Jump to content

Question

Posted

Just curious... if I login to my personal Google account to check my Calendar / tasks, what exactly will my corporate IT be able to see.

 

Will it just be stuff on screen ? 

 

While I don't really have anything to hide, I don't want to give my company (or some hack working for it) access to my private info, either.

 

Here's the overall idea and reason for this question.

 

I use Google for my personal calendar, tasks and email. My company uses Outlook Exchange. I have on the average 3-6 meetings a day, and over a hundred active tasks. I also have quite a busy family schedule that I am trying to balance. I am not always in one spot and my start / end times are fluctuating. So it's important to be able to see my work calendar (meetings and tasks that are due today) and personal calendar on same screen so that I could plan my day ahead. Mail, not that important.

 

I could use the company provided software to sync my personal devices to Exchange. However, the rather vague Terms I would have to accept state that they may be able not only to remotely wipe my device (something I at least understand the reason for) but also go through the personal content, like location data and apps installed - no way I am letting a company I work for have that level of control over my life.

 

Another alternative would be to set up a Google account for just the work stuff, copy my meetings there, and maintain the master task list in it. Then I could share my personal calendar with it and have one place to look at.

 

So the question is - say I set it up this way, enable two way authentication via my personal cell phone, and while at work I log into this account via browser, turn off the display of my personal calendar, and switch from my personal task list to work task list. Now I only see work related info on the browser screen. Can someone from my IT department still get to my personal data ?

 

Thanks !

Share this post


Link to post
Share on other sites

30 answers to this question

  • 0

Posted

They can also see the page you are on...can't do much about the content of the page. If they didn't push a policy to you phone based on their network access control, if they did you may not know what they pushed out and what it can do.

Share this post


Link to post
Share on other sites
  • 0

Posted

I think you should be safe on https:// pages - even if they did capture and analyze packets, it would just appear as scrambled data on their end.

Share this post


Link to post
Share on other sites
  • 0

Posted

You think that that is all they can do? Don't work in IT do you? I can tell you I have put in systems that do way more than packet capture unbeknownst to the end user, if I wanted to I could pull up you bank account id and password if you used on of our computers to access you bank account, I could even give you screen shots of your bank totals as you view those pages.I could also give video capture of everything you did 10 minutes before, during, and after lunch.

You don't want it to be known, don't use corporate computers.

Share this post


Link to post
Share on other sites
  • 0

Posted

Here's the bottom line, they aren't going to bother spying on you because that ends up costing money...they would just get rid of you if they thought something was up (unless it came to corporate security). Those policies are in place for the BYOD generation and there's not really a sure fire way around it without risking leaks.

 

My technicians know that if they leave my company their devices will be remotely wiped if they do so without warning and agree to it in the employee handbook before they even begin work. We have SSN, Credit Card Information, Contacts, etc that are accessible at any time. If they leave with a two week notice then they are allowed to backup their personal data and then wipe the device in front of someone authorized to verify it - it's not that we want that policy, it's because we HAVE to have that in place for liability sake. Can you imagine the CEO of a Multi-Billion dollar business contacting you when a term'ed employee uses a SSN/CC to go shopping?

 

 

You CAN set permissions on your work calendar. You can make it to where if you set your appointments details to private that others around you can't see the details (only that you aren't there). You're lucky to be able to access both calendars on site like that because most corporations wouldn't allow it (it's too easy to just start migrating data over, that's the risk).

 

In the end, everything is visible when it flows through the backbone. If you access it from home, your details will become visible because more than likely you'll be proxying into the server to access said accounts (especially with Exchange 2013). If you're really THAT cautious, ask your employer for another device that purely carries your work data and nothing else, that prevents a BYOD scenario.

 

EDIT: EndPoint Management means that we can see your screens without you knowing. HTTPS means zero if you're linked in to the network.

Share this post


Link to post
Share on other sites
  • 0

Posted

Here's the bottom line, they aren't going to bother spying on you because that ends up costing money...they would just get rid of you if they thought something was up (unless it came to corporate security). Those policies are in place for the BYOD generation and there's not really a sure fire way around it without risking leaks.

 

My technicians know that if they leave my company their devices will be remotely wiped if they do so without warning and agree to it in the employee handbook before they even begin work. We have SSN, Credit Card Information, Contacts, etc that are accessible at any time. If they leave with a two week notice then they are allowed to backup their personal data and then wipe the device in front of someone authorized to verify it - it's not that we want that policy, it's because we HAVE to have that in place for liability sake. Can you imagine the CEO of a Multi-Billion dollar business contacting you when a term'ed employee uses a SSN/CC to go shopping?

 

 

You CAN set permissions on your work calendar. You can make it to where if you set your appointments details to private that others around you can't see the details (only that you aren't there). You're lucky to be able to access both calendars on site like that because most corporations wouldn't allow it (it's too easy to just start migrating data over, that's the risk).

 

In the end, everything is visible when it flows through the backbone. If you access it from home, your details will become visible because more than likely you'll be proxying into the server to access said accounts (especially with Exchange 2013). If you're really THAT cautious, ask your employer for another device that purely carries your work data and nothing else, that prevents a BYOD scenario.

 

EDIT: EndPoint Management means that we can see your screens without you knowing. HTTPS means zero if you're linked in to the network.

 

That is exactly what we do here at my company.  Sure we can do all of that and more but that costs us time and money.  We truly don't care what is on your BYOD device...we care about maintaining the integrity of the corporate data.  The same goes for what is on the computer.  That is why each and every employee agrees to the acceptable use policy/cisp when they are hired.  That is also why the BYOD program isn't all that popular...most are very happy with a corporate provided phone.  Those that do use the BYOD program are told very clearly that we DO not do a full device wipe but rather an enterprise wipe...thus leaving their personal data intact.  The AUP/cisp clearly states that all usage on the corporate network is subject to monitoring...including personal email accounts.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now
Sign in to follow this  
Followers 0

  • Recently Browsing   0 members

    No registered users viewing this page.