-4

I have setup a small virtual office. How do I prevent my employees from uploading their work files (mostly excel workbooks) to gmail/drive or the gazillion other file sharing sites? Is there a url block list which I can download from somewhere? Is there a specific port which I can block to prevent uploads?

What about proxies? Is it possible to use a third party proxy service to achieve this? When I search proxies, its only the UNBLOCKING proxies I find. But looks like this could get me somewhere.

Third party software - I am exploring these too. Though it looks too much for a simple ask of blocking just the file sharing sites.

edit - Virtual office : I am toying with Microsoft Azure virtual machines at the moment. MS Windows Server 2012 edition. Might go in for Amazon Web Services as well, similar configuration.

|improve this question
  • 1
    Please edit and describe virtual office. Who is working where and on what? – user13695 Dec 23 '16 at 13:44
  • You tried opendns VIP with whitelist? What do you mean virtual workstations? – user81331 Dec 24 '16 at 11:44
  • Instead of URL block lists, what you need is a service that categorises websites and allows you to block based on 'file upload/file share' categories. Many DNS services do this. – schroeder♦ Dec 24 '16 at 14:19
  • @schroeder looks like your suggestion is what will work for me. maybe I am typing the wrong string in my search queries. Could you please please share how to get these services? A link or two, or even a what I am supposed to search for to get these in my SERPs would be so helpful. – Terra Vita Dec 25 '16 at 2:04
  • @TerraVita "Web content filter" or "DNS content filtering" OpenDNS is an example of a vendor that does this. You may get inspiration for a better search by looking at what they offer. – schroeder♦ Dec 25 '16 at 7:59
3

You say in your title you want to

prevent employees from stealing work files/data

In your question, however, it's only about file shares.

Web filtering as in blocking URLs will definitely make it harder for your employees to upload files to file shares, but it will not stop them from stealing files in other ways if they know what they are doing. Your employees could instead use email, or upload the file to an FTP server, or even just use an USB stick.

To really keep them from stealing files via removable storage, you would need to disable all USB ports, disable boot from CD/DVD and lock down the BIOS.

Then you set your company's firewall to a whitelist approach so that they can only access domains you specify. Be aware, this will give your employees a hard time if they need to do lots of online research. Your IT staff will need to check a lot of URLs. If that is overkill for you, at least use a blacklist and log every URL, then disallow file uploads (limit the outgoing HTTP header size to a minimum, that will at least stop them from uploading a whole spreadsheet at once). Use deep packet inspection if you want to catch employees trying to upload small chunks of a spreadsheet at a time.

Block all traffic except on port 80 and 443 and use a firewall with SSL inspection capabilities so you make sure they don't use encryption to bypass your filters. That way you also keep them from using FTP (unless they own an FTP server and set it to respond on port 80).

Set their mail client to route all mails through the company server and, on the server, only allow attachments on mails for addresses you specify in a whitelist. Also, use your firewall to keep them from just downloading another mail client or another browser.

That said, no doubt you can make it hard(er) for your employees to take your files, but it is just not possible to really stop them. If they know what they are doing, they can circumvent almost every security measure you put in unless you set your policies so restrictive that it causes a lot of inconvenience in their daily work flow.

|improve this answer
  • Yes RenWal. Thanks for confirming that ateast I am thinking in the right direction. My employees arent likely to be too info-tech savvy, and I am looking at a basic level of blocking. Yes, I am only concerned about files. Since it is a virtual desktop, I would assume USB ports etc are not applicable. Do you know of any url black-lists that I can download and simply apply? Willing to spend some money on it if required, so paid lists would be ok too... – Terra Vita Dec 23 '16 at 14:45
0

URL blacklist won't work. You need URL whitelist, which means only the whitelisted sites can be visited.

First, please check whether your firewall/router supports "website white list".

If not, you need to buy a new device with this feature, or deploy a pass-by web filter.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.