6 ms·

Exfiltration protection is pointless. It's a great way to waste money and annoy your employees.

by arcbyte 7y ago

stevenpetryk 7y ago
This is not a helpful comment. Could you provide some examples of why it's a waste of money?
- outside1234 7y ago
  When there is a will, there is a way.
  - Scoundreller 7y ago
    Any output device is an output device. A VGA interface. An HDMI interface. A Scroll lock keyboard light. A hard drive interface. A speaker. All you need to do is send the signal down one wire and you could tap into that wire and copy all the data to another system. Copying files from one folder into another could do the job.
    - Darkphibre 7y ago
      > ... A scroll lock keyboard light ... Oh, this was a fascinating read! Thanks for encouraging my perusal. http://staff.ustc.edu.cn/~zhangwm/Paper/2018_10.pdf http://staff.ustc.edu.cn/~zhangwm/Paper/2018_10.pdf
      - Scoundreller 7y ago
        I brought it up because I had heard that the original iPODs ROM was extracted using the "click" sound and a microphone. I can't find any reference to it now... There is also research about using modem lights (even in the background of a room) to figure out what people are doing on their dialup internet connection. Those RX and TX LEDs are actually blinking at your data transmission rate.
        teraflop 7y ago
        Here's the iPod story: http://www.ipodlinux.org/stories/piezo/ http://www.ipodlinux.org/stories/piezo/
    - dredmorbius 7y ago
      Generalising further, signal, channel, reciever.
- cortesoft 7y ago
  Not the commenter, but I think the point is that there are simply too many ways to bypass protections. If you want someone to be able to view data, it is impossible to prevent them from exfiltrating it. In many ways it is similar to the analog hole problem with DRM. You can make it harder to do on accident, or to prevent someone from doing it for convenience (e.g. someone copying data to an insecure location to have easier access to do their job), but you can't stop a malicious actor from getting the data. They could tunnel over DNS, they could use a camera phone and record the data on the screen, etc. The possibilities are endless. https://en.wikipedia.org/wiki/Analog_hole https://en.wikipedia.org/wiki/Analog_hole
  - dragonwriter 7y ago
    > You can make it harder to do on accident That's a major point of exfiltration prevention, both because accidents are a real problem and because reducing the opportunity for accidents makes it easier to establish that intentional exfiltration is intentional, which makes the ability to impose serious consequences for it greater (especially against privilege insiders with key contractual benefits that can only be taken away for cause.) Technical safeguards aren't standalone, they integrate with social safeguards.
    - lixtra 7y ago
      >> You can make it harder to do on accident >That's a major point of exfiltration prevention But that’s not how it is advertised. Usually they claim is to catch hackers and mal intending employees.
      - TeMPOraL 7y ago
        Advertising is 100% bullshit, both in this space and elsewhere. I'm not sure why even well-paid people in positions of corporate power don't seem to get it. It's similar to Gell-Mann amnesia.
  - azernik 7y ago
    It's hard to prevent data exfiltration by an attacker with physical access to your premises, but it's much easier to prevent exfiltration (especially of large quantities of data) by compromised devices.
technion 7y ago
Within hours of setting up DLP, I had someone complaining I had broken their workflow. That workflow apparently involved emailing credit card numbers to an external personal mailbox "for security". It was allowed to go on simply because noone knew about it. Could a skilled attacker spread a card card number across three lines and get past the system? Absolutely. Is exfiltration protection pointless? Absolutely not. Once you scale a certain number of users, you'll find someone somewhere that completely ignores training (which they did have) and decides they don't see the problem with something like this. And you won't know about it until you put a suitable system in.
- arcbyte 7y ago
  This proves my point perfectly. Instead of investing in i.proved tools and productivity for your workers so they dont have to do stupid shit you dont want them to do, you instead made it harder for everyone to do their job. I'm not saying your business is going to crash and burn. I'm saying you will never be as successful as you could have been. You're literally wasting resources, leaving needs unfulfilled, and giving up ground to your competitors.
  - LocalH 7y ago
    Wasting resources by preventing people from sending CC# in clear text to a personal email? That person is lucky they didn’t get fired for doing it

