If you can’t stop it, at least make it strong
You can’t stop staff from signing up on their own, but you can make sure the passwords are strong.
(Illustrative scenario, not a real incident)
At this twenty-person ad agency,the rule is written clearly:use only approved tools.
Xiao Yu, a designer,often visits an overseas stock-asset site.He signed up with his company email,using the password he always uses.
Later, that site was reported breached.Xiao Yu’s company email and passwordshowed up together on the leaked list.
The company only found outwhen another of Xiao Yu’s accounts started acting strangely.Until then, IT had no ideaXiao Yu was using that site at all.
The stricter the rules,the less people volunteer.
I used to think a ban would keep things out.Later I realizeda ban only drives things deeper into hiding.
When staff go looking for tools,mostly they just want to get their work done.If you can’t stop it, take a step back and ask:are these accounts at least safe?Does the company at least know they exist?
Zhuangzi said: “The empty room fills with light.”Clear a little space in the heart, and light can come in.
Rules are the same.Leave a door open for telling the truth,and problems will walk out on their own.
- Publish the list of approved tools, and how to request new ones.
- Invite everyone to report the tools they use, with no blame.
- Anything registered with a company email gets, at minimum, a strong, unique password.