Best practice to block Dropbox usage

Question

We have users sync their data at company with their home computer. What's the best way to block it?

• Block *.dropbox.com
• Find out all dropbox IPs and block IPs.
• For windows users, deploy GPO to prevent dropbox installation.

Answer 1

Using Dropbox is not inherently a greater security risk than other methods of data transfer. I work at a security consulting firm and we often use Dropbox to move encrypted archives to our clients. We also use SFTP, but this seems to be problematic for some of our clients.

A better policy is that all company data must be encrypted at rest. This policy should include company laptops, servers, cloud services and anywhere else you maybe storing company data. Make sure you educate your employees about storing and transferring data in a secure manner. Blocking Dropbox may have adverse effects, such as forcing employees to use less secure methods of transferring data. I have found that employees will find creative ways of doing their job, and its not always secure.

Answer 2

I'd also chime in that user education is key. If people are transferring data to sync with home when you don't want them to be syncing data with home, they need to be educated that they should not be syncing data with home. Have a discussion with them and figure out why they feel they need to have the data at home. If it is because they need to be able to do work from home on occasion, then perhaps it would be worth configuring a VPN or other remote access system to allow them to securely access data when at home but keep control of the data on company systems.

I also have to agree that blocking Dropbox outright won't fix the problem and will likely make it worse. Using Dropbox to transfer files is just a symptom of the problem and a relatively (compared to other approaches) benign one. Take away that tool without addressing the underlying problem of users not understanding data security and not having access when they think they need to and they WILL find more inventive and less secure ways to do it.

Answer 3

Dropbox isn't the problem, but I wouldn't suggest letting it go unaddressed either. Use things like least privilege and application/firewall restrictions to keep users from installing/using Dropbox on their work computers where possible. Use network monitoring to detect unauthorized uses of the system. Unless it is something that is approved for a business purpose (and the risk has been evaluated and accepted by your IT Security officer), Dropbox is not somewhere you want your corporate data being kept.

Of course, generally speaking you don't want your corporate data being kept anywhere outside of your company's control. Unfortunately, due to things like telework requirements, this is not always possible to maintain. This is where things like data at rest protection (e.g.: whole-disk encryption) can help protect you. Where possible, you should encrypt all data on any mobile company devices (laptops, smartphones, removable drives, etc.) and any other corporate systems that leave your facilities.

However, all the encryption in the world won't help when an employee decides that they absolutely must have some corporate data at home. At that point, they'll find some way to do it whether you like it or not. This can be by use of personal thumb drives, e-mail, or any number of other methods. You can certainly block most of these through technical means (and I do suggest you try, where practical) but, as soon as you think you've built a user-proof security measure, you'll then find someone's hired a smarter user.

To handle such outliers, the first thing you may want to consider is actually a measure of acquiescence. Re-evaluate the users' needs, and determine which ones actually have a good business case for teleworking. For those cases, issue laptops, smartphones, and removable drives that are fully encrypted and configured in line with corporate standards. Give them VPN access to the parts of your network that they need to be able to telework. If you can provide the users a way to do what they need to do simply and with relatively little hassle, they'll be much more likely to do it your way instead of finding a way around you.

For users who do not have enough business justification to authorize full teleworking capabilities (and for the rest of the company as well, really) you should also focus on user education and policy enforcement. Make sure users understand what methods are permitted (if any) for securely transferring data off of their regular work computers, and what punitive measures may be taken if violations of that policy are discovered. If your company has a BYOD policy that users may find useful, make sure they're aware of it and how to properly follow it. In the end though, a law with no teeth is worth nothing - you must make sure that management has bought into these policies and is willing to follow through with enforcing them.

---

TL;DR Version:

As others have said, Dropbox is really just a symptom of the larger problem: You have users who feel that your company's policies are getting in the way of getting their job done. This issue needs to be addressed from several angles:

1. Management Buy-In & Policy Enforcement - Make sure management is fully on-board with the company's policies regarding telework, BYOD, and data leakage. They need to be willing to follow through with money to provide support for these policies (e.g.: laptops, VPN infrastructure, extra support staff, etc.) as well as administrative action to deal with violations.
2. User Education - Make sure users understand your company's policies and how to securely transfer data when there is a business need.
3. Re-evaluate User Needs - See if there are any users who may actually need your company's support to safely telework, and give it to them if you can.
4. Data at Rest Protection - Make sure all mobile devices issued by your company (e.g.: laptops, smartphones, removable drives, etc.) are fully encrypted.
5. Other Technical Means - Use firewall policies, least privilege, network sniffing, and other mechanisms to block and detect unauthorized attempts at data leakage. Keep in mind that this really is your last line of defense, and will almost certainly not be foolproof.