Elektronika 2009-11.pdf - Instytut Systemów Elektronicznych

An experiment of implementation of DLP system
working as a Linux kernel loadable module
(Próba implementacji systemu ochrony przed utratą danych (DLP)
pracującego na poziomie jądra dla systemu Linux)
ADAM RAKOWSKI student, dr inż. IMED EL FRAY
Zachodniopomorski Uniwersytet Technologiczny w Szczecinie, Wydział Informatyki
Computerization in business is a fact. A perspective of shortening
the time of document flow between company units, improving
internal communication and enhancement of management
processes is expectation of many managers. Due to increased
role of computers in business, the need of better care of data security
- from physical security till access control is a fact.
Each computerized corporation stores the critical confident
data about its contracts, staff, technology, security procedures
etc... An enterprise shares important data to many people, so
the risk of information leakage caused by disloyality or human
error is significantly increased. Published in 2006 „Deloitte’s
2006 Global Security Survey” [1] tells that the second most frequent
reason of internal IT security violation is data leakage
caused by qualified person (28%). Only the viruses and malware
are the reason of more incidents (31%). The same report
published one year later [2] describes data leakage or intellectual
property theft as the incident happening once in 5% of surveyed
companies, while in 8% of companies - several times.
Due to „CSI Computer Crime and Security Survey” (September
2007) a cost of sacrifice caused by electronic crimes was in average
$345 000 per company, about $175 000 more than a year
before. A global cost of confidential data leakage in company or
data theft caused by qualified person was $13.6 million [10].
DLP systems are a response to data leakage risk caused
by employee working with sensitive data. Current IT business
applications and systems can authorize user and share important
documents to him if administrator allowed him to use
that data. After successful authorization the actions performed
on protected file usually are not traced or logged, system also
is not able to prevent data leakage. There are many possible
channels the thief can use: socket, removable memory, screen
capture or printing. Well working DLP system should prevent
data loss or at least log that try and notify administrator.
Data loss prevention system can be made in one of following
architectures: host control architecture or DLP network.
In first architecture administrator has to install controlling software
on each of computer working in network, where protected
documents are shared. When user logs in the system
and reads from the database set of user’s permissions and
privileges to protected documents, then the system starts tracing
user’s activities. Administrator can set actions performed
in case of policy violation.
DLP network is based on another idea. All the hosts are free
of controlling software, but it is installed on a network gateway,
so the data is analyzed only when tries to get out of network [3].
Data identification
According to DLP definition given by Securosis [4] - an independent
IT security research laboratory - “Products that,
based on central policies, identify, monitor, and protect data at
rest, in motion, and in use, through deep content analysis”.
Most important problem is document comparison and classification
of the file to protected files group. When employee
attempts to send a confidential information to inappropriate
recipient, system has to detect this violation. Trusted DLP application
should recognize also a snippets of protected documents,
or protected files modified a bit, or even encrypted.
Recognition and similarity determination is implemented using
deep analysis, dictionary methods, regular expressions, statistical
methods or watermarks [3,4]. Good DLP implementation
can also extract data from compressed archive and
analyze data the archive contains. Side effect of watermarking
are possible delays in documents access caused by huge
quantity of connections to database [4].
Additional technique can be embedding metadata in protected
file, but in can be cumbersome. Any application working
with such protected file should “know” if this file is
protected or not. It implicates on a DLP system vendor need
of creating dedicated viewers, browsers which can interpret
metadata and edit these documents. Disadvantage of this solution
is that user can use only selected applications, tools and
formats. Better idea could be keeping in memory the information
which files are protected and taking control on external
editor (browser) to inform DLP system that any application
tries to get access to protected file.
Possible scenarios
Fig. 1. A difference between DLP host protection and DLP Network
Rys. 1. Porównanie koncepcji DLP host protection i DLP Network
Available channels of potential data loss are: instant messagers,
chats, e-mail, webmail, sending data by ftp/http, printing confident
data or screen capture. If user knows that supervisor application
use heuristic analysis and similarity comparison, he
should get any ciphering application to save text as encrypted
file, also steganography application could be helpful. DLP system
can trace (and manage with) copies of protected file. The
most terrible scenario may looks like following one.
48 ELEKTRONIKA 11/2009