Insurer monitors staff use of PCs

Insurer Royal London is testing security software which could allow its IT security team to monitor staff use of PCs.

Royal London has so far installed 3ami's Monitoring and Audit System (MAS) on a small number of machines used by the company's security team. The system monitors the behaviour of a PC and stores this information on a database which can be interrogated by IT staff.

The MAS package uses a software agent to capture data such as applications opened, files saved or printed, and whether devices such as USB memory sticks have been attached. The software will not save usernames or passwords but will record text typed into documents or emails, and screen grabs of what is on the screen.

For example, the system would be able to show what someone typed in - such as a website address - and what appeared on the screen as a result.

Royal London's group IT security manager Nick Harwood said that while the software won't stop misconduct, such as visits to inappropriate websites, it will help the company find out later.

He said: "We will not be looking through this for things, we will be looking to react to incidents - but we've been proactive in our reacting."

And while some of the data the agent collects can be found in other places, that involve lots of effort, Harwood told silicon.com.

He explained: "You can go into the internet logs or dredge through email. That can be very time consuming."

To allay staff concerns about such a technology, the insurer has included its Staff Consultative Committee in discussions ahead of deployment, and by making it clear to staff that the company reserves the right to monitor activity.

The insurer is now discussing the benefits of the software with its business units before rolling it out further.