1

I am cross-posting this question from Serverfault, because I am in doubt where it fits best.

Say I have a server set up for processing sensitive data. The few authorised users of the system are instructed not to copy any of the sensitive data out of the platform, but could in principle do so using scp etc. This is similar to my car being able to drive about 200km/h although I am not allowed to do so anywhere around where I live.

Can I somehow detect and log (preferably via auditd, but could be other tools) if a user somehow copies data out of the system?

I suppose I could explicitly monitor the use of commands such as scp, rsync, ftp, sftp etc., but then again there may be other tools I am not monitoring, users' own programs, malicious users' renamed copies of common copying tools etc.

I imagine some things might be more reliably detected at the network level, but still: would a sufficiently determined malicious user not be able to for example sneak data out through an encrypted network connection where I cannot monitor what is being transferred?

Edit:
Examples
I have files '/data/sensitive1.csv' and '/data/sensitive2.csv' residing on the system. Users can read these, but have been instructed not to copy this data out of the platform. Can I reliably detect if anyone does it anyway? Can I detect and log if a user does:

  1. scp /data/sensitive1.csv some_remote_system:/somewhere/
    It should be easy enough to audit-log scp, but what if the user uses another tool that I have not thought of?
  2. cp /data/sensitive1.csv /home/user/some_other_name.txt
    scp /home/user/some_other_name.txt some_remote_system:/somewhere/
    This would still show up by audit-logging the users' user folders, but I guess it complicates the audit trail?
  3. python users_own_script.py /data/sensitive1.csv
    This could be a perfectly legitimate processing of the data, but as far as I know, typical audit-logging would not easily show if the user's code has perhaps copied data out of the platform. I know how auditd could be set up to log that /data/sensitive1.csv was accessed and maybe some network monitoring would show that some data was transferred out of the system via some encrypted network connection afterwards, but is it not difficult, if not impossible to tell if this data was in fact the contents of /data/sensitive1.csv?
Improve this question
5
  • With the use of steganography, covert channels, encryption(such as public key cryptography), and other - things, I guess it would be very difficult, but probably not totally impossible... But I don't know, I mean a rootkit and properly dev'd malware would probably not have difficulty in masking the actions. Such as telling the system "this is what being transferred" but behind the scenes, it can be whatever. From cryptographic keys(Kleptography) to source code not yet released.. Although I don't know; I can only speculate EDIT: A good word for above: APT (Advanced Persistent Threat)
    – William Martens
    Oct 7, 2020 at 15:34
  • 1
    Monitoring what has been tramsmitted is very, very different from monitoring that data has been transmitted. I could encrypt with PGP (or ZIP) and upload to Dropbox using a browser. What is it that you want to know? What was copied or that something was copied?
    – schroeder ♦
    Oct 7, 2020 at 15:53
  • I wish to know whether someone on the platform has copied data, they were instructed not to copy, out of the system.
    – Thomas Arildsen
    Oct 7, 2020 at 17:16
  • 1
    So, you really are asking about all possible ways that data could be exfiltrated and all possible ways of transmitting it. This becomes either too broad, or there is a very easy answer: no, you cannot ever be sure that data has not been accessed or transmitted. You might be able to block all but permitted data flows, as per the answer below.
    – schroeder ♦
    Oct 7, 2020 at 18:24
  • I think the conclusion for my purposes will be that we cannot ever be sure and then implement a limited set of logging rules assuming users are "in good faith", and then requiring by policy that users do not copy restricted data out of the system.
    – Thomas Arildsen
    Oct 8, 2020 at 10:45

1 Answer 1

Reset to default
2

It's possible to monitor access to select data. It's possible to monitor selected tool use like scp.

I've lost track of how many times I've seen claims of security because all data is kept in the cloud or something similar. What is often forgotten is the underlying detail of function. If a user is reading/viewing the data, it's on his device! It can be made inconvenient to extract it but photographing the screen always works.

If the data is never viewed, just processed, then you can attempt to detect exfiltration of the raw data. Common mechanisms include:

  • Forcing all access through a decrypting MiTM type monitor gateway
  • Traffic monitor triggers on size & time (assuming large data)
  • Unusual database queries

All of these mechanisms can be defeated with sufficient access. Fundamentally you are asking about Insider Threat. There are whole industries marketing tools that claim to detect anomalous activities and insider threat patterns. Depending upon details and environment, some of these tools can work fairly well, none are perfect.

Improve this answer
1
  • The best practise is to have signed audit logs for anything critical. In case of insider threat, detection is often as important as the safety of the data.
    – nethero
    Oct 7, 2020 at 21:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .