(ISF) Use of home email accounts in work setting

Hello everyone,

We have a client with an interesting internal email problem. Because of the amount of spam staff receive on their work email account, they have switched to using their home email accounts to use for work purposes. The client will be installing Barracuda at the beginning of the next fiscal year and we've shared with her all the tips and ideas on how to prevent getting on spammer lists. Her bigger issue at the moment is to get people to stop using their home email accounts.

The client would like to cite "industry standards" around this practice rather than just putting the edict out that this is not acceptable. She'd like to have solid reasons why not to do this. (HIPAA, etc.)

I'm wondering if anyone has any online references you can share that address this issue directly. As always, thanks for your help!

Mary A. Gross, Director
InfoTAP, a program of Nonprofit Management Solutions
8265 Vickers Street, Suite B
San Diego, CA 92111
(858) 292-5702 (voice)
(858) 292-9943 (fax)
www.infotap.org
www.npsolutions.org

[Non-text portions of this message have been removed]

Messages in this topic (1) Reply (via web post) | Start a new topic

.

Well, there's that whole Karl Rove thing...

http://www.washingtonpost.com/wp-dyn/content/blog/2007/04/12/BL2007041200941_pf.html

I realize that's not quite what you're asking [about which I know
nothing interesting], but it doesn't seem totally alien to the topic.

Jason Zanon
DemocracyInAction

-----original message-----
>>We have a client with an interesting internal email problem. Because of the amount of spam staff receive on their work email account, they have switched to using their home email accounts to use for work purposes. The client will be installing Barracuda at the beginning of the next fiscal year and we've shared with her all the tips and ideas on how to prevent getting on spammer lists. Her bigger issue at the moment is to get people to stop using their home email accounts. The client would like to cite "industry standards" around this practice rather than just putting the edict out that this is not acceptable. She'd like to have solid reasons why not to do this. (HIPAA, etc.) I'm wondering if anyone has any online references you can share that address this issue directly. >>

Messages in this topic (0) Reply (via web post) | Start a new topic

.

The only reason I can think of to ban access to personal email accounts is to keep staff focused productively on their work instead of being distracted by non-work related email messages. In which case the use of personal email accounts while at work could be covered by an acceptable use policy for the company Internet connection.

On the other hand, there *are* reasons to require staff to use their assigned email accounts for work purposes.

Work email is the property of the employer, not the employee. Therefore the employer may require that its property be stored and transmitted using its systems. When an employee leaves the organization, it is much easier to retain that employee's email if it resides in a company-owned system.

Another reason is that email sent using the organization's domain name promotes the organization's brand, instead of promoting Yahoo! or Google's brand. For example, the organization's corporate communications policy may stipulate that official correspondence be sent under the organization's domain name.

Hope this helps.

Zac

--

Sarai - Technology guidance, support and management.

Note: I use this email address primarily for email newsletters and discussion groups. If you wish to contact me directly, please email zac%40sarai.org">zacsarai.org.

Messages in this topic (0) Reply (via web post) | Start a new topic

.

What Zac said, and, third, kind of highlighting his first point, the email services your users have at home may be even less benign than Google or Yahoo. In email policies, I've always described corporate email as being akin to letters on company letterhead. Anything you say is reflective of the business. So, if the user's email is through a provider with a clear political bent, or a gaming company, or whatever, they are somewhat associating the company with that entity. That can be complicated.

For many years, my primary personal address was on the domain I've owned since 1994 - krazy.com. I wouldn't consider sending business email from that address.

--
Peter Campbell
http://techcafeteria.com

-----original message-----
>>We have a client with an interesting internal email problem. Because of the amount of spam staff receive on their work email account, they have switched to using their home email accounts to use for work purposes. The client will be installing Barracuda at the beginning of the next fiscal year and we've shared with her all the tips and ideas on how to prevent getting on spammer lists. Her bigger issue at the moment is to get people to stop using their home email accounts. The client would like to cite "industry standards" around this practice rather than just putting the edict out that this is not acceptable. She'd like to have solid reasons why not to do this. (HIPAA, etc.) I'm wondering if anyone has any online references you can share that address this issue directly. >>

[Non-text portions of this message have been removed]

Messages in this topic (0) Reply (via web post) | Start a new topic

.

Hi all,

>From my point of view, policy-wise, I'd never, ever let this happen. The security implications are horrendous. In my case, the organization has invested substantially in multi-layered security systems to ensure computing, data confidentiality, etc, etc.

Letting people use their personal email systems - that I would imagine could or might be less secure - then lets them touch the organizations network. That's an uncontrolled vector. It would bother me to no end. Just the uncontrolled acceptance of attached files alone would send me running. And, then what about access by others to that email - such as spouses, etc.. How about sending personal political endorsements from a personal account that has been used as an organizational account.. whew. Not good. Organizationally.. There are legal implications, privacy stuff, etc, etc. This is a slippery slope. I'd run and hide. The organization is, tacitly, endorsing the contents of that email account.

