Background
Employee computer monitoring and auditing is the key to upholding the laws of a digital network, argues Tim Ellsmore, the managing director of Manchester-based IT security firm 3ami.
"Without law enforcement - both prevention of and accountability for crime - no community can be considered truly 'safe," explained Ellsmore. "Employee computer monitoring and auditing both prevents employees from engaging in irresponsible or illegal computer activity and creates accountability for individuals who do indulge in such activity. In the absence of police officers and live witnesses, employee computer monitoring and auditing is the most effective way to keep an office's digital community safe from internal and external threats."
Ellsmore added that an integrated and comprehensive monitoring solution, such as 3ami Monitoring and Audit System [http://www.3ami.com], can coordinate your existing data security systems into one easy-to-manage auditing framework.
From piracy fears to regulatory concerns, the protection of confidential data and intellectual property is one of 2010's hot topics. With recent UK legislation [http://bit.ly/dthkdX] significantly raising the fines (up to £500k) for businesses that commit serious data security breaches, it is now time for organisations to find more aggressive and effective ways of protecting the confidential data on their networks.
3ami MAS is a crime deterrent and law enforcement tool all wrapped in one: it enables employers to uphold the laws of their digital networks, creating safe and secure digital workplaces.
One of 3ami's most long-standing customers is McKay, a rapidly growing electrotechnology firm that has won numerous infrastructure projects throughout New Zealand and the South Pacific over its 73-year history.
McKay recently upgraded its existing license of 3ami MAS to the latest version, 3ami MAS version seven (3ami MAS v7), which was released last summer.
Like all versions of 3ami MAS, 3ami MAS v7 also captures and securely stores records of all user activity on every application, including email, word processing, spreadsheet applications, instant messaging and online. Each click of the mouse and type on the keyboard can be monitored.
Norway public schools have already discovered the simplicity and effectiveness of 3ami's monitoring solution for preventing inappropriate computer activity. As the BBC reported in May 2009, 3ami MAS is being used to prevent 6,000 schoolchildren in the Nord-Trondelag region of Norway from cheating on laptop-based examinations. [http://bit.ly/aHAFY]
The seventh version of 3ami MAS has an optional add-on feature that allows employers to prevent employees from downloading confidential company files onto personal USB memory devices and removing those files from the premises without permission. When McKay upgraded to 3ami MAS v7, the company also purchased 3ami's USB security lockdown functionality.
"One of the determining factors that originally brought us to 3ami MAS was the transparency it gives of all user activity on the entire network," said Graeme Bratty, McKay's manager of finance. "The reports are comprehensive and easy-to-read, and we can set up alerts to notify us to anomalistic and suspicious activity as it occurs. With the upgrade, we are now capable of preventing unauthorised usage of USB storage devices on McKay computers. 3ami MAS is an extremely powerful tool for preventing intellectual property theft and holding employees accountable for their actions on the network. A couple of people are former staff members as a result of the detailed information that MAS has provided us with."
Comprehensive monitoring tools such as 3ami MAS enable companies to protect their intellectual property and hold employees accountable for their activities on the company's computer network. At a time when data security breaches from the world's most high-profile organisations have become the norm, it is essential for companies to adopt a proactive stance towards preventing intellectual property theft and other illegal computer activities while providing a safe, secure and accountable digital workplace.
Challenge
The challenge facing companies that do not fully monitor activity on their computer networks is that they have no real way of knowing, with certainty, whether employees have misused the data they have access to.
"Most employers don't want to believe their employees are capable of deceiving them," said Ellsmore. "But when human nature rears its ugly head, even the most loyal employees can turn to intellectual property theft or insider espionage. It's as easy as downloading something onto a memory stick and walking out of the office."
The Formula One "Stepneygate" scandal of 2007 is one of many cases of insider espionage that support Ellsmore's call for organisations to begin undertaking more serious monitoring and auditing of employee computer activity.
"Stepneygate," as it is known in the racing world, started when the wife of the chief engineer for the McLaren Formula One racing team brought 780 pages of Ferrari documents into a Woking copy shop and requested that the documents be scanned onto two CDs. The copy shop employee recognised the Ferrari logo on the documents and googled the woman's name; he discovered she was the wife of Mike Coughlan, the chief engineer for Vodafone McLaren Mercedes. The copy shop employee then emailed Ferrari's sporting director to report what had just happened.
