Top Infected Machines - Dealing with Threats?

Question

I printed out a list of the top 25 infected machines (associate machines only) a bit of detail..

associate machines are only for sales associate. the domain login is the same for every machine, associates are provided internet, email, and inhouse programs to complete CRMS, web leads, instore sales and so on. they are allowed to go to vendor websites and research diamond information online.

on the report that I have, there are some associate used machines that have 100+ threat counts for one month (this is high threats to low threats).

for the use of the computers, we have determined that 50 threats (this includes tracking cookies) should be more than what they receive in one month.. there are only 10 - 15 vendor websites that they should be accessing.

what is a good way to control and reduce the threat count on these machines? I use opendns to block specific categories of websites (there are alot of categories blocked).

• I use sunbelts VIPRE enterprise, and have antirvirus agents installed on every machine in the company doing a quicks can at 12AM, and then a deep scan at 9PM daily.

• Group polices are inplace to prevent certain changes and so forth. Some of the machiens allow the domain logon as administrator, some do not. There have been some issues with this.

• we have mcafee mxlogic spam filters as a 'cloud' that filters all incoming and outgoing email from our exchange server, delivering it to outlook mailbox with inhouse spam policies as well (content and so forth).

• WSUS runs updates every tuesday from the server

  looking for some feedback on how to control these threat counts..

  thanks

Answer 1

This is almost a HR issue but without detail it's difficult to say.

Here you'd need to look at what the threats are that are being listed. There is an IT/change management issue here if activities are being characterised as threats incorrectly by the software and another if something is characterised as a threat but the employee is not misusing resources.

Beyond that I agree with Robert that this is a HR issue

Answer 2

In similar situation I finally blocked everything but those 10-15 vendor sites. Can you do that to your associates?

It is strange that your anti-virus is able to find threats only after PC got infected.

Answer 3

I know that my outlook is pretty different than most in IT - I work at a university, we have zero control over client machines, everything we do is network-based.

How about just putting those associates machines in their own VLAN, and then creating rules on the router or firewall to block traffic to EVERYTHING but the sites they should be getting to? Even a simple open source router/firewall like Vyatta, with Squid URL filter, should do the job fine...