What is your default umask set to? Did you run into any problem setting a stricter default umask?
027 on most systems. This gives a default of rw-,r--,--- which is suitable for me. I have seen some environments use 077, but unless the users are very limited in what the can do (so why give them a shell at all?) or experienced it just causes helpdesk/IT issues.