Intranet Blog

Poor intranet policy management could lead to lawsuits

Toby Ward — Wed, 14 Feb 2007 20:13:48 -0800

A new poll from a vendor shows that nearly 50% of UK organisations could be leaving themselves open to litigation through managing their corporate policies primarily on the intranet (see Businesses warned over use of intranet).

I could not find the actual poll results and the company that conducted the poll, NETconsent, does not make it readily available on its website. This sounds like another marketing exercise masquerading as scientific research... but regardless the information is worthwhile.

The marketing states that the “poll reveals that many organisations have a passive and potentially dangerous attitude towards managing their policies. Intranet implementations that grow organically can prove challenging to manage and might no longer meet the increasing compliance requirements for such processes.”

NETconsent highlights the following “dangers of managing policies over the Intranet”:

No proof – Simply making a policy available for reading on the intranet is not sufficient. In the instance of a legal challenge companies need to demonstrate that an employee has agreed to the policy in question, if not also read and understood it.

Out of date / inaccurate – Policies need updating on a regular basis. If policies are not kept up to date with company and legislative changes, employees may be reading and agreeing to inaccurate information, leaving the company open to risk.

Understanding – Without measures to ensure that policies are read and understood, organisations do not know whether their policies are viable and effective.

Relevance – Many policies will only be relevant to a set group of people. Managing policies through the intranet may make it confusing for employees to identify which policies are relevant to them. Ideally policies should only be targeted at the relevant employees.

Access – In many organisations not all employees have access to the intranet or use it on a daily basis. This may result in employees being unaware of policy changes or unable to access policy documents.

I believe the use of “danger” to be rather strong here, but I’ll let each reader judge for themselves vis a vis the present intranet environment and culture at their respective organization.

“The research indicates just how many businesses rely on the Intranet to communicate policies,” says Dominic Saunders, NETconsent’s Operations Director. “While it is encouraging that companies are using policies to educate their employees and protect themselves, managing them over the intranet might not be enough.”

“Without evidence of the signed document, employers are leaving themselves open to risk. In the event of a breach of policy, organisations need to be able to demonstrate not only that they have a policy in place but that the employee concerned has seen and agreed to the document.”

How can you tell both lawyers and marketers are involved in this announcement? Fear and legalease can together form a very powerful marketing punch.

I’ve not heard of a company that was sued because each and every employee did not sign-off on an intranet policy. If it’s stated and available through a link on every single page (via CSS template) then that should suffice. I’m not saying that such a lawsuit is not possible, it obviously is possible, but I’ve not seen or heard of one as of yet.

NETconsent is of course raising the possibility of potential lawsuits under some circumstances in order to sell companies their product – which by no coincidence helps “mitigate risks” by maintaining “full and accurate records of written policies.” Fair enough.

NETconsent Ltd. “is the world-leading vendor of effective policy management software solutions and corporate communications.”

NETconsent’s “Tips for better Policy Management” include:

Ease of use – The more policies that are managed through the intranet the more updates and changes will be required. To minimise the time spent on managing policies by staff it should be easy to create, update, distribute and monitor responses of new and revised policies.

Updates – Keep all policies updated and current in line with corporate culture, working practices, legal precedents and legislation changes.

Record agreements – Maintain records of employee agreement to relevant active policies, whilst retaining a full archive of agreements to previous policy versions.

Access for all – Ensure that all employees, including those that work from home or remotely, have access to central policy repository.

Control – Make sure that access of ‘author rights’ to policies is tightly controlled and only nominated persons can make changes to policies and policy records.

Understanding – Randomly test employees’ understanding of policies to determine whether further education or policy reviews may be required.

Check – Carry out checks to ensure that any required policy agreements can be accessed for evidence at short notice.

About the poll

“The results were taken from a telephone poll of 100 UK HR and IT managers, working in a range of sectors including technology, government and professional services, across a variety of company sizes.

Digg this Post to del.icio.us Post to Slashdot

Criminals work smarter to take your money

Toby Ward — Tue, 11 Jul 2006 11:37:17 -0700

There’s more of your money to take; and the crooks are using more technology to take it.

e-Bay and PayPal phishing e-mails are becoming more and more prevalent. And now the dirty little crooks are no longer relying on e-mail to get you to cough up your dough. Some criminals have learned that we’re becoming more cautious about these e-mails – so they’re setting up fake call centers so that you phone-in and give your personal information after you receive the e-mail.

