How does this one sit with you? I know a department head who tolerates it when certain VIPs bypass security checkpoints by using analog lines. ("I need it for my fax machine," cry the VIPs.) Sure, it's in the name of confidentiality, but it's really about accountability. "I don't want anyone knowing about my porn-surfing and stock trades."

With the head of IT acting so permissive, can you honestly imagine his IT department being treated as a strategic unit? Instead, it will be treated as the purveyor and maintainer of all things toy-like. This, too, is crazy and irresponsible. Think Napster. Think Johnny Castaway screensavers. Think BonziBuddy. What the hell are these doing on any business network?

The stakes here aren't small. Toys can easily cause a technician to waste an hour or two troubleshooting a nonbusiness problem. And because the economies of scale on business networks can turn into the unruliness of scale, this type of occurrence can represent hundreds of wasted technician hours. Even "goodwill" gestures, like disabling a URL filter for a VIP to pick up her Webmail, have deeper consequences, like "MyNakedWife." More wasted hours.

The dollar consequences of a poorly written, malfunctioning screensaver are no less real than the dollar consequences of the scofflaw dial-up PC or Webmail user getting Trojaned. It's not about the technology.

Even if it were about the technology, technology can't keep up. Look at the latest: "GoToMyPC.com." Think of it as the Napster of remote control. Your user PC initiates an outgoing, permitted connection through your firewall, contacts a broker at GoToMyPC.com, allowing a remote-control connection with a user "somewhere on the Internet." How convenient. How terrifying.

Does your AUP spell out that putting your user PC security in the hands of an untrusted third party is totally unacceptable? It had better, or your users will be flocking to GoToMyPC.com. After all, it's convenient.

For many of these things, prevention begins at the desktop. If users can't download and install, they can't do anything stupid, risky, illegal or counterproductive. There's no good business reason for most workers not to have a locked-down desktop and browser.

It's not about the technology. It's about good old-fashioned business negotiation. It's about selling your AUP -- and built-in consequences -- aggressively to upper management. It's about being seen as a critical part of the bottom line and being willing to take the heat when people whine about losing their toys. It's about communication, not telecommunication. Sure, we talk to upper management, but are we communicating? A mentor of mine once said, "When you get to the point where you're talking without communicating, you've lost the battle." Amen.