Secure Windows Endpoint DLP Deployment

Project Title

Self-Hosted Employee Monitoring, Source-Code Protection and USB Device Control System

Project Overview

I am looking for an experienced Windows endpoint security and system administration freelancer to deploy a centrally managed, self-hosted employee monitoring and data-loss prevention system.

The system will protect confidential source code and project files across all company Windows PCs.

The management server must be hosted on my VPS. I will provide the VPS specifications and access details to the selected freelancer through a secure method.

The freelancer must complete the deployment remotely. An on-site visit will not be possible.

I prefer open-source software and self-hosted solutions.

1. Centralised Management Dashboard

Deploy and configure a central dashboard accessible only to authorised administrators.

The dashboard should provide:

* Status of all managed computers.
* Online/offline status and last communication time.
* Installed applications and relevant system changes.
* Security events and suspicious activity.
* USB device connection and disconnection history.
* Alerts for attempted policy violations.
* Searchable logs with timestamps and computer/user identification.

The system must continue collecting and retaining events when I am not actively monitoring the dashboard.

2. USB Device Allowlisting — Mandatory

This is a critical requirement.

All unauthorised USB storage devices must be blocked by default. Only explicitly approved devices may be used.

Required functionality:

* Block unapproved USB storage devices.
* Allow specifically approved USB devices.
* Identify approved devices using hardware identifiers and serial numbers where reliably supported.
* Prevent employees from bypassing restrictions through ordinary user accounts.
* Record connection attempts involving unauthorised devices where supported.
* Alert the administrator when a prohibited device is detected or an access attempt is blocked.
* Provide an administrator-controlled method to approve additional devices.
* Apply policies consistently across all managed computers.

Restrictions must survive computer restarts and ordinary Windows updates.

The freelancer must test the policy using both authorised and unauthorised USB storage devices.

USB restrictions must not unnecessarily disable keyboards, mice or other essential peripherals.

The implementation must distinguish between blocking USB storage access and blocking device installation. It must enforce the intended storage restrictions without accidentally disabling unrelated devices.

3. Source-Code Protection

Implement practical controls to reduce the risk of employees transferring confidential source code outside the organisation.

Where technically supported, the system should:

* Monitor access to designated confidential project directories.
* Record relevant file modifications and configured file-system events.
* Restrict unauthorised transfers to removable storage.
* Support restrictions on uploads to unauthorised websites and cloud-storage services.
* Support appropriate restrictions on personal email and file-sharing applications.
* Record relevant security events and blocked transfer attempts.
* Detect attempts to disable or tamper with security software.

Monitoring alone is insufficient. The solution must include actual enforcement mechanisms for the transfer channels it claims to block.

The freelancer must clearly explain which controls actively prevent transfers and which merely generate alerts.

Known limitations involving encrypted applications or unsupported transfer methods must be documented.

4. Remote Deployment and USB Policy Enforcement

Because the freelancer cannot visit the office, deployment must be completed remotely.

Required deliverables:

1. Configure the central server on my VPS.
2. Install and configure the required management software.
3. Provide a Windows installation package or deployment script for the endpoint agent, where supported.
4. Provide a PowerShell script, Group Policy configuration or equivalent supported configuration for USB restrictions.
5. Document the exact steps required to install the endpoint agent on each computer.
6. Provide a repeatable procedure to apply USB policies across all managed computers.
7. Document how to approve new USB devices and revoke their approval.
8. Provide a recovery procedure if a policy accidentally blocks an authorised device.
9. Verify that endpoint agents reconnect to the management server after restarts or temporary network interruptions.

Scripts must use supported enforcement mechanisms and be suitable for legitimate administration of company-owned computers.

Any security policy that could interrupt normal operations must first be tested on a designated computer before wider deployment.

5. Server and Network Security

The freelancer must:

* Assess the VPS specifications before selecting the software.
* Recommend a suitable operating system and resource allocation.
* Configure encrypted communications between endpoints and the server.
* Restrict administrative dashboard access.
* Configure strong administrator authentication.
* Avoid exposing unnecessary management ports to the public internet.
* Configure appropriate log retention and backups.
* Document firewall rules and required network connectivity.

I will provide the VPS details after selecting the freelancer.

6. Documentation and Handover

The freelancer must provide:

* Complete installation instructions.
* A list of installed components and their purposes.
* Configuration files and custom scripts created for the project.
* Instructions for managing all endpoints.
* USB allowlisting and revocation instructions.
* Troubleshooting and recovery instructions.
* Backup and restoration instructions.
* A list of software licences and recurring costs.
* A final report identifying implemented controls and known limitations.

All administrator accounts, credentials, configuration files and custom scripts must be handed over to me.

The freelancer must not retain unauthorised access to the VPS or office computers after completion.

7. Acceptance Testing

Project completion depends on successfully demonstrating that:

1. All managed computers appear in the central dashboard.
2. Endpoint agents reconnect after computer restarts.
3. Unauthorised USB storage devices are blocked.
4. Authorised USB storage devices function according to the configured policy.
5. Relevant USB events are recorded.
6. The administrator can approve and revoke USB devices.
7. Relevant security events appear in the dashboard.
8. Attempts to tamper with endpoint protection are detected where supported.
9. Administrative access is properly secured.
10. Installation and recovery instructions are complete and reproducible.

The freelancer must demonstrate the results remotely and provide evidence of the acceptance tests.

8. Freelancer Qualifications

Applicants should have practical experience with:

* Windows endpoint security and administration.
* Windows device-control policies.
* PowerShell automation.
* Microsoft Defender device control or equivalent USB-control products.
* Wazuh or comparable endpoint monitoring systems.
* Data-loss prevention and source-code protection.
* Linux VPS administration.
* Firewall configuration and secure remote management.

9. Proposal Requirements

Please include the following in your proposal:

1. Your recommended software stack and reasons for selecting it.
2. Which components will run on my VPS and which will run on the Windows computers.
3. How you will enforce USB device allowlisting.
4. How you will block unauthorised source-code transfers.
5. Which requirements can be met using open-source software.
6. Which features require commercial licences or additional software.
7. Your recommended VPS specifications.
8. Your fixed project cost and estimated completion time.
9. Any limitations or prerequisites that need clarification before deployment.

Please do not propose a monitoring-only solution that cannot enforce the required USB restrictions.

The project will be considered complete only after deployment, testing and documentation.

---
來源：Freelancer.com | 出價次數：2 | 剩餘時間：7 日 | 專案類型：固定預算