Upload File

can something be learned from the lichtenstein tax affair? · 3. agenda. 1. the script 2. the...

  • Home
  • Documents
  • Can something be learned from the Lichtenstein tax affair? · 3. Agenda. 1. The Script 2. The InfoSec Incident 3. Risk Management view on the incident 4. Controls with regard to Data
68
The data went down the drain Can something be learned from the Lichtenstein tax affair? Presenter: Dror-John Roecher

Upload: others

Post on 22-May-2020

0 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: Can something be learned from the Lichtenstein tax affair? · 3. Agenda. 1. The Script 2. The InfoSec Incident 3. Risk Management view on the incident 4. Controls with regard to Data

The data went down the drain

Can something be learned from the Lichtenstein tax affair?

Presenter: Dror-John Roecher

Page 2: Can something be learned from the Lichtenstein tax affair? · 3. Agenda. 1. The Script 2. The InfoSec Incident 3. Risk Management view on the incident 4. Controls with regard to Data

2The Data went down the drain - Troopers 08

My Personal Disclaimer

There are many rumors regarding what happened.There are many unanswered questions regarding what happened.For this talk we assume that what is publicly known is what acutally happened.

The ideas & opinions presented are my own and do not represent my employers‘ views or opinions.

Page 3: Can something be learned from the Lichtenstein tax affair? · 3. Agenda. 1. The Script 2. The InfoSec Incident 3. Risk Management view on the incident 4. Controls with regard to Data

3The Data went down the drain - Troopers 08

Agenda

1. The Script2. The InfoSec Incident3. Risk Management view on the incident4. Controls with regard to Data Leakage5. Technical Data Loss / Data Leak Prevention6. Could Lichtenstein have been prevented?7. Lessons Learned

Page 4: Can something be learned from the Lichtenstein tax affair? · 3. Agenda. 1. The Script 2. The InfoSec Incident 3. Risk Management view on the incident 4. Controls with regard to Data

4The Data went down the drain - Troopers 08

Agenda

1. The Script2. The InfoSec Incident3. Risk Management view on the incident4. Controls with regard to Data Leakage5. Technical Data Loss / Data Leak Prevention6. Could Lichtenstein have been prevented?7. Lessons Learned

Page 5: Can something be learned from the Lichtenstein tax affair? · 3. Agenda. 1. The Script 2. The InfoSec Incident 3. Risk Management view on the incident 4. Controls with regard to Data

The script

What happened?Who was involved?

Page 6: Can something be learned from the Lichtenstein tax affair? · 3. Agenda. 1. The Script 2. The InfoSec Incident 3. Risk Management view on the incident 4. Controls with regard to Data

6The Data went down the drain - Troopers 08

The Actors

Mule: Mr. Kieber Intelligence: BND

Legal ProsecutionA Bank: LGT Wealthy Individuals

Tax Crime Investigation

Page 7: Can something be learned from the Lichtenstein tax affair? · 3. Agenda. 1. The Script 2. The InfoSec Incident 3. Risk Management view on the incident 4. Controls with regard to Data

7The Data went down the drain - Troopers 08

The Stage

Sells DVD

Passes DVD on as„administrative assistance“

Calls on legal prosecution

Starts tax evasionInvestigation

Copies data regarding trusts/accounts on DVD

Found trust with LGTto evade German taxes

Page 8: Can something be learned from the Lichtenstein tax affair? · 3. Agenda. 1. The Script 2. The InfoSec Incident 3. Risk Management view on the incident 4. Controls with regard to Data

8The Data went down the drain - Troopers 08

Common questions…

Did the BND break German or Lichtenstein law?Did Mr. Kieber break Lichtenstein law?Was the action taken by the BND legitimate?

