Hot answers tagged

9

I was asked about your problem several times in several occasions. What makes it really difficult to answer is, that this in fact isn’t really a tech-problem. It's much more a social/human problem. There are many great firewall-systems like SonicWall/FortiGate/etc. (also VM-Based solutions) which will cost you maybe only 500$. They are all able to block ...


8

As soon as a user can open/display a document, you're usually out of control. Digital Rights Management (DRM) might help to prevent some leakage, but sooner or later these are bypassed, anyway. If something is displayed, usually it can be copied somehow. You cannot prevent a user from taking "physical" (maybe let's better call them "analog") copies (like ...


7

Sorry, that's literally impossible to prevent, unless you post security guards next to all computers who monitor your users' behaviour. This is known as the analog hole.


7

This encompasses many security and access control practices companies follow. Generally you'll need to do this at many levels at many places. There are a lot of Data Loss Prevention software that can help you prevent information theft. A quick comparison is here. To quickly answer your question, these are the things you'd normally want to do: Remove write ...


5

It is common to block (and then whitelist) executables however this has the burden of upset users and then overworked support staff who need to maintain the whitelists. What we're seeing nowadays is slightly more sophisticated tools that introspectively look at the EXE to see if it "looks" like malware. One of my clients uses wildfire which will poke ...


5

You probably want to look at two classes of products: Data Leakage Protection (DLP) and intrusion detection systems (IDS). To detect ePHI on a system, you are more or less going to be checking for some common things based upon patterns. For example, in your EMR if you identify patients using a 10 digit code that starts with 4 letters followed by 6 numbers, ...


3

I don't mean this to sound harsh, but this is part of my day job, and to be honest I don't think you have the experience or scope necessary to pull something like this off successfully by yourself while achieving any sort of meaningful result. DLP is a HUGE domain. You haven't even been given any clear direction in what it is you need to be catching which ...


3

I am sure there is... Question is if it is that important you invest in the big $$'s I am sure such software would cost - which I know the cost of HIPAA violations here in the US, are you sure you would feel it is reliable? Seriously? Think about it... PHI is not just terms, it is the association of terms, and other terms. It is also specific types of terms (...


3

Sounds like you're looking for Data Loss Prevention (DLP) solutions. Although there are plenty of commercial tools, I recall Google, Snort, and a few other organizations offer FOSS DLP capabilities. Commercial DLP vendors like Symantec (Vontu) and Websense offer complete solutions. The last I checked, FOSS DLP solutions were still quite lacking in ...


3

First you need to decide how you will identify this data - this is probably going to be the biggest issue and it is not necessarily technical. Do you aim to tag all documents and files with a rating? This works for organisations that do tag ever single piece of data, as the gateway then just looks for the tag and acts accordingly. Do you set a blacklist of ...


3

A lot of organisations have this challenge, not just for source code, but for personal data, intellectual property etc - so a lot of work has been done developing solutions. McAfee, Symantec and various others have very effective products on the market which can be tailored from very simple (looking for signatures in a similar way to how an antivirus ...


2

To add to some of the answers so far, I'd suggest that how easy it would be to achieve this largely depends on the level of access that you provide to your users. If you provide web browsing without restrictions, then you're in real trouble as there's a huge number of sites that provide information transfer, both obvious ones (e-mail) and less obvious (...


2

Once you give someone access to the data, it is insecure. You can do many things to make it more secure, such as multiple networks, locking down the internet, etc. But there will always be a way to get the data out. Since the source code is text, there are an immeasurable number of ways to get the code out. Email, cutting and pasting it into websites, ...


2

You are talking about a Document Management System. Typically these systems allow users to save documents and delegate read/write access on a user or group level. They also allow for auditing of when users access documents. Some may also restrict editing and copying or even printing of a document (in addition to auditing all such actions). There is simple ...


2

Quarantine, don't block. Pull the executable out and store it in a protected area. If it matches the hash of an authorized executable, then provide the recipient the authorized executable. If it doesn't match a whitelist, then provide the recipient with a link to a workflow that prioritizes the executable for release and whitelisting. Carefully examine ...


