Perimeter
6/19/2009
02:40 PM
John H. Sawyer
John H. Sawyer
Commentary
Connect Directly
RSS
E-Mail
50%
50%

Data Leakage Through Nontraditional Networks

Securing our company's data is our job. We build up layers of defense to protect it when it is housed within our corporate network and corporate computer systems. Firewalls, VPNs, encryption, and data leakage prevention all help in some way to protect the data that we don't want anyone else to have. Sometimes, however, we are stuck in the situation where we don't control the network or systems that portions of our data ends up on.

Securing our company's data is our job. We build up layers of defense to protect it when it is housed within our corporate network and corporate computer systems. Firewalls, VPNs, encryption, and data leakage prevention all help in some way to protect the data that we don't want anyone else to have. Sometimes, however, we are stuck in the situation where we don't control the network or systems that portions of our data ends up on.A few examples that come to mind are third party contractors, business partners and cloud service providers. We are either forced by business decisions or the desire to offload storage and processing to someone who can do it cheaper. Either way, our data ends up where we are not in direct control of the network nor are we responsible for securing the network it resides on.

What about some other examples of networks you don't control that might end up with your data? Try to think of something that is more non-traditional but highly likely to be unauthorized? Did I hear P2P? If not, let me remind you of the recent leak of sensitive Marine One blueprints over P2P from a defense contractor. That was definitely data that the government didn't want outside of their control but it made it out and likely because of misconfigured P2P software client.

Having your data leaked via P2P is a scary situation to consider but it has happened and will continue to happen. New technologies are currently being developed that could make it even easier. The recent announcement by the Opera Web browser development team is the most recent. The technology called Unite will include a mini Web server in each Web browser allowing users to share files and folders directly to users across the Internet.

Do you really want all your users and their systems to become web servers? I didn't think so...The easy fix is to not use Opera, but that doesn't mean your contractors or home users won't be using it.

Just thinking about the possibilities for abuse gives me a headache, but don't worry about me, there's more on the horizon to be concerned about. Take a look at "Veiled," a new browser-based darknet that will be demonstrated at BlackHat next month. It sounds as if it could be as easy as getting someone to open an HTML-based e-mail or clicking on a link to pull them into the darknet. From there, who knows what could happen.

Besides policy and contracts that state P2P can't be used on systems that access sensitive data and such, what are you using out there to protect yourselves? DLP is certainly an option but is limited when considering data that doesn't live on your network. There are also monitoring companies who search for your data on P2P network, or you could do it manually.

It's an interesting problem that's going to get worse with these new technologies and more companies moving their data to the cloud. How do you plan to deal with it?

John H. Sawyer is a senior security engineer on the IT Security Team at the University of Florida. The views and opinions expressed in this blog are his own and do not represent the views and opinions of the UF IT Security Team or the University of Florida. When John's not fighting flaming, malware-infested machines or performing autopsies on blitzed boxes, he can usually be found hanging with his family, bouncing a baby on one knee and balancing a laptop on the other. Special to Dark Reading.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-2413
Published: 2014-10-20
Cross-site scripting (XSS) vulnerability in the ja_purity template for Joomla! 1.5.26 and earlier allows remote attackers to inject arbitrary web script or HTML via the Mod* cookie parameter to html/modules.php.

CVE-2012-5244
Published: 2014-10-20
Multiple SQL injection vulnerabilities in Banana Dance B.2.6 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) return, (2) display, (3) table, or (4) search parameter to functions/suggest.php; (5) the id parameter to functions/widgets.php, (6) the category parameter to...

CVE-2012-5701
Published: 2014-10-20
Multiple SQL injection vulnerabilities in dotProject before 2.1.7 allow remote authenticated administrators to execute arbitrary SQL commands via the (1) search_string or (2) where parameter in a contacts action, (3) dept_id parameter in a departments action, (4) project_id[] parameter in a project ...

CVE-2012-5865
Published: 2014-10-20
SQL injection vulnerability in dispatch.php in Achievo 1.4.5 allows remote authenticated users to execute arbitrary SQL commands via the activityid parameter in a stats action.

CVE-2012-5866
Published: 2014-10-20
Cross-site scripting (XSS) vulnerability in include.php in Achievo 1.4.5 allows remote attackers to inject arbitrary web script or HTML via the field parameter.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.