The answer to all these questions is: I don’t care.Whether or not the players acted within legal boundaries or not is not relevant:

Incidents don’t care about “legality”Incidents don’t care about “legitimacy”

Page 9: Can something be learned from the Lichtenstein tax affair? · 3. Agenda. 1. The Script 2. The InfoSec Incident 3. Risk Management view on the incident 4. Controls with regard to Data

9The Data went down the drain - Troopers 08

Chronology ( [1], [2], [4], [5] )

02/14

First public notice:Seizure at Klaus Zumwinckel,CEO of “Deutsche Post”,regarding tax evasion

02/15

Zumwinckel resigns.Hundreds of suspects.

03/11

International warrantfor Mr. Kieber…

02/16

Public discussion of“buying data” and criticism of “handlingstolen goods” (fruits ofthe poisonous trees).

02/18 02/20

Second prominent suspect:Karl Michael Betzl, Privacy Officer of Bavaria.

Hundreds of seizuresaccross Germany.Increased rate ofSelf-denunciation

02/23 02/24

LGT Bank starts to Defend Itself. It announces it willsue the (alreadyconvicted) data-thief:Heinrich Kieber

02/29

Questions about theauthenticity of Kieber asinformant arise.

02/26

Germany announces it willgive away the data toother interested nations.

Page 10: Can something be learned from the Lichtenstein tax affair? · 3. Agenda. 1. The Script 2. The InfoSec Incident 3. Risk Management view on the incident 4. Controls with regard to Data

10The Data went down the drain - Troopers 08

Looks like a really „bad guy“ [5]

Page 11: Can something be learned from the Lichtenstein tax affair? · 3. Agenda. 1. The Script 2. The InfoSec Incident 3. Risk Management view on the incident 4. Controls with regard to Data

11The Data went down the drain - Troopers 08

Mr. Kieber’s Motivation?

According to [3]: MoneyHelp stopping

Tax evasionCorruptionMoney laundering

Page 12: Can something be learned from the Lichtenstein tax affair? · 3. Agenda. 1. The Script 2. The InfoSec Incident 3. Risk Management view on the incident 4. Controls with regard to Data

12The Data went down the drain - Troopers 08

Mr. Kieber’s history… [6], [7], [8]

1997 International warrant against Mr. Kieber for a CHF 600.000 check-fraud in Spain.

04/2001 – 01/2003 LGT employee: tasked with the digitalization of paper-based account data.

2003 attempted extortion against Lichtenstein (tried to get 2 fake passports in order to escape the international warrant).

2003: Turned himself in to Lichtenstein criminal prosecution.

Page 13: Can something be learned from the Lichtenstein tax affair? · 3. Agenda. 1. The Script 2. The InfoSec Incident 3. Risk Management view on the incident 4. Controls with regard to Data

13The Data went down the drain - Troopers 08

Mr. Kieber’s history… [6], [7], [8]

2004: Pleaded guilty at trial, promised to return all stolen (LGT) data, was sentenced to 1 year prison (3 years according to some sources).

10/2004: Spanish International warrant canceled.

11/2005: Procedures in Spain discontinued.

01/2006: First Email to BND offering data…

Page 14: Can something be learned from the Lichtenstein tax affair? · 3. Agenda. 1. The Script 2. The InfoSec Incident 3. Risk Management view on the incident 4. Controls with regard to Data

14The Data went down the drain - Troopers 08

More questions…

If Mr. Kieber worked at LGT from 2001-2003, how come the BND claims to have data up to 2005?Was/is there an other informant?Who leaked Mr. Kieber’s name and why?

The answer to all these questions is: I don’t care –for the scope of this talk, these questions are not relevant: The data was disclosed, regardless of personal history / political motives.

