Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

8/21/2019
10:00 AM
Jeff Costlow
Jeff Costlow
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

'Phoning Home': Your Latest Data Exfiltration Headache

Companies phone enterprise customer data home securely and for a variety of perfectly legitimate and useful reasons. The problems stem from insufficient disclosure.

It seems that every day there's another news headline about how companies are using consumer data. Facebook was in the news again recently when the FTC slapped it with a $5 billion fine based on investigations into the Cambridge Analytica scandal. FaceApp made headlines for potential connections to Russia. And already this year, Congress has held hearings with some of the biggest names in tech, digging into their practices around the use and protection of customer data.

The manner in which companies handle and use customer data has become a source of growing scrutiny. But consumers aren't alone in needing to worry about how companies use their data. Every day, enterprise organizations put massive volumes of data in the hands of third-party vendors. In some cases, like with software-as-a-service applications, it's explicit that enterprise data will live within a third-party environment. But with other products, particularly those that live within the enterprise data center or cloud infrastructure, it's far less clear. And when factoring in the devices that employees themselves connect to the network (without the knowledge of IT), knowing exactly how, when, and for what purpose third-party vendors are collecting and using their data can be even more difficult.

Phoning Home
As highlighted in our recent security advisory, we have observed a growing frequency of vendors "phoning" or "calling" data home (the white-hat term for exfiltrating data) to their own environments — sometimes without the knowledge or permission of their customers. To be clear, phoning data home is not necessarily problematic. Companies phone customer data home for a variety of perfectly legitimate and useful reasons with the customer's advance knowledge and approval, and do so securely through de-identification and encryption.

But phoning data home becomes problematic when enterprise customers are unaware that it's happening. Unfortunately, that happens more than you'd think — and at times, the perpetrators are the ones you'd expect to take the best care of your data. Within our security advisory, we highlighted four cases from the past year where vendors (including two prominent security technology providers) were calling home their enterprise customers' data without the customers' knowledge or authorization. These cases, spanning two large financial services firms, a healthcare provider, and a multinational food services company, all illustrate the alarming need for businesses to have better visibility into how their data is being used and where it's going — even with trusted security vendors.

To be clear, we don't exactly know why these vendors are phoning home data. In all likelihood, it was either for a legitimate purpose or the result of a misconfiguration. But the fact that large volumes of data were traveling outbound from customer environments to vendor environments without customers' knowledge or consent is problematic. Not only does the enterprise customer lose control of how the data is managed once it leaves its environment, this also potentially exposes it to major regulatory issues.

A Regulatory Headache
Although the United States doesn't have a unified data privacy framework, many large enterprise organizations operate according to the General Data Privacy Regulation (GDPR). Depending on the industry, they may also be subject to other data security or privacy regulations such as HIPAA, PCI, GLBA, FISMA, etc.

These regulations, GDPR in particular, require that organizations know exactly what data they have, the value of the data, how they are using it, and how they are protecting it. If the organization is unaware that a vendor is removing data from its environment, no matter how benign the reason, that certainty is eliminated.

This also gets at the heart of the processor/controller relationship. In many cases, an enterprise may be both a controller and a processor. As controller, enterprises must only appoint processors that guarantee compliance with GDPR. If an enterprise has no way of knowing what a vendor is doing with the data, then the enterprise cannot lawfully appoint the vendor and would risk penalties in doing so.

For organizations that fall into the processor category (and most do with respect to at least some of their data) any data called home by a vendor, even for a benign purpose, makes that vendor a subprocessor. If the organization is unaware the data is being called home, it is still responsible for the subprocessor's actions and may be exposed to additional liabilities.

Mitigating Risks
There are several actions enterprises should take to protect their data from the risks associated with phoning home.

First, enterprises need to better monitor vendor activity on their networks, including active vendors, former vendors, or a prospective vendor post-evaluation. Organizations should also monitor egress traffic, especially from sensitive assets such as domain controllers, and match egress traffic to approved applications and services. Additionally, companies should track the deployment of software agents as part of any evaluation of products. More broadly, all enterprises need to understand the regulatory considerations of data crossing political and geographic boundaries. And they must track whether data used by vendors is in compliance with their contract agreements.

At the highest level, companies need a new operating principle of accountability for their vendors. Ask questions. Understand vendor protocols for phoning data home. Find out how data is being used. Know where data is going and when it's appropriate to phone data home to a vendor environment.

Again, most phoning home is well-intentioned and has a legitimate purpose. But until companies start paying more attention to their data and holding vendors more accountable, unauthorized phoning home represents a paramount risk to enterprise security — one of Cambridge Analytica proportions. 

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "How to Avoid Technical Debt in Open Source Projects."

Jeff Costlow is the CISO at ExtraHop. He started his career in computer security in 1997. Jeff has deep experience with networking protocols, a passion for secure software development and many years of software engineering under his belt. In his spare time, Jeff enjoys ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/9/2020
Russian Cyber Gang 'Cosmic Lynx' Focuses on Email Fraud
Kelly Sheridan, Staff Editor, Dark Reading,  7/7/2020
Why Cybersecurity's Silence Matters to Black Lives
Tiffany Ricks, CEO, HacWare,  7/8/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-11081
PUBLISHED: 2020-07-10
osquery before version 4.4.0 enables a priviledge escalation vulnerability. If a Window system is configured with a PATH that contains a user-writable directory then a local user may write a zlib1.dll DLL, which osquery will attempt to load. Since osquery runs with elevated privileges this enables l...
CVE-2020-6114
PUBLISHED: 2020-07-10
An exploitable SQL injection vulnerability exists in the Admin Reports functionality of Glacies IceHRM v26.6.0.OS (Commit bb274de1751ffb9d09482fd2538f9950a94c510a) . A specially crafted HTTP request can cause SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerabi...
CVE-2020-15504
PUBLISHED: 2020-07-10
A SQL injection vulnerability in the user and admin web interfaces of Sophos XG Firewall v18.0 MR1 and older potentially allows an attacker to run arbitrary code remotely. The fix is built into the re-release of XG Firewall v18 MR-1 (named MR-1-Build396) and the v17.5 MR13 release. All other version...
CVE-2020-8190
PUBLISHED: 2020-07-10
Incorrect file permissions in Citrix ADC and Citrix Gateway before versions 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 allows privilege escalation.
CVE-2020-8191
PUBLISHED: 2020-07-10
Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 allows reflected Cross Site Scripting (XSS).