IT Security Tip: Don't Use Hardware You Find in a Parking Lot

From an Healthcare IT News article on ransomeware attacks on hospitals:

"Department of Homeland Security officials recently conducted a test in which DHS staffers dropped computer disks and flash drives in government buildings and contractor parking lots to see how many would subsequently be used," [Bill Carey, vice president of Marketing at GoodSync] said. "Sixty percent that were picked up were plugged into office computers, and the installation rate rose to 90 percent for disks and drives bearing an official logo. The test revealed a huge security vulnerability."

Security tip: If you find hardware in a parking lot or in the street, don't plug it in.

You probably wouldn't eat a sandwich you find on a park bench. Apply the same caution with IT equipment of unknown provenance.

Data Security for SaaS, PaaS, and Social Media

One of the most common objections to cloud computing is that cloud computing poses too great a risk for data security. Internal data that is being stored safely in an internal data center may be subject to interception in transit to or from a remote application. It might also be vulnerable when stored in the cloud itself.

Cloud vendors such as Amazon, Google, and Salesforce are going out of their way to demonstrate tight security controls to major clients. Nonetheless, a lot of CIOs, CSOs, and others have their doubts.

It's worth pointing out that, whether they realize it or not, most enterprises are leaking—nay, hemorrhaging—data to the public Internet. As I wrote nearly a year ago, summarizing some fine reporting in InformationWeek, P2P applications alone are responsible for massive data leaks even at large, public companies.

When InformationWeek reporters investigated P2P networks to find out just how much confidential data was being accidentally leaked by P2P networks, they were shocked at what they found. Users were inadvertently publishing "spreadsheets, billing data, health records, RFPs, internal audits, product specs, and meeting notes . . . files with the home and cell phone numbers of senators, confidential meeting notes, and fund-raising plans [for a state political party] . . . spreadsheets listing patients' names along with their HIV and hepatitis status . . . [and] a slew of court documents regarding a sticky divorce."

Fortunately, there's technology available to detect and thwart such leaks. Data leak protection (DLP) products, often available as network appliances, can scan data leaving the network and raise an alarm about confidential data leaking out. A lot of companies have jumped into this market; a few years ago, no less than 46 different start-ups were tackling this problem. A few companies have emerged as leaders. You can learn more about DLP at this informational site: www.dlpindepth.org.

Certainly it makes sense for any medium or large enterprise to have a DLP solution in place. Once it's in place, it should provide effective monitoring and control over data posted to the cloud.

DLP doesn't address the problem of security vulnerabilities in cloud storage, but it does address vulnerabilities in cloud communications, and it also enables enterprises to ensure they know what data is being posted to the cloud in the first place, regardless of whether the destination is Salesforce.com, AWS, Facebook, or some other app.

Is Someone in Your Company Publishing All Your Confidential Files? How Do You Know?

I've written about IT security, in one form or another, for almost a decade now, so I've seen more than my fair share of stories about virus and worm attacks, employees stealing confidential information, malware being used to extort money from large companies, and other nefarious acts of theft and sabotage. But I have to say that a pair of articles—one by John Foley and another by Avi Baumstein—in a recent issue of InformationWeek managed to rattle even me.

The topic is data leakage caused by peer-to-peer (P2P) file-sharing applications. P2P applications enable users to share and transmit files over a vast network of computers all running the same P2P software. In some P2P networks, a node simply makes files available for other nodes to discover and download. For example, I might put a bunch of documents in a sharing folder. You might use the P2P application to search for these documents, discover them, and copy them from my system to yours.

Another model of P2P network is specially designed for handling large media files, such as software distribution packages and movies. These networks use a "swarming" protocol such as BitTorrent to disassemble very large files, transmit them as hordes of little files, and then reassemble them into a copy of the original on the other end. Because there are hundreds, thousands, or even millions of computers functioning as nodes in the network, this type of P2P network offers a convenient solution for efficiently distributing large files, such as 150 MB software packages, without putting excessive load on any one CPU or segment in the network.

Sounds clever and convenient, right? But P2P file-sharing applications can also be dangerous, because many of them allow anonymous remote users to browse and transfer a lot more content that the computer owner may realize. Here's a typical example: Joe comes home from a long day's work at a large accounting firm. He wants to download a song he heard on the radio. He uses a P2P network to find a bootleg copy of the song. He downloads the song. What he doesn't realize is that when he's installing the P2P application and clicking Next, Next, Next, to get through the installation, he's making the entire contents of his laptop accessible to the P2P network. Other users of the network can now browse his laptop and download whatever they find.

His company's firewall? Bypassed. His company's security policies? Moot. Joe is not intending to do harm (well, other than perhaps grabbing a pirated version of a song), but by using P2P software, he's effectively negating the millions of dollars of security controls his IT has developed and implemented to keep their business data confidential and in compliance with regulations such as SOX and Gramm-Leach-Bliley. He's publishing all the confidential materials he has on his laptop. Chances are, he's got quite a few.

When InformationWeek reporters investigated P2P networks to find out just how much confidential data was being accidentally leaked by P2P networks, they were shocked at what they found. Users were inadvertently publishing "spreadsheets, billing data, health records, RFPs, internal audits, product specs, and meeting notes . . . files with the home and cell phone numbers of senators, confidential meeting notes, and fund-raising plans [for a state political party] . . . spreadsheets listing patients' names along with their HIV and hepatitis status . . . [and] a slew of court documents regarding a sticky divorce."

Limewire, the most popular client of a P2P solution called Gnutella, is supposedly installed on over 18% of all computers.

Three suggestions, then:

1. Read the full InformationWeek articles (here
   and here) and encourage your managers and employees to do the same.
   
2. Forbid or tightly control the use of P2P programs such Limewire on your business computers.
   
3. Have an IT engineer use one of these programs immediately to discover if your business is already exposed.