Is my Data Loss Prevention approach missing something obvious?

Question

I think I'm too close to the problem here and I just looking for a sanity check.

My product blocks files from being stolen by restricting what programs can access what 'type' of the data. (e.g. Excel can read xls(x), Word can read doc(x), etc.). Basically a 'Content Based White List'.

It seems that my ‘would be’ competitors (McAfee, TrendMicro, etc...) are crazy about signature scanning as being the 'Way'.

To me, attempting to detect leakage by 'content' is flawed since it's so easy to encrypt data before putting it on the wire. That said, it's certainly easier to sell to the non-techie.

So, to all you experts out there, what am I missing?

If I prevent a sensitive file from being renamed, block Save As/Export and block 'Clipboard' operations, what am I missing? (Yeah, I know about the 'Send to' feature inside of Office and can deal with that)

But I get the feeling that there is something OBVIOUS that I missing.

What is it?

Answer 1

The most likely weakness is in how you identify a file's "type".

A file's extension is ambiguous: ".dat", for example, can be any of thousands of file types. Many file formats are "PKZip"-style compressed archives containing the real data, so you can't use naive content sniffing (eg. it's hard to distinguish a Java JAR, an Word docX, and a PKZip archive). Even advanced content sniffing has edge cases that make it hard to get right (you can append a zip file to a JPEG to get a file that is valid in both formats).

Edit: The other thing you're missing is the analog hole.

So a user can't copy and paste credit card information from a Word document to an email, and they can't attach the document to the email. Nothing is preventing them from re-typing the document in the body of the email.

Answer 2

I think that your idea is interesting but it cannot be a total solution. What applications will you control? If you control Office what about Libre Office? If you control that, I'll just send it to myself on email and edit/copy or whatever on my iPad or iPhone.

IF you control all the office apps, maybe I'll run Node-Webkit with an office document reader library embedded.

If you fix that, I'll go into CMD prompt, PowerShell or something else. Can you really control everything, will you remember everything? VBA, PowerShell, WSH, CMD, ....

The only way to control a machine that has decades of design behind it to make it into a powerful, flexible all-purpose tool is to turn off everything and lock down what is left. Companies spend millions on this sometimes and I've never worked in any high-security environment yet where I couldn't get data out if I really had wanted to.

So your ideas have merrit but need to be part of a larger solution that includes GPO lockdown, removal of features and software and whitelisting of software (intelligent that is not just based on file name).

Answer 3

If you are trying to protect it from the user that's admin on the box, then it's quite a difficult proposition because they can undo whatever your product does.

Assuming non-admin:

• What about saving the file to a different extension, e.g. via word/excel?
• What about I write some code and call it winword.exe, would you let it open? If so, my code could save, transmit etc. the contents.
• How about if I were to write an excel macro to save the contents elsewhere?
• If I have physical access to the machine that has the file (e.g. on hard disk, on USB), I can always attach the medium to another machine and copy, or better yet, just take the hard disk on my way home, copy everything, and bring it back the next day :-)

You might also want to read 10 immutable laws of security, some of which may be applicable in your case.

Verifying the file signature helps when someone attempts to 'save as' or 'copy' in the original format, but not so sure when they change the format (e.g. doc to txt or even an older doc format). If the signature also depends on the content of the file (as opposed to just the format), then the question is whether it can track someone making changes such as making some changes to the content (such as adding spaces at the end, or even bogus content) so that the file signature would change but the essence of the document won't. In the case of office documents, one can typically change the physical file without changing the document contents.

I decided to do something like this because of malware related issues and IP theft concerns at my father's company, and we ended up removing all removable media from the computers, put locks on the physical computer boxes, disconnected the network from the Internet and then made sure that there were usually enough eyes, because he had trade secrets, as well as customer data, that we couldn't lose. (Although this was done in the last century, you can still turn around a workstation or a desktop and see that there are two loops for someone to put in a physical lock and take the key!)

Of course taking a photo with a digital camera always beats all such programs and protections, but very much like in our case, I'd assume that that's outside the scope and perhaps acceptable 'risk'. If not, put on cameras where the machines are (which is actually what my dad did later although he didn't necessarily do it for all machines!)

Hope this helps.