1

My company recently implemented a content filtration system (Websense) which ranges anywhere from mildly irritating to enraging depending on what useful website it's blocking and what program I have to configure proxy settings on in order to get my work done.

As a developer, I'd definitely say that it's caused me to lose a lot of perfectly good time implementing workarounds and generally causing me to lose my "flow" as I work. I'm sure hundreds of other employees at my company have had similar experiences, so it's easy to see the enormity of the number of dollars being thrown away if you figure each interruption can cause developers to lose on the order of 15 minutes of productivity.

Personally, I'd love to see the whole thing removed and have the company trust its employees not to be evil in using resources. Of course, this would probably never fly because the higher ups probably imagine everyone would be on social networking and music sites all day, and that people would be downloading programs loaded with viruses and spyware.

Given all this, is there any non-intrusive automated system (not manually-entered blacklists) out there which will satisfy management and developers at the same time? Preferably one that doesn't yell at me for trying to download Firefox? I'd love to recommend it to our IT department.

6 Answers 6

3

I can't provide you with a "solution", but since you didn't mention it in your post, I thought I'd point this out:

Your company (assuming it's in the United States) is filtering access to the Internet, probably in large part, because they want to show their "due diligence" in protecting against claims of a "hostile workplace environment" (see http://www.fcc.gov/owd/understanding-harassment.html). Most likely, it has very little to do with "trusting employees", and more to do with fear of legal claim.

I'd love to not have to use filtering software / hardware at my Customer sites. It would make life easier for me, and would be one less point of failure for the Customer. If / when the legal climate changes, that might be a possibility.

Legal issues aside, I have been in favor, for some time, of using management to solve managemnet problems. Websense, as a example, is able to generate reports that can be supplied to managers to help them monitor their staff's Internet usage. To my mind, it's not the IT department's job to decide the appropriateness of an employee's Internet usage. That's what their manager's job is-- managing that employee and making decisions about their continued employment based on their performance.

Talking about "downloading Firefox" gets into desktop support issues. That's a huge can of worms, and one that's bigger than your question. You may need "Administrator" access to your computer to do your job, but there may be good reasons why that's not feasible either. There are corporate liability concerns associated with allowing users to download and install any software they want, and there are productivity concerns associated with not.

I don't think there's an easy answer, nor will there be.

3
  • Actually, I do have administrator access on my PC, and until recently, there was no filtration at all (which is odd, for a large company). I must admit, though, that I didn't think about the legal issues and "due diligence" before I saw your answer.
    – dss_so
    Jun 29, 2009 at 17:32
  • The company may have had a close call w/ a potential claim and decided it was worth it to spend money to filter. I see more companies filtering in order to avert potential claims than to "save money" in "improved" worker productivity. I'd also echo the statements made by others - Webesense is perfectly capable of doing good, but it sounds like the configuration is locked down too far. I'd encourage you to communicate a list of those sites that you're being blocked from accessing to IT or your manager, so that the specific configuration of Websense can be reviewed. Jun 29, 2009 at 17:36
  • I just wanted to add - this is more of a policy/legal issue than an actual technical issue. You may want to go to management with your concerns about how the web filtration is leading to a decrease in productivity. If they are a company worth their salt, they will probably listen to you and you may be able to negotiate at least your or a certain number of developer's machines unfettered (or at least less restricted) access. Jun 29, 2009 at 18:31
3

First off... hang on. You say this is "recent" - all such systems take a while to bed in, and folk to get their usual sites correctly categorized. Give it a month.

Secondly... cut the IT some slack. I work at SmoothWall, and the hardest web content filtering problems we hit when people use our filter is looking after technical staff. It is a tough thing to balance, especially (and no offence intended here) as tech staff often have a better opinion of their honesty/integrity than non-tech staff. Maybe this is because they tend to be skilled workers.

