How to block the websites on client machines

Question

In our office we are blocking sites like Facebook, Twitter etc.The problem is that some of the users bypass our proxy and firewalls through external proxy sites like www.youhide.com or www.freezethefirewall.com.

Problem: There's an enormous number of proxy sites on the Internet.
Is there any method to really prevent access to the blocked websites?

We are currently using windows 2003 server and client machines with xp platforms.

Answer 1

The technical solution is to monitor access and block new offending sites as they appear.

This isn't a technical problem, it's a policy problem. You cannot possibly block every proxy out there, so you must stop the problem at its source - the employees. You need them to understand why you're blocking those sites, and why they should adhere to your policies.

First, you need to identify what your policy is, and have your employees sign a copy. An internet policy at a workplace can be really easy to create. Ours looks something like this:

Whilst at work, we expect you to work. Your work will require access to the internet. We trust you to understand that, whilst browsing social networking sites all day is tempting, it's counter-productive. Furthermore, there are certain types of content and activity that are not appropriate for a work environment. As such, this policy aims to provide a basic set of guidelines around internet access at work.

As part of this policy, we expect you to agree to the following terms:

1. Your internet activity at work may be monitored and logged, in order to facilitate investigation of any inappropriate usage.
2. You should use internet access for work purposes, with personal use (Facebook, Twitter, etc.) kept to a minimum.
3. You must not abuse your privilege of internet access. This includes browsing pornography and other abhorrent materials, downloading files from file sharing networks, or any other activity that may cause damage or degradation to our network.
4. Your activity on social media sites is your own, and we respect that. However, you agree that, as an employee, your behaviour reflects on the company. As such, you should avoid posting content that is likely to damage the reputation of the company.
5. You must not distribute any of the company's intellectual property via the internet, in accordance with the non-disclosure agreement you signed when joining the company.
6. You must adhere to the attached security policy.

Breach of these terms is grounds for disciplinary action, or, in severe cases, dismissal.

We provide the following guarantees:

1. All logs will be safely stored in accordance with the Data Protection Act 1998.
2. Upon termination of your work contract with the company, all logs related to internet activity on your account will be destroyed.
3. We shall attempt to make access to the internet available at all times, at a reasonable speed.
4. We shall make appropriate provisions to ensure that the network is secure and functional.

In order to fulfil our guarantees, we need our employees to adhere to this policy in its entirety. Should you have any questions about this policy, please speak to your line manager.

This document forms a binding contract with between you and the company.

Name (print): __________________________________________________________
Signature: __________________________________________________________
Date: ____ / ____ / ________

The goal is to make it clear, short, and informative. Make sure they understand exactly why the policy is in place:

• To make sure people are actually doing the work you pay them to do.
• To help ensure that that network security is maintained.
• To make sure that the network access is fast for those who need it.

Once you've got a policy in place, you must enforce it. Penalise employees that violate the internet policy, and fire those who do it repeatedly.

Answer 2

Truth is, there's really no reliable way to provide general Internet access while at the same time removing access to sites you don't want.

Back when I worked in a cubicle I used to waste my time finding new and interesting ways to circumvent all the IT security policies. And I can tell you with relative certainty that there is no solution that can't be broken by someone with the proper motivation, know-how, and a few hours at home for some preparation. Eventaully they just gave up and put me in charge of IT. :-)

Your best bet may be not to prevent access, but to log it. If you block access, then people will circumvent the blocks. But if you log access, then there's nothing to circumvent. The prevention comes in the form of self-regulation when they know with certainty that they'll have to account for their behavior.

It helps to get your employees to buy-in to the policy; this dramatically simplifies everything. If you think that YouTube shouldn't be allowed but they're visiting it anyway, then clearly they disagree with you. You may perhaps deprecate the value of getting employees to agree with your policies, but you do so at your own peril. Maintaining an adversarial relationship with the people you work with will cause significantly more problems with security and productivity than blocking YouTube could ever solve.

But if you can come up with a set of practices and policies that protects the company while at the same time treating your employees as they'd like to be treated, you'll find compliance dramatically easier to maintain.

Obviously each company is different, and each has different requirements. But my point is that this is a employee-relations problem rather than a technical one.

Answer 3

You have two options:

1. Modify the hosts file C:/windows/system32/config/etc and add the website address
2. you can use a proxy server to block certain websites (more specific with users IPs) like squid or TMG / ISA.

Another effective way is using software like open NDS or Aobo Filter.