Anti-virus software isn't the only computer security tool

No matter what network restrictions you put in place or what security policy you try to implement you can never protect the user against themselves. With social networks growing there is a rise in link sharing and email forwarding, not to mention drive by downloads and iframe trickery and the like that sit quietly on infected web pages. You can lock a whole network down as tight as you can, but you can never protect yourself fully from an uneducated user. Social engineering is still the biggest risk (in my opinion) to most networks, the more users the more risk. I guess my point here is that an educated user that can be trusted not to abuse policies and privileges is the best security tool.

kapheroph - great comment. So how do we educate users. I deal with issues mentioned in the article all the time. It would be great if there was a way for people to learn before falling victim. I'm open for ideas.

@techVision Unfortunately that depends on your user base and what you need to gain by external network access (the internet) as there is no magical answer. Every organisation needs a different set of guidelines depending on their needs. For some organisations the best way could to be to hold an official meeting and drill them with rules and regulations. But this will only impact on the few that are genuinely interested. The best way in my opinion is to get those interested people together to gain a collective knowledge base and make sure that filters down through to the rest of the employees. Employees are more likely to listen and take notice of other workmates rather than than the boss or some random person standing out the front talking. I'm running out room sorry, feel free to mail me if you want more info as I could talk about this all day and as it was I had to cut some out. But the main point is good workplace / departmental communication and respect for the workplace.