Skip Links

Network World

  • Social Web 
  • Email 
  • Close

Plugging corporate data leaks

By Winn Schwartau , Network World , 05/12/2003
Schwartau

Have you ever forwarded an e-mail to someone, then realized you left in original comments that the recipient wasn't supposed to see? Or maybe you accidentally forwarded a private company memo to a journalist or client? Company information should be guarded at all times, and accidentally sending private information can be just as bad as doing it on purpose.

When you look inside any enterprise network, the disparity of information and the varying degrees of data classification sensitivity is dizzying. Is privacy-related human resources information more sensitive than product plans? Are customer lists more valuable than litigation preparation documents? Should all data be handled the same, or do some areas receive much more attention to security?

You can use antivirus software to contain data leaks abetted by Back Orifice or other remote administration tools. But "password recovery tool" is a mere product classification euphemism for "commercially sold password-cracking tool." Sure, such tools have legitimate uses in a corporation, but do you really want the majority of your office staff password-cracking from their desks?

Thousands of subclasses of software present a danger to any company that cares about plugging its private information leakage. Products such as Pest Patrol and OptOut can help you uncover remotely installed spyware and steganography, in which information is hidden in seemingly innocuous files and documents.

We all receive Word and Excel documents. The first rule in opening any attachment is to make sure it has been thoroughly scanned for viruses. But when you are sending someone a .DOC file, what exactly are you sending him? You would like to think that the contents of the file are all you are sending - but how wrong you are.

Unbeknownst to you, Microsoft adds information, called metadata, to every .DOC file you create. Worse yet, this information is invisible to you, unless you have the right tools to recover and examine it.

Metadata is much more than tracked changes or comments intentionally left in a document for group sharing. Microsoft metadata includes the last 10 authors of a document; full name and path of the location where the document is stored; white font information; amount of time spent editing the document; file properties; residual fast-save information; hyperlinks; smart tags; embedded text or graphic objects; and more. E-mailed documents might include embedded header information (sender name, e-mail address and subject). Even deleted text you thought was long gone can reappear, which can lead to an embarrassing or damaging situation.

Partner Content

Brilliantly simple security and control solutions for email, web and endpoint

www.sophos.com

Stopping data leakage

Learn how to exploit your current security investment to control the information that flows into, through and out of your network.

Download the white paper.

Why detection rates aren't enough

Evaluating endpoint security products is a time-consuming and daunting task. Learn the six critical questions you need to ask prospective vendors to get the right endpoint solution.

Download the white paper.

Applications: taking back control

Employees installing unauthorized applications is a growing threat to business security and productivity. Cost-effectively reduce this threat by integrating control into your malware protection.

Learn more today.

Comment
Login
Forgot your account info?
Add comment
Anonymous comments subject to approval. Register here for member benefits.
Have a NetworkWorld account? Log in here. Register now for a free account.

Videos

rssRss Feed

Whitepapers

Magic Quadrant for Application Delivery Controllers

Gartner summarizes its view on Application Delivery Controllers, evaluates strengths and weaknesses...

Vulnerability Management For Dummies

Download this concise book "Vulnerability Management for Dummies," to learn about the simple steps...

The ROI and TCO Benefits of Data Deduplication for Data Protection in the Enterprise

This paper examines and quantifies the costs and benefits of backup with deduplication storage as...

Webcasts

Transforming the Enterprise WAN Edge: Video from Cisco

Life on the edge of your WAN has changed dramatically. With the need to deliver advanced services,...

PoE Plus: Impact on the PoE Market

The standard for Power over Ethernet (PoE), IEEE Std. 802.3af(tm)-2003, advanced networking,...

Harnessing the power of communications to increase workplace performance

Due to the convergence of IT and telecommunications technologies, the business workplace has been...

Special Reports

The Evolution of Network Security

We have so many holes punched in our firewalls today that many industry insiders question the value...

The self-managed network

We aren't there yet, but advances in network and systems management tools are making it possible to...

Get instant email notification when white papers, webcasts, executive guides are added to our library. Stay informed and up-to-date with the latest on IT Technologies with Network World's Resource Alerts.