We do the same as Zac's company. From an IT standpoint there are too many issues with leaving it wide open such as:
1. Bandwidth consumption - You have the potential for users to stream video, download non-work related media, etc. About 4 years ago I turned of the ability to instant message, stream video, and go to sites known for downloading media. This cut our bandwidth usage in half. Reducing the cost of doing business by ~$10,000/year.
2. Just because each workstation/Server has AV loaded there is always the chance that the latest and greatest virus will bypass it. Mimimizing the sites that users can go to will minimize the risk of getting a virus from the browser. We recently had a situation where a remote employee who had AV loaded on his laptop, but wasn't connected to the firewall and it's content filtering, went to a site and gave them his company credit card information because it told him he wasn't protected (no comment). Content Filtering would not have allowed him to go to this site.
3. Just because "everyone should be a grown up" doesn't mean that they are. Last year we had to fire a temporary employee for repeated internet usage of trusted sites. Prior to the firing he was given a warning in which he replied "I didn't know I wasn't suppose to do that".
Exceptions can always be made through the firewall. Our HR department needs access to youtube, facebook, twitter, etc. so those individuals are able to get to those sites.
If you've ever had a security audit on your system (We've had 2) you'd know that best practice says to proactively lock down the internet completely and only give access to what is needed, as it's needed. I don't want to deal with the fallout (complaining from users, more work for me, etc.) which is why we do a hybrid.
Also, make sure to inactivate the rights for executing IE for users/computers that don't need access to the internet. We have workstations scattered throughout the plant that are used by supervisors to check email and run their equipment. They don't need internet access so they belong to a GPO that restricts IE.
Jennifer Mesiano
IT Director
Walton Signage
1. Bandwidth consumption - You have the potential for users to stream video, download non-work related media, etc. About 4 years ago I turned of the ability to instant message, stream video, and go to sites known for downloading media. This cut our bandwidth usage in half. Reducing the cost of doing business by ~$10,000/year.
2. Just because each workstation/Server has AV loaded there is always the chance that the latest and greatest virus will bypass it. Mimimizing the sites that users can go to will minimize the risk of getting a virus from the browser. We recently had a situation where a remote employee who had AV loaded on his laptop, but wasn't connected to the firewall and it's content filtering, went to a site and gave them his company credit card information because it told him he wasn't protected (no comment). Content Filtering would not have allowed him to go to this site.
3. Just because "everyone should be a grown up" doesn't mean that they are. Last year we had to fire a temporary employee for repeated internet usage of trusted sites. Prior to the firing he was given a warning in which he replied "I didn't know I wasn't suppose to do that".
Exceptions can always be made through the firewall. Our HR department needs access to youtube, facebook, twitter, etc. so those individuals are able to get to those sites.
If you've ever had a security audit on your system (We've had 2) you'd know that best practice says to proactively lock down the internet completely and only give access to what is needed, as it's needed. I don't want to deal with the fallout (complaining from users, more work for me, etc.) which is why we do a hybrid.
Also, make sure to inactivate the rights for executing IE for users/computers that don't need access to the internet. We have workstations scattered throughout the plant that are used by supervisors to check email and run their equipment. They don't need internet access so they belong to a GPO that restricts IE.
Jennifer Mesiano
IT Director
Walton Signage
--- In vantage@yahoogroups.com, Zac Jason Woodward <zac@...> wrote:
>
> Bandwidth shaping needs to be done per your own business' needs. Our choice was to route all internet traffic through a content filter and an AV scanner making sites that are known security risk unavailable. If somehow there is a false positive all they have to do is call or shoot off an email to have that site whitelisted.
>
> "Zac" Jason Woodward
> Network Administrator
> Intermountain Electronics, Inc.
> O: 877-544-2291
> M: 435-820-6515
> F: 435-637-9601
> www.ie-corp.com
>
> Creating customer confidence through extraordinary service and experienced industry experts.
>
> From: vantage@yahoogroups.com [mailto:vantage@yahoogroups.com] On Behalf Of Barbara Hemme
> Sent: Tuesday, March 13, 2012 7:09 AM
> To: vantage@yahoogroups.com
> Subject: [Vantage] System Admin Followup
>
>
>
> What is your internet usage policy? Do you allow total internet access for those in the office? Do you only allow certain sites?
> We are gathering this info to determine whether or not we need a second IT person.
>
> [Non-text portions of this message have been removed]
>
>
>
> [Non-text portions of this message have been removed]
>