Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

At several places I've done some work at, I have a suspicion that some of the executives browse porn on their work computers. It appears this porn surfing has lead to virus infections on their computers despite the presence of an anti-virus. Filtering theses specific users' browsing is not an option, so what would be my next best solution be? I put Firefox + Adblock pro on their computers. I'm tempted to add NoScript, but I'm worried they'll start calling when noscript interferes with browsing on legit websites. Is there anything else I can due to mitigate this risk?

share|improve this question

13 Answers 13

up vote 5 down vote accepted

Might want to try a sandboxing app like Microsoft's Steady State: http://www.microsoft.com/windows/products/winfamily/sharedaccess/default.mspx

I'd also recommend a real time malware scanner, such as Windows Defender, on top of whatever anti-virus you're running. Perhaps add in a cloud based malware scanner like Threatfire or Prevx as well.

share|improve this answer

Use OpenDNS Low filtering and tell them that you are securing the company against malware, phishing, etc. You can put in legitimate exceptions by "Manag[ing] individual domains". They're not going to come to you to except porn sites, now are they? ;-)

Cheers

share|improve this answer
2  
I already have exceptions for them in place for everything.... as per their request. –  Brett G Jul 29 '09 at 21:49
    
@Brett Well.... !!! –  Alex Angas Aug 6 '09 at 13:10

You say: "It appears this porn surfing has lead to virus infections on their computers despite the presence of an anti-virus.".

I see too many answers focusing on the porn aspect of the issue.

One might land on a porn type "trap site" even when searching for something as innocent as a cookie recipe or pcitures of the latest Corvette model.

Since you are already using an antivirus product, it is probably time to review its usefuleness and replace it.

But above else, you need to be certain what is actually causing the infections other than "..this porn surfing..."

share|improve this answer
    
+1 Well said. –  John Gardeniers Jul 30 '09 at 5:43
    
I have yet to find an anti-virus product that catches everything.... –  Brett G Aug 5 '09 at 4:40
    
-1 Does it really matter how they ended up at the porn site? Does it really matter if it even was a porn site? –  Ian Boyd Sep 1 '09 at 13:26

Use IE8 or Chrome, which run at a security level below standard user. Run them as a standard user on Windows XP/Vista, so that they cannot harm their machines.

And on Windows Vista: IE8 and Chome run at a lower integrity level.

share|improve this answer
1  
Why not Opera or Firefox? –  grawity Jul 29 '09 at 19:20
    
@grawity Because Firefox and Opera cannot run at lower integrity levels (aka Protected Mode) as Chrome and IE can. –  Ian Boyd Sep 1 '09 at 13:24

Filter - but don't block porn. AV and page analysis at the gateway. Block exes. Show them how firefox is the porn fiend's browser-of-choice.

TBH, I would even be careful admitting you know why, never mind vocalising those thoughts... whatever you need to do has to be fair invisible to the user. Good luck!

share|improve this answer
    
AV and page analysis at the gateway? –  Brett G Jul 29 '09 at 21:54
    
Yeah - some kind of proxy which does AV (do you have an existing web filter that can do this, but still not block the porn?), perhaps has anti-malware URL lists, and maybe looks for suspicious javascript. Definitely block exes - those "codecs" (actually trojans) are some of the worst offenders. –  Tom Newton Jul 30 '09 at 16:28

Back when I first got into IT, I worked in a small mom-and-pop shop where we went to a lot of small offices. We'd work on their personal computers too for the same rate, and whenever there was a frequent porn surfer I'd just burn them a copy of knoppix, show them how to boot to a CD and go.

Edit: Have you tried addressing the fact that they are using work computers to look at porn with your boss? You may not have influence over them but someone up the chain can give them a "cmoonnnnnnn"

share|improve this answer
    
The OP does specify these are "executives" - not a lot of "up the chain" for them, usually... –  Paul Lathrop Jul 29 '09 at 19:05

Another option possible option, install Hyper-V on their machine and once you have a clean .VHD of their computer setup you can let them go. Especially if they're using networked profiles this would allow them to trash their local machine and for you to restore the original VHD and their network profile will still be the same so you could have them recovered instantly.

Word of advice, I'd be very careful with bringing up the topic of why these computers keep having issues if they're at the executive level. Said to the wrong person you might end up with a pink slip.

share|improve this answer
4  
Its good not to work in the US:) –  James Jul 29 '09 at 19:04
3  
+1 on keeping your lips zipped. If it makes you uncomfortable, you should probably start quietly searching for a new job. –  Paul Lathrop Jul 29 '09 at 19:06
    
You said it, aside from that the way I also see it, if they're an executive in a company and they feel they're entitled to look at porn at work I'd sure feel it's not my job to tell them it's not their place. If your company has a legal department (or even singular lawyer) you could consider working with them about drafting a new company memo about the dangers of porn in the work place, sexual harassment issues etc and make it just seem to be company wide information and they might really take to that themselves quietly. –  Chris Marisic Jul 29 '09 at 19:11
1  
No, aside from mentioning it here... I'm never planning on telling anyone. I'm not going to dictate to them where they can surf and where they can't (which is why I have an exception for them in the web filters). The only thing I'm worried about is keeping the computer safe from viruses wherever they go on the web. –  Brett G Jul 29 '09 at 21:24

Sandboxie can be useful for this purpose. Generally it tries to intercept all disk and is stores them in a sandbox folder. I find it works particularly well when combined with instance of Portable Firefox.

share|improve this answer
    
Please note that it only works on 32 bit Windows (2000/XP/Vista/7), not 64 bit versions. –  Peter Mortensen Jul 29 '09 at 22:50

Options I'd look into...

