Advertisement
If you have a new account but are having problems posting or verifying your account, please email us on hello@boards.ie for help. Thanks :)
Hello all! Please ensure that you are posting a new thread or question in the appropriate forum. The Feedback forum is overwhelmed with questions that are having to be moved elsewhere. If you need help to verify your account contact hello@boards.ie

Help! Desktop monitoring program

Options
  • 17-04-2012 11:10am
    #1
    Irene818
    Registered Users Posts: 19 ✭


    I am looking for monitoring software that will allow me to see what applications are used by the employees, for how long and to review the log on and log off sessions by them. Has anyone had experience with such sort of software?


Comments

  • Options
    #2
    900913
    Registered Users Posts: 367 ✭✭900913


    Link:
    http://www.os-monitor.com/

    More info at 2012 Employee Monitoring Software Comparisons and Reviews


  • Options
    #3
    LoLth
    Moderators, Technology & Internet Moderators Posts: 10,339 Mod ✭✭✭✭LoLth


    Be very careful here. ireland is not the US and Europe has a lot more legislation concerning the right to privacy and a qhole working group exploring privacy in the workplace as well as establishing that not only to employees have a right to the expectation of privacy but also that given the online nature of modern life, employees are expected to be allowed to access personal information online from their workplace if the access is available (ie: if they have internet access to gmail, expect them to access it. if you dont want them to access it, block the site).

    that software specifically states that it monitors and records chats/email
    Logs AIM/ICQ/Yahoo/MSN/Skype/Google Talk conversation

    thats almost certainly going to be private conversations (protected by a user/pass combination that you as an employer have no right to know) and recording it without your employee's knowledge could open you up to civil prosecution and perhaps even criminal.

    the software makes a point of claiming silent installation and monitoring... you cannot monitor your employees without them knowing and you had better have an acceptable use policy in place that your employees have agreed to upon joining the company.

    I am not a solicitor or a legal-type of any kind so before you start exploring technical solutions consult a solicitor (employment law) and make sure you know what is and is not allowed before you do anything.


  • Options
    #4
    BaconZombie
    Registered Users Posts: 8,811 ✭✭✭BaconZombie


    Great post LoLth, was going to post the same last night.

    Even if you have an "acceptable use policy in place" does not get you out of following Irish and EU laws.
    There are some rights you can't sign away, and I'm not sure if an AUP has been tested in court in Ireland yet.

    I'd say work VERY closely with your companies Legal & Human Remains Resource to make sure you are only monitoring what you allowed to and that only authorized people can view the logs and know how/when they can use the information from them.

    Edit:

    Also if you want to monitor encrypted traffic you will have to be doing a MiTM attack on all connects, this can be costly if you do not want to effect speed to much and it also opening another huge can of worms....
    LoLth wrote: »
    Be very careful here. ireland is not the US and Europe has a lot more legislation concerning the right to privacy and a qhole working group exploring privacy in the workplace as well as establishing that not only to employees have a right to the expectation of privacy but also that given the online nature of modern life, employees are expected to be allowed to access personal information online from their workplace if the access is available (ie: if they have internet access to gmail, expect them to access it. if you dont want them to access it, block the site).

    that software specifically states that it monitors and records chats/email


    thats almost certainly going to be private conversations (protected by a user/pass combination that you as an employer have no right to know) and recording it without your employee's knowledge could open you up to civil prosecution and perhaps even criminal.

    the software makes a point of claiming silent installation and monitoring... you cannot monitor your employees without them knowing and you had better have an acceptable use policy in place that your employees have agreed to upon joining the company.

    I am not a solicitor or a legal-type of any kind so before you start exploring technical solutions consult a solicitor (employment law) and make sure you know what is and is not allowed before you do anything.


  • Options
    #5
    LoLth
    Moderators, Technology & Internet Moderators Posts: 10,339 Mod ✭✭✭✭LoLth


    BaconZombie wrote: »
    Even if you have an "acceptable use policy in place" does not get you out of following Irish and EU laws.
    There are some rights you can't sign away, and I'm not sure if an AUP has been tested in court in Ireland yet.

    you're right. the AUP hasnt been tested but the ECHR working group 42 report (I think its 42, the one on privacy it could be 8 ...) did not have much faith in the legality of AUPs as they are not a contract between equals. If they are part of the starting contract then the employee to be can decide if they accept the constraints before joining the workforce, however, if an AUP is put in place after they have commenced working the employer could be leaving themselves liable for a "constructive dismissal" civil suit if the employee refuses to accept the terms and ends up being let go because they cant use the computer and so cant do their job.
    I'd say work VERY closely with your companies Legal & Human Remains Resource to make sure you are only monitoring what you allowed to and that only authorized people can view the logs and know how/when they can use the information from them.

    as BZ says and an alternate policy is to block and not monitor. If you dont want users using IM/Google chat there are proxy servers (ISA for example) that can filter at an application level as well as by port/destination address. Worried about a user sending a corporate secret through gmail or other webmail application? block access to webmail or use file management software to control what can and cant be done with documents of particular classifications. Want to stop people chatting on IM, block its use. If you monitor user activity and get caught with a screenshot of someone's online bank password recovery phrase, or a printout of an email marked "private" or a saved version of a users online email that is usually password protected (and therefore expected to be private) its the company that is in the wrong and the IT/HR manager for allowing it and you can bet that any employee that gets reprimanded through the use of covert monitoring is going to be a disgruntled employee and no matter what you do, you cant block smartphones with cameras built in.


