You Decide Scenario: Week 3
Detecting and preventing insider threats is its own discipline, with its own dynamics. If you put these countermeasures in place, you can reduce the threat dramatically.
First, you can use an IP packet-filtering router. This type of router permits or denies the packet to either enter or leave the network through the interface on the basis of the protocol, IP address, and the port number. The protocol may be TCP, UDP, HTTP, SMTP, or FTP. The IP address under consideration would be both the source and the destination addresses of the nodes. The port numbers would correspond to the well-know port numbers (Vacca, 2009). Packet filtering lets you control data transfer based on the address the data is, the address the data is going to, and the session and application protocols being used to transfer data. The main advantage of packet filtering is leverage. It allows you to provide, in a single place, particular protections for an entire network. Consider the Telnet service. If you disallow Telnet by turning off the Telnet server on all your hosts, you still have to worry about someone in your organization installing a new machine (or reinstalling an old one) with the Telnet server turned on. On the other hand if Telnet is not allowed by your filtering router, such a new machine would be protected right from the start, regardless of whether or not its Telnet server was actually running.
Another advantage of a packet filtering router is that users won’t even realize it’s there, unless they try to do something that is prohibited by the packet filtering router’s filtering policy ("Building Internet Firewalls," n.d.).
Secondly, you can use port blocking which is the prevention of a given communication on a specific port before it reaches your computer. Port 25 is the SMTP port used by mail servers to send mail. The popular trend with viruses now is to install “zombie processes” on infected machines. These zombies are then used as spam mail servers sending continuous streams of spam out to random addresses. It only takes one machine to get infected, and your business email will be blocked. You can block port 25 (SMTP) for all machines except your mail server. Most firewalls will allow you to do this, but the settings will be different for each one ("Why You Should Block Outgoing Port 25 (SMTP) On A Firewall," 2010).
Thirdly, you can use the Sarbanes-Oxley Act (SOX) guidelines to control log files. Log files contain a wealth of information which obtain information on user level activities like logon success or failure, system level activities like file read, write or delete, host session status, account management and others. Monitoring these log files will assist in detecting system problems, and obtain log trail for forensic investigation. Section 802 of SOX mandates that records are maintained for seven years after the auditor concludes the audit. So it can be safely assumed that as far as system logs are concerned, they need to be stored or archived for posterity ("How IT Can Aid Sarbanes-Oxley Compliance," n.d.).

References
Building Internet Firewalls. (n.d.). Retrieved from http://www.c3.hu/docs/oreilly/tcpip/firewall/ch06_01.htm
How IT Can Aid Sarbanes-Oxley Compliance. (n.d.). Retrieved from http://www.manageengine.com/products/eventlog/EventLogAnalyzer-SOX-Whitepaper.html
Vacca, J. R. (2009). Local Area Network Security. In J. R. Vacca (Ed.), Computer and Information Security Handbook (p. None). Burlington, MA: Morgan Kaufmann.
Why You Should Block Outgoing Port 25 (SMTP) On A Firewall. (2010). Retrieved from http://www.scotiasystems.com/blog/it-hints-and-tips/why-you-should-block-outgoing-port-25-smtp-on-a-firewall/