7 ms·

This is an interesting perspective. Just as a counter argument, one of the things we tried to do at a previous employer was data exfiltration protection. This

This is an interesting perspective. Just as a counter argument, one of the things we tried to do at a previous employer was data exfiltration protection. This meant using outbound proxies from our networks to reach pre-approved urls and we don't want to mitm the TLS connections. This leaves a bit of a problem, because we don't want to whitelist all of s3, the defeats the purpose, so we had to mandate using the bucket.s3 uri style, which is a bit of a pain for clients that use the direct s3 link style, but then we could whitelist buckets we control. I don't want to say this use case is more important, but I can see the merits of standardizing on the subdomain style, and that this might be a common ask of amazon.

arcbyte 7y ago
Exfiltration protection is pointless. It's a great way to waste money and annoy your employees.
- stevenpetryk 7y ago
  This is not a helpful comment. Could you provide some examples of why it's a waste of money?
  - outside1234 7y ago
    When there is a will, there is a way.
    - Scoundreller 7y ago
      Any output device is an output device. A VGA interface. An HDMI interface. A Scroll lock keyboard light. A hard drive interface. A speaker. All you need to do is send the signal down one wire and you could tap into that wire and copy all the data to another system. Copying files from one folder into another could do the job.
      - Darkphibre 7y ago
        > ... A scroll lock keyboard light ... Oh, this was a fascinating read! Thanks for encouraging my perusal. http://staff.ustc.edu.cn/~zhangwm/Paper/2018_10.pdf http://staff.ustc.edu.cn/~zhangwm/Paper/2018_10.pdf
        Scoundreller 7y ago
        I brought it up because I had heard that the original iPODs ROM was extracted using the "click" sound and a microphone. I can't find any reference to it now... There is also research about using modem lights (even in the background of a room) to figure out what people are doing on their dialup internet connection. Those RX and TX LEDs are actually blinking at your data transmission rate.
        teraflop 7y ago
        Here's the iPod story: http://www.ipodlinux.org/stories/piezo/ http://www.ipodlinux.org/stories/piezo/
      - dredmorbius 7y ago
        Generalising further, signal, channel, reciever.
  - cortesoft 7y ago
    Not the commenter, but I think the point is that there are simply too many ways to bypass protections. If you want someone to be able to view data, it is impossible to prevent them from exfiltrating it. In many ways it is similar to the analog hole problem with DRM. You can make it harder to do on accident, or to prevent someone from doing it for convenience (e.g. someone copying data to an insecure location to have easier access to do their job), but you can't stop a malicious actor from getting the data. They could tunnel over DNS, they could use a camera phone and record the data on the screen, etc. The possibilities are endless. https://en.wikipedia.org/wiki/Analog_hole https://en.wikipedia.org/wiki/Analog_hole
    - dragonwriter 7y ago
      > You can make it harder to do on accident That's a major point of exfiltration prevention, both because accidents are a real problem and because reducing the opportunity for accidents makes it easier to establish that intentional exfiltration is intentional, which makes the ability to impose serious consequences for it greater (especially against privilege insiders with key contractual benefits that can only be taken away for cause.) Technical safeguards aren't standalone, they integrate with social safeguards.
      - lixtra 7y ago
        >> You can make it harder to do on accident >That's a major point of exfiltration prevention But that’s not how it is advertised. Usually they claim is to catch hackers and mal intending employees.
        TeMPOraL 7y ago
        Advertising is 100% bullshit, both in this space and elsewhere. I'm not sure why even well-paid people in positions of corporate power don't seem to get it. It's similar to Gell-Mann amnesia.
    - azernik 7y ago
      It's hard to prevent data exfiltration by an attacker with physical access to your premises, but it's much easier to prevent exfiltration (especially of large quantities of data) by compromised devices.
- technion 7y ago
  Within hours of setting up DLP, I had someone complaining I had broken their workflow. That workflow apparently involved emailing credit card numbers to an external personal mailbox "for security". It was allowed to go on simply because noone knew about it. Could a skilled attacker spread a card card number across three lines and get past the system? Absolutely. Is exfiltration protection pointless? Absolutely not. Once you scale a certain number of users, you'll find someone somewhere that completely ignores training (which they did have) and decides they don't see the problem with something like this. And you won't know about it until you put a suitable system in.
  - arcbyte 7y ago
    This proves my point perfectly. Instead of investing in i.proved tools and productivity for your workers so they dont have to do stupid shit you dont want them to do, you instead made it harder for everyone to do their job. I'm not saying your business is going to crash and burn. I'm saying you will never be as successful as you could have been. You're literally wasting resources, leaving needs unfulfilled, and giving up ground to your competitors.
    - LocalH 7y ago
      Wasting resources by preventing people from sending CC# in clear text to a personal email? That person is lucky they didn’t get fired for doing it
novaleaf 7y ago
since your employer is willing to invest in this, wouldn't a custom proxy solve your problem? just whitelist the s3 buckets you care about, and have people access s3 through the proxy.
- kevin_nisbet 7y ago
  This is based on using a http proxy, it's just the proxy whitelists the domains to connect towards. As for a proxy that can mitm tls connections, I'm not a big fan of this approach, as you ned to add a cert into the trust store of all the machines, which if compromised tends to be a bad day across the board.
cortesoft 7y ago
But that isn't really a counter argument.. if you provide the ability to use both formats, your use case would still work (only provide access to the custom subdomain you control).
- kevin_nisbet 7y ago
  you're correct, it's just my experience with this is that certain libraries expected the url format we couldn't accept to be working, and didn't provide an alternative. So having more flexibility in the api can work against you at times is all.

