.

Any good network based solutions for blog monitoring?

<<

neteng33

Newbie
Newbie

Posts: 8

Joined: Sat Jul 12, 2008 8:36 am

Post Sat Jan 10, 2009 6:41 pm

Any good network based solutions for blog monitoring?

Hello,

I have a situtation that I am trying to find solution to. My company, like many, is experiencing a tough time with the current economic climate. Unfortunately, we have had to lay some employees off, and this is a contributing factor to many employees resorting to anonymously posting very negative and libelous comments about the company. Senior management is convinced that these postings are coming from employees that are posting using company equipment on company time. We have used our existing web content filtering system to confirm that employees have visited the particular site from company networked PCs. However, I am unable to determine exactly what actions they are taking (what text they are actually posting).

Is anyone aware of any network based tools (not interested in installing client side software on a gazillion workstations) or creative techniques that I might use to determine what exactly is being posted? I do understand that I would only be able to monitor networks/systems under my companies control.

Thanks
<<

apollo

Full Member
Full Member

Posts: 146

Joined: Fri Apr 04, 2008 7:44 pm

Post Sat Jan 10, 2009 7:25 pm

Re: Any good network based solutions for blog monitoring?

You could always write some snort rules that log posts to the sites you are most interested in monitoring.  You would probably get way more than you wanted,  but that would certainly be a possibility.
CISSP, CSSLP, MCSE+Security, MCTS, CCSP, GPEN, GWAPT, GCWN, NOP, OSCP, Security+
<<

LSOChris

Post Sat Jan 10, 2009 9:48 pm

Re: Any good network based solutions for blog monitoring?

cheap way:
sure plug a linux box with a big hard drive into the span port and create a tcpdump filter to capture everything from the workstations the suspected employees are using.

expensive way:
install netwitness
<<

neteng33

Newbie
Newbie

Posts: 8

Joined: Sat Jul 12, 2008 8:36 am

Post Sat Jan 10, 2009 10:25 pm

Re: Any good network based solutions for blog monitoring?

Thanks for the suggestions guys.  Actually, I don't think any suspects have been identified, which is one of the reasons that i am not interested in a solutions that require software to be installed on client workstations (thousands of machines).  Also, we are a medim size company with several Internet connections, so whatever solution I come up with will have to be replicated at at least 6 locations.
<<

geekyone

User avatar

Full Member
Full Member

Posts: 180

Joined: Fri Oct 26, 2007 12:45 pm

Location: Peoria, IL

Post Sun Jan 11, 2009 7:09 am

Re: Any good network based solutions for blog monitoring?

I agree with Apollo an IDS rule that triggers on posts would be the easiest and cheapest method.  You might also want to combine that with a string search based on your company name and variations.  That should give you a lot less false positives.
CISSP, CEH, GPEN, GCIH, GCFA
<<

dalepearson

Sr. Member
Sr. Member

Posts: 357

Joined: Thu Nov 09, 2006 10:03 am

Post Mon Jan 12, 2009 9:39 am

Re: Any good network based solutions for blog monitoring?

Personally I would have thought your companys Internet policy would not allows access to blogs etc, although with your current situation this will probably add more fuel to the company bashing people do in their own time, but this you cant control.

My reason for posting, was just to offer some advice on the level of monitoring you undertake. Not sure where you are based, but most companys have privacy and human rights laws, and as such extreme monitoring at a personal level without concent could leave you in hot water.

I would suggest involving your legal and hr teams for additional support and guidance.
<<

adamj

User avatar

Newbie
Newbie

Posts: 17

Joined: Wed Jan 23, 2008 11:49 pm

Location: Maryland

Post Tue Jan 13, 2009 2:14 am

Re: Any good network based solutions for blog monitoring?

That's what an acceptable use policy is all about.  Note too, that as far as I'm aware, the laws between different countries vary considerable regarding how much monitoring is allowed, and whether or not the company has to have some just cause for doing a thorough audit of an employee's machine etc.
IDS rules won't be perfect.  You only have to look at spam filtering to see how limited machines can sometimes be at matching patterns etc without proper context!
<<

Bogwitch

Jr. Member
Jr. Member

Posts: 51

Joined: Wed Aug 16, 2006 3:29 am

Post Tue Jan 13, 2009 12:13 pm

Re: Any good network based solutions for blog monitoring?

IANAL. A word of caution, unless you have explicity told your staff that their computer use can be monitored and recorded and that they have signed to agree to such monitoring, you may find yourself on the wrong side of the law if you install a border monitoring product (tcpdump, wireshark, etc) and may also find that any gathered evidence is inadmissable if things progress to court, e.g. after disciplinary measures, etc.
CISSP, C|EH, C|HFI
<<

timmedin

User avatar

Sr. Member
Sr. Member

Posts: 469

Joined: Thu Feb 05, 2009 11:18 pm

Post Sat Feb 14, 2009 2:45 pm

Re: Any good network based solutions for blog monitoring?

Assuming you read the information from the other posters about legality and policly...

We use websense to monitor this. You can drill down and see the full url that was accessed. If someone posted on a certain blog you could search websense for access to that site and look at the url, specifically the url for posting.

If you set something like this up, save yourself the trouble and block those types of sites unless there is a solid business case for your company or department.
twitter.com/timmedin | http://blog.securitywhole.com

Return to Forensics

Who is online

Users browsing this forum: No registered users and 1 guest

.
Powered by phpBB® Forum Software © phpBB Group.
Designed by ST Software