Phishing schemes often start with misleading spam urging people to visit a fraud website designed to mimic the real business website (such as e-Bay or PayPal). Once unsuspecting people go to the site they’re asked to give personal information – or are loaded up with spyware such as those that track and log your keystrokes.

According to Symantec's latest Internet Security Threat Report, there were 7.92 million phishing attempts per day during the second half of 2005, compared with the 5.7 million attempts per day it reported for the first half of 2005. And the attacks are becoming sneakier and more sinister.

Criminals Increasingly Blend IT Threats is an interesting read from eWeek: “As businesses and home users have become increasingly savvy about traditional threats delivered via e-mail attachments, criminals are finding new ways to lure end users to consume their attacks, according to the report. Researchers specifically cited a growth in the number of threats that use spam e-mail messages or IMs to distribute links to Web sites where malware or spyware is secretly downloaded to end users' computers.”

One of the keys to identifying a phisher is looking at the URL requesting you to update your information. If for example, rather then clicking through to the PayPal URL www.paypal.com, a phisher would have you go to a dummy site with a similar URL (e.g. paypal.palpay.com). Now, one crook even used a URL hosted on PayPal's legitimate site that had been altered by cyber-criminals using a “so-called cross-site scripting attack.” Little bastards!

Here are some tips from MailFrontier (TopTenTipsforFindingaPhish) to avoid being scammed:

Know thyself: Know the online companies you deal with. When a suspect email arrives, remember: it could be fraud, it's definitely spam, and it is definitely not for you. Delete it.
Subject matters: Consider the subject line of an email carefully. Citibank will never send you an email headed “_Citiibank_account_update ACT-N0W”. These messages may get through spam filters because they appear to come from a reputable source, but that doesn’t mean it’s really from Citibank.
Learn the language: Understand how the companies you deal with want to interact with you. For example, banks usually want you to access your account through their website–not an email link. “Phishing” emails stand out because they don’t follow the rules.
Browsing around: Practice safe browsing. Open a new browser window each time you log on to a web site that displays personal information. When you are done at that site, log out and close that browser window.
Spelling counts: Be sure to read emails that say they are from companies you know. Sometimes a real email will have a spelling or grammatical error, but anything more than one error is suspicious.
Mousing around: Scroll over the links in emails you receive and check them. In some email systems, you can scroll over the different links in an email and see the actual contents of the link. If the email says PayPal, but the link content says “ www.paipall.com”, be careful. And note: URLs can be disguised—so don’t take a suspect link at face value.
All form, no function: Never enter your personal or credit information into a form in an email. If you feel the email is legitimate, call the company or visit their web site and log in to provide the requested information.
It’s personal: Expect good customer service. Unless your name is “eBay User” or “johndoe99”, most “phishing” emails are not personalized. If you receive a “Dear Customer” email, it may be time to move on.
Make a statement: Read your statements – every one, every month to ensure your charges and debits are correct. Often information obtained through phishing is not used right away. Stay vigilant and report any suspicious activity immediately.
Stay current: Use and maintain your email protection software for spam blocking, fraud blocking, and anti-virus. If you have any questions, there are many fine web sites which can provide the latest information on the latest virus, “phishing” attack, or on-line scam.

Protecting your goods

Toby Ward — Mon, 19 Sep 2005 21:11:38 -0700

There’s an adage that is old for the intranet age (since they came to be mainstream in the early 90s) that says you shouldn’t put anything on the intranet that you wouldn’t put in print. It relates to the older adage that you shouldn’t print anything that you wouldn’t want anyone outside the company to read.

Your content is valuable. You wouldn’t want to share most of it with the outside world – especially the competition or media. However, if you are making content available via the intranet then it is possible it can be leaked externally. The number one leaking culprit, of course, is the employee.

There are three general positions or models to adopt vis a vis content protection:

Open market – publish just about anything you can on the corporate intranet.
Closed market – put sever constraints on what can be published.
Asynchronous market – a hybrid model that entrusts employees with a certain level of responsibility to maintain confidentiality.