Lastly... many solutions (SmoothWall and Websense included) allow for "soft block" or "warn" mode. This is good for tech staff - it pops up a block page saying "We'd rather you didn't visit this site, it is probably in violation of the AUP" but allows the user to click through. This is logged, so a user abusing the system can be spotted.

1

You might want to have a chat with the individual/group responsible as there may be reasons why those are blocked.

For example, you cited that you can't download Fx - that is blocked where I work as well due to the fact that the web-based software used in the company is only certified by the vendor for use in IE. Stupid? yup. Sucks? certainly. But that's what the vendor has done, and by using anything other than what they have "certified" we can be denied support even if it is blindingly obvious that that component isn't what is causing the problem. We (and possibly you) are being held technologically hostage. Or we'd at least be using IE8 instead of IE6...

That aside, while I can't speak for large organizations, I have set up some small networks for the local fire departments, and I have them using OpenDNS. The admin can set the filtering options, and it can be tweaked as needed. They have a process in place for getting exceptions to sites that shouldn't be blocked but are. You may want to see if that is an option too.

Lastly, no IT Security has gotten fired for being too paranoid. ;)

You would think you could trust people to act like adults, but as a recent event where I work has shown, that just isn't the case.

1

Websense is a good program ... I suspect the issues you are attributable to having related to how websense is configured rather than to problems with websense. More candidly .. if the current admins implemented something else (like Astaro), they would configure it with similar restrictions.

One note .. you need to have clean hands. If your issues are around chat, Twitter, BitTorrent, or personal stuff, get over it. You might be able (with embellishment) to justify why you need to be able to IM, because developers are special, but the admins won't budge on that sort of stuff. These restrictions and filtering programs came about for a reason, most admins hate them, and most would much rather set them to filter porn only and be done with it. But the business reality doesn't allow that.

I suggest the following ...

1- keep a log of what (specifically) you are doing that is getting blocked or causing you interruption or workaround.

2- After a week or so, take this log to whoever administers the system, and show them how the restrictions are causing you trouble and slowing you down.

With rational conversation and evidence, you may well be able to get them to loosen things up for you.

1
  • I don't use any social sites, and certainly wouldn't use them at work. The thing that bugs me is when I search for the solution to a specific problem on Google which links me to an article or blog entry on a blocked site. For some of these sites, Websense shows the warning page and does provide the option to visit the site, but it's still annoying and intrusive in my opinion.
    – dss_so
    Jun 29, 2009 at 17:36
0

It's not the system it's the configuration. Replacing websense with a different web content filter system is not going to resolve all your issues if it's not configured properly.

Where I work we only block adult material. And you would be surprised how many false positives that generates. I think sometimes it tags any web traffic coming from a particular IP or subnet as pornography. Hosts that live on shared hosting accounts tend to get blocked as well as blogs from time to time. We just have an system where an employee can put in a support ticket to get a particular url white listed.

1
  • I should add that we are not using Websense. Jun 29, 2009 at 17:22
0

I think you're taking the wrong approach. You really need to sit down and talk (in as friendly and civil a manner as possible) to your administrators about this. If you have a clear business case for downloading Firefox or other software, or accessing technical sites that would be blocked for the general user populace, then something needs to be done about the policy implemented (which I suspect may be one of the out-of-the-box defaults from the sound of it).

Websense isn't an "all or nothing" solution, there are very granular levels of policy which can be set to apply to different groups and users. When you make your case (in as friendly and civil a manner as possible, remember), you will be wanting to request an access policy for yourself and other developers that does block genuinely objectionable material but that leaves access open to technical sites and software downloads.

It's also worth bearing in mind that the Websense site database is provided externally, and that your admins have no control over the site categorisation in it, aside from the ability to override it for specific named sites. Websense have been known to make mistakes in the past, and at least some of the frustration you're experiencing may be nothing more than an honest accident.

Finally, and the real clincher, is that your admins may be utterly powerless to do anything here. They may be in a position where they have a strict directive from on-high, and they may have already pleaded the case and failed. So don't go too hard on them.

You must log in to answer this question.