Exactly what does it mean to monitor user activity?
Monitoring user activity can include everything from video cameras used for physical security to active monitoring of how staff utilize social media on their computers. The scope of activity monitoring depends on the objectives of the monitoring effort and the charter defined by the organization.
User activity monitoring within enterprise IT can include this full range of what could be described as surveillance but more often includes the active review of administrator and end user activity with the specific goal of identifying misuse of privileges through ignorance, mistake or malicious intent. The driving objectives are typically information protection, compliance and ensuring availability.
Methods of user activity monitoring are as varied as the technologies used by administrators and end users. These include network packet inspection, analysis of key logging, indexed video recordings of sessions, kernel monitoring and log collection and analysis. Regardless of the monitoring technology, the information must be reviewed in context with policy and the user role to identify inappropriate activity. Such activity would include:
- Email administrators reading email between the board and executive team
- Healthcare workers accessing patient records for a celebrity not in their care
- Sales representatives downloading full client lists and sales pipelines
- Administrators taking shortcuts around the change control process so they can leave early before a long weekend.
It is the nature of monitoring efforts that a great deal of data is collected and analyzed to find the nugget of actionable information. Worldwide shipping containers are inspected to search for criminal environmental, smuggling or terrorist activity. The vast majority of the containers inspected pass without incident. As such, there is constant pressure to speed the process and more quickly identify the ones with illicit content. The same is true for any enterprise IT user activity monitoring solution.
By subscribing to our early morning news update, you will receive a daily digest of the latest security news published on Help Net Security.
With over 500 issues so far, reading our newsletter every Monday morning will keep you up-to-date with security risks out there.