5

I just installed the Global Protect VPN from my company on my local machine so I can access our servers remotely. I just "agreed" to the following statement:

VPN Connected

This system is for the use of authorized users only. Individuals using this computer system without authority, or in excess of their authority, are subject to having all of their activities on this system monitored and recorded by system personnel. In the course of monitoring individuals improperly using this system, or in the course of system maintenance, the activities of authorized users may also be monitored. Anyone using this system expressly consents to such monitoring and is advised that if such monitoring reveals possible evidence of criminal activity, system personnel may provide the evidence of such monitoring to law enforcement officials.

I understand that they can (and should?) monitor all of my traffic while the VPN is enabled.

My question is if they can monitor all of my web traffic when the VPN is Disabled?

The above statement doesn't seem like it limits the monitoring to just when the VPN is Enabled.

O.rka
  • 153
  • 1
  • 5

1 Answers1

4

When you say "disabled" I will assume you mean "disconnected" from the VPN. I will also assume this is a company asset and not a personal asset.

You can't be completely sure based on the information you gave, but I would say generally no based on the research I've done and based on my manual poking around our Palo Alto admin console (and local log examination). They can (and hopefully will) monitor your traffic while you are connected to the corporate network, whether you are on-premises or connected via VPN. Also, here is a list of PA GlobalProtect features you can reference to get an idea of what is seen/logged. If you disconnect or disable your VPN and visit your bank, when you reconnect, this shouldn't be available in the Palo Alto logs.

However -- here are a few other things to consider:

  • You may be violating the company Acceptable Use Policy (AUP) whether or not you are connected via VPN. Don't violate the AUP.
  • There are many other ways security and infrastructure teams monitor user activity. A good example would be an endpoint agent that logs your activity and then pushes it to the syslog servers once it's connected.
deletehead
  • 712
  • 4
  • 10