At a high level, this section suggests some approaches for fitting Cyfin or CyBlock into the organization’s overall employee internet usage management program. Topics addressed include:
(a) policy-based concepts and approaches for addressing Web-use management issues.
(b) centralized vs decentralized approaches to Web-use management and administration.
A. Policy-Based Web-use Management.
At a fundamental level, an effective Acceptable Use Policy / Web-use management program includes:
- a strategy for Internet use
- a policy for governing that use
- a policy-based mechanism or process for monitoring and reporting on that use
- a follow-through process for analyzing Internet usage and taking appropriate action on the basis of that analysis.
Strategy for Internet Use. In a way, discussing the need for strategy is “stating the obvious,” but then again, maybe not. In today’s world, network resources are absolutely crucial to achievement of the enterprise’s goals and objectives. In addition, it’s no secret that they are extremely expensive. Consequently, to ensure cost-effective mission success, the enterprise should have a carefully crafted, clear strategy for the way these resources are to be used. The strategy should state the enterprise’s goals and objectives in a clear, coherent way and should indicate the priorities to be employed, functions that are to be stressed, etc.
Employee Web-use Management Policy. Typically referred to as an Acceptable Usage Policy (AUP), a sound, formal Web-use policy is needed to help implement the enterprise’s strategy. In the context of network usage, an effective, thoughtful, and properly administered policy is a dual-purpose document. That is, it 1) encourages and guides all members of the enterprise work force toward positive constructive use of network resources, while 2) simultaneously helping to curb inappropriate or abusive use.
To accomplish the first purpose, it should clearly reflect the strategy discussed above as it relates to network usage. In so doing, the policy should clearly state how, when and why network resources should be used and when they should not. To aid the second purpose, it should clearly state what is acceptable use and what is not, and it should clearly indicate the sanctions to be imposed for engaging in unacceptable use. In our judgment, though, the former should be emphasized more than the latter. In sum, a sound Web-use policy is more than just a litany of restrictions and penalties; it is the fundamental promoter and guideline for using network resources in positive ways to benefit the enterprise and all of its members and stakeholders.
Policy Dissemination. The policy should be widely disseminated, in an understandable form, to all concerned. As part of this process, the various components of a policy-based Web-use management system can be used to “educate” the enterprise’s computer users in a positive manner. First, management can explain the content of the policy itself, pointing out the reasons—both positive and restrictive—why the policy is necessary. Finally, management can describe how the various provisions of the policy will be monitored and audited, how the users will be notified of any deviations, and the kinds of corrective action that may be taken if necessary. As mentioned earlier, such orientation does not need to focus solely on the “negative.” It can be used to stress how management wants the workforce to use Web sites (not just how they should not be used), and how proper use can help the enterprise and all of its stakeholders succeed. Done this way, the policy helps preclude misunderstanding or confusion as to what constitutes desirable and undesirable use of network resources.
Policy-Based Monitoring and Reporting. By definition, Web-use policy management strives to ensure that Internet usage conforms to both the positive and restrictive aspects of the enterprise’s policy. Successful accomplishment of this objective requires implementation of some type of highly efficient monitoring, documenting and reporting product that can record and display the number, type and origin of Web site visits. This information is needed to determine the degree to which network resource usage conforms to the enterprise’s Web-use policy. To produce this information, enterprises can implement some sophisticated but easy-to-use Web-use management products that are currently in use in a number of sectors.
Follow-Through Process (for Analyzing and Using Reports). As indicated earlier, an effective policy-based Web-use management approach includes a follow-through process for analyzing Internet usage and taking appropriate action when deviations from policy are noted. Such action may be needed to 1) bring network usage into conformance with policy, or 2) to modify the policy (or related plans) accordingly. When this is the case, management can use the information provided by the reporting system to guide adjustments to priorities, strategies, schedules and tactics, and/or to guide any necessary workforce-related actions, e.g., assignments, training, or disciplinary action. It can also be used to guide the establishment of Web-access blocking regimens if management decides to include filtering in its overall approach.
B. Centralized vs Decentralized Approaches to Web-Use Management
Depending on several organizational factors (size, dispersion, mission, culture), an enterprise may choose to use a centralized or decentralized approach to Web-use management.
Centralized Web-use Management. Centralized management generally means that all of the organization or enterprise’s outbound Web activity is monitored and controlled by a single individual or office from a single location – typically in the organization’s headquarters or main office.
We have observed two variants of centralized management:
(a) A single IT group or individual performs (a) many of the day-to-day employee monitoring, report generation and policy-enforcement functions and (b) the usual technical administration functions.
(b) A central HR office performs the day-to-day employee monitoring, report generation and analysis, and policy-enforcement functions, while IT performs the usual technical administration functions.
A centralized approach may be suitable for relatively small organizations that do not have any (or many) major divisions, large departments, far-flung field offices or remote facilities. On the other hand, under certain circumstances, a centralized approach may also be suitable for large customers even if they have major divisions and a physically dispersed organization. This will be the case if senior management wants the management and administration of all network resources to be monitored and controlled from one central location, e.g., headquarters.
Under the centralized approach, all covered workers – no matter how many – will be subject to the same usage policy provisions. And their division and department managers and local IT administrators will have no control over the settings, parameters and formats discussed above.
Wavecrest software can easily support a centralized approach. In such cases, the customer operates with a single license subscription. Under this arrangement, the customer is authorized to install one copy of the server software on one centralized server, although multiple remote control consoles connected to that one server can be employed. As implied earlier, this means that all covered workers and all output products (e.g., reports) will be subject to one group of settings that govern a number of Cyfin or CyBlock parameters, actions and formats. Examples of such items include: reporting language, maximum IDs to be displayed in reports, category classifications (acceptability ratings), block-allow settings (for filter products), thresholding enabled or disabled for automatic abuse-detection, etc.
Advantages of Centralized Management. Compared to a decentralized approach, centralized Web-use management offers the following advantages:
- Uniform application of policy provisions to entire workforce.
- Fewer managers and administrators involved.
- Lower cost.
- Easier control over security and privacy issues.
Disadvantages of Centralized Management. A centralized approach can have the following disadvantages:
- Less autonomy and less empowerment for line managers and/or dispersed HR representatives.
- Less flexibility in “localizing” policy provisions.
- Overburdened IT personnel (possibly).
Decentralized Web-use Management. When senior management wants to decentralize the management, administration and control of network resource usage, multiple licenses will be required. Under this arrangement, the customer can install multiple copies of the software on multiple servers, with one or more remote administration consoles connected to each server. Under a multiple-license arrangement, if desired, different groups of workers can be treated and evaluated differently with respect to their online activity. And their “local” managers and administrators will have much more autonomy and flexibility with respect to the use of Web-use management software and associated reporting and filtering actions.