How do we know if the payroll server is reached from an unusual computer?
By watching which devices talk to it and flagging new ones. A payroll or HR server normally has a small, stable set of clients: a few computers in HR and finance, a backup system, perhaps the payroll provider. When a workstation that has never connected to it suddenly does, especially at an odd hour or after scanning other machines, that is worth checking at once. On every plan, NetSenX learns each host's normal connections and raises a lateral-movement alert when sessions between devices do not match that pattern, naming the source device, the destination and the time. It does not manage permissions and does not know who sat at the keyboard: restrict access with accounts and firewall rules, and use the server's own login logs to see which account was used.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.
Read next
Related questions
- Which servers hold the most sensitive employee data, and how do we watch them?
- How should HR and IT handle a security alert that involves an employee's device?
- Can a network security tool be used for employee investigations?
- Is it legal in the EU to use network logs in a disciplinary case?
- How do we keep network security monitoring from becoming employee surveillance?