  • Options
    #6
    Irene818
    Registered Users Posts: 19 ✭Irene818


    I am planning to expand my business in Europe and I agree with you that it is essential to know EU employment laws beforehand. The staff will definitely be notified that they will be monitored. Blocking is not a good option for me because some "dangerous" websites are needed to be visited in billing hours.
    900913 wrote: »
    Link:
    http://www.os-monitor.com/

    More info at 2012 Employee Monitoring Software Comparisons and Reviews
    thanks for the list! I actually found Praetorian Guard in the net and decided to give it a try. I don't think it is a very popular tool but it seems that it has all the features that I need. We'll see how it works.


  • Advertisement
  • Options
    #7
    BaconZombie
    Registered Users Posts: 8,811 ✭✭✭BaconZombie


    If you have any system or staff working out of France, Russia or Germany you will have ALOT of issue with Workers Councils if you try and install any of these kind of monitoring solutions.
    Irene818 wrote: »
    I am planning to expand my business in Europe and I agree with you that it is essential to know EU employment laws beforehand. The staff will definitely be notified that they will be monitored. Blocking is not a good option for me because some "dangerous" websites are needed to be visited in billing hours.


    thanks for the list! I actually found Praetorian Guard in the net and decided to give it a try. I don't think it is a very popular tool but it seems that it has all the features that I need. We'll see how it works.


  • Options
    #8
    LoLth
    Moderators, Technology & Internet Moderators Posts: 10,339 Mod ✭✭✭✭LoLth


    also, not just the employment laws but the privacy laws. There is an overlap (privacy in the workplace etc) but "expectation of privacy" is not necessarily dealt with in employment law but is referenced in Privacy law and in some countries its not something that can be signed away as BZ already mentioned.

    As for blocking, you could block "dangerous" site (lets say facebook) generally and then have a group with permission to access it for those users that have a valid work reason for doing so - and you can have access to the group require a request from the individual's team leader - just as an example as I have no idea what your business model is. Then, if a user spends all day on facebook to his/her friends and the task at hand doesnt get done, its the team leader's responsibility. you can be sure the team leader will ensure that no-one on their team slacks off on Facebook.


  • Options
    #9
    infodox
    Registered Users Posts: 126 ✭✭infodox


    Slightly off topic, but what is the legality of selling/writing such software? Monitoring/Remote Control software can easily be abused as a trojan by malicious persons, and a lot of the ""net nanny"" software out there HAS been used by criminals in the past with slight modifications.

    I had been wondering for a while how legal it is to sell remote access/monitoring software that has configurable options for "run hidden" etc, wanting to make sure it was 100% legit before going into business. I figure it would likely be seen in a bad light though, esp. given current circumstances.


  • Options
    #10
    syklops
    Closed Accounts Posts: 18,969 ✭✭✭✭syklops


    infodox wrote: »
    Slightly off topic, but what is the legality of selling/writing such software? Monitoring/Remote Control software can easily be abused as a trojan by malicious persons, and a lot of the ""net nanny"" software out there HAS been used by criminals in the past with slight modifications.

    I had been wondering for a while how legal it is to sell remote access/monitoring software that has configurable options for "run hidden" etc, wanting to make sure it was 100% legit before going into business. I figure it would likely be seen in a bad light though, esp. given current circumstances.

    Is it not the same as the legality of making or selling crowbars. So long as you dont market it as "Guaranteed to smash any lock and get you into any house", the vendor needn't torry too much.

    Core Impact markets its software to professionals. Its price also puts it out of the market for petty criminals(or so they say).

    Im sure in the license agreement, you agree not to break any privacy laws in your country and Core Security is not responsible for anything you do. If I break into the central bank, and kill some workers in there using only a Draper hammer and a screwdriver, do you blame the manufacturers? Do you blame Woodies for having these tools available to the public?


  • Options
    #11
    LoLth
    Moderators, Technology & Internet Moderators Posts: 10,339 Mod ✭✭✭✭LoLth


    syklops wrote: »
    Is it not the same as the legality of making or selling crowbars. So long as you dont market it as "Guaranteed to smash any lock and get you into any house", the vendor needn't torry too much.

    I think thats the generally accepted thinking on the subject
    Core Impact markets its software to professionals. Its price also puts it out of the market for petty criminals(or so they say).

    I have to laugh at that... most criminals that want to use Core Impact will either pirate it or can afford it. The vast majority of security professionals that dont have the backing of a large corporation cant afford the licensing and so are less adroit with its use than the criminals... imho, metasploit has it right. free to use version has everything you need, fancy bits require a license but dont really affect functionality, just reporting. Is Saint still free?
    Im sure in the license agreement, you agree not to break any privacy laws in your country and Core Security is not responsible for anything you do. If I break into the central bank, and kill some workers in there using only a Draper hammer and a screwdriver, do you blame the manufacturers? Do you blame Woodies for having these tools available to the public?

    At the end of 2011 there was talk of a government vote to ban "dual use" tools, both posession and sale would be illegal so yes, the government would indeed blame woodies as well as anyone that bought the hammer in the first place. I rarely use smilies beyond the standard happy or big grin but this kind of thinking definitely calls for use of this one :rolleyes:


  • Advertisement
Advertisement