With regulations such as PCI, HIPAA and GLBA, companies are required to know and document who has access to sensitive data and applications. User activity monitoring tools can help identify and record specific actions, either continuously or when a problem is suspected.
McKenzie Medical Center is a regional facility serving western Tennessee. With more than 30 medical providers and nearly 300 support staff, the clinic offers a variety of practices from obstetrics to cardiac care. Don Page is the IT administrator and Nathan Hacker is the IT security officer at McKenzie.
A few years ago, Page noticed the bandwidth usage of the clinic network’s firewall was excessively high relative to the business needs for Internet access. At the same time, there was a problem with low worker productivity. Page suspected that employees were spending their time online with non-business related activities. But how to prove it?
ANALYSIS: Should social networks be blocked at work?
Page and Hacker installed user activity monitoring software from SpectorSoft on the PCs at a branch clinic. Within two weeks, they had documented more than $18,000 worth of time where employees were doing things online other than company business. Armed with this insight, the clinic director approved usage of the monitoring software throughout the entire clinic. Page reminded employees of the company’s Internet usage policies and notified offenders of the new monitoring process. It didn’t take long before worker productivity shot up and bandwidth usage dropped by two-thirds.
“Not only did we see increased productivity, but the drop in bandwidth usage made it much easier to manage our network,” says Page. “Since we started monitoring user activity, we’ve been able to save the clinic quite a lot of money.”
Today, with the rise in social networking and personal Internet use, many employees get distracted from their daily responsibilities, which can ultimately contribute to reduced productivity and inappropriate use of company resources. Unrestricted access to the Web, personal email, IM and social media can also be a potential legal liability, either with intellectual property or customer data leaving the company or a compliance violation to regulations such as HIPAA and PCI.
As a result, many companies are being forced into the role of Big Brother to monitor workers’ activities because they can’t simply turn a blind eye and hope for the best.
When it comes to enforcing Internet use policy, companies have several options: block access to specific websites at the firewall or with a software solution; monitor access for policy violations; or trust that workers won’t abuse their access to this corporate resource.
While some people may claim that monitoring is an invasion of privacy, a company is well within its rights to monitor and control the use of its own resources. Many companies choose to monitor activity when a problem is already suspected and proof is needed, such as in the McKenzie Medical Center situation.
SpectorSoft helps small to midsize enterprises manage the issues related to PC application and Internet usage. The company’s product, SPECTOR 360, manages the recording of a wide range of activities, including email, chat/IM, Web surfing, online searches, keystrokes, programs used, documents printed and data copied to removable storage devices. The tool also provides a video-style screen snapshot recording during device usage.
SPECTOR 360 performs its monitoring by using an agent called the client recorder which can capture all activity from specific PCs. The recorder collects the requested activities, converts them to a compressed and encrypted format, and then sends them during idle time to the SPECTOR 360 server for subsequent storage and reporting. The agent runs in the background on the monitored PCs and integrates with a Windows SQL server.
The recorders can be deployed automatically, with or without employee notification, in stealth or visible mode. During an investigation, administrators can both deploy and monitor in stealth mode, which eliminates any clues that an employee’s activities are under surveillance.
SPECTOR 360 allows granular configuration of what is to be captured by choosing from dozens of settings, including capturing all Web browsing, chat or IM conversations and so on. The capture settings allow further refinement by defining text string triggers. For example, keyword triggers could define text strings such as “account number” or a client’s name to trigger an information gathering/alert event for capturing email or data that may violate compliance regulations or company policy.
The tool also can be configured to capture screens by interval, such as every 15 seconds, or by event, such as keystroke, application launch or a trigger phrase. Combining screen capturing with logging and trigger events helps organizations more effectively monitor PC usage and ensure that policies and compliance requirements are being adhered to.
SPECTOR 360 generates reports for each device being monitored or rolls-up that information in groups of devices for department or group level reporting. Charts, graphs and detailed information are available in many of the reports, allowing administrators to identify trends or areas that may need additional focus or to simply observe how employees are using company resources.
McKenzie Medical Center continues to use SPECTOR 360 years after the initial discovery of Internet misuse. “SPECTOR 360 shows me exactly what my users are doing on the network. It allows us to optimize productivity, comply with HIPAA regulations and safeguard protected health information,” says Page. “The data we gather allows us to proactively address ethics, security, productivity, and compliance concerns by monitoring computer and Internet usage across our organization day and night, 365 days a year.”
Brian Musthaler is a principal consultant with Essential Solutions Corporation. You can write to him at Bmusthaler@essential-iws.com.
______________________________________________________________
About Essential Solutions Corp:
Essential Solutions researches the practical value of information technology, and how it can make individual workers and entire organizations more productive. Essential Solutions offers consulting services to computer industry and corporate clients to help define and fulfill the potential of IT.
