Keep your personal information off your work devices.
But IN PRACTICE, what is normal?
Your statement seems to indicate that IT staff can just browse personal communications, desktop displays, keypresses. I am sure that they can if necessary, but what kinds of scale and automation are we talking about? Doing such surveillance ad-hoc or without a very small number of targets seems like it would easily become intractable for any org with thousands of people.
I am not in an IT department, so I have no idea what goes on.
It seems the standard advice is always to take the most extreme precautions and to follow the corporate rules to the letter... but here I am typing this into a work computer on a chrome browser without a care in the world.
http://www.huffingtonpost.com/2010/02/26/dan-ackerman-school...
So here is an example of a school administrator spying on students via their provided laptops. It's not the only one. This was 'normal' for the school system until they got called on it.
Blanket collection and searching of data by a company is very possible, in just the same way as you search through mass of logs from applications. They aren't going to have someone watching these logs all the time though, so you don't have to have a huge staff to handle it. They may spot check, they may only go thought the data when something suspicious occurs. They may automatically troll through the data looking for keywords which escalate to a real person for further analysis.
When I go into a company I make sure we put a policy in place that to review an employees emails / web traffic / devices we need to have Legal and HR sign off on it unless the person being investigated is part of one of those groups then it is one group and an executive.
This covers me from legal/HR fallout and it covers the employees because they know we aren't just sneaking around looking at their stuff, it creates trust.
But, in general, never do X advice can be actively harmful because it advises people against doing things that very many do without repercussions and causes people to ignore advice that it's important to follow.
They can read your emails, and chat logs and whatever else is sitting on your work machine. The only way of dealing with that is never have personal information on them in the first place.
Even if your employer is fine with personal use, courts will rule that it's all in scope during a discovery phase. I've been involved in litigation scenarios where people's personal email ended up being sifted through by the other litigant because opposing counsel convinced the judge that business was being conducted there, and there was evidence of frequent access on a corporate device.
All of your protections from a legal point of view are really defined by custody and scope of control. Data stored on your device in your home is the most protected. Data stored on your employer's PC or file server on your employer premises is the least protected.
Is it safe to assume that the only way that that (or any https content) can be captured is by keylogging or some kind of desktop capture?
Any forensic analysis of a PC/Laptop or look at proxy logs will show your connectivity to an personal email account. In a discovery scenario, all that needs to be done is to present a pattern where personal mail was used for business in the company. (I guarantee that is happening somewhere)
It's one of these scenarios where it isn't a problem, until it is
No, plenty of corporate firewalls provide HTTPS MITM by installing their own root certificate and making client machines trust it. HTTPS certificate pinning as it's implemented in most browsers specifically allows this behavior by not checking pinned certificates if the root certificate is in the computer's private keystore (vs. system keystore) because it's assumed the private keystore is full of only certificates the user or machine owner wants to always trust.
I'm a lot more confused about 'Bring Your Own Device' (BYOD) companies. BYOD has proliferated because employees are generally happier to pick their own devices and not have to carry two devices. Employers are happy because it's cheaper, even if there is some stipend involved. It makes IT a bit more complicated but thats about it.
But can they look at my messages then? What if they pay my service bill but I own the device?
Client gets upset about some deal, they sue your employer. They claim you leaked some information to a competitor. Client and employer both want access to your device, to look for evidence of the information leak. You conducted work, on behalf of the employer, on your own personal device. They have to have the legal right to search that device for evidence..
Now.. if you had two devices. One for work, one for personal. You never used your personal device for work.. then to me, personal device is off limits, unless they found compelling evidence ELSEWHERE that you had disclosed information via your personal device. However, that would need to come out and be backed by evidence. They can't just look at your device without being compelled. I am no lawyer though, and my knowledge of civil/criminal evidence handling is shallow..
What if you had just memorized the information – does the company have to have the right to waterboard its employees just because they would like to search for evidence?
And the law, especially in the US, agrees.
No doubt they will have an internal CA installed, but if you keep an eye on who authored the certificates on your favorite websites, you can reasonably be assured of some privacy. Additionally install HTTPS everywhere.
Then all you need to be paranoid about is remote monitoring software.