arcbyte 7y ago

Exfiltration protection is pointless. It's a great way to waste money and annoy your employees.

stevenpetryk 7y ago
This is not a helpful comment. Could you provide some examples of why it's a waste of money?
- outside1234 7y ago
  When there is a will, there is a way.
  - Scoundreller 7y ago
    Any output device is an output device. A VGA interface. An HDMI interface. A Scroll lock keyboard light. A hard drive interface. A speaker. All you need to do is send the signal down one wire and you could tap into that wire and copy all the data to another system. Copying files from one folder into another could do the job.
    - Darkphibre 7y ago
      > ... A scroll lock keyboard light ... Oh, this was a fascinating read! Thanks for encouraging my perusal. http://staff.ustc.edu.cn/~zhangwm/Paper/2018_10.pdf http://staff.ustc.edu.cn/~zhangwm/Paper/2018_10.pdf
      - Scoundreller 7y ago
        I brought it up because I had heard that the original iPODs ROM was extracted using the "click" sound and a microphone. I can't find any reference to it now... There is also research about using modem lights (even in the background of a room) to figure out what people are doing on their dialup internet connection. Those RX and TX LEDs are actually blinking at your data transmission rate.
        teraflop 7y ago
        Here's the iPod story: http://www.ipodlinux.org/stories/piezo/ http://www.ipodlinux.org/stories/piezo/
    - dredmorbius 7y ago
      Generalising further, signal, channel, reciever.
- cortesoft 7y ago
  Not the commenter, but I think the point is that there are simply too many ways to bypass protections. If you want someone to be able to view data, it is impossible to prevent them from exfiltrating it. In many ways it is similar to the analog hole problem with DRM. You can make it harder to do on accident, or to prevent someone from doing it for convenience (e.g. someone copying data to an insecure location to have easier access to do their job), but you can't stop a malicious actor from getting the data. They could tunnel over DNS, they could use a camera phone and record the data on the screen, etc. The possibilities are endless. https://en.wikipedia.org/wiki/Analog_hole https://en.wikipedia.org/wiki/Analog_hole
  - dragonwriter 7y ago
    > You can make it harder to do on accident That's a major point of exfiltration prevention, both because accidents are a real problem and because reducing the opportunity for accidents makes it easier to establish that intentional exfiltration is intentional, which makes the ability to impose serious consequences for it greater (especially against privilege insiders with key contractual benefits that can only be taken away for cause.) Technical safeguards aren't standalone, they integrate with social safeguards.
    - lixtra 7y ago
      >> You can make it harder to do on accident >That's a major point of exfiltration prevention But that’s not how it is advertised. Usually they claim is to catch hackers and mal intending employees.
      - TeMPOraL 7y ago
        Advertising is 100% bullshit, both in this space and elsewhere. I'm not sure why even well-paid people in positions of corporate power don't seem to get it. It's similar to Gell-Mann amnesia.
  - azernik 7y ago
    It's hard to prevent data exfiltration by an attacker with physical access to your premises, but it's much easier to prevent exfiltration (especially of large quantities of data) by compromised devices.
technion 7y ago
Within hours of setting up DLP, I had someone complaining I had broken their workflow. That workflow apparently involved emailing credit card numbers to an external personal mailbox "for security". It was allowed to go on simply because noone knew about it. Could a skilled attacker spread a card card number across three lines and get past the system? Absolutely. Is exfiltration protection pointless? Absolutely not. Once you scale a certain number of users, you'll find someone somewhere that completely ignores training (which they did have) and decides they don't see the problem with something like this. And you won't know about it until you put a suitable system in.
- arcbyte 7y ago
  This proves my point perfectly. Instead of investing in i.proved tools and productivity for your workers so they dont have to do stupid shit you dont want them to do, you instead made it harder for everyone to do their job. I'm not saying your business is going to crash and burn. I'm saying you will never be as successful as you could have been. You're literally wasting resources, leaving needs unfulfilled, and giving up ground to your competitors.
  - LocalH 7y ago
    Wasting resources by preventing people from sending CC# in clear text to a personal email? That person is lucky they didn’t get fired for doing it

novaleaf 7y ago

since your employer is willing to invest in this, wouldn't a custom proxy solve your problem? just whitelist the s3 buckets you care about, and have people access s3 through the proxy.

kevin_nisbet 7y ago
This is based on using a http proxy, it's just the proxy whitelists the domains to connect towards. As for a proxy that can mitm tls connections, I'm not a big fan of this approach, as you ned to add a cert into the trust store of all the machines, which if compromised tends to be a bad day across the board.

cortesoft 7y ago

But that isn't really a counter argument.. if you provide the ability to use both formats, your use case would still work (only provide access to the custom subdomain you control).

kevin_nisbet 7y ago
you're correct, it's just my experience with this is that certain libraries expected the url format we couldn't accept to be working, and didn't provide an alternative. So having more flexibility in the api can work against you at times is all.