Page 15: Can something be learned from the Lichtenstein tax affair? · 3. Agenda. 1. The Script 2. The InfoSec Incident 3. Risk Management view on the incident 4. Controls with regard to Data

15The Data went down the drain - Troopers 08

Agenda

1. The Script2. The InfoSec Incident3. Risk Management view on the incident4. Controls with regard to Data Leakage5. Technical Data Loss / Data Leak Prevention6. Could Lichtenstein have been prevented?7. Lessons Learned

Page 16: Can something be learned from the Lichtenstein tax affair? · 3. Agenda. 1. The Script 2. The InfoSec Incident 3. Risk Management view on the incident 4. Controls with regard to Data

The InfoSec Incident

Page 17: Can something be learned from the Lichtenstein tax affair? · 3. Agenda. 1. The Script 2. The InfoSec Incident 3. Risk Management view on the incident 4. Controls with regard to Data

17The Data went down the drain - Troopers 08

Data Leakage / Data Loss

What happened in Lichtenstein is a case ofData Leakage / Data Loss

This can happen (and it does) in many different ways:Accidentally

Loss of data medium (USB-stick, etc.)Unintended disclosure (via email, mail to wrong recipient, etc)…

Deliberately“Business breaks security” approachThief / Hacker steals data / laptop / USB-stickInsider steals data / laptop / USB-stick / printer-outputDumpster diving…

Data Loss / Data Leakage can be a worst case scenario (think stolen identities, credit cards, r&d data …)

Page 18: Can something be learned from the Lichtenstein tax affair? · 3. Agenda. 1. The Script 2. The InfoSec Incident 3. Risk Management view on the incident 4. Controls with regard to Data

18The Data went down the drain - Troopers 08

An incident usually happens…

A worst-case incident usually happens, when…

Risk is not properly controlled

AND

A couple of minor defects coincide

Page 19: Can something be learned from the Lichtenstein tax affair? · 3. Agenda. 1. The Script 2. The InfoSec Incident 3. Risk Management view on the incident 4. Controls with regard to Data

19The Data went down the drain - Troopers 08

“Minor” defects w/ respect to Lichtenstein

HR of LGT failed to check or failed to be alarmed by Kiebers’ background, even tough he was hired to digitalize sensitive data.

“System” to digitalize data did not prevent copying of data (whereas system pertains the whole setup, including organizational controls, physical security, monitoring, etc.).

At the 2004 trial, LGT failed to assure the complete return of all data (how that could have been accomplished – I don’t know).

Page 20: Can something be learned from the Lichtenstein tax affair? · 3. Agenda. 1. The Script 2. The InfoSec Incident 3. Risk Management view on the incident 4. Controls with regard to Data

20The Data went down the drain - Troopers 08

Agenda

1. The Script2. The InfoSec Incident3. Risk Management view on the incident4. Controls with regard to Data Leakage5. Technical Data Loss / Data Leak Prevention6. Could Lichtenstein have been prevented?7. Lessons Learned

Page 21: Can something be learned from the Lichtenstein tax affair? · 3. Agenda. 1. The Script 2. The InfoSec Incident 3. Risk Management view on the incident 4. Controls with regard to Data

CISOs’ / Risk Managers’ Approach to theLichtenstein Affair

Page 22: Can something be learned from the Lichtenstein tax affair? · 3. Agenda. 1. The Script 2. The InfoSec Incident 3. Risk Management view on the incident 4. Controls with regard to Data

22The Data went down the drain - Troopers 08

Definitions: Threat, Risk & Vulnerabilities

Threats: Possible events with a negative impact. (E.g. “sensitive data is disclosed”).

Vulnerabilities: Circumstances which abet the “happening” of incidents. (E.g. “no classification of data present” – therefore no guideline for “what is classified?”)

Risk is always the risk associated with a threat and which is mitigated by controls.

