denverpilot
Well-Known Member
And if you're intelligent enough not to be trip trading while operating a flight? How then?
If (as an IT guy) I were told to see if someone had been online when they'd shouldn't have been, I would start with looking at all the logs of things that are automated in the background that they likely didn't shut off. Stuff that would talk to servers and they wouldn't notice it if they weren't real serious about disabling EVERY automated login.
On a company device, we'd just have access to the device logs itself. Change the MAC all you like... wouldn't matter. We would just have a nice log of you doing it, which would hang you higher than if you didn't.
And other stuff. Never met anyone clever enough to completely cover their tracks yet, and they've tried.
All depends on if it's a "casual look" by someone without all the admin level IT access to the device and devices in the path (someone not in IT seeing you in the scheduling system) or a hard look by an IT person.
And every time they make an old greybeard like me do a hard look like that, I think to myself "digging through logs sucks, so I'm writing a script or tool to gather all this stuff" and the next time it's just five minutes of hunting through my work-scripts directory of crap to find the old ones and run them. What took three hours the last time is now a "five minute problem".
So I can go get a taco and not have to interrupt my lunch over someone obviously desperately wanting their boss to fire them.
We had one boss get all cranky that people were using Facebook "all day in the monitoring reports". Until I walked into his office and told him HE was on Facebook *right now*. He blinked. "What?!"
"Your Reports are showing traffic from people's Facebook App on their iPhones in their pockets. Ding. Ding. You've got an update!"
Heh. So you do have to know what you're looking for and what you're looking at when you find it...