Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

8/21/2019
10:00 AM
Jeff Costlow
Jeff Costlow
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

'Phoning Home': Your Latest Data Exfiltration Headache

Companies phone enterprise customer data home securely and for a variety of perfectly legitimate and useful reasons. The problems stem from insufficient disclosure.

It seems that every day there's another news headline about how companies are using consumer data. Facebook was in the news again recently when the FTC slapped it with a $5 billion fine based on investigations into the Cambridge Analytica scandal. FaceApp made headlines for potential connections to Russia. And already this year, Congress has held hearings with some of the biggest names in tech, digging into their practices around the use and protection of customer data.

The manner in which companies handle and use customer data has become a source of growing scrutiny. But consumers aren't alone in needing to worry about how companies use their data. Every day, enterprise organizations put massive volumes of data in the hands of third-party vendors. In some cases, like with software-as-a-service applications, it's explicit that enterprise data will live within a third-party environment. But with other products, particularly those that live within the enterprise data center or cloud infrastructure, it's far less clear. And when factoring in the devices that employees themselves connect to the network (without the knowledge of IT), knowing exactly how, when, and for what purpose third-party vendors are collecting and using their data can be even more difficult.

Phoning Home
As highlighted in our recent security advisory, we have observed a growing frequency of vendors "phoning" or "calling" data home (the white-hat term for exfiltrating data) to their own environments — sometimes without the knowledge or permission of their customers. To be clear, phoning data home is not necessarily problematic. Companies phone customer data home for a variety of perfectly legitimate and useful reasons with the customer's advance knowledge and approval, and do so securely through de-identification and encryption.

But phoning data home becomes problematic when enterprise customers are unaware that it's happening. Unfortunately, that happens more than you'd think — and at times, the perpetrators are the ones you'd expect to take the best care of your data. Within our security advisory, we highlighted four cases from the past year where vendors (including two prominent security technology providers) were calling home their enterprise customers' data without the customers' knowledge or authorization. These cases, spanning two large financial services firms, a healthcare provider, and a multinational food services company, all illustrate the alarming need for businesses to have better visibility into how their data is being used and where it's going — even with trusted security vendors.

To be clear, we don't exactly know why these vendors are phoning home data. In all likelihood, it was either for a legitimate purpose or the result of a misconfiguration. But the fact that large volumes of data were traveling outbound from customer environments to vendor environments without customers' knowledge or consent is problematic. Not only does the enterprise customer lose control of how the data is managed once it leaves its environment, this also potentially exposes it to major regulatory issues.

A Regulatory Headache
Although the United States doesn't have a unified data privacy framework, many large enterprise organizations operate according to the General Data Privacy Regulation (GDPR). Depending on the industry, they may also be subject to other data security or privacy regulations such as HIPAA, PCI, GLBA, FISMA, etc.

These regulations, GDPR in particular, require that organizations know exactly what data they have, the value of the data, how they are using it, and how they are protecting it. If the organization is unaware that a vendor is removing data from its environment, no matter how benign the reason, that certainty is eliminated.

This also gets at the heart of the processor/controller relationship. In many cases, an enterprise may be both a controller and a processor. As controller, enterprises must only appoint processors that guarantee compliance with GDPR. If an enterprise has no way of knowing what a vendor is doing with the data, then the enterprise cannot lawfully appoint the vendor and would risk penalties in doing so.

For organizations that fall into the processor category (and most do with respect to at least some of their data) any data called home by a vendor, even for a benign purpose, makes that vendor a subprocessor. If the organization is unaware the data is being called home, it is still responsible for the subprocessor's actions and may be exposed to additional liabilities.

Mitigating Risks
There are several actions enterprises should take to protect their data from the risks associated with phoning home.

First, enterprises need to better monitor vendor activity on their networks, including active vendors, former vendors, or a prospective vendor post-evaluation. Organizations should also monitor egress traffic, especially from sensitive assets such as domain controllers, and match egress traffic to approved applications and services. Additionally, companies should track the deployment of software agents as part of any evaluation of products. More broadly, all enterprises need to understand the regulatory considerations of data crossing political and geographic boundaries. And they must track whether data used by vendors is in compliance with their contract agreements.

At the highest level, companies need a new operating principle of accountability for their vendors. Ask questions. Understand vendor protocols for phoning data home. Find out how data is being used. Know where data is going and when it's appropriate to phone data home to a vendor environment.

Again, most phoning home is well-intentioned and has a legitimate purpose. But until companies start paying more attention to their data and holding vendors more accountable, unauthorized phoning home represents a paramount risk to enterprise security — one of Cambridge Analytica proportions. 

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "How to Avoid Technical Debt in Open Source Projects."

Jeff Costlow is the CISO at ExtraHop. He started his career in computer security in 1997. Jeff has deep experience with networking protocols, a passion for secure software development and many years of software engineering under his belt. In his spare time, Jeff enjoys ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Sodinokibi Ransomware: Where Attackers' Money Goes
Kelly Sheridan, Staff Editor, Dark Reading,  10/15/2019
Data Privacy Protections for the Most Vulnerable -- Children
Dimitri Sirota, Founder & CEO of BigID,  10/17/2019
State of SMB Insecurity by the Numbers
Ericka Chickowski, Contributing Writer,  10/17/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-16404
PUBLISHED: 2019-10-21
Authenticated SQL Injection in interface/forms/eye_mag/js/eye_base.php in OpenEMR through 5.0.2 allows a user to extract arbitrary data from the openemr database via a non-parameterized INSERT INTO statement, as demonstrated by the providerID parameter.
CVE-2019-17400
PUBLISHED: 2019-10-21
The unoconv package before 0.9 mishandles untrusted pathnames, leading to SSRF and local file inclusion.
CVE-2019-17498
PUBLISHED: 2019-10-21
In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent memory read. A crafted SSH server may be able to disclose sensitive information or cause a ...
CVE-2019-16969
PUBLISHED: 2019-10-21
In FusionPBX up to 4.5.7, the file app\fifo_list\fifo_interactive.php uses an unsanitized "c" variable coming from the URL, which is reflected in HTML, leading to XSS.
CVE-2019-16974
PUBLISHED: 2019-10-21
In FusionPBX up to 4.5.7, the file app\contacts\contact_times.php uses an unsanitized "id" variable coming from the URL, which is reflected in HTML, leading to XSS.