Need to proxy connections to the Internet and STRICTLY limit where people can go. Unfortunately, there is very little desire to do this and many are willing to accept living in a compromised environment. At home, I have been modifying each machine's 'HOSTS' files ('There's no place like 127.0.0.1'), using K9 Web Content filtering, and recently been using OpenDNS to limit where my users (family) can go. Also, I have killed MSIE and have forced all users to use Firefox with the NoScript enabled. I have played with a virtual proxy that works well (especially when configured with 'Hosts', K9, OpenDNS, Antivirus, and FW blocking of all other hosts besides the proxy. When I figure out how to do the failover piece to keep the availability at 99%, I will implement it for good. Nothing is full-proof, but I sleep better at nights! (Thanks to RF-NCNF for the OpenDNS and NoScript tips!).