Calculated risk and pyhsical control

• Threat: Trap is triggered, Impact: Death

• Vulnerability: Mouse is susceptible to cheese

• Mitigating Control: Helmet (physical control, reducing impact to headache)

• Risk: Probability x Impact (see next slide)

Page 23: Can something be learned from the Lichtenstein tax affair? · 3. Agenda. 1. The Script 2. The InfoSec Incident 3. Risk Management view on the incident 4. Controls with regard to Data

23The Data went down the drain - Troopers 08

Simple Risk Formula

Risk(Threat) = Probability * Impact

How do controls come into place? Controls act either on the probability or on the impact…

Risk = (P – ControlsP ) * (I – ControlsI )

Page 24: Can something be learned from the Lichtenstein tax affair? · 3. Agenda. 1. The Script 2. The InfoSec Incident 3. Risk Management view on the incident 4. Controls with regard to Data

24The Data went down the drain - Troopers 08

Mitigating Controls

Controls can be grouped into:

Managerial ControlsOperational ControlsTechnical Controls

Prob

abili

ty

Risk Control Strategy

Page 25: Can something be learned from the Lichtenstein tax affair? · 3. Agenda. 1. The Script 2. The InfoSec Incident 3. Risk Management view on the incident 4. Controls with regard to Data

25The Data went down the drain - Troopers 08

Managerial Controls

Address the design and implementation of the security planning process and security management

Management controls also address:Risk managementSecurity control reviews

Page 26: Can something be learned from the Lichtenstein tax affair? · 3. Agenda. 1. The Script 2. The InfoSec Incident 3. Risk Management view on the incident 4. Controls with regard to Data

26The Data went down the drain - Troopers 08

Operational Controls

Operational controls are those for operations and activities in such a way that they are conducted under specified conditions.

Operational controls may be documented through the use of work instructions, operational procedures or manuals.

Page 27: Can something be learned from the Lichtenstein tax affair? · 3. Agenda. 1. The Script 2. The InfoSec Incident 3. Risk Management view on the incident 4. Controls with regard to Data

27The Data went down the drain - Troopers 08

Operational Controls

They include:DocumentationConfiguration and change managementIncident response planningDisaster recovery planningSoftware development and test environmentOutsourced facilitiesPersonnel securityPhysical security

Page 28: Can something be learned from the Lichtenstein tax affair? · 3. Agenda. 1. The Script 2. The InfoSec Incident 3. Risk Management view on the incident 4. Controls with regard to Data

28The Data went down the drain - Troopers 08

Technical Controls

Address technical issues related to designing and implementing security in the organizationTechnologies necessary to protect assets are examined and selected

They include Identification and authenticationAccess controlAudit and accountability…

Page 29: Can something be learned from the Lichtenstein tax affair? · 3. Agenda. 1. The Script 2. The InfoSec Incident 3. Risk Management view on the incident 4. Controls with regard to Data

29The Data went down the drain - Troopers 08

Agenda

1. The Script2. The InfoSec Incident3. Risk Management view on the incident4. Controls with regard to Data Leakage5. Technical Data Loss / Data Leak Prevention6. Could Lichtenstein have been prevented?7. Lessons Learned

Page 30: Can something be learned from the Lichtenstein tax affair? · 3. Agenda. 1. The Script 2. The InfoSec Incident 3. Risk Management view on the incident 4. Controls with regard to Data

Controls with regard to Data Leakage

Page 31: Can something be learned from the Lichtenstein tax affair? · 3. Agenda. 1. The Script 2. The InfoSec Incident 3. Risk Management view on the incident 4. Controls with regard to Data

31The Data went down the drain - Troopers 08

Threat: Deliberate Data Leakage

Least FeasibleMemorizing data: writing it down at home Manual notes: taken home/emailed home

Somewhat FeasiblePaper copied: taken home - then digitized Photographs: taken home on DigiCamScreenshots: printed & taken home/emailed home

Most FeasibleData attached to Email: then mailed homeData copied: to USB/CD/DVD, taken home

Most work

Least likely

Least work

Most likely

Page 32: Can something be learned from the Lichtenstein tax affair? · 3. Agenda. 1. The Script 2. The InfoSec Incident 3. Risk Management view on the incident 4. Controls with regard to Data

32The Data went down the drain - Troopers 08

Managerial Controls

Perform Risk Analysis to identify and mitigate the risks. Forms the basis of all other controls.

