Which servers hold the most sensitive employee data, and how do we watch them?
Usually the payroll and HR systems, followed by a few less obvious ones. Think of shared folders with contracts and medical certificates, the directory server that holds every account, the backup server that holds copies of everything, and the mailboxes of HR and management. Start by listing them, with who owns each one, which computers and suppliers should reach it and whether it is in-house or a cloud service. Then protect them in layers: multi-factor authentication, access only for the people who need it, encryption at rest, logs of who logged in, and backups the network cannot delete. For the systems on your own network, NetSenX helps with one layer: on every plan it raises an alert when a device that does not normally connect to them starts to, or when one of them sends unusual volumes of data out. Cloud HR services need their own audit logs.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.
Read next
Related questions
- How should HR and IT handle a security alert that involves an employee's device?
- Can a network security tool be used for employee investigations?
- Is it legal in the EU to use network logs in a disciplinary case?
- How do we keep network security monitoring from becoming employee surveillance?
- Can an unused office computer be used by attackers?