1) inline filtering. I thought I ran across this setup before; basically having HTTP traffic filtered for malware as they're surfing (filter for content of malware, not block the porn...wanted to make that clear). Something like the implementation for HAVP-Squid Secure Proxy or WebScan from this page. There may be others on that list too.

2) Sandboxie. There may be other software similar to this.

3) Faronics Deep Freeze; however, users can only save data to network drives, their profile, or external drives (or other partitions you configure for saving data to). When you reboot, the computer goes back to the way it was when frozen. We don't run antivirus on systems with this on it since anything that infects it will disappear at reboot (we found deleting c:\Windows to be cathartic...rebooting recovers the OS). This will still let them infect their profile but their system will be safe.

4) Use something like Partimage or other imaging software that will let you create hard drive snapshots in order to recover their systems when they're infected.

That's everything off the top of my head that I would explore as possibilities...

share|improve this answer
    
If you're looking at something like Deep Freeze preventing changes to persist across reboots, also take a look at Windows SteadyState: microsoft.com/windows/products/winfamily/sharedaccess/… It's a no-charge package from MS that may accomplish most or all of you likely would want Deep Freeze to be able to "re-fresh" a PC. –  damorg Jul 30 '09 at 14:07

There are ways to deal with these issues but you're going about it all wrong. First, you need to get your facts together. Suspicions and assumptions are useless. This is a simple and routine admin task.

  • Find out why the AV software appears to be ineffective and either fix or replace it
  • Find out where the infections are coming from, without the guesswork
share|improve this answer

My recommendation would be to find whitepapers from companies like Finjan, McAfee, etc that talk about "drive-by Malware". I recall that Finjan in particular has case studies about major retailers whose sites were hacked used to distribute malware.

Use that pretense to wave your hands and get a few executive-types excited, then use the chaos to implement a few improvements, like:

  • Upgrade to Vista/7
  • Have them run as unprivileged users
  • Provide them with an admin account without internet access
  • Install appropriate tools to protect the network (like a local firewall)

You also need to manage the political situation. If you have multiple people in IT, designate one the "Executive Support" person, and make executive work the priority 1 and track the work. When other projects drag, the reason becomes the amount of cycles that VP Fred and EVP Bob are using up. (Don't mention the porn) You can't just whine about it -- you must explicitly document it.

Keep in mind that you cannot solve the world's problems. If it is acceptable for people to use company assets to futz around with porn, your options are limited. Just make an honest effort to mitigate the risk to the enterprise as a whole, and cover your ass in the process.

share|improve this answer

Enable a group policy that forces IE browser history to be kept for say 30 days. Then have it hide the tab that has the clear history on it. I think the tab can be hidden, I know you can set prevent them from clearing.

Make it company wide, it's simply a new security policy....... :)

Caught in the act would be what you're going for.

If not, then go with the CD idea. Release a company policy that says we understand when travelling one may need to use company assets for visiting personal sites. As such we are providing all laptop users with a bootable CD that will allow seperation of personal and company internet browsing. They'll clue into it without it actually being said.

or do both :) That forces them to use the CD.

share|improve this answer

Give them a bill for your time fixing the PC and suggest they simply subscribe to a site. I'm sure it would be less expensive and give them a "clean" path to what they seek.

share|improve this answer
    
They are top executives ... company anyways would pay the bill and they wouldn`t care much . You know, you can make company to pay for computer fixing, but not for pr0n site :) –  Kristaps Jul 29 '09 at 20:05
    
If they're going to insist on using business resources for their non business habits, you should be able to straight faced suggest that they subscribe to an electronically safe source of content so that they do not trash their machines. After all, if this is condoned by management, why shouldn't a paltry monthly subscription be in order? –  Kevin Kuphal Jul 29 '09 at 20:28
1  
I'd love to see the tax deducation for a subscription to "xxxmidgetsintightpants.com" explained to an auditor! –  Mark Henderson Jul 30 '09 at 0:11
1  
There's nothing quite like telling the person who already pays the bills, or at least signs for them, that they have to pay you extra to fix their computer. Yep, that's one heck of a career move. –  John Gardeniers Jul 30 '09 at 5:41
    
Then again, if you can't explain it to the auditor...MAYBE you shouldn't be doing it –  Kevin Kuphal Jul 30 '09 at 20:03

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.