Page 33: Can something be learned from the Lichtenstein tax affair? · 3. Agenda. 1. The Script 2. The InfoSec Incident 3. Risk Management view on the incident 4. Controls with regard to Data

33The Data went down the drain - Troopers 08

Operational Controls

Policies:No Email from “data digitizing” system (“prohibited use policy”)Limitation of USB devices (“prohibited use policy”)No camera/mobile phone on premises (“prohibited use policy”)

HRThorough background-screening of employees

IT-OperationsNo CD-RW on “data digitizing” system ( “minimal machine”)No copier accessible for data-digitizing personnel or in data-digitizing-premises (“least privilege”)

Page 34: Can something be learned from the Lichtenstein tax affair? · 3. Agenda. 1. The Script 2. The InfoSec Incident 3. Risk Management view on the incident 4. Controls with regard to Data

34The Data went down the drain - Troopers 08

Technical Controls

General Policy EnforcementNo USB support in “data digitizing” system: Easy to disable USB, mature “device control products” available.

No Email from “data digitizing” system (policy enforcement): Easy, no additional products needed. Simple case of suppressing connectivity / can be handled at the network layer.

Targeted Technical ControlsData Leak/Data Loss Prevention System (DLP): a new technology

Page 35: Can something be learned from the Lichtenstein tax affair? · 3. Agenda. 1. The Script 2. The InfoSec Incident 3. Risk Management view on the incident 4. Controls with regard to Data

35The Data went down the drain - Troopers 08

Agenda

1. The Script2. The InfoSec Incident3. Risk Management view on the incident4. Controls with regard to Data Leakage5. Technical Data Loss / Data Leak Prevention6. Could Lichtenstein have been prevented?7. Lessons Learned

Page 36: Can something be learned from the Lichtenstein tax affair? · 3. Agenda. 1. The Script 2. The InfoSec Incident 3. Risk Management view on the incident 4. Controls with regard to Data

Technical Data Loss / Data Leak Prevention

How it works

Page 37: Can something be learned from the Lichtenstein tax affair? · 3. Agenda. 1. The Script 2. The InfoSec Incident 3. Risk Management view on the incident 4. Controls with regard to Data

37The Data went down the drain - Troopers 08

Security hype cycle

Page 38: Can something be learned from the Lichtenstein tax affair? · 3. Agenda. 1. The Script 2. The InfoSec Incident 3. Risk Management view on the incident 4. Controls with regard to Data

38The Data went down the drain - Troopers 08

DLP vs Digital Rights Management (DRM)

DLP is basically a spin-off of DRM.The “music industry” wanted to protect music from illegal copying and developed DRM which enables the provider to define rights regarding copying, playing, converting, etc...

Example: Microsoft Zune Player DRM [9]

DLP is “just a flavor” of automatic DRM.

Page 39: Can something be learned from the Lichtenstein tax affair? · 3. Agenda. 1. The Script 2. The InfoSec Incident 3. Risk Management view on the incident 4. Controls with regard to Data

39The Data went down the drain - Troopers 08

Definition of DLP [10]

“Products that, based on central policies, identify, monitor, and protect data at rest, in motion, and in

use, through deep content analysis.”

Key concepts:Central PolicyDeep analysisBroad coverage across platformsProtect data in motion & at rest & in use

Page 40: Can something be learned from the Lichtenstein tax affair? · 3. Agenda. 1. The Script 2. The InfoSec Incident 3. Risk Management view on the incident 4. Controls with regard to Data

40The Data went down the drain - Troopers 08

Central Policy / Data Classification

Creation, Management and Workflow for the definition of the policy:

Needs data classification scheme and associated actions:

Page 41: Can something be learned from the Lichtenstein tax affair? · 3. Agenda. 1. The Script 2. The InfoSec Incident 3. Risk Management view on the incident 4. Controls with regard to Data

41The Data went down the drain - Troopers 08

Deep Analysis

Deep Analysis means:Look at the Content and Context of the analyzed data:

Content: The actual content of the dataContext: Context in which the data is used (source, destination, time/date, meta-data, etc.)

