Unintentional Leaks

One of the most pressing aspects of information security is the fact that the number of accidental data leaks is approximately equal to the number of intentional ones. However, approaches to protecting against intentional and accidental leaks differ significantly. In the former case, organizations should focus on raising awareness and training staff, and implementing tools to notify users of attempts to violate security policies.

Unintentional Leaks

In the latter case, it is important to minimize user rights, reduce the number of possible information leakage channels, use information monitoring and control tools, and store and analyze security event archives. In this article, we will examine in detail the main causes of leaks, as well as potential methods for mitigating them.

A typical example is a recent incident in Colorado: an employee of a government agency lost a USB drive containing confidential data belonging to nearly 20,000 staff members.

The loss or theft of removable media is the primary cause of data breaches. Removable media — such as USB flash drives, CDs/DVDs, memory cards, and tape drives — are a commonly available and popular means of storing and sharing information.

Such media are easily removed from office premises, and their small size increases the risk of loss. Given that removable media are used by a large number of both staff and executives, the potential for the theft of critical corporate data and subsequent damage to the company is quite obvious.

A recent incident in Colorado provides a telling example: an employee of a government organization lost a USB drive containing confidential data of nearly 20,000 full-time employees. The electronic documents stored on the drive contained the names, first names, and Social Security numbers of both current and recently terminated employees.

Despite the organization’s clearly defined information security policies, the removable drive was not encrypted, resulting in significant reputation and, consequently, financial damage.

To prevent similar situations, organizations must develop and implement policies, procedures, and rules defining information security requirements. Staff training is required to clarify these requirements and periodically monitor their compliance. Necessary security measures must be implemented to prevent the leakage of critical information.

In this case, the employee clearly lacked understanding of the most basic rules for handling critical information and violated information security policy requirements: copying to external media and removing it outside of a controlled area is prohibited.

Lack of necessary security measures: encryption of information on storage media when recording and transferring such information outside of a controlled area; lack of mechanisms for monitoring and controlling connected devices; control and filtering of information transferred to removable devices.

Second place on the “honored” list is the loss of mobile devices. Currently, employees are increasingly using both personal and corporate mobile devices (smartphones, tablets, or laptops) to process restricted information.

Like removable media, they are easily removed outside the controlled perimeter. It should be noted that mobile devices themselves are desirable prey for thieves and robbers. Losses (theft of tablets, laptops, and other devices) are a fairly common incident.

For example: a corporate laptop containing the personal data of several thousand American citizens, including driver’s license numbers and Social Security cards, was stolen from the car of the King County Sheriff (Washington, USA).

The data was not encrypted.

According to research by international experts, the last year saw the theft of more than a million laptops containing valuable corporate data. People want to be mobile and not tied to a stationary workstation. Using mobile devices allows them to work from anywhere and at any time, but this inevitably creates additional security threats.

In addition to the aforementioned threats related to the theft of mobile devices and the critical information stored on them, I would like to highlight the most common security incidents that occur when using mobile devices:

1. Using personal mobile devices to access information systems.
2. Organizational topics (resources). The problem is that while all devices on the corporate network must comply with information security requirements (configured OS rights and policies, antivirus protection installed, data encryption), on a personal laptop, for example, these requirements are often ignored.
3. Connecting to the organization’s information resources via unsecured public networks. In this case, there is a risk of interception and modification of transmitted traffic. Working on a mobile device (laptop) in a public place allows an attacker to view the information necessary for successful authentication in the system. In addition to the “cure” described above for lost or stolen storage media, when using mobile devices, care should be taken to configure the device in accordance with the rules for stationary workstations.
4. To access system resources, it is recommended to use secure, trusted communication channels, such as a VPN. It is important to be careful when entering your login and password and prevent an attacker from obtaining this data. One of the causes of unintentional leaks is the careless handling of paper documents.

Documents containing sensitive information are often stored unsupervised, left near printers, or lost outside the organization. A typical incident occurred at a dental clinic: employees were taking patient records outside the facility. An employee accidentally forgot one of the records in a taxi, after which the woman’s health information was leaked.

This problem can be addressed through organizational and technical measures, namely, categorizing information, implementing controls on printed documents, regulating the handling of paper documents within the organization, and mandating the use of shredders for documents containing critical information that require destruction.

Emails sent incorrectly are also a potential cause of leaks. This typically occurs because employees are inattentive when selecting recipients or want to simplify the task of sending emails by sending a single message to a shared electronic database.

Example: accounting staff at the University of Mississippi Center made an error while sending a letter to a centralized database about changes to insurance programs. The attachment contained a spreadsheet containing the personal information of 2,281 students: Social Security numbers, gender, age, addresses, phone numbers, dates of birth, and Social Security numbers. The same applies to sending emails and faxes. The process is similar to the previous points, with only differences in the sending methods.

For example, the British Information Commission fined the Bank of Scotland £75,000 for sending faxes containing confidential information to incorrect numbers. According to experts, bank employees made the mistake between late February 2009 and July 2012. Pay slips, bank statements, and mortgage applications were sent to the incorrect addresses.

