HR Solutions: Track employees' IT activities to stave off risk

Many companies are knowledgeable about information technology and computer usage policies - and with good reason.

There's a lot at stake, and the potential for serious financial damage is real. Inappropriate jokes and pictures may lead to lawsuits based upon protected classes such as gender, age, religion, disability and national origin. Proprietary information concerning pricing, client lists and trade secrets might be stolen. Without proper protections in place, valuable product designs may be sent to competitors or posted to news groups. Personal data on clients and personnel may be sold, which could lead to identity theft and result in victims suing the company. Beyond those financial risks, productivity is decreased when employees use company-provided computers, networks and the Internet for nonbusiness reasons on company time.

Having policies in place is very different from enforcing them, but it's important to focus enforcement on three key areas: computer usage, e-mail and the Internet.

Monitoring employees' digital activities

Personal information and other inappropriate data, such as pornography and gambling activities, must not be stored on business-owned computers. The hardware, as well as access to company-sponsored e-mail and Internet accounts, should only be used for work-related reasons. Employees should be made aware that they have no privacy in these areas. Employers must review employees' Internet usage, e-mail content and files stored on hard drives and networks, and they must take appropriate actions when they encounter violations to company rules.

Monitoring and tracking employee habits in computer usage, e-mail and using the Internet is essential to policy enforcement.

Several software packages, such as Express Matrix and Spectorsoft, are available to track and record each user's activity, which enables an organization to easily investigate suspected abuse or misuse.

Stealth computer monitoring features track everything from Web mail, searches, instant messages and chats to files copied to removable media and downloaded content. Some software will even take screen snapshots similar to a digital surveillance tape, reflecting the exact sequence of everything an associate is doing, step by step. When employees know that the company has a foolproof method to detect unacceptable activity, it is highly likely they will stop engaging in these behaviors.

Protecting company data

Asset management software can be used to track and inventory a company's IT assets. Companies would be able to identify and monitor what is installed on the network. Software also can be enlisted to aid in the recovery of stolen computers by reporting geographical locations by IP address when a stolen computer is used online.

Gateway solutions can be implemented at the Internet connection point, providing security and monitoring for inbound and outbound online traffic. Appliance-based gateway solutions, such as Sophos, are available to ensure protected, productive Web browsing. These solutions proactively guard networks in real time from Web threats such as viruses, worms, Trojan horses, spyware and other unwanted applications. Appliance-based solutions might require a larger upfront financial investment, but companies can save money in the long run since there is one central point of management and installation, with the solution geared toward the entire network versus a single computer.

Managing e-mail issues

When it comes to e-mail, a company can pay a monthly fee to outsource hosting capabilities, but protective software would still need to be implemented to ensure compliance with the corporate rules.

Another option would be to use an internal e-mail server. Beyond the financial benefits - no fees based on the number of accounts and fewer additional charges for storage capabilities - companies are able to collaborate internally while having the security of knowing that private and confidential emails stay internal, without the need of an Internet connection. E-mail anti-virus protection and anti-spam filtering software can be added on the server to provide extra safeguards.

For some companies, the Microsoft Small Business Server may be an all-in-one solution. While this server incorporates many of the safeguards already addressed, it also enables a company to lock down its computer network system so that employees only access what management wants them to see. Internet usage may be monitored, reported and enforced and IT team members or consultants can review reports and e-mails to conduct investigations and determine compliance.

Computers, the Internet and e-mail usage are heavily relied upon in today's business environment, but they introduce significant risks. Every day there are new internal and external security threats. To fully protect a business, research and introduce the software or hardware solution that best meets the needs of the organization for maximum protection.Lynne Haggerman, M.S., is president/owner of Lynne Haggerman & Associates LLC, a Springfield firm specializing in management training, retained search, outplacement and human resource consulting.