Elektronika 2009-11.pdf - Instytut Systemów Elektronicznych

Fig. 2. Possible scenarios of data leakage
Rys. 2. Możliwe scenariusze celowej utraty danych
User takes some screen captures of confident data. Images
are stored in clipboard by default. User copies these images
do graphics editor and perform some changes (cropping,
adding some random points). Performed operations can reduce
the probability of positive matching the screen captures
taken by user in case of embedded watermark in print screen.
Later user writes the screenshots to file and creates encrypted
archive. After all the archive is sent using SSL protocol.
Alternative scenario can be like this: user copies a fragment
of protected text document to clipboard. Then he performs
a simple, reversible obfuscation of this text. Text after
obfuscation is directed to input of steganography application.
The result of this operation is image. This image is sent by instant
messager.
Analysis of example scenarios show how wide range of IT
system has to be mentioned and controlled. It also shows that
protecting only some selected output channels will only delay
the discreditation of DLP system.
Available solutions
Nowadays DLP system can be software implementation (for
Windows) or hardware.
Software implementation are offered by (e.g.): Websense,
RSA, McAffe, Symantec, Nitrobit, Trend Micro i GSS. The
leader of DLP software for Windows is Websence. It’s Data
Security package is made of four fully integrated components:
Data Discover, Data Monitor, Data Protect and Data Endpoint.
System is based on user policies and rules. Policy determines
access range for each group of users to documents (context)
and allowed output channels. The PreciseID technology using
ThreatSeeker solution (determines whether remote source of
data is safe or can be dangerous to computer) makes possible
classifying corporation data on workstation (end-point protection)
and also in whole the Internet.
Controlled channels are network traffic (HTTP, SMTP and
IM) and workstation supervision (removable storages, printing,
print screen, clipboard). Administrator set the policies used in
case of violation. Some of possible actions are force encryption
when writing to removable storage, denial or quarantine [7].
Another solution in data loss prevention comes from Nitrobit
company and is called Policy Extension. Due it’s name
it is a set of policies which extends standard Windows security
policies. This software is available for Windows OS version
2000 to Vista, 32 and 64 bits. It supports removable media,
system registry, services and network storages. Removable
media can be configured using it’s serial number, type and
vendor [8]. Disadvantage is less flexibility of configuration.
Popular solution for Windows platform is security policies
based package LeakProof made by Micro Trend company. It
is made of three components: DataDNA Technology (documents
watermarking), Server and Client module (installed on
employees’ computers). Both DLP network and end-point protection
modes are supported. This software allows to control
removable media, also plugged to COM and LPT ports and
printers. Blocking print screen is also possible.
Features of control: removable media, optical discs drives,
USB memory, e-mail and webmail (also encrypted), HTTPS
and FTP protocols, IM protocols. An interesting feature is controlling
Bluetooth interfaces and WiFi networks. LeakProof can
also work with on- and off-line computers.
System can deny disloyal or absent-minded employee, or
display on his screen a message window with policy information
and message that try of violation is possible. When such
employee tries to move data to removable media, system can
force encryption of file [9].
All the above solutions, despite the fact they can not guarantee
full security of sensitive or confident information, they reduce
the risk of consequences caused by neglect of employees.
For computer geeks hacking DLP system is possible. Main
problem and the topic of this paper is a question why there is
no DLP system for Linux similar to described or released as
Open Source.
Experiment of implementation DLP
solution for Linux
Others also were looking for an answer to this question [5],
we started searching a reason of this fact. General idea of the
experiment was to find out why the vendors of DLP systems
for Windows have not tried to take over the market of DLP solutions
for Linux platform. Is this fact for the reasons of difficulties
related to Linux, or maybe because of unwillingness of
business to Linux caused by many myths about this system?
To find it out, a small DLP system for Linux have been written.
It’s aim is to keep sensitive corporate data within the company.
System PXX works in end-point mode with same laws
for each user. It’s task is to block all the possible output channels
for selected processes to prevent data leakage, but without
making any problem to user. PXX is made of two
components. First - PXX-lkm is a loadable Linux kernel module
(2.6.18 and higher). His task is exchanging original system
calls of open, close, send, sendto and sendmsg functions with
own implementations, and communication with second component
- PXX daemon. The service is responsible for parsing
configuration file with paths of protected files and logging the
incidents in local log and system log. Both elements communicate
by netlink socket. This communication architecture allows
tear the components apart to insert own element
between to improve functionality.
Fig. 3. Architecture Rys. 3. Architektura
After launching the service and loading kernel module
service tries to access /etc/files files, which contains protected
files list. The module swaps original kernel’s system calls with
own functions (listing 1).
sys_call_table[__NR_open]=my_sys_open;
sys_open=sys_call_table[__NR_open];
sys_close=sys_call_table[__NR_close];
sys_call_table[__NR_close]=my_sys_close;
ELEKTRONIKA 11/2009 49