Block some sites

One approach is to allow access only to sites needed for business. This requires a firewall appliance with web proxy or a simple firewall and a proxy server, like Squid, from http://www.squid-cache.org, which is part of most Linux distributions.

The other approach is to run a proxy application which does content filtering based on 'naughty' words and analyses the graphics, detecting possible amount of something looking like human skin in the pictures. These applications can also check each website agains a blacklist of known porn sites. One such application is Surfcontrol, from http://surfcontrol.com.

First is to have a written policy in place and acknowleged by all employees that specifically forbids this type of activity.

Deploy a proxy server for Internet access and put a policy in place for granting Internet access that requires authorization by management.

Monitor the proxy logs and notify managers and HR of those folks who violate the policy.

Publically fire the first two people who violate the policy more than once (unfortunately it may take more than one public firing to get everyone's attention).

In your proxy server either implement white lists or black lists to filter sites.

Consider an appliance that filters on content and keywords.

Do not repair machines damaged from this kind of activity without Senior Management written authorization (see written policy).

Good luck,

jdg