In an emergency, sure.. but regularly, no way.

However, all that said: given that the organization encouraged this BECAUSE their system was unreliable.. You'd be hard pressed to argue the "security" aspects if the organization's house is in such disarray.

Regards

Gavin

-----original message-----
>>We have a client with an interesting internal email problem. Because of the amount of spam staff receive on their work email account, they have switched to using their home email accounts to use for work purposes. The client will be installing Barracuda at the beginning of the next fiscal year and we've shared with her all the tips and ideas on how to prevent getting on spammer lists. Her bigger issue at the moment is to get people to stop using their home email accounts. The client would like to cite "industry standards" around this practice rather than just putting the edict out that this is not acceptable. She'd like to have solid reasons why not to do this. (HIPAA, etc.) I'm wondering if anyone has any online references you can share that address this issue directly. >>

[Non-text portions of this message have been removed]

Messages in this topic (0) Reply (via web post) | Start a new topic

.

You might alert employees to a privacy issue. If they access personal emails via Outlook or otherwsie save the emails to their computer (as opposed to simply reading via webmail), the emails will be backed up along with the rest of the computer and will therefore be visible to the company.

Robert Tolmach

-----original message-----
>>We have a client with an interesting internal email problem. Because of the amount of spam staff receive on their work email account, they have switched to using their home email accounts to use for work purposes. The client will be installing Barracuda at the beginning of the next fiscal year and we've shared with her all the tips and ideas on how to prevent getting on spammer lists. Her bigger issue at the moment is to get people to stop using their home email accounts. The client would like to cite "industry standards" around this practice rather than just putting the edict out that this is not acceptable. She'd like to have solid reasons why not to do this. (HIPAA, etc.) I'm wondering if anyone has any online references you can share that address this issue directly. >>

Messages in this topic (0) Reply (via web post) | Start a new topic

.

----original message-----
>>We have a client with an interesting internal email problem. Because of the amount of spam staff receive on their work email account, they have switched to using their home email accounts to use for work purposes. The client will be installing Barracuda at the beginning of the next fiscal year and we've shared with her all the tips and ideas on how to prevent getting on spammer lists. Her bigger issue at the moment is to get people to stop using their home email accounts. The client would like to cite "industry standards" around this practice rather than just putting the edict out that this is not acceptable. She'd like to have solid reasons why not to do this. (HIPAA, etc.) I'm wondering if anyone has any online references you can share that address this issue directly. As always, thanks for your help!>>

This seems a bit thorny. The internal practice of the organization
was that the staff had to (were encouraged to?) use their home email
accounts for work purposes. Of course, Gavin is completely right -
this shouldn't have happened in the first place. But since it did...

This seems to me like much more of a carrot situation than a stick -
they were trying to get their work done, needed to use workarounds,
and now, they are going to get their hands slapped for the
workarounds? Even telling people that this isn't acceptable for yadda
yadda reason is still kind of like getting one's hand slapped. Um,
not so nice for staff morale, I think. Plus, they have the additional
work of telling people to use their work addresses after all,
changing whatever systems they have gotten used to that includes
their home email, etc.

I'd say, be really nice to them. Give them good info, and some nice
incentives to switch back (first 5 people to completely switch get
free lunch at the local eatery.)

My $.02

Peace,
Michelle
-------------------
Michelle Murrain
michelle%40murrain.net">michellemurrain.net

Blogs: http://www.metacentricities.com
http://www.zenofnptech.org

"One doesn't discover new lands without consenting to lose sight of
the shore for a very long time."; -- Andr�s Gide

Messages in this topic (0) Reply (via web post) | Start a new topic

.

-----original message-----
>>We have a client with an interesting internal email problem. Because of the amount of spam staff receive on their work email account, they have switched to using their home email accounts to use for work purposes. The client will be installing Barracuda at the beginning of the next fiscal year...>;>

<snip>;

I'm not sure when the client's new fiscal year will start, but I think one of the incentives for staff to stop using personal email accounts would be for the organization to start filtering spam sooner using a spam filtering service.

Of course there are budgetary constraints, and I realize that a spam filtering service is an additional immediate and recurring cost but the cost to handle potential problems with personal email accounts will likely be much higher.

Spam filtering services can be implemented relatively quickly and can be discontinued when the Barracuda appliance is installed.

One spam filtering service I would encourage you to investigate is Electric Embers. No relationship with them, but they are non-profit oriented and host some several other email lists I subscribe to.

Details: http://electricembers.net/

Disclosure:

Although I manage a Barracuda spam appliance at the organization I'm with, each organization is different and the price point for spam filtering services was not cost effective for us. Ping me offline if you or your client have questions about the Barracuda.

--

Romel

Messages in this topic (0) Reply (via web post) | Start a new topic

.