The result was a scandal that rocked the racing world. The McLaren racing team was stripped of its 2007 championship points and forced to pay $1 million in fines, and Ferrari's head of performance development, Nigel Stepney, was fired under suspicions that he had passed on the private documents to members of the McLaren team.
But even Ferrari admitted they would have had no way of knowing about the intellectual property theft if the copy shop employee had not called them.
"Ferrari would have remained blissfully ignorant of it if not for the tip-off," Nigel Tozzi, representing Ferrari, told the BBC. [http://bit.ly/6yvwO2]
All too often, organisations rely on blunders and tip-offs to alert them to potential theft of intellectual property. As an increasing amount of information moves to computers - and as mobile devices become ubiquitous - it is imperative that organisations develop proactive strategies to safeguard their networks from reckless, irresponsible and damaging computer activity. It is equally imperative to account for such activities, when they take place.
McKay's Challenge
McKay is no stranger to these security issues. The rapidly growing electrical engineering firm has established a solid reputation for defence over the last 73 years; in fact, McKay is a prime contractor to the Royal New Zealand Navy's Project Protector Programme, and was a finalist in the New Zealand Ministry of Defence Award for Excellence to the Industry 2009.
Considering McKay's high-profile client list, specialist knowledge and 73 years of experience, it comes as no surprise that the company's intellectual property has an extremely high value.
"McKay's intellectual property is broad in its nature, and covers items like strategic plans, customer databases, business development information and design documents," explained Lindsay Faithfull, McKay's CEO. "This intellectual property has a very high value for a growing company like McKay, and it needs to be protected by all means possible."
McKay started considering employee computer monitoring and auditing software when the company became concerned that certain staff members may have been looking to acquire McKay's intellectual property. McKay sought a reliable IT solution that would enable them to have oversight over activity on all McKay computer systems. The solution needed to be comprehensive, easy-to-install and simple enough for non-IT staff to use on a daily basis. It also needed to be capable of alerting McKay to inappropriate or illegal activity as it happened.
McKay's Solution
Bratty said the deciding factors that brought McKay to 3ami MAS were the comprehensive reporting, transparency of all user activity on the network, and quality of support provided by 3ami.
"We looked at a number of options, but 3ami MAS was the only one that was very comprehensive for a reasonable price," said Bratty.
The main security features McKay relies upon are 3ami MAS alerts, reporting and the USB security lockdown feature.
Bratty explained: "The USB lockdown feature, in particular, is very powerful from a security perspective."
With the new 3ami MAS USB security module add-on, certain users can be restricted so that no USB mass storage devices will work for them on any computer in the network. Others can be authorised to use only official company USB storage devices on certain computers; still others can be authorized to use any USB storage device on any computer.
The software can be used to block all USB mass storage devices, including cameras, flash drives, mobile phones and iPods. It can also be used in conjunction with encrypted biometrics.
McKay uses 3ami MAS to run monthly audits of computer activity across the entire network as part of the company's regular review reporting.
McKay's CEO, Lindsay Faithfull, said, "3ami MAS provides fantastic visibility into the use of McKay's IT system by all users, including what files are transferred and where. The ability to lockout the use of memory sticks, in particular, is a very powerful feature."
Bratty added,
"It is difficult to quantify what the payback period will be, but from a peace of mind perspective, it's almost immediate. We now know our system is more secure from the threats USB ports can pose to a computer system."
Why 3ami Monitoring & Audit System
3ami MAS is a crime deterrent and law enforcement tool all wrapped in one. With 3ami MAS, you can monitor whether employees have downloaded confidential information to an external memory device; track the use of certain language on the network to prevent cases of bullying or harassment; and ensure that employees are not accessing inappropriate websites or downloading illegal files. Depending how you set your alerts, 3ami MAS can also alert you to security threats, such as the creation of dummy accounts or backdoors into the network. The secure records of all employee computer activity can be accessed instantly and compiled into reports to identify a range of different user activities. 3ami MAS typically obviates the need for most other audit control and logging tools, but if other data security systems are already present, 3ami MAS can coordinate and corroborate all systems into one complete auditing framework.
Client contact:
Tim Ellsmore
+44(0)1695 738003
www.3ami.com
About McKay Electrical (www.mckay.co.nz)
Established in 1936, McKay is a multi-disciplined electrotechnology company providing excellent services to our industrial and marine clients. We pride ourselves in being able to undertake almost all aspects of electrical projects in-house, including:
- Electrical design.
- Control system integration (automation and control).
- Electrical and instrumentation installation.
- World class switchboard design and manufacture.
- Through life support.