Monitor file attachments

Well, the first one will be more difficult. It really depends on how someone could send out information. E-mail? FTP? File sharing? I don't have an easy suggestion right off the top of my head for this one.

The 2nd one, monitoring web usage, is easy. Get a proxy server. Set it up, and configure all users to go through the proxy server for their outbound Internet access. YOu then just check the proxy logs to see what web sites were visited, and who visited them.

Winproxy is a proxy server that works well. http://www.winproxy.com

You can also use a program like WebTrends to analyze the proxy logs and make nice HTML reports for your boss to look at. http://www.netiq.com/webtrends

hope this helps

Well, first one also not THAT difficult.
Suppose that your firewall system blocks off other ways of sending out (FTP, file sharing etc.) - there is really no way why users would be allowed those facilities. The IT department might sometimes need them but therefore you have a configurable firewall.

Monitoring file attachments and main content can be done by content scanning software. It acts as an add-in to platforms like Lotus or MS-Exchange. This sw is used most often to monitor INcoming text/attachments (e.g. scanning for nudity...) but is also tailored for OUTgoing. Your policy should define then what is sensitive company info - e.g. the combination of the name and a few keywords related to your trade secrets. Also make two groups:* E-mails to be blocked immediately (and e-mails to be put into quarantaine until SecOfficer has a look at them)
* Mails to be let through but put on a suspect log. This log will be reviewed by SecOfficer daily.

Organisationally speaking, make sure that SecOfficer role and IT operating are clearly separated. Don't come in the difficult role of determining what is right and wrong being an operator, the role conflicts totally with the userfriendly approach IT should have....

Hope this helps,

- The Netherlands

SurfControl is great for montioring what users are doing on the web and you can configure it to your companies corporate web policy to block sites (your company does have a duty of care to its staff). You also need to make sure that you cover your backside (and the companies)and make sure they have policies on web/e-mail usage etc.
If you have AVD/TVD running on your e-mail server then you can configure it to block file types eg .txt .doc .xls so as well as scanning for nasty little virus you can stop files being sent out of your company.