Guest Post: Six Risks from Not Using Internet Monitoring Software
When you start talking about Internet monitoring software, most times you see folks divide up into two camps. The first is all for it, convinced that the company must watch what users are doing at all times to catch those who violate policy. The second considers monitoring as an infringement on their privacy, and that any Internet monitoring software can only serve to make employees feel even less trusted.
The fact is that both of these camps are in the extreme, if opposite, and both are wrong. Internet monitoring software is an effective and invaluable solution for protecting users from many of the dangers associated with accessing the Internet. The protections that Internet monitoring software offers can all be deployed without having to log a single user’s web access. Sure, Internet monitoring software can be used to maintain logs and provide reports of a user’s surfing if you wish, but that is something a company would choose to do for a specific issue; not a part of the protections that they so desperately need. With all the threats present on the Internet today, let’s look at the top six risks to your company that come about from not using Internet monitoring software:
1. Malware
Malware can cause all kinds of problems if it infects a machine, from lost productivity and downtime, to larger compromises that back door programs can provide to attackers. Malware can spread from machine to machine, and once it gains a foothold within a company, it can take down an entire site whether by infecting all the other machines, or simply because the network team takes a location down to prevent the infection from spreading to other sites. Users can be exposed to malware by downloads of files, or by accessing compromised sites. Internet monitoring software can block access to sites known to be hosting malware, and can also scan all file downloads to be sure they are safe.
2. Time wasted
I will never advocate that you cut users off from personal access to the Internet. As long as the office can interrupt their evenings or weekends, some personal use should be tolerated in the interests of fairness and morale. But the Internet can also be a huge time sink, and many users can hit a site with the intention of no more than a quick check-in, to find 45 minutes later that they are late for a meeting. Internet monitoring software can help control access to non-business sites, and limit the time spent surfing for fun.
3. Bandwidth consumption
Internet monitoring software can help to control access to high-bandwidth services; ensuring that there is enough bandwidth available for customers to hit your website and for email to flow. You don’t want your ecommerce site to be slow to respond because too many users are streaming movies.
4. Data leakage
Whether it’s Wikileaks, peer-to-peer networking, personal web mail services, or your competitor’s portal, you don’t want users forwarding or posting confidential information from your business to outside sites. Internet monitoring software can block access to these services, helping to enforce policy and keeping sensitive information inside.
5. Legal action
A user on your network downloads a pirated movie from one of those sites. The MPAA tracks the download to your network. Who do you think is going to be the target of a settlement offer, or worse, a lawsuit? What users do on their own time and with their own equipment is their business; what they do with the company’s computer on the company’s network is yours. Internet monitoring software can prevent users from stepping on the wrong side of copyright while on the clock, which protects the business from any consequences.
6. HR issues
Again, what a user does at home is their own concern, but there are plenty of things on the web that have no reason for a user to access while at the office. Some users are more sensitive to questionable content than others, and the last thing anyone wants is for one employee to feel threatened or offended by the actions of another. Internet monitoring software can protect users from accidentally clicking the wrong link, which protects everyone from having a sit down with HR.
Remember, using Internet monitoring software doesn’t mean you have to be big brother or play the role of the Internet police officer to protect your users. Internet monitoring software can provide protections while maintaining the anonymity of your users and keeping their individual web browsing habits private. Adding these protections makes good business sense, and can be done without making users think that they are untrusted, or being spied upon. Look at Internet monitoring software as the next layer of your defense in depth strategy.
This guest post was provided by Casper Manes on behalf of GFI Software Ltd. GFI is a leading software developer that provides a single source for network administrators to address their network security, content security and messaging needs. Learn more about why you need Internet monitoring software.
All product and company names herein may be trademarks of their respective owners.
Blame it on Amazon?
With Sony’s PlayStation Network offline since April 20 following what is being called the second largest breach in history, there has been plenty of time for rumours, speculation, and red herrings. The latest is Bloomberg’s report,
“Hackers using an alias signed up to rent a server through Amazon’s EC2 service and launched the attack from there, said the person, who requested anonymity because the information is confidential. The account has been shut down, the person said.”
While it’s mildly interesting that criminals choose to use Amazon servers, it’s not really surprising. Amazon Web Services offers great services at good prices, and attracts a wide range of customers – individuals, small business, and large enterprise all leverage their services. Given the alleged sophistication of the attack, EC2 is simply an obvious choice.
While a shift in attention to Amazon might be good for Sony, we should expect criminals to use EC2 like everyone else. Criminals also use rental vehicles, disposable mobile phones, and WiFi hotspots. They probably even purchase their computers the same places we do.
The Sony PlayStation Network data exposure has two causes:
- Security deficiencies at Sony. While we don’t know what the specific weaknesses were, the fact that information on PlayStation Network customers – including credit card information — was stolen across the Internet would make it pretty difficult for Sony to convince us that they had appropriate security controls in place.
