Best Way to Isolate Company Data

Question

I work in a Software Company. Currently, we don't have any security software to secure our data in an employee laptop. Now we want to make a policy where any data stored or created on the company laptop and server must not get outside of the internal network. This includes securing these scenarios:

• Any data from the company laptop not allowed to be copied to USB / External Hard Disk for later copied into their own device.
• Any data cannot be uploaded to the external server through the internet.
• Even if the laptop hard disk is taken off and put on another laptop, it should be unreadable.

On top of these limitations, for any job to be done, we should allow for:

• Data can be a copy or moved inside the company internal network

• Some document (pdf, word, excel, etc, not source code) can be send through an Email

• The employee still can access the internet (maybe limited to some work-related website like StackOverflow, Linkedin, etc)

• The employee can be work from home

For this, I listed the following to-do list:

• Installing hard disk encryption software on every laptop and blocking the USB port
• Block any third party software installation
• Prepare a VPN network so the employee can access company internal network through the internet

I still cannot figure out how to prevent employee uploading data to cloud storage like google drive, etc. Is my current solution is correct? or there are other approaches to implement this kind of policy?

Answer 1

First, you are dealing with developers. They are known to sidestep and bypass everything that stands in their way. No matter what protections you setup, a developer will bypass it sooner or later. And tell the others.

Data can be a copy or moved inside the company internal network

You cannot guarantee that even with a VPN. If the user owns its own network, he can install a server on its own network pretending to be the VPN server. Or can alter the routing to bypass the VPN.

Some document (pdf, word, excel, etc, not source code) can be send through an Email

Copy the sourcecode, convert to base64, uuencode, rot13 or something like that, paste on a Word document, and exfiltrate. Or convert to QR-Code, put on a PDF. Or compress it, stash it inside a Excel macro. The exfiltration routes are numerous.

The employee still can access the internet (maybe limited to some work-related website like StackOverflow, Linkedin, etc)

Copy the code, paste on a Linkedin chat. Have another person copying from the chat to disk. Code stolen.

Installing hard disk encryption software on every laptop and blocking the USB port

Hard disk encryption protects the data in if someone steals the laptop. The user of said laptop have the password. It does not prevent him from copying the data. Blocking USB is a little more efficient against data theft.

Block any third party software installation

3rd party software do little to help/hinder data exfiltation. All someone needs to steal data is already installed on every modern OS. One can even create a Powershell script that turns the screen white or black, and have a camera capturing data on another computer. Even without extra software.

This problem cannot be solved with technology.

Answer 2

Your plan is full of holes. and these cannot be fixed.

if you allow PDFs out you allow anything that can be converted to pdf out.

if you allow any email out source code can be copied and pasted into an email.

if you allow web access source code can be copied and pasted into gmail.

I think the only solution is to keep the most secret stuff on a server that does not have access to the internet. and only allow access to this server by physical presence

It's probably easier and cheaper to hire trustworthy staff.