Small business - Web monitoring

[Diggles]

Short: Anyone have experience with web monitoring software for a small business with 10 employees?

Long: Just helped a client that one of their 'slacker' employees got Cryptolocker (encrypts your files and demands ransom, no undo'ing at all) type malware that encrypted all her work files and even reached out and encrypted stuff on their file server. Luckily they had a pretty decent backup of the server so that wasnt an issue, but the all the files on the workstation were toast and non-recoverable. So he'd like to gather some evidence to make a more informed decision about what steps need to be done.

Client would rather I look into something and give it a try than pay a bigger firm to bring something in.

So far Activtrak looks pretty promising and its free

[Snowreap]

not directly answering your question, but: at my wife's workplace they don't do web monitoring. Internet traffic from the 'work' computers is simply blocked outright, unless the site is on a 'whitelist' of work-related sites (including sites needed for Windows and Anti-Virus updates). non-work traffic is limited to a couple of 'public' computers in the break / conference room, and wireless is open if people want to use their own mobile phones or tablets.

as a result, there's not really anything to monitor, and nobody needs to be troubled to review any logs. periodically my wife will be asked to add additional entries to the 'whitelist' on the router (an old otherwise obsolete PC with an extra NIC installed, running stock OpenBSD and no extra software). the obvious downside with this option is the need for somebody who can navigate a Unix command line and who knows how to use 'vi' or 'emacs'. the upside is that the solution required no cash outlay at all (the PC would have been thrown away otherwise, and they happened to have an extra NIC on hand (probably scavenged from another old PC before it got thrown away)).

-ken

[Diggles]

ya I know about whitelists, but probably lil too draconian for this client.

Also, many of these programs can do whitelists via their software agent and would eliminate your need to run that box at all. Simple web interface management for the administrator.