Re: FW: Securing workstations from IT guys

[Jan Heisterkamp <janheisterkamp () web de>]

Nick Vaernhoej schrieb:
> A key logger? At what point are we crossing the line of common decency [...]
Precisely the question has to be:" At what point are we crossing the
line of common demency [...]

1. The use of keylogger in a company environment without employees
consent or judicial decree is ilegal and will bring your company in
serious problems

2. For that, your forensic "e-Trail" is nothing worth due the fact that
the information you received from the keystroking-logs does not comply
with legal reqirements in order to be accepted as evidence in a trial.

3. The time you afford for a general monitoring of all users keystroke
logs is wasted time and costs your company money

4. There are enough other ways to secure workstations properly

Regards,
Jan


> -----Original Message-----
> From: listbounce () securityfocus com [mailto:listbounce () securityfocus com]
> On Behalf Of Vandenberg, Robert
> Sent: Tuesday, November 27, 2007 11:18 AM
> To: security-basics
> Subject: RE: Securing workstations from IT guys
>
>  
> Those are good points.
>
> I would recommend that you put in a keystroke logger program with the
> written approval of your upper management on the PCs in question and
> then download the logs each day.  That way you are able to create a
> forensics "e-Trail" that can be used to confront/counsel/etc. them.  I
> would also make sure that you look at your documenation and ensure that
> each IT person has signed a document stating that they will not use
> their abilities improperly.  Combine those two and you have a means of
> pursuing them legally. 
>
>
> This electronic transmission is intended for the addressee (s) named above. It contains information that is 
> privileged, confidential, or otherwise protected from use and disclosure. If you are not the intended recipient you 
> are hereby notified that any review, disclosure, copy, or dissemination of this transmission or the taking of any 
> action in reliance on its contents, or other use is strictly prohibited. If you have received this transmission in 
> error, please notify the sender that this message was received in error and then delete this message.
> Thank you.


-- 
Grupo Ampersand S.A.
IT-Security Consultants & Auditors
Apdo. 924  Escazu 1250
Costa Rica C.A.
Phone: (506)588-0432
ceo_at_ampersanded.com  [corp.]
janheisterkamp_at_web.de [priv.]