[cyclmpc]

You can never make everyone happy, especially the general public that do not understand IT security. I have learned not to waste my time with trying to win over those people. As long as your IT team understands and has a good relationship with the head of management in general, this should not be an issue. You have to draw the line somewhere. If your users do not like it, they can work elsewhere. I do not mean to sound like a hardliner, but the public has to assume that you are in IT for your IT experience, whether you can properly communicate it in a method that makes their non-IT heads understand it or not.

Let me give you an example that really hammered home the need for basic p/w on our devices. Over the course of time, people will lose their BB. It's going to happen. No two ways about it. Way back in the day, most of our users were very against the need for a p/w. All sorts of excuses were given, from it takes too long, to it reduces my efficiency, to I have too many p/w to remember, etcxxx8230;all ridiculous. A person lost their device. Within an hour of losing the device, people around our national company as well as other users on the personxxx8217;s contacts began receiving emails of a sexual nature as well as generally insulting emails. None of the emails were of an overly explicit nature, but it was enough to have corporate respond to HR with the content of the messages. As the next hour went, the emails began to ramp up their rhetoric and sexual nature. At that point, the device was xxx8220;killedxxx8221;. The person that lost their device had to send out emails of apology and take care of their personal accounts as they had left account #xxx8217;s and personal PINxxx8217;s there. Our company tried to sell that off as a xxx8220;once in blue moonxxx8221; issue. Within two weeks, a corporate person lost theirs and it happened all over again. Policy drawn up, policy enforced.

I actually do not think that reference to having equipment confiscated as being Cold War-like. We have similar verbiage to the hardware people use, to the sites they surf, to the work they do on the software we provide. The big deal is you have to secure things to the lowest common denominator. Just because you have use of the equipment, does not mean you have the right to abuse it.

Just my 2 cents. Good luck in finding your balance. It definitely is a hard thing to do and something you have to continuously review to make sure you have the right balance for your environment.