In order to make an efficient argument, we will investigate the possibility of how snooping can be done.
It should be noted: not all companies will monitor your behavior, even if given the opportunity. This is a strictly hypothetical investigation. We are only investigating the possibility of snooping, not how your employer utilizes it. How you assume your employer to behave is between you and your employer.
With those things said, there are pivotal points to be considered when investigating the degree of possibility of snooping:
- Who owns the hardware you use?
- Whose network are you using?
- Who is around?
Who owns the hardware you use?
If you use empolyer-owned hardware, this is probably the worst-case scenario. Your employer has a broad spectrum of tools to choose from when determining how to snoop. If you use your employer's hardware, anything is possible: everything can be monitored. Employers have complete autonomy when setting up hardware. Keyloggers, screen recorders, packet manipulators, and annoying reminders to keep working are just a small list of what can be installed on the computer without your consent because it is not your computer. It is impossible to verify that something has been tampered with any confidence. Even if you manage to use a different network (unlikely), the data can pass between any number of hardware before reaching your monitor. As stated before, this is probably the worst scenario to be in.
You work at a video production company. The software essential to the purpose of your position is expensive and resource-intensive, so you're provided with a company-built machine with an Adobe software suite, Blender, etc. to use while you're in the office. Your team lead seems to hint that he knows a lot about the details of the project you've been working on, so you decide to investigate the software installed on the computer. Fortunately, the "uninstall a program" window inside of Windows Control Panel doesn't show anything suspicious.
Then you remember that article on how programs can be hidden from control panel. The only way then is to view the registry, which is not possible when you don't have the administrator account (you don't). No administrator account, no assurance.
Whose network are you using?
Anyone who has used Kali Linux before can tell you, networks can be vulnerable (and usually are). But monitoring/manipulating with Kali and monitoring/manipulating your local network are two completely different ball games. Having control over the network gives you access to all traffic from all MAC addresses. Sometimes the traffic will be garbled (encrypted), sometimes it will be plain text (unencrypted). However, traffic is all monitoring is limited to. Only things you do over the network are view-able; if it isn't networked, you're safe*.
Unencrypted traffic is dangerous. Anyone who listens in can see what goes in and out of your ethernet/wireless card and where exactly it goes. This is not good if you want to mask what exactly you're sending across the wires (a comment on a blog post, a file sent to an FTP server, or an email sent over an SMTP server not using SSL). To be safe here, using TLS/SSL will keep you safe-er. This will encrypt the information sent over the line, keeping the content inside the packet between you and the server.
However, you must also consider that even with TLS/SSL, possibility for snooping is still present. "Metadata", or data about your data, can still be collected due to the nature of how your computer makes requests over the network. You still have to inform the router connected to the internet of where you want information from, or where it needs to go. Virtual Private Networks add protection from this level of snooping** by encrypting all network traffic and sending it to a router somewhere else, masquerading as you.
You decide to bring your own workstation to work after the previous privacy fiasco. After connecting it to the network, everything goes smoothly. However, you notice that your team lead brought up a topic of discussion that reminded you a lot of the comment you made on a message board. Like before, you decide to investigate.
You read up on security.stackexchange.com and find out that you might have had your information snooped. In defense, you begin to encrypt all of your traffic using a VPN. After many more blog posts, you notice that the conversations tend to happen less fluidly. Success!
*: Careful here, as some software not used on the internet may still send usage information in the background. It is best practices to notify the user of this in advance (Check here to send anonymous usage statistics to X company), but not all will.
**: It is possible to block VPN's by MAC address or by using an alternate DNS to prevent connections to VPN's. This is common practice by some ISP's.
For the last point, we will begin with our example:
Suddenly, your employer starts mentioning those topics similar to the message board you follow again. You think to yourself, "But wait! My hardware is secure and my traffic is behind a VPN! How is this possible?!"
Who is around?
Sometimes, the easiest way to collect information is to look for it. Literally look. Cameras, peeping over your shoulder, using binoculars to look at your screen across the room, looking at your computer while it's still logged in and you're in the bathroom, etc. These "medieval methods" of snooping may be crude, but I would rather walk up to someone's computer and find out what I want to know compared to doing all the hard work of network/hardware snooping.
Also, this is arguably the hardest to defend against without making serious changes in your physical behavior and space, some of which may not be possible inside the confines of an office. I leave examples and solutions to those paranoid enough to worry about and solve these problems, as some are extremely tedious (imagine using two-factor authentication combined with a biological scan and...you get the point).