Exfiltration protection is pointless. It's a great way to waste money and annoy your employees.

stevenpetryk 7y ago

This is not a helpful comment. Could you provide some examples of why it's a waste of money?

outside1234 7y ago
When there is a will, there is a way.
- Scoundreller 7y ago
  Any output device is an output device. A VGA interface. An HDMI interface. A Scroll lock keyboard light. A hard drive interface. A speaker. All you need to do is send the signal down one wire and you could tap into that wire and copy all the data to another system. Copying files from one folder into another could do the job.
  - Darkphibre 7y ago
    > ... A scroll lock keyboard light ... Oh, this was a fascinating read! Thanks for encouraging my perusal. http://staff.ustc.edu.cn/~zhangwm/Paper/2018_10.pdf http://staff.ustc.edu.cn/~zhangwm/Paper/2018_10.pdf
    - Scoundreller 7y ago
      I brought it up because I had heard that the original iPODs ROM was extracted using the "click" sound and a microphone. I can't find any reference to it now... There is also research about using modem lights (even in the background of a room) to figure out what people are doing on their dialup internet connection. Those RX and TX LEDs are actually blinking at your data transmission rate.
      - teraflop 7y ago
        Here's the iPod story: http://www.ipodlinux.org/stories/piezo/ http://www.ipodlinux.org/stories/piezo/
  - dredmorbius 7y ago
    Generalising further, signal, channel, reciever.
cortesoft 7y ago
Not the commenter, but I think the point is that there are simply too many ways to bypass protections. If you want someone to be able to view data, it is impossible to prevent them from exfiltrating it. In many ways it is similar to the analog hole problem with DRM. You can make it harder to do on accident, or to prevent someone from doing it for convenience (e.g. someone copying data to an insecure location to have easier access to do their job), but you can't stop a malicious actor from getting the data. They could tunnel over DNS, they could use a camera phone and record the data on the screen, etc. The possibilities are endless. https://en.wikipedia.org/wiki/Analog_hole https://en.wikipedia.org/wiki/Analog_hole
- dragonwriter 7y ago
  > You can make it harder to do on accident That's a major point of exfiltration prevention, both because accidents are a real problem and because reducing the opportunity for accidents makes it easier to establish that intentional exfiltration is intentional, which makes the ability to impose serious consequences for it greater (especially against privilege insiders with key contractual benefits that can only be taken away for cause.) Technical safeguards aren't standalone, they integrate with social safeguards.
  - lixtra 7y ago
    >> You can make it harder to do on accident >That's a major point of exfiltration prevention But that’s not how it is advertised. Usually they claim is to catch hackers and mal intending employees.
    - TeMPOraL 7y ago
      Advertising is 100% bullshit, both in this space and elsewhere. I'm not sure why even well-paid people in positions of corporate power don't seem to get it. It's similar to Gell-Mann amnesia.
- azernik 7y ago
  It's hard to prevent data exfiltration by an attacker with physical access to your premises, but it's much easier to prevent exfiltration (especially of large quantities of data) by compromised devices.

technion 7y ago

Within hours of setting up DLP, I had someone complaining I had broken their workflow. That workflow apparently involved emailing credit card numbers to an external personal mailbox "for security". It was allowed to go on simply because noone knew about it. Could a skilled attacker spread a card card number across three lines and get past the system? Absolutely. Is exfiltration protection pointless? Absolutely not. Once you scale a certain number of users, you'll find someone somewhere that completely ignores training (which they did have) and decides they don't see the problem with something like this. And you won't know about it until you put a suitable system in.

arcbyte 7y ago
This proves my point perfectly. Instead of investing in i.proved tools and productivity for your workers so they dont have to do stupid shit you dont want them to do, you instead made it harder for everyone to do their job. I'm not saying your business is going to crash and burn. I'm saying you will never be as successful as you could have been. You're literally wasting resources, leaving needs unfulfilled, and giving up ground to your competitors.
- LocalH 7y ago
  Wasting resources by preventing people from sending CC# in clear text to a personal email? That person is lucky they didn’t get fired for doing it