Perimeter
6/19/2009
02:40 PM
John H. Sawyer
John H. Sawyer
Commentary
50%
50%

Data Leakage Through Nontraditional Networks

Securing our company's data is our job. We build up layers of defense to protect it when it is housed within our corporate network and corporate computer systems. Firewalls, VPNs, encryption, and data leakage prevention all help in some way to protect the data that we don't want anyone else to have. Sometimes, however, we are stuck in the situation where we don't control the network or systems that portions of our data ends up on.

Securing our company's data is our job. We build up layers of defense to protect it when it is housed within our corporate network and corporate computer systems. Firewalls, VPNs, encryption, and data leakage prevention all help in some way to protect the data that we don't want anyone else to have. Sometimes, however, we are stuck in the situation where we don't control the network or systems that portions of our data ends up on.A few examples that come to mind are third party contractors, business partners and cloud service providers. We are either forced by business decisions or the desire to offload storage and processing to someone who can do it cheaper. Either way, our data ends up where we are not in direct control of the network nor are we responsible for securing the network it resides on.

What about some other examples of networks you don't control that might end up with your data? Try to think of something that is more non-traditional but highly likely to be unauthorized? Did I hear P2P? If not, let me remind you of the recent leak of sensitive Marine One blueprints over P2P from a defense contractor. That was definitely data that the government didn't want outside of their control but it made it out and likely because of misconfigured P2P software client.

Having your data leaked via P2P is a scary situation to consider but it has happened and will continue to happen. New technologies are currently being developed that could make it even easier. The recent announcement by the Opera Web browser development team is the most recent. The technology called Unite will include a mini Web server in each Web browser allowing users to share files and folders directly to users across the Internet.

Do you really want all your users and their systems to become web servers? I didn't think so...The easy fix is to not use Opera, but that doesn't mean your contractors or home users won't be using it.

Just thinking about the possibilities for abuse gives me a headache, but don't worry about me, there's more on the horizon to be concerned about. Take a look at "Veiled," a new browser-based darknet that will be demonstrated at BlackHat next month. It sounds as if it could be as easy as getting someone to open an HTML-based e-mail or clicking on a link to pull them into the darknet. From there, who knows what could happen.

Besides policy and contracts that state P2P can't be used on systems that access sensitive data and such, what are you using out there to protect yourselves? DLP is certainly an option but is limited when considering data that doesn't live on your network. There are also monitoring companies who search for your data on P2P network, or you could do it manually.

It's an interesting problem that's going to get worse with these new technologies and more companies moving their data to the cloud. How do you plan to deal with it?

John H. Sawyer is a senior security engineer on the IT Security Team at the University of Florida. The views and opinions expressed in this blog are his own and do not represent the views and opinions of the UF IT Security Team or the University of Florida. When John's not fighting flaming, malware-infested machines or performing autopsies on blitzed boxes, he can usually be found hanging with his family, bouncing a baby on one knee and balancing a laptop on the other. Special to Dark Reading.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2037
Published: 2014-11-26
Openswan 2.6.40 allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon restart) via IKEv2 packets that lack expected payloads. NOTE: this vulnerability exists because of an incomplete fix for CVE 2013-6466.

CVE-2014-6609
Published: 2014-11-26
The res_pjsip_pubsub module in Asterisk Open Source 12.x before 12.5.1 allows remote authenticated users to cause a denial of service (crash) via crafted headers in a SIP SUBSCRIBE request for an event package.

CVE-2014-6610
Published: 2014-11-26
Asterisk Open Source 11.x before 11.12.1 and 12.x before 12.5.1 and Certified Asterisk 11.6 before 11.6-cert6, when using the res_fax_spandsp module, allows remote authenticated users to cause a denial of service (crash) via an out of call message, which is not properly handled in the ReceiveFax dia...

CVE-2014-7141
Published: 2014-11-26
The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and crash) via a crafted type in an (1) ICMP or (2) ICMP6 packet.

CVE-2014-7142
Published: 2014-11-26
The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (crash) via a crafted (1) ICMP or (2) ICMP6 packet size.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?