Technology Best Practices

Being “Big Brother”
How to Monitor User Traffic on Your Network
By T. Scott Plumley

It is often said that the biggest white-collar crime is the use of Internet for personal reasons on the job. Many business owners would like to track employee computer usage anonymously. There are several methodologies to assess employee Internet usage. There are many ways to monitor a user’s workstation profile - an Internet proxy package, server folder/file auditing, email scanning and complete workstation monitoring.

Internet access and traffic is one of the most popular areas employers seek to monitor. Here are a few steps you can use to find some information pertaining to Internet usage on a Windows PC. The way to accomplish this is to scan the user’s profile on his workstation. Anyone who logs into a Windows machine has a personal profile that keeps track of information pertaining to his use. You will need each employee’s password or the ability to access their profiles and you can quickly monitor browse through their profiles. Simply open the Internet browser and look through the history. It will keep a week’s worth of history, or more depending on how it is set in the options. If the history has been deleted, you can check the Cookies and Temporary Internet Files. Access this folder by going to the options in Internet Explorer and viewing the files. Under Internet Explorer 7 you would go to Tool > Internet Options > Browser History > Settings > View Files.

Users are becoming more and more computer savvy, so with a quick search on any search engine they can easily find the two or three step process to clear all of this information. That is when we will need to proceed to the next level of traffic monitoring.

A proxy server is an easy, fairly inexpensive way to monitor traffic on your network. The depth and intricacies of what you are looking for will dictate the price you pay for a packaged software solution. A proxy is a software or hardware package that is used to funnel all Internet traffic. Depending on how your network is set up, it could possibly be configured to use the username that the employee is using to track all Internet use. This will allow you to easily run a daily, weekly, or monthly report on any or all employees. The proxy will provide at least the base information regarding who went where and when. A proxy can also be used to set access lists that can prevent employees from going to sites that are not specific to the business in which they are involved.

If you have a server, server auditing can also be set up to monitor all user access to files and folders on your server systems. You can set it on all folders or specific folders depending on how much information you want to track. This is useful if you need to make sure that unwanted file access is not taking place or that an employee isn’t involved in possible data theft by copying files to their local workstation for easy removal from your system.

Another key area to monitor is employee email. It is very simple to setup a Yahoo or Google email account and email documents to yourself through the internal system. If you have a proxy in place or a web traffic access list software package you can eliminate access to these online email portals. Otherwise you have some options regarding monitoring email. If your mail is hosted with an Internet service provider, you have the ability to CC yourself on all incoming mail to that account. If you host your own email using Exchange or some other corporate email, you have many more options available. There are third party vendors that can provide software that will allow you to set up conditions to route both incoming and outgoing mail to whomever you want whenever you want. This way you can set it up so that any mail coming or going to a certain employee will be forwarded to your mailbox.

Lastly, there is a great program that I have used on countless occasions and it encompasses everything I have written about above. It is called Spector Pro and it is $100.00 per workstation. Hands down, it is the best spy program that I have used to monitor workstation traffic. It is a stealth running program and doesn’t inhibit the performance of the machine whatsoever. The advanced user will not know that it is running on his machine.

Here are a few things the program does:

1. Monitors screen shots of the machine at an interval you can set to allow you to a see a timeline and what the user was actually doing. Blocks any site you choose to limit.
2. Records all keystrokes and tells you what program they were keyed in.
3. Monitors all chat software and keeps a log of all conversations that have taken place.
4. Logs all Internet sites visited.

Employers can arm themselves with tools to monitor employee use of company property. Be sure you have broad and clear Internet and workstation usage polices presented to your staff.