[Laurax]

I don't really know how to start this question so i will begin with a back history. I started working for a company a few weeks back in sales. Having quite a bit of computer knowledge the task was handed down to me to secure their servers. This is a small company that is wide open with all their file sharing. Every computer has access to every other computer including the three servers. It has been brought to our attention that a few in the company have been uploading files to the internet to share with rival companies. The easiest way i know to put a stop to this is to unhook all internet access and stop all sharing which is unfeasible. every computer here runs on windows xp including the patched together servers. I am looking for software or a way to easily lock down the servers so access is only granted to a few. I found that our company doesn't have a lot of money to invest in this and if need be i can go into each individual computer and discontinue all file sharing. Without requiring individual log-ins on most computers the company has left open all financial and important company data wide open. like I said I have a fairly decent background in computers so if i am overlooking anything please point me in the right direction. All systems running off windows Xp in some form, I have very little funds to invest, and as we speak our designs are being sent forth into the world.

[wk2000]

The first step is to identify the data that needs to be protected. Then classify them and place them into different password protected shares on the server and give the passwords to people on a 'need to know' basis.

To catch the crook, I'd create a dummy 'important' file and audit access to it.

Or you can implement a Snort box and create a rule that look for keywords in the 'important' document. Snort will sniff through all network traffic and identify the bad guy thats sending it out of the company.

[Laurax]

Yeah, I got the go ahead to update to xp pro on all the machines and update the server to windows 2003. I guess there is no cheap solution to security hehe. Now comes the fun part off trying to bring all these machines up to speed. Is there any decent logging software out there that I can install on the server itself?

[wk2000]

what do you want to accomplish with this "logging software". Is it something like this :
http://www.gfi.com/eventsmanager/esmfeatures.htm

[Laurax]

Yeah I decided to upgrade all the running pc's to xp pro and upgrade the server to windows small business server 2003. This should allow me to grant and take away access so everyone isn't able to open everything on the server. Now the only prblem is installing server 2003 on the machine now running xp pro. I don't want to lose any files stored on the server during upgrade. This system is such a mess I already have a headache just thinking about the task before me. That logging software looks like it may help keep an eye on our spies in the company. Why can't I just be a salesman like I was hired for .

[wk2000]

Hows your security project going ?

[Laurax]

Im going through some tracking software that i can put on my server. Not being familiar with software of this type i am loading them on my workstation computer and trying them out. I wish there was a sight that would give the pros and cons of software like this then add include a section for cheap companies .

[Laurax]

Well here's another update. Doing the best I can I have been monitoring file access and modifications. I havent found a program yet that just lets me see what files are being accessed and whose accessing them without 100 other additions that i dont need. It sux when you know you have a mole feeding the competition information and there is nothing you can do to stop it.

[wk2000]

Here's a security dedicated forum, you can try your question there:
http://www.security-forums.com/

[Laurax]

Thank you .