• United States

Plugging corporate data leaks

May 12, 20034 mins
Microsoft WordNetworking

Have you ever forwarded an e-mail to someone, then realized you left in original comments that the recipient wasn’t supposed to see? Or maybe you accidentally forwarded a private company memo to a journalist or client? Company information should be guarded at all times, and accidentally sending private information can be just as bad as doing it on purpose.

When you look inside any enterprise network, the disparity of information and the varying degrees of data classification sensitivity is dizzying. Is privacy-related human resources information more sensitive than product plans? Are customer lists more valuable than litigation preparation documents? Should all data be handled the same, or do some areas receive much more attention to security?

You can use antivirus software to contain data leaks abetted by Back Orifice or other remote administration tools. But “password recovery tool” is a mere product classification euphemism for “commercially sold password-cracking tool.” Sure, such tools have legitimate uses in a corporation, but do you really want the majority of your office staff password-cracking from their desks?

Thousands of subclasses of software present a danger to any company that cares about plugging its private information leakage. Products such as Pest Patrol and OptOut can help you uncover remotely installed spyware and steganography, in which information is hidden in seemingly innocuous files and documents.

We all receive Word and Excel documents. The first rule in opening any attachment is to make sure it has been thoroughly scanned for viruses. But when you are sending someone a .DOC file, what exactly are you sending him? You would like to think that the contents of the file are all you are sending – but how wrong you are.

Unbeknownst to you, Microsoft adds information, called metadata, to every .DOC file you create. Worse yet, this information is invisible to you, unless you have the right tools to recover and examine it.

Metadata is much more than tracked changes or comments intentionally left in a document for group sharing. Microsoft metadata includes the last 10 authors of a document; full name and path of the location where the document is stored; white font information; amount of time spent editing the document; file properties; residual fast-save information; hyperlinks; smart tags; embedded text or graphic objects; and more. E-mailed documents might include embedded header information (sender name, e-mail address and subject). Even deleted text you thought was long gone can reappear, which can lead to an embarrassing or damaging situation.

I found an amazing array of edits and document-handling records in a recent story that my editor and I iterated. Try this: In Word, go to File, select Open, then in the “Files of type” drop-down list, select “Recover text from any file” and click Open. The document will open without the native .DOC formatting. Take a look at the end of the document. Voilà! Hidden secret metadata magically appears.

So what can we do about this security and confidentiality breach?

Many people are under the impression that converting a .DOC file to an .RTF file format will hide much of the Microsoft-collected information, but this is simply not the case, as shown by metadata recovery tools. However, when I converted my .DOC file to .txt, all of the offending information was swept away. This is not a practical solution for most business applications, because we like our .DOC files to be pretty and nicely formatted.

Now the tough question: How much private and confidential metadata do you want to send to friends, colleagues, partners, lawyers, journalists, clients and so on? Once you answer that question, have your techies look at a few of the products that will solve this problem, such as iScrubMetadata Assistant and Workshare Metawall.

First, you have to be aware. Then, you have to care. Only then can you do something. It’s your turn.

Winn Schwartau is the president of Interpact, Inc., a security awareness consulting firm, and the author of many books including " Information Warfare," " CyberShock," " Time Based Security" and " Internet and Computer Ethics for Kids." His popular speeches entertain government and commercial audiences on three continents.

More from this author