Being nosy can be good for business. Although workplace privacy has become a hot-button issue for many unions and employee-rights groups, there are many legitimate reasons for an organisation to want to know what’s happening on its computers. From industrial espionage, to sabotage, and workplace harassment suits, it’s not hard to understand the strong financial incentives that may exist for keeping tabs on employees’ workstations.
SpectorSoft offers a pair of products that allow an IT department to observe virtually all activity on individual workstations. Spector Professional Edition and e-Blaster 3.0 are separate solutions to a common problem. Each offers an inexpensive way to monitor the actions and data running through a computer’s keyboard and screen.
Spector Professional’s allows administrators to virtually look over the shoulder of the workstation user and view snapshots of his or her screen, making it a wonderful tool for monitoring behavior of a suspicious employee. In contrast, e-Blaster is ideal for keeping an eye on general employee-side network interactions. It serves as the distant early warning (DEW) line, whereas Spector Pro provides the detail necessary to make a case or prove innocence.
View to a user
Spector Pro is designed to live on an end-user’s workstation and keep track of a variety of his or her activities. By default, the solution monitors Web browsing, mail, and Internet chat, and there are provisions for keeping up with Web sites visited, mail sent and received, and chats with other users. Further, Spector Pro can block access to specified Web sites.
The application tracks every keystroke entered on the keyboard, regardless of the application. It can be configured to alert an administrator via email if certain keywords are received or typed, such as specific Web sites visited, specific individuals joined in chat, or specific words typed in to any application.
Finally, Spector Pro takes a snapshot of the screen at regular, preset intervals. The result is a thorough picture of the activity on a computer — a picture that the user may not even know exists.
Administrators can perform a stealth installation, which leaves no icons, no installation file, and no notice when the software loads on computer boot.
They can then access the software with a hot-key combination that can be customised, and a password can be added for even more security.
Administrators can set an impressive number of monitoring parameters from within Spector Pro, including the type of graphics used to store captured snapshots, the frequency of snapshots, and how much storage space is used for storing the various captured files. Because the software will faithfully capture a great deal of information, it’s best for an administrator to think about exactly what he or she wants to see and how long it will be between reviews of the captured data, so as to avoid creating massive files that aren’t used.
Spector Pro’s report page allows an administrator to click through tabs that present Web sites visited, email activity, chats, keystrokes, and the screen snapshots. The snapshots unfold across time, unreeling like a stop-motion movie of the user’s activities.
If the administrator is only interested in one aspect of behavior, it’s easy to focus on the required details, but all the information is available if the administrator chooses to look at it. The key is that, with the exception of email alerts of keyword activity, the reports are not automatically sent to administrator; instead, an admin must retrieve them.
Spector Pro has its limitations. The most significant are on the chat clients it supports. If your organisation uses Yahoo Messenger or AIM, then you’re in luck. However, the solution does not recognize Microsoft Messenger, Trillian, and many other messenger clients. It won’t capture data that is sent or received on unsupported clients. Another important limitation concerns the Web browsers it supports. Internet Explorer will be captured with full URL information. We found that Mozilla surfing was also captured accurately, although the browser wasn’t recognised. But Opera, for example, was a stealth browser to Spector Pro.
The mail-capture facility works with Outlook, Eudora, and most POP3/SMTP clients. This takes care of recording most enterprise email, but it can’t do a great deal to help you know what an employee is doing with a Web-mail account.
Even with unsupported clients and software, however, Spector Professional captures the keystrokes entered. You lose context when looking at one side of a chat, but there will be evidence if someone is sending organisation secrets out past the firewall.
Checks in the email
There are many similarities between the e-Blaster and Spector Pro. As with Spector Pro, e-Blaster can be installed in stealth mode. Actually, the e-Blaster .EXE file can even be sent to the client via the network. Both record email, chat, Web browsing, and application keystrokes.
Although e-Blaster does not have the snapshot feature, it does have better facilities for monitoring Web-based email, with complete reporting of email sent and received in the major Web-based email systems. Administrators can choose whether complete email contents, summaries, or simply headers are reported.
The major difference between the two solutions lies in the way each one creates and delivers reports. Whereas Spector Pro will notify an administrator only if certain keywords appear, the e-Blaster automatically creates a report and delivers it via email using SpectorSoft’s SMTP mail server. It sends report emails on a regular basis, ranging from hourly to daily, providing detailed information on activity across the pre-selected applications.
Administrators configure report type (text or HTML), applications, reporting frequency, and other variables in a configuration screen that, like Spector Pro’s, is invoked with a hotkey sequence. Configuration of both products is easy, with simple check boxes and straightforward options for every application type.
Although Spector Professional and e-Blaster 3.0 have their similarities, their differing capabilities and reporting styles make them complementary rather than redundant. e-Blaster is the tool for daily monitoring of users, the security camera in the hall that provides assurance to both employees and administrators. Spector Pro is better for in-depth monitoring of a suspect workstation, delivering minute-by-minute snapshots of a display.
It would be nice to think that solutions such as Spector Professional and e-Blaster 3.0 would never be needed. In today’s business environment, though, each could turn out to be an investment with a high rate of return.