3 ms·

I am surprised that the information got out. In my company any email attachments to addresses outside the company domain were automatically zipped and passworde

I am surprised that the information got out. In my company any email attachments to addresses outside the company domain were automatically zipped and passworded at the mail-server. We would then receive an email with the password which we have to then inform to the original recipient (usually by forwarding the email... MITM? What does that mean). And this is for a company that is nowhere near as regulated. How did GS let this happen?

Mandatum 12y ago
That's the first time I've heard of that sort of setup. Very cool.
- rurounijones 12y ago
  Huh, I thought it was quite common, my mistake. It certainly worked but it was a total drag for normal users as we were constantly in communication with outside parties. But then making us happy was not the goal of the software :D
shard972 12y ago
> How did GS let this happen? It was a glitch.
- Dylan16807 12y ago
  And there should have been a completely separate layer that would have caught the data sent by the glitch. To rephrase the question: "How did GS not have defense in depth here?"
SEJeff 12y ago
Clearly someone in their infosec department just got fired. In the financial industry (I work in tech for finance), the "DLP" aka Data Loss Protection segment is very busy. A few ideas: https://www.verdasys.com/solutions/eip.html https://www.verdasys.com/solutions/eip.html http://www.symantec.com/data-loss-prevention http://www.symantec.com/data-loss-prevention http://interguardsoftware.com/sp_dlp_lnd_v6.html http://interguardsoftware.com/sp_dlp_lnd_v6.html http://technet.microsoft.com/en-us/library/jj150527(v=exchg.150).aspx http://technet.microsoft.com/en-us/library/jj150527(v=exchg.... DLP software is what keeps sensitive software inside the confines of where it is supposed to stay. Funnily enough, DLP software like exactly the stuff in those links is what was not installed in the base Edward Snowden was at in Hawaii because it used too much bandwith. The Federal Reserve uses Verdasys to prevent digital copies of the plates that print money from making it out (I know a guy who works in their tech department). It is scary to work at a place where they don't always trust even their administrators who have root/Administrator privs.
- greatquux 12y ago
  Is such a setup able to figure out if I base64 or uuencode a file and include it as text inside of a plain text e-mail? I would think there'd always be a way around this somehow.
  - SEJeff 12y ago
    Yes. The software we use will actually log when you perform any sort of read on files matching certain strings (ie sensitive source codes). One of our infosec guys encoded some sensitive source code and played it through the speaker to his phone and reconstructed it. The DLP software detected that and it was in a dashboard buried amongst other things.
chaz 12y ago
The article doesn't mention the email contained an attachment. I've sent and received a lot of emails with confidential data in the form of people chatting, parts of a spreadsheet pasted in, or an entire HTML automated report.
- rurounijones 12y ago
  That is a fair point, in fact a very fair point if this was part of some "reporting" thing, the text might have been embedded in the email itself.... (Which raises other questions though, like signing and encryption and storage etc)

Mandatum 12y ago

That's the first time I've heard of that sort of setup. Very cool.

rurounijones 12y ago
Huh, I thought it was quite common, my mistake. It certainly worked but it was a total drag for normal users as we were constantly in communication with outside parties. But then making us happy was not the goal of the software :D

shard972 12y ago

> How did GS let this happen? It was a glitch.

Dylan16807 12y ago
And there should have been a completely separate layer that would have caught the data sent by the glitch. To rephrase the question: "How did GS not have defense in depth here?"

SEJeff 12y ago

Clearly someone in their infosec department just got fired. In the financial industry (I work in tech for finance), the "DLP" aka Data Loss Protection segment is very busy. A few ideas: https://www.verdasys.com/solutions/eip.html https://www.verdasys.com/solutions/eip.html http://www.symantec.com/data-loss-prevention http://www.symantec.com/data-loss-prevention http://interguardsoftware.com/sp_dlp_lnd_v6.html http://interguardsoftware.com/sp_dlp_lnd_v6.html http://technet.microsoft.com/en-us/library/jj150527(v=exchg.150).aspx http://technet.microsoft.com/en-us/library/jj150527(v=exchg.... DLP software is what keeps sensitive software inside the confines of where it is supposed to stay. Funnily enough, DLP software like exactly the stuff in those links is what was not installed in the base Edward Snowden was at in Hawaii because it used too much bandwith. The Federal Reserve uses Verdasys to prevent digital copies of the plates that print money from making it out (I know a guy who works in their tech department). It is scary to work at a place where they don't always trust even their administrators who have root/Administrator privs.

greatquux 12y ago
Is such a setup able to figure out if I base64 or uuencode a file and include it as text inside of a plain text e-mail? I would think there'd always be a way around this somehow.
- SEJeff 12y ago
  Yes. The software we use will actually log when you perform any sort of read on files matching certain strings (ie sensitive source codes). One of our infosec guys encoded some sensitive source code and played it through the speaker to his phone and reconstructed it. The DLP software detected that and it was in a dashboard buried amongst other things.

chaz 12y ago

The article doesn't mention the email contained an attachment. I've sent and received a lot of emails with confidential data in the form of people chatting, parts of a spreadsheet pasted in, or an entire HTML automated report.

rurounijones 12y ago
That is a fair point, in fact a very fair point if this was part of some "reporting" thing, the text might have been embedded in the email itself.... (Which raises other questions though, like signing and encryption and storage etc)