检测使用HTTP上传和使用USB设备复制
我的（pananoid！）老板要求我做两件事 1. 检测用户何时使用 HTTP 将文件上传到网络。例如，我如何检测用户是否将火上传到某个地方的免费网络服务器，并可以窃取公司数据
- 检测用户正在将文件复制到 USB 设备以及这些文件的名称是什么。此外，如果他们复制 zip 文件来记录 zip 文件的内容，以防有人只是压缩一些公司文件并像这样获取它。
首先，第1种可能吗？对于第二个，我可以检测到复制的文件名吗？
其次，有人喜欢这样做的软件吗？
请注意，我是网络管理员，我要监控的每个人都在其计算机上拥有本地管理员权限，我们不想进一步限制用户访问。
多谢
I have been asked by my (pananoid!) boss to do two things
1. Detect when a user uploaded files to the net using HTTP. So for example how can I detect if a user uploads fire to a free webserver somewhere and can hense steal company data
- Detect that a user is copying files to a USB device and what the name of these files are. Also if they copy a zip file to log the contents of the zip file, in case someone just zips up some company files and takes it like that.
Firstly is number 1 possible? and for number 2 can i detect the file names that are copied?
Secondly, any likes to software that does this?
Note that I am the network admin and everyone who I will monitor has local admin rights on their computer and we do not want to further restrict users access.
Thanks a lot
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
可以拥有自由或安全，但不能两者兼而有之。从未上锁的盒子中获取数据的路径太多，无法一一列举。有人将文件压缩并放在拇指驱动器上？如果他们使用< code>tar 或
shar或将它们粘贴到 Word 文档中，或打印到 PDF 文件并通过电子邮件发送隐写式嵌入色情内容？是的，一位前同事愚蠢到向他未来的雇主发送了一大堆记录的电子邮件离开前几天，但你不能指望人们会那么愚蠢，因为
你的老板想要的东西是不可能的，因为小偷的动机中等，并且不想“进一步限制”访问。
You can have liberty or security, but not both. The number of paths to get data out of an unlocked box are too many to enumerate. Someone zipped up the files and put them on a thumb drive? What if they used
tarorsharor pasted them into a Word document, or printed them to a PDF file and sent it out via e-mail steganographically embedded in pornography?Yeah, a former coworker was stupid enough to send a huge set of huge, logged e-mails to his future employer a couple of days prior to leaving, but you can't count on people being quite that stupid.
What your boss wants isn't possible given a moderately motivated thief and not wanting to "further restrict" access.
鉴于几乎任何人都可以免费使用 OpenSSH（ssh、scp）等加密安全工具，他所要求的东西是不可能的。
Given freely available cryptographically secure tools like OpenSSH (ssh, scp) are usable by almost anyone, what he's asking for is not possible.
我同意你们所有人的观点，websense、DLP、代理、网络监控可以帮助您识别并阻止您的策略不允许的活动。顺便说一句，技术应该通过信息安全政策和意识计划来维持。所以你有两个领域需要建立。一方面，人们必须因信息安全政策而受到警告，并不断通过意识计划得到通知，然后（第二）如果有人违反政策，技术必须发挥作用。警告你。
I agree with all of you, websense, a DLP, a proxy, a network monitoring, can help you to identify and stop activities not permited by your policies. By the way, a tech should be sustained by a policy on information security and an awareness program. So you have two fields to build-up. one way people must be warned because of the information security policy and constantly informed by the awareness program, then (second) if someone breaks the policy, the technology has to do its work. warn you.
基本上没有办法阻止恶意员工窃取和导出数据，除非在进出大楼时进行脱衣搜查，并且没有任何外部网络访问权限。
您的老板应该更关心意外数据泄露（即错误输入电子邮件地址或全部错误回复）和违反遏制措施。专门针对前者的一系列技术被称为数据泄露防护。我对他们的所有热情并不感兴趣，但我敢打赌，如果你表现出兴趣，很多公司都会愿意向你承诺全世界。
后者主要是通过严格遵循“最小特权”心态来完成的。销售人员不应该能够使用 CVS 来检查产品的源代码，开发人员不应该能够访问工资数据库。始终只授予某人完成工作所需的最低访问权限。
There's basically no way to prevent a malicious employee from stealing and exporting data, short of strip searches when entering and leaving the building and no outside network access whatsoever.
Your boss should be more concerned with accidental data leakage (ie, mistyped email address or mistaken reply alls) and breach containment. The series of technologies dedicated to the former are called Data Leakage Prevention. I'm not hip to all their jive, but I bet more than a few companies would be willing to promise you the world if you showed interest.
The latter is mostly done by closely following the "least privilege" mindset. A guy from sales should not be able to use CVS to check out the source code to the product, and a developer shouldn't be able to access the payroll database. Always only grant the minimum amount of access required to someone in order for them to do their job.
简短的回答：不。除非您愿意“进一步限制访问”。
http 上传的访问限制将是一个过滤互联网代理。让每个人都通过 Websense 之类的东西，你就可以记录他们在网上所做的一切。
对于 USB 设备，没有。您的选择以及具有如此大的安全需求的公司如何处理该问题，是严格锁定客户端并禁用 USB 密钥的使用。 （还有 CD 刻录机、软盘驱动器，如果您还有这些的话，等等）同样，这将需要侵入性软件，例如 Landesk，+ 删除本地管理，这样用户就无法删除该软件。
Short answer: No. Not unless you're willing to "further restrict access".
The access restriction for http uploads would be a filtering internet proxy. Make everyone go through Websense or something, and you have a log of everything they did online.
For the USB devices, no. Your option there, and how companies with security needs of that magnitude deal with that issue, is to tightly lock down the clients and disable USB key use. (as well as CD burners, floppy drives if you still have those, etc) Again, that's going to require intrusive software, something like Landesk, + removing local admin so users can't take the software off.