How can I prevent someone from carrying out a file from a machine

Question

Assume the following scenario:

You have to set up a machine in a way that a user is unable to bring out a certain set of files (or a single file only) from that machine while he has to be able to access the file on the machine itself.

The user has physical access to the machine when he is unobserved. He has no Admin privileges.

The machine runs Windows 7 and has built-in devices to read and write optical mediums as well as flash storage. It has USB ports, too, as well as a wireless network adapter.

There are however a lot of ways to gain that stuff if one truly wants to do it. Here is what I have listed so far:

• Uploading to a server. So i need to disallow any network access.
• Copying to a medium or booting another OS from one. I would have to disable all devices.
• Physically removing the hard disk. I would have to encrypt the device.
• Copying the file to the RAM, then freezing and moving it. I can not think of a solution.

---

Are there other methods of gaining a copy of the desired file? How can I fully prevent all the possible methods?

Footnote:

If you wonder why the heck anyone would like to do this: Due to the trust issues of my boss.

Answer 1

Well, you're going to have to fix your boss's "trust issues." I know of a defense contractor that removes optical drives and fills USB ports with a glue gun. Classified information is on an isolated network with no outside access. But, the real thing they do is address the "trust issues." Their employees who work with classified data must have security clearances. Even that isn't perfect, but it has apparently worked for them so far.

If I can see a file, and I'm sufficiently motivated, I can make a copy with a pencil or even commit parts of it to memory. (Edit: I wrote this before seeing your comment on the value of a transcription.)

What you are looking for is something called "originator controlled access control," ORCON, and as far as I know it doesn't exist except in contrived proof-of-concept situations.

The best you can do is reduce the possibilities. How far you reduce the possibilities, and how much you spend doing it, are business decisions. The boss needs to assign a value to protecting the file: "How much would you pay an insurance company every year to cover the file against copying?" That's your budget, and you can then tell the boss what you can do within that budget, which is far better than saying you can't do anything. You can't absolutely protect the company vehicles from automobile accidents, either, but you can reduce the possibilities through careful maintenance, driving record checks on new hires, driver training, etc. How much you can reduce the risk depends on how much you're willing to spend.

You, and maybe your boss, should read Ken Thompson's Turing award lecture, “Reflections on Trusting Trust”.

Answer 2

It's a wicked problem that you will probably not be able to solve with the budget you have within the time you will be working for a single company. Consider that portable cameras known as 'cellphones' are cheap and ubiquitous these days; an unattended user may, for example, just display all the data he wants to exfiltrate, and make a stream of photos called 'video' of the computer's screen as it is spewing secrets out.

People with government-level secrets and security budgets to match tend to approach such problems by setting up facilities such as what the Americans call "SCIF:s". Depending on the country, the protocol for accessing secret information in such a facility may involve an armed guard observing the user while the data is being processed. There's usually also an implied threat of prosecution and harsh punishment in case the user violates the trust. Even with such conditions in place, espionage has a long past history, and will probably also have long future history.

That all having been said, bosses having vague and ill-defined "trust issues" is often a sign of dysfunctional work environment. Depending on other features of the environment, you might want to consider suggesting hiring an expensive outside business consultant to tell your boss his half-cocked approach sucks and/or finding a new employer. In such circumstances, some experts suggest the kind of employers who hire out expensive business consultants to say obvious things, but your mileage may, of course, vary.

Answer 3

You can't. File permissions only affect the file itself, not its content. When the user can open the file with any program, they can also write it to another file which then won't inherit any permissions the original file had, so they can do with that file whatever they want.

The only way would be to remove any physical methods from moving any data off the system at all (removable media, USB ports, network connections, printer etc.). But that would likely be infeasible because it would make other required work impossible. Also, even then could the user still transcribe it from the monitor to a piece of paper.

The true solution for this problem would be to improve the trust relation between your boss and his staff, but that's a topic for Workplace Stackexchange.

Answer 4

Add the following to your controls:

Collect all electronic devices at the door so that attackers can not photograph the document image on the computer display.

Scan frequently for rogue wireless access points to thwart "man in the middle" MITM attacks. See HAK5 for their "rubber ducky."

Inspect for keglogger devices. HAK5 did a segment on an evil laptop power supply which looks just like the dozens of bricks on the floor of every office.

Answer 5

Besides the excellent suggestions of others, I would also recommend:

• Hire a security expert to perform a penetration testing and do it regularly
• Enforce logging/auditing: could be digital (i.e. system logs stored on a different location) or analog, such as signing of a guestbook to get the keys to access the room where the computer is stored.
• Enforce a "no-lone zone" so that access to the machine must be done in pairs

Ultimately your solution is not technological but must involve the human factor so that's where you need to point your efforts at.