4

How a file-level security system works internally? For example https://en.fasoo.com claims that if someone in your organization trys to leak information you will be noticed ( They didn't say this exactly but according to their white papers this is my impression ). Let's assume they serve a complete secure ECM which store all documents in the most secure encrypted format and their authorization system works perfectly and there is no hole in this layer. At the end people needs to get documents they needed in a non encrypted format to work with them. What stop them from copying the non encrypted documents and leak them?

6

This looks like a Data Loss Prevention (DLP) system in which DRM is applied to documents. While I haven't assessed Fasoo itself, I have assessed five or six different enterprise DLP solutions over the years so I can make some inferences about how it works and how secure it is.

In my experience the answer to your question is "pretty much nothing stops you from leaking documents". All DLP suffers from the analog hole (e.g. someone taking a photo of the document on their screen using their phone), and most DLP solutions offer little security against a determined attacker. They're better at detecting accidental leakage, such as a sensitive document being dropped onto an open file share, or emailed without proper encryption. DLP and DRM are inherently broken objectives on a general-purpose computing platform.

Document tracking tends to utilise similar tricks to canary tokens. The document has some element embedded in it that causes network traffic to be sent whenever the document is opened. This can be something as simple as a hidden 1x1 pixel image inside the document, loaded from a web server. These don't stop you from exfiltrating a document, but the idea is that it catches an unwitting attacker opening the document from an unauthorised location.

The DLP part generally works by storing fuzzy hashes of document contents in the DLP server's database, then giving it access to all shared directories and outbound network traffic so that it can try to find documents that have been put in the wrong place or that are being exfiltrated from the network. This usually involves TLS inspection at the gateway. In addition, for an enterprise DLP solution like this, there are sometimes hidden byte sequences injected into the document file that can be caught by detection agents on the network during file transfers.

In most cases DLP is a bit of a misnomer, since it's much more adept at data loss detection than data loss prevention. Even then, it isn't great. I've exfiltrated gigabytes of faux customer data to file sharing websites and even pastebin on DLP-enabled networks without a single alert going out. It usually suffers from the same problem as IPS solutions - either you turn the reporting levels down and never catch anyone, or you turn them up and get flooded with false positives until your security team just ignores everything. Configuring and training DLP solutions is a very long and arduous job that rarely gets done properly.

The remainder of the software implementation is likely little more than a document storage webapp with audit functions and some enterprise integration features like tying user accounts to AD accounts or an SSO platform.

  • “giving it access to all shared directories and outbound network traffic” I was kind of expecting this to be followed by something about the DLP itself being exploitable and opening a way for information leaks. Is this a concern with the systems you have experience with? (I have zero experience about DLP.) – Gilles Feb 24 at 10:11
  • 1
    @Gilles Yeah the DLP solution is often a great target because once you pop it you get access to domain creds that can read most shares, and usually get a bunch of tasty network telemetry full of secrets. It's like popping a load balancer that does TLS termination - all the juice in one central location. I've never been on an assessment where such pivoting was in scope though, so I've never done it in practice. – Polynomial Feb 24 at 13:27
  • Thank you for your answer very informative. What's your idea about a decentralized DLP? I don't give a f for decentralization of power here but I think with a balance combination of IPFS + Hyperledger we could create a decentralize central point of data. – Deev Une Feb 25 at 3:53
  • @DeevUne Any traditional implementation will be better than anything that involves a blockchain. – Polynomial Feb 25 at 12:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.