Detecting and Preventing Data Exfiltration Through Encrypted Web Sessions via Traffic Inspection
Web-based services, such as email, are useful for communicating with others either within or outside of an organization; however, they are a common threat vector through which data exfiltration can occur. Despite this risk, many organizations permit the use of web-based services on their systems. Implementing a method to detect and prevent data exfiltration through these channels is essential to protect an organization's sensitive documents.
This report presents methods that can be used to detect and prevent data exfiltration using a Linux-based proxy server in a Microsoft Windows environment. Tools such as Squid Proxy, Clam Antivirus, and C-ICAP are explored as means by which information technology (IT) professionals can centrally log and monitor web-based services on Microsoft Windows hosts within an organization. Also introduced is a Tagger tool developed by the CERT Insider Threat Center that enables information security personnel to quickly insert tags into documents. These tags can then be used to create signatures for use on the proxy server to prevent documents from leaving the organization. In addition, the use of audit logs is also explored as an aid in determining whether sensitive data may have been uploaded to an internet service by a malicious insider.
This report is related to the following area(s) of work:
Security and SurvivabilityTechnical Note
CMU/SEI-2013-TN-012
March 2013
Cite This Report
SEI:
Silowash, George; Lewellen, Todd; Burns, Joshua; & Costa, Daniel. Detecting and Preventing Data Exfiltration Through Encrypted Web Sessions via Traffic Inspection (CMU/SEI-2013-TN-012). Software Engineering Institute, Carnegie Mellon University, 2013. http://www.sei.cmu.edu/library/abstracts/reports/13tn012.cfm
IEEE:
G. Silowash, T. Lewellen, J. Burns, and D. Costa, "Detecting and Preventing Data Exfiltration Through Encrypted Web Sessions via Traffic Inspection," Software Engineering Institute, Carnegie Mellon University, Pittsburgh, Pennsylvania, Technical Note CMU/SEI-2013-TN-012, 2013. http://www.sei.cmu.edu/library/abstracts/reports/13tn012.cfm
APA:
Silowash, G., Lewellen, T., Burns, J., & Costa, D. (2013). Detecting and Preventing Data Exfiltration Through Encrypted Web Sessions via Traffic Inspection (CMU/SEI-2013-TN-012). Retrieved May 24, 2013, from the Software Engineering Institute, Carnegie Mellon University website: http://www.sei.cmu.edu/library/abstracts/reports/13tn012.cfm
CHI:
Silowash, George, Todd Lewellen, Joshua Burns, and Daniel Costa. Detecting and Preventing Data Exfiltration Through Encrypted Web Sessions via Traffic Inspection (CMU/SEI-2013-TN-012). Pittsburgh, PA: Software Engineering Institute, Carnegie Mellon University, 2013. http://www.sei.cmu.edu/library/abstracts/reports/13tn012.cfm
MLA:
Silowash, G., Lewellen, T., Burns, J., & Costa, D. 2013. Detecting and Preventing Data Exfiltration Through Encrypted Web Sessions via Traffic Inspection (Technical Report CMU/SEI-2013-TN-012). Pittsburgh: Software Engineering Institute, Carnegie Mellon University. http://www.sei.cmu.edu/library/abstracts/reports/13tn012.cfm
Find Us Here
Share This Page
For more information
