Reasons for Monitoring
While blocking may be more common than monitoring among midmarket firms, CIOs are likely to monitor first, then determine if there's justification to block. "They say, 'Gee, people are doing things we didn't anticipate,'" says Myer. "If all you do is block and you don't monitor, what you're assuming is that the categorization is accurate for all your traffic. You're assuming that every gambling site is in the gambling category. For example, [users will] do a search for gambling sites, and they'll find one that's not blocked. If you're not monitoring, you don't know that they found one that's not blocked."
Before deploying a filtering product, BEA's Bisulca says he monitored about 13,000 people for some three months to determine the type of traffic on the network. Then he passed the data over to the CIO, the head of human resources and legal departments.
They were "shocked" by some of the content, says Bisulca. "We wanted them to have a level of awareness. We actually just showed them the data, the types of sites that people were going to and the amount of time." Then it was a group decision to implement blocking.
"I would say there were 5% of the people that were going to sites that were completely unacceptable, and 20% were going to sites that were questionable," he says.
Yet while monitoring can help find bandwidth hogs and determine Web site abusers, some IT executives get prickly at the suggestion that they're "monitoring" employees.
On the western slope of the Rockies, an hour's drive from Aspen and Vale, is the city of Glenwood Springs. A few miles from the municipal offices is the city's community center, which houses a public Internet "lab": a bank of Internet-ready computers available to anyone, including the 30,000-plus tourists who pass through town yearly on their way to a holiday mountain retreat.
The city's IS group monitors website usage at both the city offices and the public Internet. To do so, Bruce Munroe, the city's director of information systems, uses tools from 8e6 Technologies, including a dedicated server loaded with both monitoring and filtering software.
"It was easy for me to decide what to block," he says. "I knew what sites posed threats. It was a natural to go ahead and install against spyware and porn sites." But Munroe is quick to note -- and adamant -- that this isn't about employee monitoring. "Our primary objective was stopping malware," he explains.
This was first published in January 2007