SYNOPSIS

Data loss possesses a constant risk for any business that utilizes a web browser interface...which is nearly every business. Information transferred to a client device is vulnerable to key loggers, video frame grabbers, and other malware attacks. Authorized users can maliciously steal confidential information, and unauthorized users may unintentionally leak private data. To mitigate these issues, IT departments can secure corporate servers and encrypt data transmissions. But sometimes, this is not enough. The user browser presents a weak link in what may otherwise be a strong chain of security. Fortunately, technologies are available to provide on demand, session-based browser security. In The Essential Series: Preventing Data Loss through Unsecure Browsers, security expert Dan Sullivan outlines the threats of unsecure browsers to data loss, and describes methods for protecting Web applications from client-side data loss due to malware or malicious user activity.

CHAPTER PREVIEWS

Article 1: Understanding Data Loss and the Threat of Unsecure Browsers

Advances in information technology have reduced the cost of doing business, formed opportunities to create new products, and reduced barriers to interacting with customers. These advances have come with a downside, though. Businesses face a virtually constant risk of data loss, in large part because of the way information flows in distributed systems. In the past, information might have flowed from a mainframe to a terminal hardwired to the mainframe. Anyone who wanted access to information needed both physical access to a terminal and logical access to data on the centralized repository. Today's information infrastructure is much less centralized, and as a result, the flow of data is much less centralized.

Information is easily transferred from reasonably secure corporate servers and networks to client devices that may harbor key loggers, video frame grabbers, and other malware. One of the advantages of contemporary application design is that it is possible to share information with large numbers of users at a relatively low marginal cost. However, this sharing ability brings with it potential threats.Authorized users can maliciously or unintentionally steal or leak confidential or private information. Both your systems and the people that use them can become conduits for the loss of private and confidential data.

Preventing data loss requires a multi‐pronged strategy. Users must be made aware of information security policies and procedures. Servers should be secured by removing unnecessary applications, closing unused network ports, and keeping the operating system (OS) patched. Data that is transmitted beyond the trusted corporate network should be encrypted. Unfortunately, these data loss prevention measures are not enough. In fact, you could invest more in securing application servers and network infrastructures and still not address a significant risk for data loss: the user browser.

The user browser is typically a weak link in what might otherwise be a strong chain of security. Fortunately, technologies are available to provide on‐demand, session‐based browser security. This three part series outlines the threats of unsecure browsers to data loss and describes methods for protecting Web applications from client‐side data loss due to malware or malicious user activity.

This first article in the series examines ways in which data loss occurs and countermeasures for reducing the risk of data loss. The second article describes techniques for preventing data leaks from Web applications. The final article examines the challenge of preventing data leaks from malicious and unintentional user activities.

Article 2: Preventing Data Leaks from Web Applications

Web applications are complex, distributed systems made up of multiple components, each of which requires particular security controls. Servers, network communications, and client devices can all become points of data loss. This article examines the risk of data leaks from Web browsers as well as methods for mitigating those risks.

Threats to Confidentiality and Privacy in Browsers

The browser is a virtually ubiquitous application that makes it an ideal platform for delivering client‐side applications. It also makes it an ideal target for someone seeking to steal private and confidential data. Three threats you should consider when designing Web applications are:

• Limits of SSL encryption
• Malware on the client device
• Lures to malicious Web sites

Any one of these could be the foundation for a data leak.

Article 3: Preventing Data Leaks from Malicious and Unintentional User Activities

The term data leak is something of a euphemism. Comparing data loss to the kinds of leaks that occur with plumbing captures the idea of a potentially slow but persistent loss, but it misses the potential role of human actions. The focus in this third and final article in this series focuses on the role of malicious and unintentional user activities in data loss and its prevention.

Risk of Loss of Enterprise Information by User Activities

Companies and other organizations can lose data because authorized users intentionally copy or capture data with the intent of using it in ways they are not authorized to do so. These organizations can also lose data because of mistakes, oversights, and other unintentional acts that leave information vulnerable to theft or tampering. The two types of user‐related data loss are so different, they warrant separate discussions.

Data Loss from Malicious User Activities

Web application users are granted access to data because they need that access to perform their jobs. Ideally, your authorization schemes are designed to grant all access that is needed to perform a task but not more than that. Even when minimal access rights are granted, you can see there are still many cases where you have to trust employees or business partners to not misuse the data that they can access. Consider examples of confidential or sensitive information that must be available to a wide range of employees:

• In a bank, tellers, branch managers, customer service representatives, and fraud detection specialists may all require the ability to read detailed customer financial information.
• In a health care situation, receptionists, nurses, doctors , pharmacists, and insurance processing staff will require varying levels of details about a patient, including data that is regulated as protected healthcare information.
• In a law firm, lawyers, clerks, and paralegals may need to share confidential client information such as trade secrets, human resources case information, and litigation material.

This list is not meant to imply that any group of employees is untrustworthy; it is designed to show the breadth of opportunity available to employees who are motivated to commit information theft. Many current security controls still provide the opportunity for a crime when the motivation is there.