> I would argue that's it is irresponsible not to
Please do so. Please present a compelling argument for why, in the general case, it is irresponsible not to spy on your employees.
Please do so. Please present a compelling argument for why, in the general case, it is irresponsible not to spy on your employees.
Now we can all debate the value of AV scanning in general (I'm on the probably-not-worth-it-and-way-too-risky side), but if we attribute any kind of value to AV scanning (it might help with wide-spread attacks at the cost of facilitating targeted attacks), then being able to peek into SSL tunnels is a requirement for it to provide any kind of its proposed value.
Depending on your users level of knowledge and your updating procedure, not running AV might indeed be considered irresponsible.
If your systems are somewhat unpatched and your users oblivious to threats, then you're much more likely to be owned by and wide-spread malvertising and email spam attack (both of which AV actually protect against) than you're likely to be the victim of a targeted attack (which AV actually makes easier to pull off) just by virtue of the former being much more common than the latter.
> How can you claim to protect customer data or respect customer privacy without looking at the data flowing out the front door?
Because others are customer service reps.
Because how do you do a job without the data required to do a job?
There's no squaring the circle here. You can not lay obligations on corporations to secure their stuff, but not permit them to have any tools that allow them to actually implement that security, and expect security to be the result. You can't assume that all employees of all companies everywhere that deal with sensitive information are solely staffed by angels, especially in light of the fact that the very fact that they deal with sensitive information can attract people who deceptively pose as employees long enough to get their hands on this information.
Murder and manslaughter are illegal!