This is a short interview (YouTube) in which Boaz Fischer and a guest discuss employee monitoring as a cybersecurity measure and how it intersects with employee privacy. They define employee monitoring as collecting user activity on systems, argue organizations need monitoring beyond basic logs to identify insider risk, discuss when employees should or should not be informed (use-case dependent), and emphasize governance controls to prevent misuse while using monitoring as a deterrent and risk-reduction tool. The conversation closes with the guest describing consultancy work implementing user activity monitoring.
Chapters
Are you considering employing employee monitoring as part of your cybersecurity strategy? And do you have reservations about the privacy concerns about it? With me, I have Sean affair to answer some of these questions.
Hello, guys.
So to start off, I want to answer or ask you, Sean, about what is employee monetary?
So employee monitoring in its definition is the capability to determine who is doing what to collect people, activities, or in our case, user activities, on when they access systems, infrastructure dealing with data, etc.
Okay, so why do we need to go above and beyond? Because a lot of organizations have systems, they collect information about their own employees. For example, your mail server will tell you the mail that is going backwards and forward for every employee. When you go into an organization, you'll have swipe cards. So there's a lot of data already being captured. Why do we need to go above and beyond?
Yeah. So unfortunately, these days, with or without our consent, we are being tracked almost everywhere. Everywhere we go on the streets, when we go into offices, we have surveillance cameras, we leave digital footprints, fingerprints, everywhere. So we are being tracked. That's a fact. Now, organizations, when they want to determine or identify better a risk coming from people, that should be a natural choice for them to look at user actions and not logs from the door or from the swiping card system. Obviously.
Yeah. So the question about privacy is a lot of employees will probably find it some form of invasive. How would you answer that?
Well, that's a good question, Boaz. When we look at invasive technology, we look at getting into intrusions, systems that collect private information from individuals. When I look at that, when people turn into users and they join the organization system, they're part of the system. Any access to organization data, organization, IP infrastructure is considered operational activities. Any organization monitors its own systems, people as users, when operating the organization as part of the business, their actions should be monitored to determine risk as well.
So the question then is, should management and executive be forthcoming? So should they inform their employees that are being monitored or maybe not tell them?
That's a very good question. And we can see very simple examples. On the roads we have the speeding cameras, but we have a lot of warning signs before the speeding camera. So obviously it really depends on the organization use case and what they want to achieve. We have organizations that work with U.S. federal agencies, for example, when the business case is a national security, so they're aiming to catch the bad apples and whoever is breaching the trust, they need to be prosecuted. So obviously they will not inform them because they already in a very sensitive position. However, in other large organizations and private organizations, part of the monitoring has a proactive approach to notify the users that are being recorded. So there will be the organization encouraging its own people to behave, to reduce risk and be aware to risk, and also to align its employees with the corporate interests and values. So it really depends what the organization wants to achieve. But either way, data that is collected from user actions is critical to understand and determine behavior and fix it.
Yeah. So the question, we get the essence and the benefit from it. And I would also suggest that it could be a potential deterrence strategy. Correct. From an employee's perspective, do they see from a perspective of saying, well, we've got this employee monitoring, it's aimed against us, does that create a bigger wedge of mistrust? What do you think? Yeah, it's a very good question.
So employees, they should assume that the organization trusts them, otherwise they wouldn't be there. Employees are hired based on trust and skills, of course. So when they are monitored, then, you know, today employees are monitored in various ways. So the moment they enter to the parking, when they use the lift to the office, inside the office, there are surveillance cameras everywhere and everything they touch, lives, fingerprints, digital fingerprints. So we are tracked and we accept it. It's a part of our life. It's natural for us at the moment when we are monitored. I think the approach of the organization is to present it as a training, as encouragement to do the right things and help employees to be better. So this is the way organizations should present it, not as an intrusive mechanism.
Excellent, excellent answer. So what is the key takeaway from this question in terms of distinguishing between employee monitoring and privacy?
Well, as we all know, and it comes from the third division for the insider threat program, employee monitoring is a fundamental tool to have in order to determine people risk. That's the closest you can get to minimize and reduce the risk for any organization when it comes to privacy. There are, and there should be a lot of good controls and strong controls to make sure that the monitoring will not be misused and it will be used for a specific assignment. And once it's used properly and controlled, that becomes very effective tool to reduce risk within any organization.
So Sean, just one last question. So how does suicide go ahead and help organizations? What's your approach?
So we work with organizations to understand exactly what are the problems they scare of when it comes to people, what people can do to take the business down, or what could happen with people that can take the business down. And we help organization by implementing user activity monitoring tools to help understand people behavior, change their behavior, reduce the risk. And that's even before all the corporate controls that can be easily bypassed by employees. So this is what we do for organizations today and it's really effective.
Excellent. Well, thanks. Thanks everyone. Thanks. Sean, if you like this video, I would suggest that you go and get yourself this book, which is actually my new book, the Human side of Cyber. Ignore it. Your own peril. You can get it at nakedinsider. Com book or check out the link down below with that. I thank you. Thank you Sean. It's great. And see you next time.