- The criminals. Let us not forget that Sony was the victim of a crime.
Like TJ Max, the Sony security breach should be a wake-up call. Consumers often feel safer dealing with larger, more established companies. But it appears that some of them don’t have security right yet.
We also need to understand that tracking down cyber criminals is becoming increasingly difficult. Cloud-based services aren’t anonymous – while false identities can be used, criminals still need to connect to the cloud-based service from somewhere. However, with the widespread proliferation of free WiFi hotspots and disposable mobile phones and data devices, we need to accept the fact that tracing an attack back to the source may not be possible and that more traditional investigation methods – like following the money trail – remain important and techniques must be constantly updated.
I’m sick of HBGary
I’ll admit it. I spoke about the HBGary hacks during a guest lecture I gave at Carleton University last week. But in all honesty I’m getting sick and tired of hearing about them. Journalists keep focusing on the wrong issues and people need to understand that many decisions – even in so-called security companies — are often not made by security professionals. Just because the company employs “security experts” doesn’t mean they consult them on internal matters. In my experience the opposite is often the case and the shoemaker’s children proverb applies.
From a technical perspective, the root cause of the initial security breach was poor software design, poor implementation, and inadequate testing. It’s an industry-wide problem that won’t change until customers demand better software and are willing to pay for it. Things got worse because the folks at HBGary appear to have ignored basic and well understood best practices with regard to passwords.
However, let’s not ignore the other root cause. While it doesn’t justify criminal behaviour, let us not forget that HBGary, in an apparent attempt to obtain publicity for themselves, allegedly did the cyber equivalent of visiting the nearest biker hangout to announce, “Just want to let you know we’re going to screw with you in the media tomorrow, but don’t worry, we’re only going to screw with you a bit.” Or, if you prefer a different analogy, they kicked the hornet’s nest without wearing the customary protective equipment.
As security pros dealing with people allegedly responsible for hacking and denial of service attacks on major companies, HBGary must have expected probes of their systems and at minimum a distributed denial of service attack. They reportedly kicked the hornet’s nest deliberately and intentionally. It leaves me wondering if becoming a victim was part of their publicity strategy. Getting yourself hacked would certainly be an bold publicity stunt for a security company, but it wouldn’t be the stupidest thing I’ve seen either.
Feds seek new ways to bypass encryption
CNET has an interesting article today entitled, Feds seek new ways to bypass encryption. While Declan included some interesting tidbits in his article, he completely missed a key point essential to the intensifying debate.
Any mechanism that allows the Government easier access allows criminals and foreign Governments easier access as well. The point of hard drive encryption, to name one example, is that it protects sensitive information if someone steals your computer. Whether that someone is a junkie, stalker, unethical competitor, or law enforcement officer with a warrant is irrelevant from a technical security perspective.
The issue of key escrow for “lawful” access will certainly be raised again and the answer is simple: Given the security breaches that many governments have suffered, they have proven themselves incapable of protecting their own sensitive information. Why should we trust them with more?
Businesses must ensure that they retain the ability to access encrypted information in the event that the user leaves or forgets their password. In that instance, the law enforcement solution is to serve a court order on company.
Personal computers, smart phones, and similar devices are becoming increasingly that — personal. They have become an extension of ourselves. Law enforcement agencies need to come to terms with this new reality and understand that their access will continue to decline. The cost of gaining access to such devices will continue to increase exponentially until it is impractical for all but the most serious investigations. The tricks Declan outlined in this article will become less effective as criminals quickly learn about them and implement countermeasures.
Back when I studied Criminology I learned that the average IQ of inmates was just slightly lower than the overall community average and that many criminologists believed it was because people with slightly lower than average intelligence were more likely to commit the type of crimes that could land one in jail. Twenty years of experience suggests another scenario: We’re much better at catching and convicting criminals with below average IQs.
Organized crime and terrorists have employed countermeasures such as encryption for decades. But what what appears to really make some law enforcement types uncomfortable is that you, me, and dumb criminals can now do it too.
The Self-Serve Emergency Room
itBusiness.ca has an interesting article and video on the Self-Serve ER Kiosk.
It’s an interesting concept, and it makes some sense. But it also begs a question: Why aren’t we allowing pharmacists to deal with non-urgent issues?
It makes little sense, especially for someone without a GP, to go to an Emergency Room or wait for hours at a walk-in clinic for a condition such as a simple infection. We have experts at our local pharmacy counter with years of training and a knowledge of drugs that far exceeds most physicians. In many countries they’re allowed to write prescriptions. Why not not in Canada?
Kiosks are cool, and they have a role, but let’s leverage the professionals already out there first.
Keep in Touch
Kudos
Recent Comments