My own personal opinion is that if you’ve hired and trusted an individual to do a job that the organization deems crucial enough to justify the pay then most individuals are trustworthy and not likely to leak confidential information to outside sources. On the other hand, I wouldn’t publish any corporate top secrets either. As such I recommend most companies adopt an asynchronous model that assumes a certain level of responsibility and trustworthiness of employees but does not make widely available all information and data to all employees.

Regardless, intranet and corporate information managers do have a responsibility to inform employees of their responsibility and to limit the organization’s liability. Such action includes the development of several policies:

Editorial policy
Terms of use
Acceptable use

Editorial policy

Your editorial policy is less of a legal security blanket and more of a definition of roles and responsibilities of those developing and maintaining online content. The editorial policy should include details on...

content types
style acceptability
news determinants (e.g. currency, impact, etc.)
formatting
archiving
photo treatments and bylines
content management system rules and directions
copyright and legal
privacy and security
governance including roles and responsibilities
taxonomy (classification)
site registration and indexing

Terms of use

Terms of use is a standard legal disclaimer. It says who owns it and declares the copyright, disclaims accuracy of content, etc.

Acceptable use

Acceptable use spells out the rules. Thall shall not...

Email content outside of the company.
Print and distribute content outside of the company.
Release content to any media outlet.
Rewrite or reproduce content for personal purposes or profit without the expressed written consent of the company (legal department).

Page footers

If you’re not already doing so make sure you have coded into your style sheets or CMS templates a footer that always includes the following:

A legal disclaimer
Terms of use
Copyright stamp
Name and email address of author
Date of publish

While clients have hired me to develop these policies and standards the work is not really rocket science. It just takes a little time and thought that could save your organization some headaches in the future.

Securing your intranet from the inside

Toby Ward — Mon, 12 Sep 2005 15:12:00 -0700

How secure is your intranet? The IT department has likely has gone to great lengths to protect financial and customer systems and databases but have they applied the same rigor to the intranet or portal?

Intranets and portals have grown exponentially since becoming mainstream in the early 1990s. Some are millions of pages large. However, the intranet has typically taken a backseat as the poor cousin to customer websites.

“Although media and management attention is focused on protecting external-facing sites from security threats, identity theft and other online vulnerabilities, intranets should not be overlooked,” writes Peter McKay, CEO of Watchfire in a recent Federal Times article When securing information, don’t overlook intranet. These sites can easily be compromised, and government IT executives are now realizing the need to expand security and privacy practices to agency intranets.”

If you’re a communicator, HR or marketing person responsible for the intranet then you need to ask the right questions of your IT department. First and foremost is understanding what you have, what is available to a wider audience, and what is specifically being done to secure it.

“Only by understanding the intranet environment — the domains, websites, directories, content, servers, technologies in use, and the policies and standards in place — can agencies ensure that they have adequate control of this information and its delivery,” says McKay. “The first step is to conduct an agency wide (assessment) to evaluate the size and complexity of the intranet. By conducting a thorough assessment agencies can effectively evaluate risks. Managers can then make informed decisions about risk mitigation as well as server and application consolidation.”

Things to look for:

· Identify systems and servers not up to date or otherwise not conforming to IT standards

· Orphaned content and rogue intranet sites and servers

· Applications that work or communicate outside the firewall

McKay recommends several key steps to “effectively manage the compliance risks and costs of managing agency intranets:

• Conduct an inventory of internal Web properties to better understand the Web environment. Knowing how many sites and servers you have, the technologies in use, and the technology policies and standards your agency employs will create a more secure and productive intranet environment.

• Scan your intranet with an automated solution to identify vulnerable areas, including forms that may be inconsistent with internal privacy policies or may lead to information leaks.

• Understand what employee and citizen information is being collected and published on the Internet and intranet. The intranet is used to publish sensitive information, including human resources forms and employee health care information. Full knowledge of all online data-collection methods is critical to effectively managing Web privacy.

• Understand exactly who has access to this sensitive information. Proper technology and security controls will allow employees to see only the information required to do their jobs. Often, contractors are granted access without careful consideration for all the information they may have access to.

• Consider applicable security, privacy and accessibility legislation such as the 2002 Federal Information Security Management Act, the 2002 E-Government Act and the 1998 Rehabilitation Act amendments.

