Any good network based solutions for blog monitoring?

Viewing 8 reply threads
  • Author
    • #3196


      I have a situtation that I am trying to find solution to. My company, like many, is experiencing a tough time with the current economic climate. Unfortunately, we have had to lay some employees off, and this is a contributing factor to many employees resorting to anonymously posting very negative and libelous comments about the company. Senior management is convinced that these postings are coming from employees that are posting using company equipment on company time. We have used our existing web content filtering system to confirm that employees have visited the particular site from company networked PCs. However, I am unable to determine exactly what actions they are taking (what text they are actually posting).

      Is anyone aware of any network based tools (not interested in installing client side software on a gazillion workstations) or creative techniques that I might use to determine what exactly is being posted? I do understand that I would only be able to monitor networks/systems under my companies control.


    • #21312

      You could always write some snort rules that log posts to the sites you are most interested in monitoring.  You would probably get way more than you wanted,  but that would certainly be a possibility.

    • #21313

      cheap way:
      sure plug a linux box with a big hard drive into the span port and create a tcpdump filter to capture everything from the workstations the suspected employees are using.

      expensive way:
      install netwitness

    • #21314

      Thanks for the suggestions guys.  Actually, I don’t think any suspects have been identified, which is one of the reasons that i am not interested in a solutions that require software to be installed on client workstations (thousands of machines).  Also, we are a medim size company with several Internet connections, so whatever solution I come up with will have to be replicated at at least 6 locations.

    • #21315

      I agree with Apollo an IDS rule that triggers on posts would be the easiest and cheapest method.  You might also want to combine that with a string search based on your company name and variations.  That should give you a lot less false positives.

    • #21316

      Personally I would have thought your companys Internet policy would not allows access to blogs etc, although with your current situation this will probably add more fuel to the company bashing people do in their own time, but this you cant control.

      My reason for posting, was just to offer some advice on the level of monitoring you undertake. Not sure where you are based, but most companys have privacy and human rights laws, and as such extreme monitoring at a personal level without concent could leave you in hot water.

      I would suggest involving your legal and hr teams for additional support and guidance.

    • #21317

      That’s what an acceptable use policy is all about.  Note too, that as far as I’m aware, the laws between different countries vary considerable regarding how much monitoring is allowed, and whether or not the company has to have some just cause for doing a thorough audit of an employee’s machine etc.
      IDS rules won’t be perfect.  You only have to look at spam filtering to see how limited machines can sometimes be at matching patterns etc without proper context!

    • #21318

      IANAL. A word of caution, unless you have explicity told your staff that their computer use can be monitored and recorded and that they have signed to agree to such monitoring, you may find yourself on the wrong side of the law if you install a border monitoring product (tcpdump, wireshark, etc) and may also find that any gathered evidence is inadmissable if things progress to court, e.g. after disciplinary measures, etc.

    • #21319

      Assuming you read the information from the other posters about legality and policly…

      We use websense to monitor this. You can drill down and see the full url that was accessed. If someone posted on a certain blog you could search websense for access to that site and look at the url, specifically the url for posting.

      If you set something like this up, save yourself the trouble and block those types of sites unless there is a solid business case for your company or department.

Viewing 8 reply threads
  • You must be logged in to reply to this topic.

Copyright ©2020 Caendra, Inc.

Contact Us

Thoughts, suggestions, issues? Send us an email, and we'll get back to you.


Sign in with Caendra

Forgot password?Sign up

Forgot your details?