I have a customer who is wanting to ensure his staff can't take any data with them.  We can lock down USB devices (Thumb drives, Hard Drives, etc), but he's now concerned about them accessing things on the server and getting them off by using web mail clients (Yahoo, Gmail, Hotmail, AOL, etc) or file sharing sites (Dropbox, OneDrive, etc).  Short of blocking access to these sites (which would be a pain), is there any way to restrict their ability to steal his work?  And, if so, how difficult AND expensive would it be?

Failing that, is there some way of recording access so we can tell that John Doe accessed these 275 files today, and he was only supposed to be accessing 100 of them?

We're in a workgroup environment at the moment, switching to a Server 2016 AD domain.  All users are local admins on their workstations (Windows 7 and Windows 10).  A lot of the people in question will likely have to REMAIN local admins due to their software (AutoCAD, Quickbooks).

Please feel free to ask any questions for me to elaborate.

I want to sniff network traffic from my firewall to our SIP Cloud provider.  I have not used wireshark much.  Can someone give me simple rundown of how to do this?

I just downloaded the lates version of wireshark.

We use Office 365 for Exchange. One employee's email account was compromised. HR received a request for changing direct deposit bank, from this employee's email address, and HR replied the email. But the request wasn't from the employee. The employee could receive all the normal emails, but not the ones related to this request.

How can we trace the original request email? How can we fix this issue?

I had this question after viewing Watchguard Firewall xFlow Configuration.

I'm getting familiar with the SANS 20 critical controls and wanted to know if there's a document that goes through every alert and specifies the available tools and or solutions at every control?  This would be specifically more valuable to me if it was within a couple of pages for quick reference.

Spectrum on behalf of Sony sent a client this e-mail: {Removed IP address below}

To whom it may concern,

Pursuant to Sony Interactive Entertainment LLC ("SIE") corporate policy, the below IP addresses were blacklisted from using our services because SIE detected activity that is abusive to our network services. In our determination, the abusive activity was not related to velocity or volume (many users behind the same IP address, i.e. NAT), but matched the specific patterns of known abuse of our publicly available services. This abuse may be the result of a computer on your network that has been compromised and is participating in a botnet abuse of our services.

The following table of IP addresses, dates and times should help you correlate the origin of the abusive activity.  The time stamps are approximate from our logs.  The actual timing of the events depend on the signature matched.  It is very likely to have occurred both before, during and following the times listed.

       Approximate Time Range (UTC),      IP Address, Reason
2018-07-23 12:46:00 ~ 2018-07-23 13:46:00 (UTC),   xxx.xxx.xxx.xxx, Account Takeover Attempts

It is most likely the attack traffic is directed at one of the following endpoints:

account.sonyentertainmentnetwork.com
auth.api.sonyentertainmentnetwork.com

These endpoints on our network are resolved by Geo DNS, so the IP addresses they resolve to will depend on the originating IP address.

The destination port will be TCP …

In the Gui, how can I check if UDP session timeout is set to 300 seconds?

Hello,
I install nginx with mod security … I want to use it as waf for backend web servers.
in this case do I have to enable reverse proxy on it ?
what's about the https servers ?
thanks.

I'm looking for opinions about setting up DMZ VLANs on switches that are also used for internal networking vs. using separate physical switches for DMZs and internal networks.  Any concerns or benefits you can think of for one over the other.  Assume Cisco equipment.

We have been hit with ransomware.  Please see the attached screenshot.

The file extensions have been changed to STG.

They hacked into the network, created admin users and made them part of the Admin group, created shares etc.

In a meeting we were told that it is possible to know or identify if a user hit a specific page and it’s contents even if the page is locked.  We understand that when a page has a lock it means SSL and that the data to/fro from the site to computer is encrypted.  Is this possible that even thought the page has a lock, there is  a way to identify the encrypted page that the user visited and identify the contents, if it has form or just regular page?