With Dean Drako, co-founder, president and CEO Barracuda Networks. Drako is responsible for overall corporate strategic direction and product development. The company recently surveyed IT professionals regarding their use of Web filters to restrict employees' Internet access.
Question: Why did Barracuda conduct this latest survey?
Drako: We entered the Web filtering business with the Barracuda Web filter a couple of years ago. ... We're seeing a lot of trends in the space - a lot of changes in what customers want and what they're looking for, and we needed to get more formal in order to get some data.
Question: Whom did you survey? What did you find?
Drako: We surveyed 228 IT professionals, and asked what their top reasons are for restricting access to Web surfing in their respective environments. Seventy percent of them said one of the top two things was blocking spyware and viruses. Fifty-two percent said that the key thing was productivity drain. Bandwidth concerns and liability issues came up as the next two reasons.
Question: Did that match what you thought you'd find?
Drako: It was kind of interesting. Our general feel in talking to customers was - we didn't hear that virus and spyware blocking was the top thing. So that was kind of contrary to what we had been experiencing in the market. When we talk to customers, the key thing that they always talk about is liability issues. Very rarely did we get a customer who came in and said, "Hey, we're having a productivity issue. My employees are spending too much time goofing around and I need to stop them." It was just interesting that when they were asked in a survey what their issues were, they spoke differently than they do when they're actually making a purchase.
Question: Did anything else from the survey results stand out?
Drako: We also did some research into where social networking is fitting into the Web filtering space, because in the last year we've seen a lot more interest from our customers in controlling social networking, in blocking the viruses on social networking sites but not the sites themselves, in blocking portions of the sites but not all of them. Customers are asking for a lot of different things around the social networking sites...
We found that about 50 percent of those using Web filtering are actually blocking some form of social networking, and about 44 percent of that is MySpace blocking. We also found significant growth in the number of people blocking Facebook, around 26 percent. ... What was interesting though is that half of the people who were not blocking [social networking] at the time said that they were monitoring it and would probably be implementing some kind of controls (blocks) in the next six months.
Question: We saw that the results indicated more companies are currently blocking MySpace than are blocking Facebook. Do you know why?
Drako: We believe a significant portion of that is due to awareness at this point. MySpace is just more well-known.
Question: You said that some survey respondents were concerned about liability issues. Were they specific about what those issues typically are?
Drako: They're concerned about people being exposed to explicit images or adult images over the shoulder of someone else and being offended and creating an HR problem. That's the big liability issue. They're concerned about somebody accidently going to a Web site and being inundated with a thousand pornographic pop-ups and getting offended and blaming the company ... That would seem to be the two concerns in the corporate world. Along with adult content concerns, there are also concerns about hate crimes and explicit racial stuff that's out there as well...
Question: Are there intermediate controls (other than outright blocks) that people can use?
Drako: One of the more interesting controls we helped implement recently was one that allowed each employee 20 minutes per day of surfing news and sports and social networking sites. If they go over 20 minutes, they're blocked. People are getting relatively sophisticated in their queries about what they're asking for, so we wanted to do the survey and kind of understand a little more what people are trying to do...
Some people will actually not block. Instead, what they'll do is flash up a warning that says, "Warning - You are going to a social networking site. This violates our policy. Click here to proceed anyway." Some people are requiring a password to get through a block. Some people are not doing any blocking. They're just publishing a policy that says, "You are not allowed to go to the following kinds of sites. And, by the way, we're recording all the sites you visit. We will generate reports, and if you are in violation of policy, your manager will be speaking with you."
There's a whole continuum of solutions that people are employing based on their respective environments. And different companies have different employee characteristics. If you're a law firm with 15 lawyers, you probably have a pretty responsible crowd and you don't need to get extremely strict about what you're doing, but you might want to do something to avoid issues of spyware and viruses. If you have a lot of hourly employees who are paid minimum wage, you might need to employ different kinds of controls.