Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

We have users sync their data at company with their home computer. What's the best way to block it?

  • Block *.dropbox.com
  • Find out all dropbox IPs and block IPs.
  • For windows users, deploy GPO to prevent dropbox installation.
share|improve this question
8  
This doesn't really really sound like a solution to your problem of data leakage, because Dropbox is not the only way to transfer files. Once they can't use that, they'll email themselves, or FTP, etc. You need to make sure your users start following policy and enforce it. –  SpellingD Nov 29 '12 at 17:39
4  
@user15580. Some of your questions have great answers. If you find an answer that is useful to you, please consider accepting it. Have a look at How does accepting an answer work? –  Adnan Nov 29 '12 at 20:45
    
Having a dropbox client folder that syncs could be problematic. Think about it. Now someone's home computer gets pwned and they have a straight shot to a computer on your network. –  k to the z Nov 30 '12 at 16:29
add comment

3 Answers

up vote 20 down vote accepted

Using Dropbox is not inherently a greater security risk than other methods of data transfer. I work at a security consulting firm and we often use Dropbox to move encrypted archives to our clients. We also use SFTP, but this seems to be problematic for some of our clients.

A better policy is that all company data must be encrypted at rest. This policy should include company laptops, servers, cloud services and anywhere else you maybe storing company data. Make sure you educate your employees about storing and transferring data in a secure manner. Blocking Dropbox may have adverse effects, such as forcing employees to use less secure methods of transferring data. I have found that employees will find creative ways of doing their job, and its not always secure.

share|improve this answer
4  
Well said. The risk is not placing the information on Dropbox, the risk is unnecessarily storing potentially sensitive data in an unsecured fashion. –  Scott Pack Nov 29 '12 at 19:36
    
Encrypting data at rest is good, but not a solution for data leakage by employees abusing the system and does not at all protect data that employees might send up to Dropbox. I'd suggest more emphasis on the employee education portion of your answer, plus stronger administrative enforcement of company policies regarding data leakage. –  Iszi Nov 30 '12 at 14:16
    
@Iszi I'll just overwrite my lady gaga cd-rw with government secrets while limp singing to "bad romance". Or put another way, even the US government can't stop this. –  Rook Nov 30 '12 at 17:38
    
@Rook As I recall, it was a CD-RW labeled "Brittney Spears". Again, just an example of how full disk encryption is ineffective against careless users. –  Iszi Nov 30 '12 at 19:44
add comment

I'd also chime in that user education is key. If people are transferring data to sync with home when you don't want them to be syncing data with home, they need to be educated that they should not be syncing data with home. Have a discussion with them and figure out why they feel they need to have the data at home. If it is because they need to be able to do work from home on occasion, then perhaps it would be worth configuring a VPN or other remote access system to allow them to securely access data when at home but keep control of the data on company systems.

I also have to agree that blocking Dropbox outright won't fix the problem and will likely make it worse. Using Dropbox to transfer files is just a symptom of the problem and a relatively (compared to other approaches) benign one. Take away that tool without addressing the underlying problem of users not understanding data security and not having access when they think they need to and they WILL find more inventive and less secure ways to do it.

share|improve this answer
    
Education and consequences. Helping users understand why they shouldn't be doing something will change behavior in some users (hopefully most of them) but reinforcing the education with consequences is a more complete approach. –  u2702 Aug 8 '13 at 16:27
add comment

Dropbox isn't the problem, but I wouldn't suggest letting it go unaddressed either. Use things like least privilege and application/firewall restrictions to keep users from installing/using Dropbox on their work computers where possible. Use network monitoring to detect unauthorized uses of the system. Unless it is something that is approved for a business purpose (and the risk has been evaluated and accepted by your IT Security officer), Dropbox is not somewhere you want your corporate data being kept.

Of course, generally speaking you don't want your corporate data being kept anywhere outside of your company's control. Unfortunately, due to things like telework requirements, this is not always possible to maintain. This is where things like data at rest protection (e.g.: whole-disk encryption) can help protect you. Where possible, you should encrypt all data on any mobile company devices (laptops, smartphones, removable drives, etc.) and any other corporate systems that leave your facilities.

However, all the encryption in the world won't help when an employee decides that they absolutely must have some corporate data at home. At that point, they'll find some way to do it whether you like it or not. This can be by use of personal thumb drives, e-mail, or any number of other methods. You can certainly block most of these through technical means (and I do suggest you try, where practical) but, as soon as you think you've built a user-proof security measure, you'll then find someone's hired a smarter user.

To handle such outliers, the first thing you may want to consider is actually a measure of acquiescence. Re-evaluate the users' needs, and determine which ones actually have a good business case for teleworking. For those cases, issue laptops, smartphones, and removable drives that are fully encrypted and configured in line with corporate standards. Give them VPN access to the parts of your network that they need to be able to telework. If you can provide the users a way to do what they need to do simply and with relatively little hassle, they'll be much more likely to do it your way instead of finding a way around you.

For users who do not have enough business justification to authorize full teleworking capabilities (and for the rest of the company as well, really) you should also focus on user education and policy enforcement. Make sure users understand what methods are permitted (if any) for securely transferring data off of their regular work computers, and what punitive measures may be taken if violations of that policy are discovered. If your company has a BYOD policy that users may find useful, make sure they're aware of it and how to properly follow it. In the end though, a law with no teeth is worth nothing - you must make sure that management has bought into these policies and is willing to follow through with enforcing them.


TL;DR Version:

As others have said, Dropbox is really just a symptom of the larger problem: You have users who feel that your company's policies are getting in the way of getting their job done. This issue needs to be addressed from several angles:

  1. Management Buy-In & Policy Enforcement - Make sure management is fully on-board with the company's policies regarding telework, BYOD, and data leakage. They need to be willing to follow through with money to provide support for these policies (e.g.: laptops, VPN infrastructure, extra support staff, etc.) as well as administrative action to deal with violations.
  2. User Education - Make sure users understand your company's policies and how to securely transfer data when there is a business need.
  3. Re-evaluate User Needs - See if there are any users who may actually need your company's support to safely telework, and give it to them if you can.
  4. Data at Rest Protection - Make sure all mobile devices issued by your company (e.g.: laptops, smartphones, removable drives, etc.) are fully encrypted.
  5. Other Technical Means - Use firewall policies, least privilege, network sniffing, and other mechanisms to block and detect unauthorized attempts at data leakage. Keep in mind that this really is your last line of defense, and will almost certainly not be foolproof.
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.