RE: Securing workstations from IT guys

[Big Joe Jenkins <swarzkopf () legolas sinnerz us>]

No. Company property is exactly that- even more so if your HR/infosec 
folks are bright enough to force all employees to sign an acceptible use 
policy/statement of non-privacy stating such at their hire.

On Wed, 28 Nov 2007, Petter Bruland wrote:

> I think installing key logger software is stepping over the line.
> Although it's company assets, isn't there some sort of privacy law that
> makes this illegal?
>
> -Petter
>
> -----Original Message-----
> From: listbounce () securityfocus com [mailto:listbounce () securityfocus com]
> On Behalf Of Nick Vaernhoej
> Sent: Tuesday, November 27, 2007 4:41 PM
> To: security-basics
> Subject: RE: Securing workstations from IT guys
>
> A key logger? At what point are we crossing the line of common decency
> towards co-workers?
> I realize it is company property and all, but if you log access to
> sensitive files and audit these logs do you really need to be more
> intrusive?
>
> This is not an attack, more a tagged on question to everyone?
> Is keystroke logging commonly accepted by you?
>
> Nick Vaernhoej
> "Quidquid latine dictum sit, altum sonatur."
>
>
> -----Original Message-----
> From: listbounce () securityfocus com [mailto:listbounce () securityfocus com]
> On Behalf Of Vandenberg, Robert
> Sent: Tuesday, November 27, 2007 11:18 AM
> To: security-basics
> Subject: RE: Securing workstations from IT guys
>
>
> Those are good points.
>
> I would recommend that you put in a keystroke logger program with the
> written approval of your upper management on the PCs in question and
> then download the logs each day.  That way you are able to create a
> forensics "e-Trail" that can be used to confront/counsel/etc. them.  I
> would also make sure that you look at your documenation and ensure that
> each IT person has signed a document stating that they will not use
> their abilities improperly.  Combine those two and you have a means of
> pursuing them legally.
>
>
> This electronic transmission is intended for the addressee (s) named
> above. It contains information that is privileged, confidential, or
> otherwise protected from use and disclosure. If you are not the intended
> recipient you are hereby notified that any review, disclosure, copy, or
> dissemination of this transmission or the taking of any action in
> reliance on its contents, or other use is strictly prohibited. If you
> have received this transmission in error, please notify the sender that
> this message was received in error and then delete this message.
> Thank you.