How Much Can Your Company See When Monitoring Your Work PC? : The Truth from a Large Corporate Se...
No. 37
There is also security-related information on the Naver Cafe, so please check it out~
https://cafe.naver.com/prsystem17
Hello, this is Security Expert PR.
The weather is so hot.
I hope all the Security Kids who love Security Expert stay safe this summer.
I wrote today's topic on the thumbnail:
"I can know everything you did on your PC last summer."
A fact check on the claim that you can see everything. Is it true?
Personal emails I sent, messages calling my team leader a jerk, games, stocks, downloaded movies, etc.
I’m going to look into how far you can view a company PC and what technical solutions are used to do so.
Since I work as a security manager at my company, I can see everything~
It is a story about monitoring. So, let's get started.
Before we begin, before you are issued a PC, laptop, mobile phone, or tablet by the company, you will likely receive a piece of paper like this upon joining.
An HR representative or manager will casually hand it to you, and you have probably heard them say something like, "Just skim through it and sign."
They specify the relevant details in the employment contract and the security pledge (online consent) and obtain your signature.
Did you read the details carefully?
Actually, you don't have time to read it, and since it is early in your employment, you can't really refuse to sign.
You feel like you won't be able to join if you don't, and they frequently ask for your consent.
At our company, the internet doesn't work if you don't agree.
Anyway, it is a bit like that.
To summarize the pledge, it states that you will not use the company's IT assets (PC, laptop, mobile phone, tablet, printer, etc.) for personal use, will maintain security standards, and will take full responsibility for any violations.
That is basically the gist of it.
After that, the company says, "We received the pledge, and you agreed to sign it.
And since this computer is company property, the company will prevent personal or confidential information from leaking and prevent it from getting infected with viruses."
Nominal OK? So, let's get started with the monitoring!
Then, how far can we go?
The conclusion is that if a company is determined to find out, it can know exactly what each employee is doing.
Really?
Yes, we can know everything. And as long as the storage space (capacity) allows, we can even view and print out every record from the time of hiring.
We can see internet access logs, personal email content, KakaoTalk (messenger) usage history, and even conversation logs.
Attempts to access important document files, records of downloads being sent externally,
printer output history, USB usage logs, and even keyboard input...
That is why recently, companies have blocked all of the things mentioned above from the start to prevent their use.
What I want to say isn't about how far we can see, but that we can already see everything.
It means they detect and monitor attempts to bypass security programs, attempts to access company data, and suspected data leakage activities.
Do you think it's because you don't trust me? Are you treating me like a thief? That is not the case.
Actually, that is partly true.
This is because one of the Information Security Team's duties is to prevent hackers from planting malware on internal PCs and attempting to steal company data by posing as internal employees, and secondly, it is crucial to play a role in preventing corporate information leaks by insiders.
We are standing guard... rather than treating them like thieves... regarding those issues... well, darn it, that is just how companies are.
"We do it just for show; we'll only do it when necessary."
You know that's all a lie, right?
From the company's perspective, "when necessary" is practically always the case.
Don't be fooled.
From the company's standpoint, if corporate secrets built up through capital and technological investment are leaked, competitors could catch up in an instant.
So, shall we look into what technologies can be utilized for monitoring?
I will discuss this by dividing it into three categories.
1. Network Monitoring
Security equipment installed at the network level (UTM, next-generation firewalls, IPS, IDS, etc.)
Through content filtering and URL filtering among their security functions, you can identify internet connection history, email content, and even what attached documents and files are being accessed.
To explain using a next-generation firewall as an example... shall we take a look at the data?
It can manage all passing traffic by connecting to the network line via inline or mirror port configurations.
The primary purpose is to detect external attacks,
and it can also manage traffic going from internal PCs to the outside.
You can view statistical information on which sites users access most frequently,
and you can also see the size of attached files.
2. What is PMS (Patch Management System)?
A patch management system is a sol...