Slashdot Mirror
OpenDLP Aims To Stem Data Loss
rollcall writes "A new free and open source tool, OpenDLP, has been released that will help organizations fight data loss caused by stolen laptops, missing HDDs, or compromised systems. OpenDLP is managed from a centralized Web application and it can simultaneously send and control thousands of non-intrusive agents to Microsoft Windows systems over NetBIOS that look for user-defined regular expressions in data at rest. When sensitive data is found, the agents 'phone home' to the Web app with their results. While organizations have continued to lose sensitive data even though many commercial products are available to help prevent this, perhaps the introduction of a free alternative will finally spur organizations to locate their sensitive data proactively before it is lost."
It just won't. That is all.
...isn't the problem with data loss NOT that the only copy of the data is physically lost, but that a copy of the data is out in the wild? This product seems to miss the point entirely.
Would OpenDLP allow the organization to search any computer, or just computers which have been set up by the organization?
The "continued to lose sensitive data" link suggested that JC Penney credit cards may have been compromised. I have a JCP credit card, but JC Penney transferred their credit card business to GEMB (General Electric Merchant Bank) years ago. I don't know if new JCP credit cards are issued through JC Penney or through GEMB, but would guess that a hacker would need to break into GEMB (not just JC Penney) data in order to steal enough information to charge things to the stolen credit cards.
it can simultaneously send and control thousands non-intrusive agents
Anyone else out there find this statement just a bit worrisome?
This ain't rocket surgery.
Turning off the NetBIOS service is one of the first things I do to any new computer.
Or did MS finally secure NetBIOS while I wasn't looking?
[Fuck Beta]
o0t!
Hmmm.... While this is usefull for several security functions, it only covers a small part of what i would consider a DLP solution. When (for example) sensitive information has to be allowed on the Notebook or PC of an employee, i want to make sure of several things:
What i want is a tool that lets me formulate a Policy concerning the aspects mentioned above (and more). E.g. certain information must not be stored localy (covered), that information may be stored when certain security criterias are matched and this information shell not be sent by email (unless employeed confirms this has been cleared with manager X).
Trying to prevent information to be stored on a PC of an employee is only a solution for a subset of the DLP problem. While i think this opensource solution is quite usefull, the name "OpenDLP" led me to expect more.
CU, Martin
P.S. I already see some companies using this to search for the sensitive word "application" on all employeed hard disks ;-)
Now we just have to wait for the version that flatlines intruders through DNI overstimulation and erases the data from the attacking host(s).
Emotions! In your brain!
Too many oxymorons here -- I don't know where to start!
The question that occurs to me is "How does it scan for sensitive information without revealing it?". That is, these regular expressions must contain strings which are uniquely (or nearly) found in sensitive information. Thus they, themselves, are very likely sensitive. And the agents containing them are running on computers which aren't supposed to contain sensitive information.
If all the sensitive information is marked by caveats which are not, themselves, sensitive (e.g. "IBM Confidential"), and you're only worried about whole documents, you can get around that. But that's not the most common case, I don't think.
^(?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14}|6(?:011|5[0-9][0-9])[0-9]{12}|3[47][0-9]{13}|3(?:0[0-5]|[68][0-9])[0-9]{11}|(?:2131|1800|35\d{3})\d{11})$
Oh yeah, it'll totally prevent loss...
It's better to vote for what you want and not get it than to vote for what you don't want and get it.
- E. Debs
So, in order to look for sensitive data in the wild I have to send sensitive data to agents in the wild?
At least they can claim a 100% hit rate.
A review of the tool was done a couple of days ago: http://blog.rootshell.be/2010/04/30/keep-an-eye-on-your-data-using-opendlp/
This product seems to solve two hacking problems in one fell swoop. First, it's well known that social engineering is time consuming. Secondly, once you have your hands on somebody else's data it's tedious to figure out which bits are the good ones.
With OpenDLP it's left to the user to set up a rudimentary botnet and then identify the juicy parts through a regex. Brilliant!
OK it might not be so, but nothing on the project website suggests it isn't. We'll know for sure only if the next release automates the transfer of bank info to Nigeria.
http://en.wikipedia.org/wiki/Luhn_algorithm
http://bavister.org/tools/genLuhn.php
False sense of security is a big problem, but you went overboard on your false positives example. Try again?
Let's say your an organization that cares more about intellectual property loss than personally identifiable information loss. What good is a text-string search going to get you when your content is an AutoCAD drawing with no searchable text? What I've come to find is that determining WHERE content comes from (drawing repository, ERP, CRM, etc.) is often more relevant to protecting data than trying to search for strings of text that might miss huge amounts of data you just couldn't knowingly develop a regex for.
This is an interesting first pass at a free DLP tool (the enterprise tools out there today are ridiculously expensive for small organizations), but until context is the main approach to a tool's attempt to stop data loss, it's inevitable going to leave the implementing company with rather large gaps in its data protection strategy.
sure- my work we always used 42+ 12 zeros to fake out our POS system.
it does check out.. and if I were writing something to test, I'd use that
however, I'd also expect that a positive result on the security software under discussion would be followed up on by a human eye looking at the data-- at which point it would be dismissed from consideration as a violation...
every day http://en.wikipedia.org/wiki/Special:Random
Then you're pretty much hosed? .doc, .ppt, .xls, etc. Sure, this OpenLDP may have a viewer, but what about .osts? .psts? .mdb? .edb? ? In Window land, there's so many opaque file formats and databases that to a regex parser would be garbage, but in knowledgeable hands can easily be opened and viewed.
body massage!
That well. I think you meant to say that NetBIOS didn't route that well. In my opinion, that's a much better way of wording it since you'd only be wrong grammatically instead of both grammatically and technically wrong.
Anyone else notice that parent, in an attempt to be witty with his grammatical retort, inadvertently inverting the logic of his sentence, thereby opening himself to the same criticisms? I wonder if there are individuals on /.who might wish to draw attention to such a mistake?
Like the Vericept/Trustwave one.
https://www.trustwave.com/dlp-overview.php