Perimeter
6/19/2009
02:40 PM
John H. Sawyer
John H. Sawyer
Commentary
Connect Directly
RSS
E-Mail
50%
50%

Data Leakage Through Nontraditional Networks

Securing our company's data is our job. We build up layers of defense to protect it when it is housed within our corporate network and corporate computer systems. Firewalls, VPNs, encryption, and data leakage prevention all help in some way to protect the data that we don't want anyone else to have. Sometimes, however, we are stuck in the situation where we don't control the network or systems that portions of our data ends up on.

Securing our company's data is our job. We build up layers of defense to protect it when it is housed within our corporate network and corporate computer systems. Firewalls, VPNs, encryption, and data leakage prevention all help in some way to protect the data that we don't want anyone else to have. Sometimes, however, we are stuck in the situation where we don't control the network or systems that portions of our data ends up on.A few examples that come to mind are third party contractors, business partners and cloud service providers. We are either forced by business decisions or the desire to offload storage and processing to someone who can do it cheaper. Either way, our data ends up where we are not in direct control of the network nor are we responsible for securing the network it resides on.

What about some other examples of networks you don't control that might end up with your data? Try to think of something that is more non-traditional but highly likely to be unauthorized? Did I hear P2P? If not, let me remind you of the recent leak of sensitive Marine One blueprints over P2P from a defense contractor. That was definitely data that the government didn't want outside of their control but it made it out and likely because of misconfigured P2P software client.

Having your data leaked via P2P is a scary situation to consider but it has happened and will continue to happen. New technologies are currently being developed that could make it even easier. The recent announcement by the Opera Web browser development team is the most recent. The technology called Unite will include a mini Web server in each Web browser allowing users to share files and folders directly to users across the Internet.

Do you really want all your users and their systems to become web servers? I didn't think so...The easy fix is to not use Opera, but that doesn't mean your contractors or home users won't be using it.

Just thinking about the possibilities for abuse gives me a headache, but don't worry about me, there's more on the horizon to be concerned about. Take a look at "Veiled," a new browser-based darknet that will be demonstrated at BlackHat next month. It sounds as if it could be as easy as getting someone to open an HTML-based e-mail or clicking on a link to pull them into the darknet. From there, who knows what could happen.

Besides policy and contracts that state P2P can't be used on systems that access sensitive data and such, what are you using out there to protect yourselves? DLP is certainly an option but is limited when considering data that doesn't live on your network. There are also monitoring companies who search for your data on P2P network, or you could do it manually.

It's an interesting problem that's going to get worse with these new technologies and more companies moving their data to the cloud. How do you plan to deal with it?

John H. Sawyer is a senior security engineer on the IT Security Team at the University of Florida. The views and opinions expressed in this blog are his own and do not represent the views and opinions of the UF IT Security Team or the University of Florida. When John's not fighting flaming, malware-infested machines or performing autopsies on blitzed boxes, he can usually be found hanging with his family, bouncing a baby on one knee and balancing a laptop on the other. Special to Dark Reading.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0993
Published: 2014-09-15
Buffer overflow in the Vcl.Graphics.TPicture.Bitmap implementation in the Visual Component Library (VCL) in Embarcadero Delphi XE6 20.0.15596.9843 and C++ Builder XE6 20.0.15596.9843 allows remote attackers to execute arbitrary code via a crafted BMP file.

CVE-2014-2375
Published: 2014-09-15
Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to read or write to arbitrary files, and obtain sensitive information or cause a denial of service (disk consumption), via the CSV export feature.

CVE-2014-2376
Published: 2014-09-15
SQL injection vulnerability in Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

CVE-2014-2377
Published: 2014-09-15
Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to discover full pathnames via an application tag.

CVE-2014-3077
Published: 2014-09-15
IBM SONAS and System Storage Storwize V7000 Unified (aka V7000U) 1.3.x and 1.4.x before 1.4.3.4 store the chkauth password in the audit log, which allows local users to obtain sensitive information by reading this log file.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
CISO Insider: An Interview with James Christiansen, Vice President, Information Risk Management, Office of the CISO, Accuvant