Can portable programs be exploited to steal information?

Question

I work with sensitive information and there are clearly controls on what can and can't be made public. While I am not an IT security person, I believe I have found a vulnerability. When I was in school and using the computer lab, one of the things I did was download portable programs onto a usb drive so that I could use the programs I wanted without worrying about the administrative privledges. I am confident that these programs could be downloaded and operated on my computer here at work.

Don't these programs pose a risk? Assuming such a program can be installed and operated on a computer, couldn't an insider steal or manipulate information at will? Do such programs inherently cause triggers that programs installed the "normal" way don't?

Answer 1

A "portable" program as you described it is simply a program that does not require any installation. A great many programs could be portable that are not marked as such. They don't pose any greater security risk than any other program. In fact, because they don't require installation, they are generally safer from a stability standpoint since they don't touch system settings.

They don't get any administrative access or anything without going through the same requirements as any other program though, so they are not a particular concern.

Answer 2

Yes you are correct, I recently did an assessment where the same question was asked to me.

Is this a vulnerability? Yes. BUT you must decide what the importance of the information is and how high the risk is that someone will (try) steal this from you.

Users should be made aware of the danger of using software that wasn't authorized by IT (such as portable apps).

There are numerous ways to mitigate the risk of occurrence and/or increase the skillset level an attacker would need to be able to successfully attack a system like this. The following actions can be taken to decrease the risk of an insider being able to successfully steal information at a high rate. (remember he can just take a picture with his phone as well or write stuff down)

• Disable internet
• Do not allow removable media, no USB, external hdd or CD.
• Disallow cmd and disallow executing programs/processes that are not authorized by the administrator
• encrypt the hard drive with a password the insider doesn't know (prevent replacing executables)

And this works all very well, until you realize an administrator could be stealing information as well... and he has full control over all systems.

IMHO you can do some general locking and bolting of your systems, but protecting information from leaving your company is not as simple as you think. The main reason why I would disable portable apps (or programs users shouldn't be using) is because it would increase their productivity (can't do anything else) and viruses.

Answer 3

The short answer is yes!

regarding "couldn't an insider steal or manipulate information at will": If the user of a computer has the ability to run any program they want and any program can read any information, than that user can read any information QED.

There is a real though small risk of attack by a determined motivated attacker who is willing to intentionally use malicious portable programs to steal information, and preventing such users from running things via USB is unlikely to deter such determined attackers who will then just move on to slurping data through a DMA FireWire device etc.

The real risk from such access comes from accidental exposure to viruses by otherwise honest users who will likely just install the first thing that Google presents when they search for "portable zomby kitten game" with out a second thought. to mitigate this I recommend hot glue in the USB ports. This has the subtle security advantage of making them "tamper evident" because you can inspect the usb ports to see if the glue has been removed. Or just clip the connectors off... You can instead configure the computers run virus checkers on attached devices and move the sensitive information off the computer.

The more general answer is the usual advice of: understand the value of the target, consider the cost of mitigation, consider the attackers, and make an educated trade-off. In most cases where you are not the NSA this is unlikely to be the biggest threat to your information.