I am cross-posting this question from Serverfault, because I am in doubt where it fits best.
Say I have a server set up for processing sensitive data. The few authorised users of the system are instructed not to copy any of the sensitive data out of the platform, but could in principle do so using scp etc. This is similar to my car being able to drive about 200km/h although I am not allowed to do so anywhere around where I live.
Can I somehow detect and log (preferably via auditd, but could be other tools) if a user somehow copies data out of the system?
I suppose I could explicitly monitor the use of commands such as scp, rsync, ftp, sftp etc., but then again there may be other tools I am not monitoring, users' own programs, malicious users' renamed copies of common copying tools etc.
I imagine some things might be more reliably detected at the network level, but still: would a sufficiently determined malicious user not be able to for example sneak data out through an encrypted network connection where I cannot monitor what is being transferred?
I have files '/data/sensitive1.csv' and '/data/sensitive2.csv' residing on the system. Users can read these, but have been instructed not to copy this data out of the platform. Can I reliably detect if anyone does it anyway? Can I detect and log if a user does:
scp /data/sensitive1.csv some_remote_system:/somewhere/
It should be easy enough to audit-log
scp, but what if the user uses another tool that I have not thought of?
cp /data/sensitive1.csv /home/user/some_other_name.txt
scp /home/user/some_other_name.txt some_remote_system:/somewhere/
This would still show up by audit-logging the users' user folders, but I guess it complicates the audit trail?
python users_own_script.py /data/sensitive1.csv
This could be a perfectly legitimate processing of the data, but as far as I know, typical audit-logging would not easily show if the user's code has perhaps copied data out of the platform. I know how
auditdcould be set up to log that /data/sensitive1.csv was accessed and maybe some network monitoring would show that some data was transferred out of the system via some encrypted network connection afterwards, but is it not difficult, if not impossible to tell if this data was in fact the contents of /data/sensitive1.csv?