Google wants your desktop

Toby Ward — Tue, 23 Aug 2005 21:45:52 -0700

The powerful tentacles of Google continue to extend deeper and deeper into your computer.

Google has unveiled a computer and search tool using “self-updating navigation” and “personal information software” that extends beyond pure search to access and manage your e-mail, instant messages, news, etc.

This new tool called the Google Sidebar is the company’s most direct challenge to Microsoft’s dominance of your desktop. The Sidebar encourages you to completely bypass your Windows desktop and that little green menu option in the bottom left hand corner of your screen.

The Sidebar Quickfind feature allows you to directly return to recently used applications or sites without extra clicks.

Google also plan to unveil this week a "communications tool" that is thought to be a new instant messaging service. Further demonstrating the company’s drive to break Microsoft’s dominance of the computer user’s desktop.

Of course, this long reach for you desktop also extends to the intranet. As I blogged last week, many organizations are starting to use the Google search engine on their own websites AND on their corporate intranets...

Big Brother Google

Toby Ward — Thu, 11 Aug 2005 12:29:34 -0700

The honeymoon is waning for darling tech and search giant Google. While its technology and services continue to amaze and delight users the world-over, the untold price of using certain Google services is beginning to leak into the unsuspecting public.

News.com (news division of CNET) writer Elinor Mills wrote a stinging column about Google’s information practices and the implications on individual privacy. Using Google as a research tool, Mills highlighted Google’s power and practices (not fully understood) using Google’s own CEO as an example. Mills was able to find out detailed personal information on Google CEO Eric Schmidt including particulars such as:

annual income
stock sales
personal hobbies
personal political allegiances
etc.

Google’s response? An outright ban of News.com; a refusal to talk to the media outlet for one year. Even more peculiar has been Google’s refusal to say much on the ban or the initial story.

What is Google afraid of?

Perhaps this story can be likened to the child who got caught with his proverbial hand in the cookie jar.

Elinor Mills' article suggests that using Google’s assorted tools and services may in fact breach the average user’s privacy threshold – without the user knowing it. For example, Google collects and stores (and who knows what else) huge volumes of user data not available to the public, including logs of individual’s respective search queries. To put this into perspective, using only what is available to the public, Mills was able to find the following which was published in the July 15 article, Google balances privacy, reach:

“But spending 30 minutes on the Google search engine lets one discover that Schmidt, 50, was worth an estimated $1.5 billion last year. Earlier this year, he pulled in almost $90 million from sales of Google stock and made at least another $50 million selling shares in the past two months as the stock leaped to more than $300 a share.

He and his wife Wendy live in the affluent town of Atherton, Calif., where, at a $10,000-a-plate political fund-raiser five years ago, presidential candidate Al Gore and his wife Tipper danced as Elton John belted out "Bennie and the Jets."

Schmidt has also roamed the desert at the Burning Man art festival in Nevada, and is an avid amateur pilot.”

No wonder Google is miffed. But did Mills really do anything wrong? I’m tempted to say ‘no’ but alas I don’t know all the particulars.

One would think that if Mills had somehow broken the law then Google would flex its impressive financial muscle and sue Mills et al. Did Mills overstep an ethical boundary? I’m also tempted to say ‘no’ but this can only be a subjective opinion as ‘beauty lies in the eye of the beholder.’

But let’s just look at what Google does know about you. Here’s what CNET News.com published as a sidebar story in the Mills article under the title “What Google Knows About You”:

• Gmail -- The e-mail service offers two gigabytes of free storage and scans the content of messages to serve up context-related ads.

• Cookies -- Google uses cookies, which are commonly used to link individual users with activities.

• Desktop Search -- Google's Desktop Search lets users easily search files stored on their computer.

• Web Accelerator -- The application speeds Web surfing by storing cached copies of Web pages you've visited; those page requests can include personal information.

Now many organizations are starting to use the Google search engine on their own websites AND on their corporate intranets. Does Google track internal corporate information retrieved from the corporate intranet as well? I don’t know...

I have to admit I’m not much of a privacy wonk but I just went to my cookies folder and deleted all Google cookies. Some of my awe and over-zealous appreciation for Google was just replaced with a little bit of fear.