IT admins spying on upper management?

Question

One tricky question.... out IT admins are for auditing purposes sometimes required to review some users, however we also have the suspicion that they spy without permission on the mailboxes of upper management (Lotus Notes based). Any idea how we somehow keep track of that or prevent this?

Answer 1

Only if they login with manager's credentials (not likely). Lotus Notes encrypts mailboxes to prevent this type of abuse. That's one of the reasons my organization went with Notes.

Answer 2

you need experienced and trusted IT management to oversee those levels of people. Zoomjets suggestion of an outside IT audit is a requirement at this point. But definitely keep it quiet that it's going to happen.



I witnessed one scenario where the company president, his lawyer and the security auditor walked in on the lead system admin and ordered the admin to give the auditor immediate unrestricted access to every system. The auditors found evidence of monitoring management emails, copies of customer lists and various other things and 2 of the 3 sys admins were fired the next morning.

Answer 3

If the IT admin login directly to the PC or laptop of Higher management people and access the mail box means then you can ask them first give admin rights for your personal username (mostly you use one username to login which have limited access and IT admin people will use another username full access). Then install some screen capture software which take screen shot in particular interval set by you. I forgot about the software name. Google it.



With the screen shot you can get to know the activities of the admin. With the admin rights user only you can install the software.



The particular software will not listed in installed softwares.



It wont listed in the task manager



with a short cut key only you can access that software.



you can set password to access the software. Even admin pressed the short cut keys it will ask for password. without password they cannot proceed

Answer 4

someone in your upper management would have to get a clue, and learn the finer points of being an IT admin, with out that kind of know how, the only other way would be to go through an out side company, but you end up with the same problem.

Answer 5

If you are concerned about privacy and security issues, consult a lawyer first then an out of house independent IT professional.