I printed out a list of the top 25 infected machines (associate machines only) a bit of detail.
Associate machines are only for sales associate. The domain login is the same for every machine, associates are provided internet, email, and in-house programs to complete CRMS, web leads, in-store sales and so on. They are allowed to go to vendor websites and research diamond information online.
On the report that I have, there are some associate used machines that have 100+ threat counts for one month (this is high threats to low threats).
For the use of the computers, we have determined that 50 threats (this includes tracking cookies) should be more than what they receive in one month...there are only 10 - 15 vendor websites that they should be accessing.
What is a good way to control and reduce the threat count on these machines? I use opendns to block specific categories of websites (there are a lot of categories blocked).
- I use SunBelt's VIPRE enterprise, and have antivirus agents installed on every machine in the company doing a quickscan at 12AM, and then a deep scan at 9PM daily.
- Group polices are in-place to prevent certain changes and so forth. Some of the machines allow the domain logon as administrator, some do not. There have been some issues with this.
- we have McAfee mxlogic spam filters as a 'cloud' that filters all incoming and outgoing email from our exchange server, delivering it to outlook mailbox with in-house spam policies as well (content and so forth).
- WSUS runs updates every Tuesday from the server.
Looking for some feedback on how to control these threat counts.