Insider Threat Control: Understanding Data Loss Prevention (DLP) and Detection by Correlating Events from Multiple Sources

Abstract

ix Tables Table 1: Instructions for Creating a New Auditing Policy 6 AbstractRemovable media, such as universal serial bus (USB) flash drives, present unique problems to the enterprise since insiders can use such media to remove proprietary information from company systems. Insiders may do this for legitimate reasons, such as to work on material at home, or they may do so for malicious reasons, such as to steal intellectual property.Organizations must establish and implement effective methods and processes to prevent unauthorized use of removable media while still allowing users with a genuine business need to access and remove such media. In addition, organizations should establish sound methods to track critical electronic assets so that they may better protect them.This report focuses on the theft of intellectual property using removable media, in particular, USB devices. We present methods to control removable media devices in a Microsoft Windows environment using Group Policy within an Active Directory environment. We also explore OpenDLP, an open source tool for identifying where sensitive data resides on organizational systems.

Technological and Information Governance Approaches to Data Loss and Leakage Mitigation

“…Many access mechanisms, such as universal serial bus (USB) drives or bring your own device (BYOD) technologies [21], allow for work mobility but may be used to steal intellectual property. [34] Here, the best advice of "awareness within the organization and at home" is unavailing, as "nothing will stop a determined user from clicking a link or installing something" [22] once they have determined a path forward-especially when that path includes intentional deceit.…”

Insider Threat Control: Using Universal Serial Bus (USB) Device Auditing to Detect Possible Data Exfiltration by Malicious Insiders

“…Sources, the use of removable media presents unique problems to the enterprise since insiders can use such media to remove proprietary information from company systems [1]. Insiders may do this for legitimate reasons, such as to work on material at home, or they may do so for malicious reasons, such as to steal intellectual property.…”

“…® CERT is a registered trademark owned by Carnegie Mellon University. 1 We discuss OSSEC further in Section 2.5, and we present background about and uses for Splunk in Section 5.…”

“…As discussed in a prior SEI report titled Insider Threat Control: Understanding Data Loss Prevention (DLP) and Detection by Correlating Events from Multiple Sources, Windows-based systems have a built-in method to audit USB events based on changes to the registry [1]. However, without sifting through registry keys, it is difficult to use this method to quickly ascertain which USB devices were used on a system.…”

Fuzzy Crime Investigation Framework for Tracking Data Theft based on USB Storage

“…But really only two of these are 'real' Registry keys. The others are aliases to branches within one of the two hives as [13][14][15][16][17][18] Windows Registry stores these data on a disk in several hive files. Just like a file system, Registry hive files contain clusters of data.…”