User Activity Monitoring: Fact vs. Fiction

We don’t like to generalize, but for the sake of this blog post, we’re going to divide everyone in the world into two distinct groups:

1. Those who monitor IT user activity. These people know the facts. They live and breathe IT security. They are by far the smaller of the two groups.
2. Those whose activities are monitored. Basically, everyone else. This group is plagued by a fictitious view of user activity monitoring.

Perceptions of user activity monitoring are vastly different depending in which group you reside.  In this post, we want to bridge the gap; to help everyone understand the mechanics, and more importantly, the motives for monitoring user activity. Let’s separate fact from fiction.

Fiction: My employer is keeping track of how much time I spend on social media.

Fact: This is unlikely.  For one, many jobs require interaction with social media channels (such as sales and marketing). Secondly, if a company wanted to prevent you from spending time on Facebook or Twitter, they can block it outright. The security professionals within your company probably don’t care that much about your personal life. What they are interested in is suspicious activity (records downloaded, transactions copied, files forwarded to personal accounts). And in nine out of 10 cases, that’s what they are keeping track of.

Fiction: I’m always under surveillance.

Fact: Yes and no. While your activity is always being recorded (at least with Proofpoint) you’re not constantly being watched. In fact, the only time you’ll get on the collective radar of the IT department is in the event of a suspicious activity. Otherwise, it’s business as usual.

Fiction: I could get away with anything if I wanted to.

Fact: Technology tools make this scenario far less likely that it once was. Sadly,  there are some employees and third-parties who  know their activity is being monitored, but they still try to get away with  illegal or unethical activities. In some cases, they succeed. But with the right technology solution in place, no harmful deed will go undiscovered. Soon, it will be extremely rare for a breach to go unidentified.

Fiction: I don’t have to worry about security if my activity is being monitored.

Fact: Wrong.  We’ve long stressed the importance of educating an entire company on security best practices, not just those in the IT department. Despite the presence of security software, there’s still the chance to download a virus or to make a mistake in transferring a file outside the appropriate channels. Prevention and education are still the best ways to address the growing number of security breaches. No software will ever eliminate these instances.

Fiction: Only the biggest companies monitor user activity.

Fact: False.  Big companies do monitor user activity (employees and vendors) but we’re starting to see this becoming a point of emphasis for smaller companies as well. Why? Unlike the large players, many startups and medium-sized enterprises literally cannot afford the costs associated with a security breach – loss of trust, compliance fines and other financial hits. Security isn’t just for the big players anymore.

These are just a handful of the many myths that persist in the realm of user activity monitoring, but they are some of the more prevalent ones. What other security myths have you encountered in your daily work lives? Be sure to share in the comments section below.