January 10, 2009 at 11:41 pm #3196neteng33Participant
I have a situtation that I am trying to find solution to. My company, like many, is experiencing a tough time with the current economic climate. Unfortunately, we have had to lay some employees off, and this is a contributing factor to many employees resorting to anonymously posting very negative and libelous comments about the company. Senior management is convinced that these postings are coming from employees that are posting using company equipment on company time. We have used our existing web content filtering system to confirm that employees have visited the particular site from company networked PCs. However, I am unable to determine exactly what actions they are taking (what text they are actually posting).
Is anyone aware of any network based tools (not interested in installing client side software on a gazillion workstations) or creative techniques that I might use to determine what exactly is being posted? I do understand that I would only be able to monitor networks/systems under my companies control.
January 11, 2009 at 12:25 am #21312apolloParticipant
You could always write some snort rules that log posts to the sites you are most interested in monitoring. You would probably get way more than you wanted, but that would certainly be a possibility.
January 11, 2009 at 2:48 am #21313AnonymousParticipant
sure plug a linux box with a big hard drive into the span port and create a tcpdump filter to capture everything from the workstations the suspected employees are using.
January 11, 2009 at 3:25 am #21314neteng33Participant
Thanks for the suggestions guys. Actually, I don’t think any suspects have been identified, which is one of the reasons that i am not interested in a solutions that require software to be installed on client workstations (thousands of machines). Also, we are a medim size company with several Internet connections, so whatever solution I come up with will have to be replicated at at least 6 locations.
January 11, 2009 at 12:09 pm #21315geekyoneParticipant
I agree with Apollo an IDS rule that triggers on posts would be the easiest and cheapest method. You might also want to combine that with a string search based on your company name and variations. That should give you a lot less false positives.
January 12, 2009 at 2:39 pm #21316dalepearsonParticipant
Personally I would have thought your companys Internet policy would not allows access to blogs etc, although with your current situation this will probably add more fuel to the company bashing people do in their own time, but this you cant control.
My reason for posting, was just to offer some advice on the level of monitoring you undertake. Not sure where you are based, but most companys have privacy and human rights laws, and as such extreme monitoring at a personal level without concent could leave you in hot water.
I would suggest involving your legal and hr teams for additional support and guidance.
January 13, 2009 at 7:14 am #21317adamjParticipant
That’s what an acceptable use policy is all about. Note too, that as far as I’m aware, the laws between different countries vary considerable regarding how much monitoring is allowed, and whether or not the company has to have some just cause for doing a thorough audit of an employee’s machine etc.
IDS rules won’t be perfect. You only have to look at spam filtering to see how limited machines can sometimes be at matching patterns etc without proper context!
January 13, 2009 at 5:13 pm #21318BogwitchParticipant
IANAL. A word of caution, unless you have explicity told your staff that their computer use can be monitored and recorded and that they have signed to agree to such monitoring, you may find yourself on the wrong side of the law if you install a border monitoring product (tcpdump, wireshark, etc) and may also find that any gathered evidence is inadmissable if things progress to court, e.g. after disciplinary measures, etc.
February 14, 2009 at 7:45 pm #21319timmedinParticipant
Assuming you read the information from the other posters about legality and policly…
We use websense to monitor this. You can drill down and see the full url that was accessed. If someone posted on a certain blog you could search websense for access to that site and look at the url, specifically the url for posting.
If you set something like this up, save yourself the trouble and block those types of sites unless there is a solid business case for your company or department.
- You must be logged in to reply to this topic.