2

The most predominant issues with DLP I currently see are in regards to what it can actually retrieve. Often this already omits encrypted connections such as HTTPS (unless SSL certificates are used to implement a MiTM). Furthermore there are some legal issues in most European countries regarding privacy and proportionality of collecting data which is one of ...


2

What you're looking for is the intent of the user at the time they're performing the operation, and that's very hard to determine from logs alone. Some factors to consider: What is the volume of data being transferred? Does the remote endpoint belong to your company, or a partner company? Has this user conducted transfers of this type in the past, or is ...


2

This was probably a typo. Data Loss mitigation is obviously a goal of DLP. Elasticity, as you said, is not a goal of DLP.


2

You need to identify your requirement and specially you need to understand what level of security they need. Simply if your client is antivirus company, source code needs to be highly secured. Therefore you have to provide somewhat high level security solution. It should not be single layer protection. Company size does not matter. Value of data is a ...


2

I don't think this is as easy as simply plugging in some DLP product into some arbitrary environment. I would say it is practically impossible to actually prevent intentional stealing of information by a insiders who needs on the one hand to have access to the code for working and on the other to have some way to communicate with externals (like surfing ...


1

Some antivirus software like Sophos can disable network bridging, which will prevent any wireless from been connected while the network cable is plugged in. We use this to stop people tethering while connected. You will need to block USB/Bluetooth at the OS to stop tethering there. Once a users laptop network leaves the premises you can use group policy (if ...


1

Adding to Jen Erat's answer, it is important that you classify your documents, so that you can have more control over the vital documents that cannot leak. Then you could put them on a controlled room with monitored access and no cameras or phones allowed. Now if you are talking, for example, about some documents you sell for some users, and want to ...


1

The purpose of Data Loss Prevention tools is to detect the accidental or deliberate transfer of internal information to anybody which is not supposed to get these information, like the public, media, competitors or attackers. Such internal information might be company secrets but also information which the company is asked to protect for others (i.e. credit ...


1

If you are using your employer's equipment and network, then nothing you do on them can be considered private. They will be able to see any personal things you do on your employer's equipment. This should not be a surprise. If you have specific questions, you need to talk to your employer's IT department.


1

If web browsers are your main concern, the 'simple' answer would seem to be setting up a proxy (e.g. squid) with SSL interception. And informing your users you are doing this. But that (as others have pointed out) doesn't buy you all that much, beyond opening up the door to more possibilities. With Squid alone, you would get the source, destination site/...


1

If you know what vendor and/or solution was chosen, I would check their docs. One key thing is whether this is a network based DLP solution (in which case, you could check the docs for BroIDS to see how they conceive of DLP), or a local agent based one (i.e. some extension to an antivirus solution). On a very basic level, a DLP solution will look for ...


1

DLP can help against accidental leaks or attempted leaks done by dumb users (i.e. just attach information to mail) but does never protect against a deliberate data leak done by a knowledgeable attacker. In your specific case it is about leakage of secret keys which only few users should have access to anyway. If the attacker manages to get access to such ...


1

I did some search and while I feel it depends on how you can find a common string / type in the file / date you want to block. Most DLP's - I checked with symantec offer ability to block an "encrypted" file but not the keys for encryption itself. If the user sends encryption keys in a particular file format such as .asc you can block those but if they're ...


1

You should focus on both, but not only, monitoring and preventing is part of single system where there are also established procedures on what to do if the data is leaked or lost. Monitoring (e.g. data availability, data leaks via audits) Taking action (procedures) in case of breach or data loss Sending notifications to interested parties Restoring from ...


1

I think that your idea is interesting but it cannot be a total solution. What applications will you control? If you control Office what about Libre Office? If you control that, I'll just send it to myself on email and edit/copy or whatever on my iPad or iPhone. IF you control all the office apps, maybe I'll run Node-Webkit with an office document reader ...


Only top voted, non community-wiki answers of a minimum length are eligible