The email that left by mistake
A clerk attaches the wrong file to an email to a customer. It holds 2,000 card numbers.
Nothing was hacked. The data simply walked out of the front door.
Two controls guard that door: one watches the way out to the internet, the other watches what leaves.
Key words
| Word | What it means |
|---|---|
| Internet gateway | The one point where a network meets the internet, where traffic in and out can be checked. |
| Web filter | A control that blocks sites on a bad list or in a banned type. |
| Proxy | A server that fetches web pages for users, so it can check and log them. |
| Data leakage | Sensitive data leaving the organisation by mistake or on purpose. |
| DLP | Data leakage protection: tools that find sensitive data and stop it leaving. |
| Sensitive data | Data that would cause harm if it reached the wrong person, such as card numbers. |
| Access control | Deciding who may use which resource. |
| Network | Computers and devices linked so they can share data. |
| Malware | Software made to harm a computer or steal data. |
| Firewall | A gate that lets some traffic in or out and blocks the rest. |
The cells students fill in are left blank in this preview.
By the end of this lesson
Note
I can explain what internet gateway security and data leakage protection do, and how each is applied.
Starter: techniques
Have a go
Starter: techniques
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.
Cycle 1: the internet gateway
All traffic to and from the internet passes one place: the internet gateway. That makes it a good place for controls.
- Access control: users must sign in before they can reach the internet, so the log names the person.
- A web filter blocks bad sites and types of site.
- A proxy fetches pages for users, scans them for malware and keeps a log.
- It can also filter email and block known bad addresses.
Cycle 2: data leakage protection
DLP stops sensitive data leaving. The tool knows what to look for: card numbers, national insurance numbers, or files marked confidential.
It checks emails, uploads, and memory sticks. When it finds a match it can block, warn the user or tell the security team.
It works best when data has been classified first, as in the asset register lesson.
Run: find a card number in outgoing text
printf 'Hello\nMy card is 4111 1111 1111 1111\n' > /tmp/outgoing.txt && grep -E -c '([0-9]{4}[ -]?){3}[0-9]{4}' /tmp/outgoing.txtA command for the lesson’s lab terminal. It is shown here and not run.
What you should see
Note
The number 1: one line matches the pattern of a card number. The number is a well known test number, not a real card. A real DLP tool uses the same idea, with many more patterns, and then blocks the message.