Internet Filtering vs.
User Activity
Monitoring
Internet Filtering vs. User Activity Monitoring
The Danger is in the Details
These days, many organizations have implemented some kind of Internet filtering software. Typically run as part of a firewall or proxy server, filtering software is designed to deter employees from easily visiting most Websites that you donʼt want them using at work. Filtering software usually relies on a list of categorized Websites, along with content-based filtering that blocks access to Web pages containing specific keywords.
That had a lot of caveats in it, didnʼt it?
In this whitepaper, weʼll discuss the benefits and methods by which Internet filtering works. Then weʼll take a look at how User Activity Monitoring differs in methodology and improves effectiveness in achieving the desired result: keeping your employees focused on work.
Why Filter the Internet?
Why is it that businesses want to filter access to the Internet? There are a number of good reasons – but the fact is that filtering doesnʼt always do a good job of meeting the actual business need. Itʼs worth taking a moment to think about the actual business drivers, to see if filtering software alone will fully meet those requirements.
Non-Work Related Websites
There are various estimates for how much time employees waste while at work. A Gallup poll has suggested that employees lose more than an hour a day surfing non-work Websites, whether itʼs Facebook, a personal email Website, games sites, or whatever. In some organizations, and with some employees, that may even be a conservative estimate, but it adds up to 250 hours per year, which averages around $5,000 lost productivity per employee each year. Multiply that by a hundred employees and youʼve lost half a million dollars in productivity. Ouch.
Filtering software seems like such an obvious solution: Simply block access to the non-work Websites. Unfortunately, filtering is always a game of
one-upmanship: a quick Google search will often give determined employees access to a site through a different URL, or access to a different, similar site that hasnʼt yet made it to the filtering softwareʼs block list.
Filtering software can often go too far. For example, you might not want
employees using their private social networking accounts during work hours, but they might well have a legitimate reason to visit Twitter – such as updating the
companyʼs Twitter feed. While most filtering software enables you to selectively
unblock sites, it gets to be a headache. Users have to open a help desk ticket, the help desk has to figure out whoʼs in charge of deciding which sites to allow, and then an administrator has to go configure the filtering software.
Those kinds of unblocking decisions are rarely companywide, either. Marketing might need access to Twitter, but Sales might not, meaning your filtering
A Gallup poll has
suggested that
employees lose more
than an hour a day
surfing non-work
Websites, whether itʼs
Facebook, a personal
email Website, games
sites, or whatever.
software management is going to become more difficult as you create
exceptions for specific departments, groups of users, and even individual users. Before long, youʼll have an exception list longer than the actual block list, leading you to wonder, “Whatʼs the point of it all?”
Improper Data Disclosure
The Internet is also a marvelous way for proprietary, confidential information to leak outside your organization. Employees anonymously posting “rumors” to Internet message boards, for example, or employees bypassing your mail controls by using public mail services like Hotmail, Yahoo, or Gmail. Thereʼs not only the danger associated with the information being out there, thereʼs the additional regulatory danger from companies subject to legislative compliance controls. For example, an employee posting news about the company during an SEC-mandated “quiet period” can result in significant fines.
Filtering software can try to block access to these kinds of Websites… but thatʼs hardly the only means of accessing them, and itʼs always that game of cat and mouse, trying to keep the filtering softwareʼs block list updated all the time. Filtering software is also designed primarily to filter Web access – but it often does nothing to block other forms of Internet access. Employees can easily configure a mail client to talk to Gmail, skipping Gmailʼs Web interface altogether and bypassing your filtering software completely.
NSFW
Unfortunately, not all of your employees will agree on whatʼs “Not Suitable For Work,” and their differences in opinion can result in significant problems for your business – starting with sexual harassment complaints. Filtering software is absolutely designed to block access to inappropriate Websites – but new Websites spring up every hour. And again, the Web isnʼt your only problem: thereʼs inappropriate email, instant messaging, and more, which arenʼt addressed by filtering solutions.
Viruses, Illegal Software, and Time-Wasters
Elf Bowling. Virus-laden software. Pirated videos and software. The things your employees can download from the Internet, which will cause significant
problems for your business, are practically unlimited. Sure, your filtering software can do its best to block access to those Websites, and your anti-virus software can do its best to scan incoming files, but itʼs a big Internet out there. Itʼs a rare organization that doesnʼt have some dangerous or illegal software floating around its file servers, and just because you havenʼt been caught yet doesnʼt mean your luck will hold. It only takes one incident for a business to realize how serious these problems are, both from a financial perspective and from an operational stability viewpoint.
Donʼt Filter. Monitor and Record.
Given all the things filtering canʼt do, you might want to think about a different approach, such as User Activity Monitoring.
The things your
employees can
download from the
Internet, which will
cause significant
problems for your
business, are
User Activity Monitoring (UAM) software monitors and records every user activity: chats, message boards, email sites, everything whether youʼre online or just working on your computer locally. Even individual keystrokes are logged and screenshots are captured, enabling you to “play back” employee sessions as if youʼd recorded them with a DVR.