The documents contained contact information and names of clients. The human factor in such errors can be mitigated through more thorough training of personnel handling outgoing correspondence, partial automation of the correspondence process, and the introduction of additional administrative and technical controls over the actions performed, such as using DLP systems.

Get Elena Krosheva’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Another common error is the erroneous granting of access rights, as well as the posting of confidential information in open sources.

This error applies to actions such as:

1. Granting excessive access rights to information and services, accidental errors when setting up access rights, disclosing personal data due to an employee’s lack of professional competence, and abuse of office when disclosing information.
2. The issue of access rights to system resources has been a pressing issue for many years. Software developers have long been aware of this problem, and in most systems, a user with default rights has very limited privileges. The procedure for granting access rights should be strictly regulated by the organization’s information security guidelines. The use of shared resources safeguarding confidential information is possible with strict adherence to regulations for handling such information, and properly configured security and control tools. The level of professional training of personnel handling this category of information is an important factor.
3. Careless disposal of paper documents is a fairly common incident. Documents containing restricted information are often simply thrown away, with their former owners not even bothering to ensure they are properly destroyed.

The confidential documents were lying near a trash can. The personal data included clients’ first and last names, passport information, and even the presence of dependents. A high-profile case occurred in Kansas: the owner of a private medical clinic was forced to suspend his practice due to incompetent handling of confidential records concerning his clients — women who had undergone abortions.

In mid-March, passersby accidentally discovered several thousand medical records containing phone numbers, names, addresses, Social Security numbers, and medical information about patients in a dumpster on a school grounds near the home of the head physician.

In addition to discarding data processing and storage devices containing restricted access information without deleting confidential data, similar errors can also include reselling or transferring such devices to third parties for commercial use.

Last year, a resident of Wales (United Kingdom) accidentally dumped a hard drive containing a file containing over 7,500 bitcoins. The value of one Bitcoin is currently over $1,000, meaning the victim lost more than $7.5 million.

Another cause of unintentional leaks is the transfer of equipment containing sensitive information to third parties for maintenance. Often, representatives of commercial organizations do not perform complex computer repairs themselves, but rather hand them over to repair centers.

However, the presence of sensitive information on these devices is not always verified, nor is it always possible due to the device itself being faulty. During maintenance or repair, personnel performing the repairs can gain access to all the information contained on the device.

For example, Virginia Tech leaked the personal data of 145,000 people when it transferred the server on which it was stored for maintenance. Leaks are also caused by security policy violations (illegitimate transfer or copying of information) at the request of other employees and others (social engineering).

1. Errors of this kind occur when an employee is asked by an unknown person or their direct supervisor to save or forward restricted information in any way. Such a request may be motivated by a deliberate desire to steal the information.
2. Confidential information on 130,000 clients was leaked from the databases of Standard Chartered Bank and CitiBank Korea. One of the individuals (a CitiBank employee) printed out personal and contact information for over 30,000 clients, while another (an SC employee) copied the information to a USB drive.
3. The data, containing clients’ names, addresses, phone numbers, and financial information, was then transferred to third parties. Insiders received approximately $300,000 for their work.

PROTECTION MEASURES AGAINST UNINTENTIONAL LEAKAGES

1. Loss of removable media: raising awareness and training staff, mandatory encryption of media, monitoring and control of connected devices, filtering information transferred to removable devices, DLP systems, using guaranteed data destruction tools, marking removable media, using stickers on the device casing and/or written text files containing the owner’s contact information.
2. Loss of mobile devices: raising awareness and training staff, encrypting information on mobile devices, prohibiting storage of information on mobile devices, and accessing information through terminals.
3. Locks and cables for laptops, use of software and/or hardware for searching (monitoring the movement of mobile devices), use of remote data destruction tools, use of guaranteed data destruction tools, marking of mobile devices; use of stickers on the case and/or screensavers containing the owner’s contact information.
4. Careless handling of paper documents: increasing the visibility Awareness and staff training, document labeling, use of folders and/or attachments containing the owner’s contact information, print control.
5. Erroneous forwarding of emails: raise awareness and train staff, implement a DLP system.
6. Erroneous forwarding of mail and faxes: raise awareness and train staff.
7. Incorrect granting of access rights, posting sensitive information publicly: raise awareness and train staff, complicate the access rights granting procedure, regularly analyze and review access rights, use monitoring and control tools for access rights granting.
8. Careless disposal of paper documents: raise awareness and train staff, use shredders or other paper document destruction tools, implement print control.
9. Careless disposal of equipment: raise awareness and train staff, use guaranteed information and/or storage media destruction tools.
10. Transferring equipment containing restricted information to third parties for maintenance: raising awareness and training staff, using means of guaranteed destruction of information and/or storage media, and entering into non-disclosure agreements with third parties.
11. Violating security policies (illegitimate transfer or copying of information) at the request of other employees or other individuals (social engineering): raising awareness and training staff.

CONCLUSION

Unintentional information leaks in organizations can occur in various scenarios. There is no single, universal approach to protecting against such leaks; a systematic and comprehensive approach is required.

By Dmitry Ostapovich, CEO https://abbiz.by/.