Companies should move away from a generic web use policy and monitor actions for access.