Keylogging as a work security measure yes or no?

Surfer

Surfer

Surfer

Soldato
Joined
31 Dec 2005
Posts
11,179
Location
Glasgow
Do you think this is a viable means of monitoring employees? ie keylogger on all the work pcs

Note: I'm not asking if its legal or not (it is). Just asking what you think the pros and cons would be.


Im not sure why its needed if your company already monitors all emails, and logs website access (and blocks websites as well) and can also access any documents personal or otherwise on user drives.

Why is it needed?


Secondly do you need to advise your employees *beforehand* that the software is being used to monitor them OR do you just need to give a generic response along the lines of "employee work is monitored" etc

thanks :D
 
i worded the question deliberately btw - (im not the one doing this)



edit: whoops my mistake :D the program its part of sophos haha oh dear... stupid email ive sent to IT support then lol....guess i'm just paranoid :o
 
Last edited:
How long is it going to take you to sit and read through all of the logs for all of your employees?
What sort of work do your employees do? If it's something like graphic design or CAD or something that can be done graphically, they might not do a lot of typing and you might be ok. But if they spend 7-8 hours a day typing, then you'll have masses of stuff to read through for each employee.


Just stick with the normal blocking of sites and restricted admin rights on their PCs.
 
Last edited:
Since when did Sophos have keylogging as part of it's security suite. Why are you under the impression it does?

Do not need keylogging as email/IM/HTTP(S)/File Data etc etc should be monitored anyway. Why would you be paranoid about doing work at work?

Prepare to be absolutely ridiculed by IT if you sent an email about this though. A user that is worse than a clueless user is a user who thinks they know about IT.
 
iMonitor is both a employee monitoring package and a part of sophos - hence the confusion

generally because accessing email, bank accounts etc logins would be captured no?
 
Oh, so you ARE the employee?

I hope you didnt make this post from your work PC? P45 in the post? :p
 
I'd just like to pipe in and say that it's completely legal, if the employer has a "no expectation of privacy" clause in the IT-usage part of your contract or company policy.
 
its a bit dubious - I don't see that many benefits to the employer, most of the benefits would be legally and ethically dubious - such as gmail and facebook login info etc...

company e-mails, office communicator, browsing history, documents stored on company systems can already be monitored without the need for key logging. Websites can be restricted, USB ports can be removed...

given that key logging would consume resources and generate data that needs to be stored, maintained and presumably searched for whatever purpose from time to time I'd fail to see what benefits could be derived from doing so that would outweigh the costs - not only the direct costs but also the indirect ones such as employees finding out about it and it contributing negatively towards the companies relationship with them...
 
dowie said:
its a bit dubious - I don't see that many benefits to the employer, most of the benefits would be legally and ethically dubious - such as gmail and facebook login info etc...
Click to expand...

There are no ethical or legal implications.

Employee signs contract that will also, presumably, mandate compliance with the companies IT usage policies.

You have no human right to access personal resources on corporate IT systems and any such access can be entirely monitored. Many HTTP proxies can content inspect even HTTPS connections and log the information contained within.
 
Last edited:
Sin_Chase said:
There are no ethical or legal implications.

Employee signs contract that will also, presumably, mandate compliance with the companies IT usage policies.

You have no human right to access personal resources on corporate IT systems and any such access can be entirely monitored. Many HTTP proxies can content inspect even HTTPS connections and log the information contained within.
Click to expand...

Incorrect.
SSL certificates would have to be obtained to perform a MITM on https, otherwise the user would know that the certificates is fake.
Same with SSH, the RSA key would change if a MITM attack is being performed. The only thing you can gather is who are you communicating to.
 
You must log in or register to reply here.
Back
Top Bottom