How can we tell if a remote employee's laptop connects through anonymising services?
Only where you can see the laptop's traffic: when it runs the NetSenX agent, or when its traffic reaches a segment you monitor, for example over the company VPN. A commercial VPN or the Tor network shows up as a long-lived encrypted connection to an outside address instead of the usual mix of destinations; NetSenX shows the destinations and volumes, and whether a destination belongs to such a service you judge from the address and the server names involved. It cannot see inside the tunnel. Remember that a private VPN is often harmless, so start with a question, not an accusation, and check your remote-work policy. Device management tools that enforce the company VPN, and identity logs that show where logins come from, cover what a network sensor cannot.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.
Read next
Related questions
- What are the security risks of hiring remote workers we have never met?
- Should we monitor the home networks of remote employees?
- How do we know if the payroll server is reached from an unusual computer?
- Which servers hold the most sensitive employee data, and how do we watch them?
- How should HR and IT handle a security alert that involves an employee's device?