'Phoning Home': Your Latest Data Exfiltration Headache

It seems that every day there's another news headline about how companies are using consumer data. Facebook was in the news again recently when the FTC slapped it with a $5 billion fine based on investigations into the Cambridge Analytica scandal. FaceApp made headlines for potential connections to Russia. And already this year, Congress has held hearings with some of the biggest names in tech, digging into their practices around the use and protection of customer data.

The manner in which companies handle and use customer data has become a source of growing scrutiny. But consumers aren't alone in needing to worry about how companies use their data. Every day, enterprise organizations put massive volumes of data in the hands of third-party vendors. In some cases, like with software-as-a-service applications, it's explicit that enterprise data will live within a third-party environment. But with other products, particularly those that live within the enterprise data center or cloud infrastructure, it's far less clear. And when factoring in the devices that employees themselves connect to the network (without the knowledge of IT), knowing exactly how, when, and for what purpose third-party vendors are collecting and using their data can be even more difficult.

Phoning Home
As highlighted in our recent security advisory, we have observed a growing frequency of vendors "phoning" or "calling" data home (the white-hat term for exfiltrating data) to their own environments — sometimes without the knowledge or permission of their customers. To be clear, phoning data home is not necessarily problematic. Companies phone customer data home for a variety of perfectly legitimate and useful reasons with the customer's advance knowledge and approval, and do so securely through de-identification and encryption.

But phoning data home becomes problematic when enterprise customers are unaware that it's happening. Unfortunately, that happens more than you'd think — and at times, the perpetrators are the ones you'd expect to take the best care of your data. Within our security advisory, we highlighted four cases from the past year where vendors (including two prominent security technology providers) were calling home their enterprise customers' data without the customers' knowledge or authorization. These cases, spanning two large financial services firms, a healthcare provider, and a multinational food services company, all illustrate the alarming need for businesses to have better visibility into how their data is being used and where it's going — even with trusted security vendors.

To be clear, we don't exactly know why these vendors are phoning home data. In all likelihood, it was either for a legitimate purpose or the result of a misconfiguration. But the fact that large volumes of data were traveling outbound from customer environments to vendor environments without customers' knowledge or consent is problematic. Not only does the enterprise customer lose control of how the data is managed once it leaves its environment, this also potentially exposes it to major regulatory issues.

A Regulatory Headache
Although the United States doesn't have a unified data privacy framework, many large enterprise organizations operate according to the General Data Privacy Regulation (GDPR). Depending on the industry, they may also be subject to other data security or privacy regulations such as HIPAA, PCI, GLBA, FISMA, etc.

These regulations, GDPR in particular, require that organizations know exactly what data they have, the value of the data, how they are using it, and how they are protecting it. If the organization is unaware that a vendor is removing data from its environment, no matter how benign the reason, that certainty is eliminated.

This also gets at the heart of the processor/controller relationship. In many cases, an enterprise may be both a controller and a processor. As controller, enterprises must only appoint processors that guarantee compliance with GDPR. If an enterprise has no way of knowing what a vendor is doing with the data, then the enterprise cannot lawfully appoint the vendor and would risk penalties in doing so.

For organizations that fall into the processor category (and most do with respect to at least some of their data) any data called home by a vendor, even for a benign purpose, makes that vendor a subprocessor. If the organization is unaware the data is being called home, it is still responsible for the subprocessor's actions and may be exposed to additional liabilities.

Mitigating Risks
There are several actions enterprises should take to protect their data from the risks associated with phoning home.

First, enterprises need to better monitor vendor activity on their networks, including active vendors, former vendors, or a prospective vendor post-evaluation. Organizations should also monitor egress traffic, especially from sensitive assets such as domain controllers, and match egress traffic to approved applications and services. Additionally, companies should track the deployment of software agents as part of any evaluation of products. More broadly, all enterprises need to understand the regulatory considerations of data crossing political and geographic boundaries. And they must track whether data used by vendors is in compliance with their contract agreements.

At the highest level, companies need a new operating principle of accountability for their vendors. Ask questions. Understand vendor protocols for phoning data home. Find out how data is being used. Know where data is going and when it's appropriate to phone data home to a vendor environment.

Again, most phoning home is well-intentioned and has a legitimate purpose. But until companies start paying more attention to their data and holding vendors more accountable, unauthorized phoning home represents a paramount risk to enterprise security — one of Cambridge Analytica proportions. 

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "How to Avoid Technical Debt in Open Source Projects."