Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

In our office we are blocking sites like facebook, twitter etc.The problem is that some of the users bypass the proxy and firewalls through external sites which allow us to bypass proxy, like:

www.youhide.com

www.freezethefirewall.com

There are enormous sites on the Internet which allow us to bypass the proxy and access the blocked sites.
Is it there any method to prevent the access to blocked websites?
We are currently using windows 2003 server and client machines with xp platforms

share|improve this question
add comment

3 Answers

up vote 5 down vote accepted

The technical solution is to monitor access and block new offending sites as they appear.

This isn't a technical problem, it's a policy problem. You cannot possibly block every proxy out there, so you must stop the problem at its source - the employees. You need them to understand why you're blocking those sites, and why they should adhere to your policies.

First, you need to identify what your policy is, and have your employees sign a copy. An internet policy at a workplace can be really easy to create. Ours looks something like this:

Whilst at work, we expect you to work. Your work will require access to the internet. We trust you to understand that, whilst browsing social networking sites all day is tempting, it's counter-productive. Furthermore, there are certain types of content and activity that are not appropriate for a work environment. As such, this policy aims to provide a basic set of guidelines around internet access at work.

As part of this policy, we expect you to agree to the following terms:

  1. Your internet activity at work may be monitored and logged, in order to facilitate investigation of any inappropriate usage.
  2. You should use internet access for work purposes, with personal use (Facebook, Twitter, etc.) kept to a minimum.
  3. You must not abuse your privilege of internet access. This includes browsing pornography and other abhorrent materials, downloading files from file sharing networks, or any other activity that may cause damage or degradation to our network.
  4. Your activity on social media sites is your own, and we respect that. However, you agree that, as an employee, your behaviour reflects on the company. As such, you should avoid posting content that is likely to damage the reputation of the company.
  5. You must not distribute any of the company's intellectual property via the internet, in accordance with the non-disclosure agreement you signed when joining the company.
  6. You must adhere to the attached security policy.

Breach of these terms is grounds for disciplinary action, or, in severe cases, dismissal.

We provide the following guarantees:

  1. All logs will be safely stored in accordance with the Data Protection Act 1998.
  2. Upon termination of your work contract with the company, all logs related to internet activity on your account will be destroyed.
  3. We shall attempt to make access to the internet available at all times, at a reasonable speed.
  4. We shall make appropriate provisions to ensure that the network is secure and functional.

In order to fulfil our guarantees, we need our employees to adhere to this policy in its entirety. Should you have any questions about this policy, please speak to your line manager.

This document forms a binding contract with between you and the company.

Name (print): __________________________________________________________
Signature: __________________________________________________________
Date: ____ / ____ / ________


The goal is to make it clear, short, and informative. Make sure they understand exactly why the policy is in place:

  • To make sure people are actually doing the work you pay them to do.
  • To help ensure that that network security is maintained.
  • To make sure that the network access is fast for those who need it.

Once you've got a policy in place, you must enforce it. Penalise employees that violate the internet policy, and fire those who do it repeatedly.

share|improve this answer
add comment

Truth is, there's really no reliable way to provide general Internet access while at the same time removing access to sites you don't want.

Back when I worked in a cubicle I used to waste my time finding new and interesting ways to circumvent all the IT security policies. And I can tell you with relative certainty that there is no solution that can't be broken by someone with the proper motivation, know-how, and a few hours at home for some preparation. Eventaully they just gave up and put me in charge of IT. :-)

Your best bet may be not to prevent access, but to log it. If you block access, then people will circumvent the blocks. But if you log access, then there's nothing to circumvent. The prevention comes in the form of self-regulation when they know with certainty that they'll have to account for their behavior.

It helps to get your employees to buy-in to the policy; this dramatically simplifies everything. If you think that YouTube shouldn't be allowed but they're visiting it anyway, then clearly they disagree with you. You may perhaps deprecate the value of getting employees to agree with your policies, but you do so at your own peril. Maintaining an adversarial relationship with the people you work with will cause significantly more problems with security and productivity than blocking YouTube could ever solve.

But if you can come up with a set of practices and policies that protects the company while at the same time treating your employees as they'd like to be treated, you'll find compliance dramatically easier to maintain.

Obviously each company is different, and each has different requirements. But my point is that this is a employee-relations problem rather than a technical one.

share|improve this answer
3  
And don't forget that your corporate network is only one of dozens (hundreds?) of Internet uplinks in your office. Everybody has a cell phone, right? –  tylerl Sep 25 '12 at 9:46
add comment

I suggest you try Qustodio. I have been using it as my primary content filtering application and it has served me well. It is extremely easy to use, provides detailed reports, blocks sites in real time and is hard to crack. I believe it will serve your purpose well.

share|improve this answer
    
If you are affiliated with the product please see the FAQ for guidance on proper disclosure. –  Scott Pack Oct 8 '12 at 20:44
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.