1

We have an issue where people are taking laptops home and connecting them to their personal home networks in order to backup corporate data to their private NAS devices. From a DLP standpoint we have trouble reconciling this activity because the activity destination is typically a private IP, something like 192.168.1.12, which is also being used within the corporate network for various labs and testing environments. Short of major policy changes about IP ranges in use and things like that, are there any creative ways to determine the difference between a personal NAS device on a home network vs a corporate-issued one being used from within the corporate network?

We tried frequency analysis of similar activities, but again many generic private IP's are being reused across both corporate and personal environments. I thought about tracking against the 'name' of the network to which the user is connected, but haven't had a ton of luck with that information being readily available in the logs I have. I've been tasked with trying to explore this from an incident response/SOC standpoint, so my available logs are more so correlated with IDS/IPS, mcafee, CIRT, and DLP-type solutions, rather than something like OS event logs.

Improve this question
8
  • Do you have a list of MAC addresses that you can compare against?
    – Pheric
    Commented Mar 9, 2020 at 19:00
  • We don't have an internal list of registered MACs for these types of devices, since they're usually one-off requests managed at the supervisor level.
    – maybezoidberg
    Commented Mar 9, 2020 at 19:13
  • Just to confirm, you also don't have the SSID or BSSID of any wireless access points these clients are connected to (if you use wireless)?
    – Pheric
    Commented Mar 9, 2020 at 19:20
  • For Windows, host logs work best & improve your SOC to include them. Either WF Profiles and/or NCSI should log an event of interest when outside the corp LAN. Perhaps your 3rd party products offer something similar.
    – phbits
    Commented Mar 9, 2020 at 19:53
  • @Pheric I do have SSID at the endpoint level, not sure about BSSID. I'll have to double check the logs. I'm assuming this would solve my request for issues on wireless, but not users who plugin directly to ethernet. Is that a correct assumption?
    – maybezoidberg
    Commented Mar 9, 2020 at 20:20

1 Answer 1

Reset to default
2

As a low-effort, low-yield approach; could you simply put out a note reminding people not to use personal NAS for business backups?

Knowing the risks of being caught with unauthorised material will surely deter at least some people whilst a more formalised technical solution is found?

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .