Firewalls do not monitor internal abuse even if configured properly. Organizations are dynamic and their people, software, and networks all constantly change. Unless you are constantly monitoring for intrusions, you cannot know if your firewall is functioning properly. As such, the KSM is a vital tool to monitor your network seven days per week 24 hours per day. My company has an Intranet.
Most security studies show that internal security breaches are as common as external threats.
In most cases, internal servers contain much more important corporate information than the external sites placed on the World Wide Web. While you may trust your co-workers and employees, mistakes can happen and crucial data may be inadvertently changed or lost. KSM allows you to monitor access permissions to important files, and secures the integrity of your data. If you are responsible for the content of the server, you should have the tools in place to enforce the security. KSM checks the security log files on servers and workstations being monitored for certain activities and patterns.