Technology

You've grouped together a couple different classes of software, with different purposes.

"Bossware": this is the BS one, that is used for monitoring employees. Remote screenshots, activity times, application use clocks, etc. No one should ever put up with having this.

MDM (Mobile device management): This is IT software for managing device settings across a fleet (used to mostly mean smartphones, but now it actually means laptops), like enabling disk encryption, enabling the firewall, installing software and security updates, etc. It is also what you use for e.g. remotely wiping devices (e.g. when they're stolen). It doesn't usually monitor user activity.

EDR (endpoint detection and response): this is security software for detecting malicious activity, meaning malware or adversarial actors (I.e. hackers). It often also enforces security settings like USB disablement and software allow/blocklists. This is a 90% automated, and a device that's not doing or having done to it anything malicious is just a green checkmark.

I run our security team, and I tell people up front that I'm not interested in what employees are doing as long as it's not destructive or dangerous. I don't and wouldn't deploy bossware. I ain't a cop, and I won't roleplay one for my employer.

Frankly, it's all too intrusive. If I had monitoring software on my computer, I'd find a way to do more work with pencil and paper or on my phone.

Computer monitoring software should be designed and set up to monitor hardware and software, not people.

This isn’t to say that it can’t monitor people, but that shouldn’t be how it is architected.

Identity monitoring software on the other hand… that should be monitoring people, with the goal to protect their PII from unauthorized access.

A six month old account with zero activity outside did this one post…..

Okay I’ll bite-

The answer? Nothing. It shouldn’t exist at all. And if you’re looking to snoop on your employees, you don’t deserve them.

Should do nothing other then malware intrusion detection and mitigation and basic security. Better process and resource management might be nice.

One reason I retired early was my job was getting impossible to do because of enterprise bullshit along this line.

If it's a business or organisation managed machine, I basically act as if every keystroke and frame of my screen is being monitored at all times.

In a work business context, the company provides and owns the devices, and for security it needs to monitor not individual person behavior but threat indication and traceability. Network traffic should be routed through a company router to restrict and monitor which device and account talks to which systems and services and to monitor indications of breach.

The logging data must not be endlessly persistend for space usage reduction, data minimization, and eventual privacy. There must not be direct unauthorized access but access must be restricted and reasons must be documented.

When the devices are company owned and the usage announced to shall be only company activities not private activities, the privacy implications are low. If individuals specific behaviors are not monitored but only their broader activities across edges with security relevance and if that information is not accessed without reason, then it's not a significant private issue but on the other hand remains security relevant anyway.

DNS and network filtering makes sense from a security perspective. If the company can assume only work related tasks are being done they can make reasonable guesses which services or countries will be accessed or internal services may be accessed from.

Parental controls make sense and change with age, parental education, and personality and trustworthiness.

I'm not sure how useful monitoring would be beyond basic indications.

What I would like to have for my own system; I would like to control and monitor which programs can see, read or write which files, services, and network targets. I do use some stuff in that area, but I would like a more obvious, convenient, and secure framework/suite. To protect myself from bad programs (which may not be "bad" initially and for a while). Zero trust means apps should run in minimum environments and access, not inherit the whole user session context and user accessible storage.