TheVille

This request is primarily directed at system adminsitrators who might have a better idea of this situation, but all help in this matter is welcome.

As you may know, I head a Welding Distributor overseas. Part of my job deals with product pricing, tender offers and job costing for customers (we help budget job requirements based on blueprints and specifications; we extrapolate product to be used quantites and help develop proper procedures). There is a lot of confidential information that we have developed over the years that we have detected that it has been leaked to other companies that are using this information in counter bids. The last case happened last week, where a competitor presented an identical quote to mine for a new welding system that we are trying to secure as sole vendors for the country (I know it was identical, as they quoted the same price, the de.scription was exactly like mine (including typos!), with only the letterhead being different). Most of these confidential documents reside on the server and roughly 7 people have access to them. We checked the company's e-mail accounts, but the documents were not sent this way. I believe they were sent using Hotmail or via USB key.

I've read of a program called Spector 360 which allows a small company (we're 32 employees with none dedicated to IT) to monitor not only e-mail accounts, but also personal web based accounts as well as removable media devices, so you can detect if sensitive files have been sent or copied through these means. I know the system is sort of a spyware, but the issue here is that I'm trying to stop a systematic theft of information that is detrimental to the company. You have to run periodic queries to detec fraud or suspicious activities, but it would give me an idea to try and stop the people who are doing this.

Any ideas on the efficiency of this product or do you guys have a different program in mind? I do not want to spend a fortune on the software, and I have abudget of max $4K.

Thanks!

http://technet.microsoft.com/en-us/libr ... t.10).aspx

Information rights management and Rights management servers.


Along with products like SharePoint. This will help protect the data and know who is accessing it.

Since it appears to be an inside job, I'd recommend catching the spy in the act. The software security won't tell you if he or she goes to the trouble to copying the confidential papers by hand or photo and faxing them off at a public fax. Whoever it is is probably being paid to spy.

I suggest you claim that there is some issue with the file server and email the documents to each of the seven people one by one. Include slightly different wording or errors in each one. If you get an exact copy of your papers on a competitor's letterhead, you can use those errors to catch the spy. Contact the lawyers and make an example of this traitor.

Also, invest in encrypted thumbdrives for your staff and train them in their use. The spy could just be accessing other's workspaces while they are away. Also change all passwords for the file shares and all user accounts. Punish anyone who leaves the passwords laying around on a sticky note.

I do know of software that will do similar things as Sharepoint, but I'm not very knowledgeable about them. I'll see if some of my expert friends could post here. Despite his screen name, I know that A_Retard could probably help you with security on a budget. He hasn't been on the forums in quite some time though.

I'll be happy to help research any options you are looking into. Just PM me if you want help.