Information leakage channels. Part 1

Ruslan Rakhmetov, Security Vision

We observe different types of information around us: some of it is informative and educational (Wikipedia articles, video courses for learning a new profession), some of it is entertaining (watching films and TV series online, music services), and some of it is household (buying food in an online shop, instructions for medicines). There are many more examples, but in general we are surrounded by a lot of data, which will be discussed in this article.

Useful data on the web is not just lying around somewhere, but is constantly changing and moving. Sometimes moving data is necessary for its functioning: backup, downloading music for listening on a trip without internet access, sending scans of documents to the bank's corporate mail for mortgage registration, etc. But sometimes moving (or stealing, as a special case of such moving) is undesirable and can be punishable.

Part of the useful information to be kept safe is your personal data (PD, or PDn), which all the services described above use to understand you better, remember you and offer their services in time. Personal data means information that allows to describe and identify its owner (subject, according to 152-FZ). This is, for example, name and surname, telephone number, residential address, age, medical history, bank card number, etc. Such data are not always critical individually, but in combination, their leakage can definitely cause a lot of harm.

In addition to personal data, there are other types of confidential information that can only be moved within the company (or its department), or cannot be transferred by any means other than a few, controlled by information protection means. We will give examples of different data leakage channels (methods and formats of transfer) and tell you about the protection measures that can be used in each case.

Different data leakage channels can have several forms, so we will give examples of both accidental losses and deliberate data theft. In the current article, we will look at the different channels in two categories: the use of physical media and networks.

1.1 Leakage with physical media

Let's imagine a situation where an employee forgot to take documents with sensitive information out of the meeting room or simply left them in the open on their desk. If an intruder walks by, they can access, memorise or simply steal the documents. In addition to accidental access, paper data needs to be disposed of properly.

To protect against such cases, or at least to find intruders, you can organise video surveillance and implement a clean desk rule. The use of shredders and other data destruction methods will also help.

AUSB stick with important data can be forgotten in a print shop, dropped on the street or left in a cafe, and an intruder can use a peripheral device to infect a computer and steal data with a virus.

For protection, policies (rules) for the use of external devices are implemented, for example, banning all flash drives (except those on the ‘white list’), controlling the use of USB devices, applying a data leakage prevention system, and informing employees about the risks.

In addition to mobile drives, data may also be contained within larger devices. For example, if you don't remove the hard drive from a decommissioned PC when you dispose of it, or if you discard an old printer and leave an internal drive with copies of the data you've sent for printing, you could also lose sensitive data.

Organisational measures can help protect you in such cases, such as securely disposing of devices, and wiping data before selling or disposing of it. Data on hard discs can also be deleted safely with overwrite. At the same time, monitoring of iron composition using AM and/or EM tools can be ensured.

Mobile devices (smartphones, tablets and laptops) can also cause data leakage. For example, losing a smartphone containing customer and partner contacts and other information or using unsecured messengers to send sensitive data are common breaches that are difficult to protect against.

Nevertheless, protection can be achieved by either prohibiting the use of mobile devices at work or by introducing policies to separate personal and work data through containers or special spaces from device creators.

1.2 Leakage through the network

An attacker can gain external access to the corporate network through insufficiently secured network ports or malware embedded in the perimeter, and accidental leakage can occur, for example, when using such a computer. Firewalls, antivirus, VPNs or other secure networking methods are implemented for protection.

There is also a variant of leakage where data actually becomes inaccessible for normal operations. For example, in the case of a DDoS attack, an attacker can make servers temporarily unavailable (causing disruptions in the operation of government systems, online shops or other services whose availability is very important). Possible errors in normal operation can also be used for theft. In such cases, protection against DDoS attacks and redundancy of communication channels are used.

Another type of network leakage is sending confidential information via e-mail. Such leakage can be accidental (for example, an employee made a mistake in the recipient's address) or deliberate, when attackers use social engineering methods and phishing emails calling for personal data.

Defence in the former case involves sensitive data alert systems, special data tags and DLP systems, while in the case of a phishing attack it involves educating employees about social engineering techniques, enforcing authentication policies and email security systems.

The need for file sharing has created a need for cloud storage technologies , which can also be a major leakage channel. For example, if access is accidentally granted or an account is compromised - anyone on the network can get the information they need.

To protect data in the cloud, encryption should be used (the simplest way is archiving with passwords, but there are other ways) and a strong password policy should be established for accounts.

Information leaks via social media deserve special attention. In recent years, there have been many cases when photos from a conference or just in the desktop environment, being published online, contained either documents not intended for the public or stickers with passwords that an attacker can use to access the data.

Policies to protect against such leaks can include banning mobile devices (see physical media section above), restricting online access to social media profiles, and training employees on online security.

The variety of sensitive data leakage channels is not limited to the above examples. In general, you can apply various protection systems (see the overview here, here and here) with orchestration and incident management tools, as well as implement various protection policies at the organisational level.