0

I have a situation where my users need to be able to access the internet and search engines to be able to perform their jobs. My problem is that I need to prevent them from being able to upload files to the internet through any means. With most sites, even malevolent ones a lot of the time, using https I am guessing that it is not possible to know if a piece of outbound traffic is a file upload or something else. Even if it isn't a file upload, there should only be so much data heading OUT to a search site.

Can anyone give me some suggestions concerning how to solve this problem? I was wondering if there is some device or software that would allow me to set caps on the total bytes a user sends altogether and to any individual domain or IP address and would then slow the traffic down appreciably and send an alarm to someone to find out if there is a good reason for the activity, someone just didn't understand the policy, or perhaps malware is trying to extricate data.

Currently our devices are behind a FortiGate 60E device, but that can be changed.

2
  • Proxies can inspect TLS traffic, if you install your certificates on your company's devices that you're issuing to your users, and can be fairly transparent once configured correctly... or painfully obvious if you want to remind your employees that you don't trust them. – Ghedipunk Aug 7 '19 at 15:57
  • 1
    If an insider decides to steal data, that is probably going to happen. We will have enough forensic logs to see who did it later, but stopping a determined person is probably not going to happen. What I need to do is stop well meaning people from doing things like saving a spreadsheet that contains social security numbers and addresses to Google Drive or Dropbox to work with it at home or on the go. All work has to take place on a VDI. That is what our compliance auditors have mandated. – Tony Sullivan Aug 7 '19 at 17:13
0

The problem you are trying to solve is very complex. As far as my understanding goes, you want to prevent the exfiltration of data by your employees, but understand that a determined attacker may as well find ways to evade your filters. I will have a look at your situation, problems that may arise and solutions to them:

How do you inspect SSL/TLS traffic?

SSL/TLS was designed to prevent a third party (you, in this case) from reading or modifying the communication in any way. This can be circumvented by using a SSL Proxy. For this, you will need to create a Certificate Authority and have every client in your network trust it. This should not be an issue for your IT department.

Once this is in place, your proxy can inspect SSL/TLS traffic and - if required - is able to block certain communication?

How to prevent users uploading sensitive data?

A naïve approach would be to create a whitelist of websites and just block all traffic to other sides. And in an idealized scenario, this is what I would recommend you to do.

However, depending on your company and the sensitivity of the data, this may upset your employees greatly. Employees like to spend some time on Facebook, YouTube or Cool Math Games, and contrary to traditional industry wisdom, blocking those will not improve productivity.

If you feel like you can employ a whitelist that your employees are happy with, then at least you will be able to limit what a possible attacker can do.

Otherwise, you will have to do a blacklist approach, blocking content and actions you don't want your employees to consume or perform. Good sites to block would be all kinds of content sharing platforms, file upload sites, pastebin-esque sites, etc.

Of course, nothing stops an attacker from registering the domain igkjdfhgokihkaihgs7ugzh.com and just uploading the sensitive documents there.

Regardless of whether you go with a blacklist or whitelist approach, you will have to make a choice between security and usability. And we all know, security at the cost of usability will come at the cost of security.

How can I prevent users from "accidentally" publishing sensitive material?

As an example you mentioned employees creating a spreadsheet containing Social Security Numbers and uploading them to Dropbox or Google Drive.

A technical approach would be to just block those services outright, but they may have plenty of legitimate use-cases in your company. It's better to solve a people problem with people solutions.

Educate your users on what cloud services are, why it's dangerous (and illegal) to upload such data to the cloud and that it is strictly forbidden to do this for any reason.

You will likely have a document disclosure policy, classifying documents in some way. Make sure every document is labelled in accordance with this policy, and ensure that only the lowest class of documents (Public, etc.) can be shared on services like Dropbox.

It may be worth a try to offer a dropbox-like service within your company. This way, if employees need to share documents with each other (or potentially with customers), they still reside on your drives, and not on Google's.

How do I prevent a skilled attacker from exfiltrating data?

Basically, you don't. Depending on the value of your data and the patience of your attacker, there is nothing you can do to stop it.

If an attacker wanted to, they could take pictures of a document with their cellphone and then exfiltrate them that way. With the right settings, one can take ~1 picture per second. If you fit a whole page on the screen (so that the data is still readable), then you could sift through a 100 page document in under two minutes.

If you want to get even more paranoid, there are glasses with cameras built into them. They look just like regular glasses, and an attacker can take all the time in the world to record as much data as they wanted.

Depending on the nature of the data (e.g. research within your company), an exact duplicate of the data may not even be necessary. A malicious employee may simply gather information by speaking to colleagues and remembering what they said. An example can be found below:

Eve: "Hey Bob, how's it going?"
Bob: "Hey Eve, I'm good. How're you?"
Eve: "Fine too. What are you doing?"
Bob: "Just working on our new recipe for the super secret burger sauce. I think I got it now."
Eve: "Really? What's the breakthrough?"
Bob: "Simple, really. All you need to do is add some flux from the flux capacitor and people just love the taste!"
Eve: "Wow, that simple? Good thing nobody's going to find that out, eh?"
Bob: "Yeah, absolutely! Wanna go get a coffee?"
Eve: "Sure thing!"

And this is the story how Eve stole the super secret burger sauce. No high-tech, no spy gadgets, just talking to people.


In summary, install a SSL Proxy, monitor the traffic and block anything you consider malicious (easier said than done). Most importantly, educate your employees. Most of them don't want to harm you anyways, they just want to get their job done.

And as for determined attackers, your assertion that there's not that much you can do against them is right. Just don't hire people named Eve or Mallory and you should be okay.

1

Fortigate devices, yours will support this, can do Web Content filtering, and site analysis.

https://help.fortinet.com/fos60hlp/60/Content/FortiOS/fortigate-security-profiles/Web_Filter/web_filter_chapter.htm?Highlight=web%20filtering

You can setup firewall rules based on user identities (either by sign-in page or RADIUS to your DC) that rate limit users, or assign them web-filter levels based on groups they're in.

Even better, the Fortigate web filtering can do deep packet inspection, so you can even inspect https sites.

0

Web and email filtering can block outgoing file types (EXE, DOCX, etc.), but to block strings of data within files, see Data Loss Prevention (DLP). The Fortigate appears to have some DLP capabilities. Google "FortiGate 60E DLP" for more information.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.