and software uses in order to minimize personal use of computers and to reduce office distractions. It also provides the proper procedure for an employee to request a company computer. Employers should use this policy to clearly lay out employee expectations, protect company property, and shield itself from liability arising from improper computer usage.