Prepared by: Stephen Allen, Allen Concepts Inc., Chandler, AZ
July 2006
ABSTRACT
John has been at his computer for hours, but his productivity has fallen lately. Is he emailing buddies, busy in chat rooms, or reading internet news? Or, worse yet, John is sending sensitive material regarding the companies product formulas. The internet is a necessary tool for many offices, but the distraction is too tempting for many. The problem is serious - internet misuse costs employers over $4 billion per year.
How can employers fight back? The most effective method of reducing inappropriate computer use is through monitoring. Employees who know they are being monitored waste much less time surfing, e-mailing, chatting, and certainly risking being caught. The employer also has a record of what the employee has done, providing information which may aid in lawsuits or theft investigations.
The battleground for monitoring software has mushroomed with options such as keystroke loggers and also with the opposing software that defeats them. Hardware keystroke recorders are not vulnerable to detection by software. Hardware keystroke recorders essentially capture data at the source, ensuring robust recording.
COMPUTER MONITORING
There are many permissible uses for monitoring computer activity. It may be monitoring your children's or employee's internet activity, or detecting unauthorized access of your PC. Countless hours are wasted by employees on the internet. Keystroke recorders are an effective tool for ensuring worker productivity and accountability.
WORKPLACE MONITORING
Businesses have the right to monitor employees in the workplace, but should have a computer usage policy in place. The computer usage policy makes the employee aware of what constitutes acceptable use, and also lets them know that the employer may be monitoring computer activities.
PARENTAL MONITORING
Parents have the legal right to monitor the computer activities of their children. Many parents are concerned about who their children are talking to online. Sexual predators find it much more comfortable to hang out in chat rooms than in front of the local school.
Computer monitoring technology can be broken down into four main areas:
1 software keystroke recorders / software monitors
2 anti-spy / anti-virus programs (defeat software keystroke recorders)
3 erasers (erase evidence of visited web sites, e-mails, etc.)
4 hardware keystroke recorders (record keystrokes without software)
COMPUTER MONITORING WITH SOFTWARE
Software is the dominant method of monitoring computer activity. It has advantages that it can transmit activities over a network, and may be very affordable. Many different software programs have been created to address the need to monitor (over 300). In response, there is software which is designed to detect or disable the monitoring software.
Keystroke recording software has existed almost since the arrival of the first computers. These programs create a log of all keystrokes typed and store the log file on the computer hard drive. These programs are generally interrupt-driven (from the keyboard interrupt). Thus, it consumes computer time while it reads the keystrokes and writes them to the computer hard drive. Further, the file on the hard drive may be discovered and erased/modified.
Modern software keystroke recorders have evolved beyond simple key loggers. Some will record the screen images, and play them back like a VCR. Other programs will e-mail the keystroke logs to a remote computer. Nonetheless, these programs still reside on the hard drive (where they can be detected) and also consume computer time. Storing screen shots to your hard drive is disastrous for computer performance, loading down the CPU, RAM, and hard drive. Storing screen images on the hard drive is like buying a high-performance boat and cruising around with the anchor down.
Many software monitors have come under the gun for their tendency to make the system unstable. Software monitors have unusual demands compared to typical software packages. It is desirable for software monitors to not show up in the program manager, and to not be listed as a resource for consuming CPU time. This desire leaves the program running under the operating system in a non-standard manner. If the program does not appear in the Task Manager, and the program causes the computer to lock up, how do you shut the program down? Further, if the program repeatedly causes the computer to lock up (and it starts running every time you power up) how do you remove it from your system? Because of these issues, software should be from a reputable company with accessible support should a problem occur.
Anti-spy programs are relatively new on the scene. They will detect and sometimes remove the software keystroke recorders. No matter how well a keystroke recorder is written, there will always be software that can detect it. Some anti-virus programs are also beginning to attack the software keystroke recorders as well. McAfee anti-virus detects some of the popular keystroke recording software. What this means is that software keystroke recorders may only be a virus update away from being detected/disabled.
Erasers attempt to "cover the tracks" of the computer user. Let's say that you are a thirteen year old kid, and you don't want your parents to know what you are doing on the computer. If you disable their monitoring software, they may find out. This is where an eraser comes in. It appears to the parents as if the computer has not been in use. Some erasers advertise that it will erase all internet history, and also erase history from over 30 third party applications. Other programs combine the anti-spy functions with the eraser functions by both detecting monitoring software and by erasing internet history. With some monitoring programs, the user may be able to disable the monitoring software through the process manager, and then manually re-launch the monitoring software when they are done.
COMPUTER MONITORING WITH HARDWARE
Hardware keystroke recorders contain two main components: a simple microprocessor, and non-volatile memory. The microprocessor handles tasks such as: interpreting keystrokes, checking for the access password, and displaying menu options. The non-volatile memory is a fairly large memory which is used to store the keystrokes. Non-volatile memory retains data even during a power loss. This allows a hardware keystroke recorder to be unplugged and still retain the keystroke log. Further, the ability to retain the keystroke log even when unplugged, makes it a portable device. It can be used to record on one computer, and can be read out on another computer. This is useful if one desires to record activities at home, and review the data at the office, for example.
Devices are about the size of an AA battery, and plug in to the back of the computer between the keyboard port and the keyboard cable. Power is supplied by the keyboard port, so that no additional wiring is necessary.
Hardware keystroke recorders require no specialized software on the computer system. They are accessed through a "host program", which can be any word processor or text editor. Hardware keystroke recorders are constantly examining the keystroke stream looking for the access password. As soon the device sees the access password, it temporarily shuts down the keyboard and "types" a menu on the screen. This is perhaps the most novel aspect of the hardware keystroke recorder. This technology allows hardware keystroke recorders to be used without installing any software on the computer system, and allows recording to take place without consuming any CPU cycles.
CONCLUSION
Hardware keystroke recorders, present an elegant solution to the "spy vs. spy" game of the software market. Because there is nothing installed on the hard drive, it is undetectable by all anti-spy, and eraser software, now and into the future. Implementing software solutions requires constant vigilance (both in time and expense) on behalf of the user to make sure that their solution is still performing. Hardware keystroke recorders work at the source to ensure accurate data recording.
Author contact information:
Stephen Allen
Allen Concepts, Inc.
Phone: 480-659-8076
[email protected] |
