disallowing sending of data via web mail

[techsupp]

I work for a computer support company, and many of our clients are recruitment companies. Their staff obviously need to browse the web to do their jobs.

The number one concern of these clients is that they don't want their staff to be able to steal their contact database. The staff need to be able to see and use the database (often ACT or some other simple db program), but should not be able to take it out of the office. We can remove floppy drives, zip drives, cd burners etc, but it seems difficult to stop them being able to zip up the database file and email it to someone. We can stop it at the corporate email server level, but I haven't found a way to stop (or even detect) the staff using Hotmail or similar service to email the file as an attachment. We could block the Hotmail site, and Yahoo mail, but there are so many others out there that that approach seems futile.

Any ideas?


Richard Carrey

 

[SgtB]

Not only would you have to worry about mail servers, but public ftp servers and such.

Here's an idea though. Web mail is not part of the job right? Well, you can write up a security policy stating that those sites are off limits. Block the big ones (yahoo,hotmail) on the firewall. Then set up an internet monitoring tool so you can catch users that go to the mail sites. Have some sort of punishment there or something. Also have them sign some sort of statement that they won't take contact list offsite under penalty of <fill in the blank>.
You can set up some content filtering that will catch/block keywords like &quot;contact&quot; or &quot;phone number&quot; that are sent over the internet. I'm not sure what application you could use for that, but I'm sure there's one out there.

Sounds extreme right? But, I can't think of a better way to do it. ________________________________________
Check out

http://www.security-forums.com

 

[pansophic]

Depending on your budget for this, you may want to take a look at:

http://www.sandstorm.com/products/netintercept/

I can't vouch for the product, as I've never used it. But everything that they claim is possible using open source tools, so I can easily believe that they have automated it.

I have used their PhoneSweep product years ago, and other than its poor reporting capabilities (which have been fixed now, I understand), it was really pretty solid.
pansophic

 

[browolf]

These databases should be delivered through some sort of intranet so that users can browse/search the information but dont actually have access to the database file. This is the most secure way.
It's fairly easy to make ASP pages on IIS talk to databases.

Even if you blocked zip files ppl could just alter the extension, mail it and then change it back at the other end.

if you blocked webmail, what's to stop ppl uploading it to geocities or other webbased ftp pages.

In the situation you describe you're chasing your tail. Constantly trying to keep up with the users(abusers). There's endless possibilties.
===============
Security Forums

http://www.security-forums.com

 

[techsupp]

Thanks for those helpful suggestions. The contractual side between the employer and employee is normally in place already. The hardware monitoring device looks just the job, but is a bit pricy at US$7,500, but it's useful to have something to offer the worried clients.

As browolf says, there are just too many possibilities. Even if you block access to the files, if the can see the data they can do screen captures and paste to a Word document.

I think it's the same old story of nothing being truely secure, you can just make it a bit harder for them to get away with it. I had been hoping for a solution along the lines of &quot;Make sure port xyz is closed&quot; but sadly, it's rarely that simple!

Richard

 

[hnd]

The really only thing is to Monitor ALL activities of your staff. Even blocking Internet ports does not prevent a user from downloading a Tool which could Transfer Data to Port 80 of an arbitrary server, Which has been prepared for this purpose.
But be careful that you do not violate the privacy of your staff.

hnd
hasso55@yahoo.com