Printable View
Okay my friends company wants to monitor all the things EVERYONE does and people are not just on the lan there are a lot of onsite people. Does anyone know of a keylogger that can send the data securely via anything secure such as ssl, https, or sftp? Oh yeah they want a solution for monday lol...
Don't you mean "offsite"? :confused:Quote:
and people are not just on the lan there are a lot of onsite people.
I don't like the basic keylogger solution for a corporate environment of any size. What you find is that you generate far too much data to analyse.
I personally favour using network, internet and application monitoring & analysis tools (they tend to have better analysis options and reporting tools) and manage by exception.
Identify potential problem areas and then consider deploying a keylogger on the much more manageable volumes of data, if needs be.
Ive been talking to him and they want A LOT of stuff. Not only do they insist on a keylogger that can take screen shots and all the extra stuff but they do want it to send securely back to their server no matter where they are...
Assuming that the remote PCs are connected to the LAN on a regular basis this might be a solution:
http://www.spectorcne.com/
Otherwise they will probably have to use two applications.
As far as security is concerned, most of these things work by encrypting and password protecting the log files. I don't know of any that actually look for a secure link.
IMO keyloggers are never a good idea. Better talk them out of it. As nihil says use the network. Setup proxy servers, IDS and a good firewall policy. Turn up auditing on windows clients. If done properly you can pretty much see everything without the need for something as "invasive" as a keylogger.
Don't loose sight of the privacy laws too. Some of this may even be against the law.
The reason that doesnt work nihil is because they have some laptops that never or rarely end up on their lan.
and ya...they insist on what they insist on I cant really convince them otherwise. I told them also if they setup a proxy to monitor all web traffic it would be more then enough. If there is suspcious activity then you can confront them but I personally think they are going to far.
Unless anyone knows of such an application I will assume one does not exist. Thanks for the input guys!!!
If the company I worked for did something like this... I'd turn in my resignation and leak it to the local newspaper so all my coworkers would know. I'm sure a lot of them would also not want to work for a company that has such practices.
Just to be clear, I'm talking about me as an end user. I can understand monitoring web usage for policy violations or to increase productivity. I can understand journaling emails. However, to intercept every keystroke of every employee seems absurd to me on so many levels. If there was an employee who they could not trust, then fire them. Or, gather enough evidence that they can't be trusted via keyloggers, etc. then fire them or prosecute them if they're breaking the law. It just seems like a HUGE ABUSE of "power".
I wonder if this policy would apply to even top level execs or if the board of directors/shareholders would support it if they knew about it.
In which case they cannot be mission critical and can safely be ignored. If they were in any way significant they would have to connect to the corporate mail server for e-mails and for a regular health check to ensure that the OS, applications and anti-malware were up to date and functioning, unless..............Quote:
The reason that doesnt work nihil is because they have some laptops that never or rarely end up on their lan.
What kind of industry is this? :shocked:....................................
I know my friend is a system admin and I know he works in the warehouse but I dont know what kind of place it is.
And phish I couldnt agree with you more.
Hmmmm, I wonder about the significance of these "stand alone" laptops?
Your normal security model would suggest that you protect your LAN and the clients that attach to it. This secures your business against attack rather than just indicating where staff are doing improper things.
A valid solution does not have to be 100% so long as it covers the core business?
A keylogger is an overhead and generally a waste of resources if deployed as suggested. You waste far too much on monitoring people doing their normal jobs, which is of no interest whatsoever.
The whole idea is totally uneconomical. 1000 seats = $50,000 + $10,000 support contract costs = $60,000.
Doing it properly would only take $600, because if they haven't got the hint after you have shot the first 10, you have a serious HR problem ;)
I am not surprised that the kind of software they envisage is not available........... there is no market to support it?
Sometimes there just isn't a technical solution to a management problem. Define your policy clearly on what is considered appropriate use of corporate resources (yes computers are corporate resources they are not the employees personal toys) and empower the managers and supervisors with the authority to enforce the policy. Like Nihil said, after the first few are fired for violation of the policy, the rest will quickly fall in line. ;)
Cheers:
That reminds me of another objection I have to the wholesale deployment of keyloggers. They are basically retroactive, whereas computer security should be proactive.
One would normally want to prevent your systems from getting screwed up rather than find someone to blame after the damage has been done.
That is why we use website filters, firewall rules, user authorities and the like, and lock systems down.
Hence, I regard them as "last ditch" rather than "frontline"
I defiantly do not agree with what they are doing and I think they are going overboard to say the least. A simple webproxy should suit the needs of almost any company. Anything more should only be in a per-basis circumstance. I figured I would ask if anything is out there though!
He-heh, that's the line I love. Tell them to get real. What a bunch of control freaks.Quote:
Originally Posted by oofki
Reminds me of a camera job I did a couple of years back. The boss kept having
me reposition the cameras so he could see his employees faces. Lawdy, were
they PO'ed. I was embarrassed.
You were just doing your job you shouldn't feel embarrassed :-)
Not in a school. Gah.Quote:
Originally Posted by DjM
Anyhoo, much as its rude to be a me-tooer, Keyloggers are a really bad idea. I imagine it wouldn't be too hard to create one that will log keys, encrypt it and send it over the net/lan whenever possible its just so pointless. We do constant screenshot tracking on about 10% of our users (good lord, I had no idea it was that many til I just counted) and that catches most stuff. What we don't catch is stuff we don't see because we weren't watching.
Also - big flaw with keyloggers, you can't see what they are clicking on. So, using the keylogger we are trialing (from net support school package) we can see what people are typing. Some people type nothing. All this means is that they are surfing their favourites or playing solitare or messing with paint.
Catching a google search will not tell you what website they actually were playing with (and should be blocked) just the search.
Come to think of it, the same guy had me install keyloggers in 3 or 4 desktops in theQuote:
Originally Posted by oofki
office a few years back. He griped they slowed the machines down, and I had to train
him to read the log files. In the end, it was a lot of work going thru those. It worked in
the sense he created the impression among his employees he could see what they were
doing on the computers. He'd have been better off running an app like Iris and sniffing
the network. The way a lot of security works, both physical and virtual, is creating the
impression you will be seen doing wrong.
We use an application called Peal Echo. It monitors http,chat,ftp, and email. Has a really nice front end. but you have to do some customization to get the data that matters. It's a pretty good monitoring solution. If they are offsite, you can either give your server an open port for the client application to report to, or it will just cache it until next time the computer is hooked up to the network.
I would advise you to search on this site www.keylogger.org as it is dedicated to keyloggers and has a lot of info about them. I suppose you will find there what you are looking for
Quote:
Originally Posted by oofki
A corporate keylogger? Maybe you can have a try on this monitoring program: Amac keylogger for mac. It seems very popular online, hope it can help.
Jino,
Please look at the date of the last post.............this thread is 4 years old! if they haven't found a solution by now then they never will.
;)