What can IT see and log? [closed]

Question

First of all, I'm a co-owner of my company and I am using my own computer on my company network. Occasionally I'll browse some websites throughout the day to kill some time.

My business partner recently got a call from IT saying I visited some unsavory sites and got some malware on my system. I am wondering what IT was able to see and log, mostly because I'm embarrassed about some of the Internet surfing I've done. Nothing illegal, so please don't judge.

Some additional information: the IT company is a separate entity that we pay for all our networking and computer needs. They have installed PC Complete Care Agent on all computers.

I usually use a VPN on my PC (Private Internet Access), but after looking at some other answers on this and other websites I realized I didn't have DNS leak protection enabled. However, a lot of my browsing was done without activating the VPN.

I know our IT uses OpenDNS. I did a leak test with and without my VPN activated and all queries pointed to OpenDNS.

My question is, was IT able to log all activity and websites even with the VPN activated, or only the activity when it wasn't activated? I'd like to know the extent of my exposure. Lesson learned.

I appreciate your help!

Answer 1

What can IT see and log?

Theoretically speaking, everything, assuming that IT set up and configured your computer for you.

No anonymity software will protect you if you cannot trust the computer that you are using. VPN will protect you if you cannot trust the network, but it will do nothing for you if you can't trust your computer. VPN scrambles (encrypts) traffic as it leaves your computer, and unscrambles (decrypts) traffic as soon as it comes in so that your web browser and other programs can interpret it. If IT installed spyware on your computer, VPN does nothing because they won't be watching your network data - they'll be watching your computer directly. It's almost as if someone is standing behind your monitor.

Many "commercial spyware" programs that IT departments install on computers are capable of logging virtually everything - for example, they can periodically take pictures of your screen, record keystrokes, log a list of websites visited, and even take pictures with the webcam, and send all of this information through the network to a remote monitoring location. Just search Google for "employee monitoring software" to get a better idea of what this kind of software is capable of.

Of course they can also do more benign things, like check to make sure your computer's software is up to date and scan for viruses. Generally if they detect a virus, they will send an automatic notification to IT, which is probably how they knew about the virus on your computer.

Granted, if your IT support is run by a separate company, they probably have no interest in spying on you, and only use these "snooping tools" for routine maintenance activities. However, in the future, if use a computer that you didn't personally install and configure, assume that you have no privacy whatsoever, and that anything and everything you do can be tracked and logged. Use your own computer and VPN if you want privacy.

Also, browsing done without VPN can, of course, be tracked simply by monitoring network traffic. Some firewalls/network monitoring systems are capable of detecting traffic generated by malware, so your IT company may have also found out about the virus through network monitoring.

Answer 2

One reason why spear-phishing is so successful on the higher ups in companies... Ahem.

Anyway, OpenDNS is advertised as a means protecting companies against malware attack and blocking use of unsavory websites that can lead to harrassment lawsuits (business level). The blocked sites are logged on OpenDNS, so you probably tripped the logging by the advertising that was being blocked on the pages visited.