Chapter 06 · Controls

Monitoring, and the limits it works within

Written for teams designing monitoring, and for anyone required to justify its scope.

What monitoring establishes

Monitoring produces a record of actions taken through systems. That record answers questions of the form "what was done, from where, and when". It does not answer questions of the form "why", and it cannot distinguish intent from circumstance. Programmes get into difficulty when the second kind of question is asked of the first kind of data.

Authentication and session records: where a credential was used.
Access records: which material was opened, by whom, and how much of it.
Egress records: what left, by which route, and at what volume.
Administrative records: which privileged changes were made, and by which account.

Egress volume against a person's own established baseline is the single most useful of these for the intellectual property category, and it is also the one most often absent, because it requires retaining a baseline rather than only alerting on thresholds.

Proportionality in practice

Monitoring scope is a design decision with costs on both sides. Too narrow and cases are invisible; too broad and the programme accumulates material it must protect, disclose and justify, while damaging the working relationship it depends on.

State the purpose for each collection in writing, and collect nothing without one.
Prefer metadata and volume over content wherever it answers the question.
Set retention by the purpose, and delete on schedule rather than by default.
Restrict who can query the records, and log the queries themselves.
Review the scope on a fixed cycle and remove collections whose purpose has lapsed.

Important

Workplace monitoring is regulated, and the applicable obligations differ by jurisdiction and by the employment relationship in question. Scope, notice and retention decisions belong with the organisation's own legal advisers before collection begins, not after a case has started.

Why telling people is a control

Covert monitoring is sometimes treated as strictly better on the theory that a deliberate actor who knows about it will avoid it. In practice the trade is worse than it looks. Deliberate actors tend to assume monitoring exists whether or not it is announced, while everyone else adjusts their behaviour only if told.

Published monitoring therefore does most of its work on the accidental and casual categories, which is where most incidents are. It also removes the single most damaging discovery a workforce can make about a security function, and it makes the eventual employment process defensible in a way that an undisclosed collection is not.