SpectorSoft Spector 360 review

Monitoring employee activity on the internet is an emotive subject, but good security practice means monitoring and reporting is essential. Spector 360 claims to be the most advanced employee-monitoring tool available.

The software is easy to install and, although the system has a number of components that can be distributed across several systems, all the server and control software can be installed on one system.

Monitoring software must be installed on each system, which will then record all activity that takes place, feeding it back to the central server systems that store the data for later analysis and display.

The Dashboard display is where it all happens. From here, the administrator can see user timesheets, application usage, website visits and keyboard activity in graphical form, showing a snapshot in a given time frame. More useful from a security perspective is the Security Favourites display, showing which users have been most active in areas such as file transfers to removable media, file downloading, printing documents, sending email with attachments and using webmail. All these activities are potential security risks. The Productivity display reveals which users visit which websites, who spends most time doing internet searches, who uses the most bandwidth, who sends the most email and which apps are used the most. These may be indicators of a productive employee, but they can just as easily show an employee who spends a lot of time watching online videos and chatting to mates.

Document tracking is also insightful. Knowing what an employee is doing with documents can be a strong indication of unauthorised activities.

All this information can be put to a variety of uses. Analysing the website activity could indicate which sites need to be blocked, but could also indicate a resource that employees find essential for their work, which could be replaced with an in-house product. The system provides the evidence to distinguish between the two by providing a complete transaction list of everything a user did in a particular activity in a given time frame.

The system can report a user's activity down to the keystroke level, providing details of what apps were involved, and also supplying screenshots taken at the time the activity was logged. This last feature is available for all the recorded activities and eliminates any chance of misinterpreting an activity. A URL may be just a string of characters, but a screenshot is unambiguous. However, the system can go beyond simply providing static screenshots and offers a replay option as well, showing the exact sequence of events.

The information produced by the system could be invaluable in detecting computer misuse and security issues, but the detailed activity reports should also help to make more efficient use of resources.

Author: Ian Parsons