You can run this in tandem with your infrastructureʼs proxy server and firewall stack. But rather than attempting to block access to things for some people, allow access to other people, and so forth, it simply keeps track of what everyone does. And you shouldnʼt try to hide that fact from your employees – really, you want to make sure every employee knows that their Internet activity
will be recorded and is subject to review. This isnʼt their home network, after all,
itʼs work.
Stick to Business
As employees surf the Internet, UAM solutions keep track of every page they hit, every link they click, and every image they view. Knowing that this is happening will deter most employees from visiting non-work related sites. Of course, all of that recording is going to generate a ton of data – so the UAM solution also needs to come with management tools that provide aggregated summary and detailed accounting of what users are accessing and doing. Seeing a spike in outgoing traffic to Facebook? Dig a little deeper – perhaps if itʼs only happening during the lunch hour, youʼll let it go. Otherwise, youʼll be able to see the exact employees responsible for the uptick in traffic, and deal with the problem accordingly.
Youʼll be able to see exactly what your users saw, creating a legally defensible audit trail. If you do end up in the unfortunate position of disciplining an
employee for their activities, youʼll have all the “paperwork” necessary to back up your case.
And because the UAM solution is looking at real-time activity, it can still provide the proactive content filtering that a filtering solution would have provided. The difference is simply that the recording solution will also catch sites that werenʼt blocked, enabling you to better manage context-based filtering in the future.
Control the Information Flow
With a proper recording solution in place, employees will know that youʼre tracking the flow of information. Should a rumor – or other confidential
information – end up on the Internet, your recording software will let you quickly search and discover the employee or employees responsible. Nothing is missed: Emails, instant messaging clients, webmail, Internet message boards, and more. Because the recording software works in real-time, you should even be able to program it with certain keywords matching topics you consider sensitive, off-limits, inappropriate, etc. and have it generate real-time alerts when it sees related Internet traffic. That way, you can not only know whoʼs talking out of turn, but take steps to quickly remove the information from the Internet, limiting the amount of damage done.
User Activity Monitoring
(UAM) software
monitors and records
every user activity:
chats, message boards,
email sites, everything
whether youʼre online
or just working on your
computer locally.
Again, simply having such a solution in place and known to employees will put an end to most of the problems. Think of recording as a preventive measure.
Reduce Complaints and Lawsuits
When employees know that Internet access is no longer anonymous, theyʼre much less likely to hit Websites that arenʼt suitable for the work environment. Theyʼre also less likely to have inappropriate email or instant messaging conversations. That means youʼre less likely to wind up in a lawsuit over some joke that some employees thought was funny – but that others were deeply offended by. Removing the “anonymous” and “hidden” aspect from employee activities simply helps employees make better work-related decisions. And, if someone does cross the line, youʼll have a complete and legally defensible record of their activity, plus real-time alerts based on keywords you select. When you can show, in court, that you took prompt and decisive action, youʼll protect your organization from the consequences of an employeeʼs wrongdoing.
No Abusive Downloads
When employees know that their Internet activity is being recorded and is subject to reporting and review, theyʼre much less likely to download games, videos, music, and other inappropriate content. If they do, youʼll have a complete record, along with summary reports, that enable you to take the appropriate personnel actions.
Increase Proficiency and Speed Troubleshooting
If all this talk of recording seems a little Big Brother-ish, donʼt forget that thereʼs a positive aspect to it as well – something that filtering software canʼt even begin to provide. When every user action has been recorded, your help desk no longer has to ask “what did you do?” or “what did the error message say?” when theyʼre trying to solve a problem for an employee. They can simply pull up the
recording, rewind it like a DVR, and view it for themselves. Time-to-resolution drops dramatically when technical professionals donʼt have to rely on incomplete or inaccurate user recollections of what happened!
And you donʼt necessarily need to record your usersʼ every action. You can use recording as a tactical tool: Monitor specific applications that deal with business-sensitive data, capturing screen snapshots and keystrokes only to that
application. In fact, doing so can actually make your recordings more useful, since theyʼll pertain directly to what you need to watch and contain less “noise.” Recordings can also help drive employee training, helping them to increase their productivity and proficiency. For example, after an employee completes a class on, say, Microsoft Office Excel, a training specialist could review their
interactions with Excel to determine how valuable the training was. Future classes can be built around known problem areas.
When employees know
that Internet access is
no longer anonymous,
theyʼre much less likely
to hit Websites that
arenʼt suitable for the
work environment.
User Activity Monitoring: Benefits for All
UAM software isnʼt just about catching employees in the act of doing something wrong. After all, the majority of your employees donʼt want to do anything wrong. Monitoring and recording simply puts everyone on notice that nothing in the workplace is anonymous, and that everyoneʼs accountable for his or her own actions. Monitoring and recording lets you spot activity trends, reduce help desk troubleshooting time, and gather other information that can be used to increase productivity and build a better network infrastructure. Monitoring and recording is beneficial for user training and follow-up, as well. There are numerous benefits to be had – most of which you wonʼt get by simply trying to block employee Web access via filtering software.
SpectorSoft’s SPECTOR 360 offers an easy-to-deploy, comprehensive solution for User Activity Monitoring. Its flexible search and reporting features let you quickly drill down to specific traffic, replay activity, and more. Learn more at www.spector360.com
