1. Hosted by Employee Monitoring Balancing Best Practices and Privacy by Kevin Beaver, CISSP founder and principal consultant Principle Logic, LLC kbeaver@principlelogic.com www.principlelogic.com Copyright © 2003, Principle Logic, LLC, All Rights Reserved.

2. Hosted by Kevin Beaver Information security consultant, author, and trainer 15+ years of IT/security experience Specialize in security incident response, security assessments, network security, and security policy and strategy development Author of the upcoming book Ethical Hacking for Dummies by John Wiley Co-author of the new book The Practical Guide to HIPAA Privacy and Security Compliance by Auerbach Publications Author of the new book The Definitive Guide to Email Management and Security by Realtimepublishers.com Columnist and information security advisor for SearchSecurity.com, SearchMobileComputing.com, ITSecurity.com, and HCPro’s Briefings on HIPAA newsletter Hold CISSP, MCSE, MCNE, and IT Project+ certifications Bachelor’s in Computer Engineering Technology from Southern Polytechnic State University and Master’s in Management of Technology from Georgia Tech Copyright © 2003, Principle Logic, LLC, All Rights Reserved.

3. Hosted by What We’ll Cover Benefits of employee monitoring When employee monitoring won't work Implementing an employee monitoring program Tips for effective employee monitoring policies Case studies on employee monitoring Good resources on the subject BTW – I’m not a lawyer…This isn’t legal advice. Please obtain professional advice that’s tailored to your particular needs! Copyright © 2003, Principle Logic, LLC, All Rights Reserved.

4. Hosted by Questions to Consider Have you thought about monitoring your employees’ computer and Internet usage? Is this monitoring fair? Do you go for what’s best for the company or your employees? Copyright © 2003, Principle Logic, LLC, All Rights Reserved.

5. Hosted by Benefits of Employee Monitoring Enhance employee productivity Help catch trade secrets leaving the company Protect the employees and business from sexual harassment, defamation, or illegal activity lawsuits Copyright © 2003, Principle Logic, LLC, All Rights Reserved.

6. Hosted by …Benefits of Employee Monitoring Decrease network bandwidth consumption Assist with storage capacity planning Help with management and maintenance of information systems Copyright © 2003, Principle Logic, LLC, All Rights Reserved.

7. Hosted by Best Practice or Invasion of Privacy? Before the Internet, this wasn’t an issue Who’s doing this? What about employee rights? Copyright © 2003, Principle Logic, LLC, All Rights Reserved.

8. Hosted by When Monitoring Won’t Work Morale considerations Micromanagement Is this a good business decision? Copyright © 2003, Principle Logic, LLC, All Rights Reserved.

9. Hosted by Who’s Responsible? Can user’s be trusted? Enforcement of employee monitoring This is a two way street Copyright © 2003, Principle Logic, LLC, All Rights Reserved.

10. Hosted by Can it Really Work? Obtain and maintain buy-in Treat people properly Show the business value Tell people what’s expected of them Copyright © 2003, Principle Logic, LLC, All Rights Reserved.

11. Hosted by Implementing the Program Get others involved Obtain buy-in Look at the big picture – keep morale in check Focus on expectations Come up with a detailed plan Develop policies and sanction plan Get the word out Copyright © 2003, Principle Logic, LLC, All Rights Reserved.

12. Hosted by Creating Effective Policies Be as specific as possible If you say you’re going to do it, then do it… Make your policies enforceable and enforce them – for everyone Bottom line goal is to state “This is how we do it here.” Copyright © 2003, Principle Logic, LLC, All Rights Reserved.

13. Hosted by …Creating Effective Policies Should consider including: The organization reserves the right… When What How Copyright © 2003, Principle Logic, LLC, All Rights Reserved.

14. Hosted by Technologies to Use Low-tech and high-tech solutions Content filtering software Network analyzers Desktop solutions Copyright © 2003, Principle Logic, LLC, All Rights Reserved.

15. Hosted by Real-World Case Studies Copyright © 2003, Principle Logic, LLC, All Rights Reserved.

16. Hosted by Finding a Balance It’s not going to be easy at first Don’t allow anything to be assumed Use meaningful discretion Never, ever let monitoring get in the way of productivity Copyright © 2003, Principle Logic, LLC, All Rights Reserved.

17. Hosted by Closing Thoughts It’s up to you Employers should (and do) have the right to decide how their own property is used Talk to your lawyer and HR experts Determine what makes the most business sense for your organization It could be that the risk of monitoring is much less than the risk of not monitoring Copyright © 2003, Principle Logic, LLC, All Rights Reserved.

18. Hosted by THANKS! Copyright © 2003, Principle Logic, LLC, All Rights Reserved.