What would you think of a 'watchdog' policy, where if someone wants to use Facebook at work, that a member of IT Security be 'friended\following' so that there can be oversight?
I can't help but feel this misses the point slightly. Firstly, although not necessarily true of Twitter, other social networks such as Facebook/LinkedIn offer much greater privacy options such that I, your employee, could trivially hide my misdemeanors from the HR watcher.
The second issue I wanted to raise was the fact you've tied having a facebook/twitter account to "at work". Facebook and twitter can easily be used both at home on company accounts and at home on home accounts to damaging effect.
For example, the following scenarios aren't covered by what you propose:
- Discussing customers/clients between friends/colleagues on personal facebook accounts from home.
- Responding to queries from competitors on LinkedIn.
- Making unflattering remarks about your co-workers on a personal twitter account.
And so on. I guess the point I'm trying to get across is that whilst use at work provides a slight additional pure-IT risk (malicious code), inappropriate use of social networks by employees could put your business at risk whether or not you ultimately decide to allow it in work.
If these are company twitter/facebook accounts you're proposing, or ones especially created for individuals for the company, then whilst they may belong to the individual in a sense, they are still company resources that should be monitored appropriately. You shouldn't need to have to follow the account to monitor it; any sufficiently authorised member should be able to log in and audit the account.
Ultimately, I think if there is a risk to the business from corporate espionage or damaging coverage on social networks (due to say, being a high profile client) I'd be inclined to implement some form of safety training anyway. I've worked at two organisations that had such courses for the more general "using the internet" scenario.
I'd also say check your employment contracts to ensure they include the standard clauses about protecting intellectual property and business image - most do.
To be clear: I'm not actually saying don't use these resources - lets face it, at least someone in your organisation if it is of any size will probably be controlling the twitter account. They're a great resource for promotion.
