stopping user from exporting the data 1

[xmario2013]

Hi :
anybody know if there is any 3rd party utility will stop user from exporting sensitive data off the network ? for example before a person quit in the company he or she may copy stuff onto a disk (USB pen or CD RW drive is a killer these days), of course we will try to limit people use of those device by disable the USB port if they dont need to or dont give them CDR drives,

but if the user is persistent enough, as long as they have read permssion to some thing, they can even simply just do a screen shot to copy the document,

how about some measure so that is disable users from being able to easily run with large amonut of data easily
out of the building

anybody have experience of doing that ?
thanks
XM

 

[ajrox]

if you really think about it....
every device known to man comes with a camera now adays.
your best bet is to lock everything down with permissions.
security background checks are a must for new employees.
there are a gazziliion ways to steal data off of a PC. all you need is physical access to it and a copy of NTFS DOS for windows on a floppy or bootable CD. by by data.
you can allso set up auditing for object access on the most critical of files just to see who is going there and when.
but nothing is a sure thing anymore.
good luck
AJ

 

[Tezdread]

disable the floppy / usb for a start, floppy in BIOS & maybe USB I don't think you can disable it with Group Policy's.

Most other security could be dione with policy's

Tezdread
"With every solution comes a new problem"

 

[SimonDavis]

You'd also need to stop them emailing it to themselves. A gmail account could take a pretty good chunk of data.

I'm not sure you really can do this.

 

[GlenJohnson]

Thin Clients Just a thought.

Glen A. Johnson
If you're from Northern Illinois/Southern Wisconsin/Central Florida feel free to join the Tek-Tips in Chicago, Illinois Forum.
TTinChicago
Johnson Computers

 

[xmario2013]

thin client and controlled email and network management(ie. IM, FTP detection) will solve most of the problem

can an encryption software like PGP do the trick ?
(ie. install the whole company with PGP software to decrypt but dont give them the private key or allow them to export the key) so whatever they finally able to email or copy out is useless without the company network to decrypt it,

but how about user using low-tech like a screen print or hard copy print and take it out of the building ?

Thanks
XM

 

[GlenJohnson]

More info on thin clients.

http://www.webopedia.com/TERM/T/thin_client.html

Glen A. Johnson
If you're from Northern Illinois/Southern Wisconsin/Central Florida feel free to join the Tek-Tips in Chicago, Illinois Forum.
TTinChicago
Johnson Computers

 

[xmario2013]

how about

http://www.adhaero.com/Secure_Info.htm

 

[Castor66]

Firms I've worked for have been auditted by banks on a number of occasions and these are roughly the things they want. If they are happy with this then they must be pretty close to total security.

Install cameras in all sensitive areas.

Disable portable mass storage devices :

http://www.gfi.com/lanpsc/

Limit the size of emails that can be sent and use journaling to make a copy of every email sent/received.

Only allow internet browsing through a proxy server and prevent user's from uploading over any protocol. Only allow internet browsing by trusted users or users who really need. Possibly use exclusive browsing so that only approved sites can be viewed.

Implement ACL's and Auditting on any sensitive files/directories.

Ensure that your security policy and your employee responsibility policy is up-to-date, legal and understood & signed by each employee. Ensure the right to search any employee on ingress or egress is there in big letters!!!

Don't allow users to have personal mobile phones in areas where computers are active.

All printing to be done through a central area and the user's must collect them and sign for them. A copy of the print is also to be kept centrally. I always thought this was totally over the top.

Don't allow any external computing devices onto the network.

Use switches and disable DHCP - use port security on your switches so only an assigned MAC address can connect to it. Setup syslog alerting if the mac address changes on any port - big red light time!

In reality, thin client is the way to go for total security. No local drive mappings - even better - stick a nice locked down version of Linux on the desktop and launch a thin client on startup. Or use KNOPPIX and let everyone boot from CD!

As a last resort, lock the doors, don't let anyone in and don't turn on the computers ;-)

 

[xmario2013]

Thanks Castor66

 

[Niyanth]

....In addition to above .. what about using key loggers SW

 

[enbw]

You can block USB access through group policies but you have to disable access to all local drives.

However, Map drives will still work to network shares but are hidden so applications will still work.

 

[minxca]

A lot of sites like these:

http://www.mirra.com/product/mirra_web_services.html

http://www.filesdirect.com/info/Default.aspx?Aff=adword03

or you can build one and upload the data