Content-Analysis is focus for DLP.

Page 42: Can something be learned from the Lichtenstein tax affair? · 3. Agenda. 1. The Script 2. The InfoSec Incident 3. Risk Management view on the incident 4. Controls with regard to Data

42The Data went down the drain - Troopers 08

Content Analysis Techniques [10]Rule-Based/Regular Expression (look for an expression)

Database Fingerprinting / Exact Data Matching (e.g. look for specific CC-Number)

Exact File Matching (look for a specific file via “hashes”)

Partial Document Matching (look for specific parts of a document)

Statistical Analysis

Categories (prebuilt categories with rules & dictionaries for specific types of sensitive data - e.g. HIPAA, PCI).

Manual Classification by originator

Page 43: Can something be learned from the Lichtenstein tax affair? · 3. Agenda. 1. The Script 2. The InfoSec Incident 3. Risk Management view on the incident 4. Controls with regard to Data

43The Data went down the drain - Troopers 08

Manual Classification Example

Page 44: Can something be learned from the Lichtenstein tax affair? · 3. Agenda. 1. The Script 2. The InfoSec Incident 3. Risk Management view on the incident 4. Controls with regard to Data

44The Data went down the drain - Troopers 08

An example for „manual classification“

Policy and Key

Document Creation & classification

Transport via Email

Authentication

Policy and Key

Mailserver

Rights-Management-Server

Page 45: Can something be learned from the Lichtenstein tax affair? · 3. Agenda. 1. The Script 2. The InfoSec Incident 3. Risk Management view on the incident 4. Controls with regard to Data

45The Data went down the drain - Troopers 08

Fingerprinting & Detection

0x9678A

0x59A06

0x1678A0x461BD

0x66A1A

0x6678A0x4D1810xB678A

01011100110100110000101100 100100 1000111 011 0110011 0111101

DatabaseRecord orDocument

AlgorithmicConversion

Hash

Fingerprinting0xB67510xB61C10x37CB20x5BD410x190C10x930050x590A90xA0001 0xB6751

0xB61C10x37CB20x5BD410x190C10x930050x590A90xA0001

Extract

FingerprintStorage &Indexing

Real-TimeFingerprint Comparison

Detection

Outbound Content(E-mail, Web, Fax, Print, etc.)

01011100110100110000101100 100100Extract

AlgorithmicConversion

Hash

0x5BD410x190C10x93005

FingerprintCreation

Page 46: Can something be learned from the Lichtenstein tax affair? · 3. Agenda. 1. The Script 2. The InfoSec Incident 3. Risk Management view on the incident 4. Controls with regard to Data

46The Data went down the drain - Troopers 08

Analysis Ranking

Detection Granularity

Det

ectio

n A

ccur

acy

High

Low

Page 47: Can something be learned from the Lichtenstein tax affair? · 3. Agenda. 1. The Script 2. The InfoSec Incident 3. Risk Management view on the incident 4. Controls with regard to Data

47The Data went down the drain - Troopers 08

Broad Coverage

Operating System support (anyone got production data on Win98 boxes? Good luck!)

File type support (the more the better – but the more, the more parsers are needed, which might be used to attack the solution itself)

Nested files (embed a spreadsheet in a Word-Document and zip it – again a parsing problem)

At rest, in use & in motion (so obviously an agent on the clients is needed - and an inline box in the network-path –yet more points of failure)

Page 48: Can something be learned from the Lichtenstein tax affair? · 3. Agenda. 1. The Script 2. The InfoSec Incident 3. Risk Management view on the incident 4. Controls with regard to Data

48The Data went down the drain - Troopers 08

Role Based AccessC

lass

ifica

tion-

base

d rig

hts

man

agem

ent

Page 49: Can something be learned from the Lichtenstein tax affair? · 3. Agenda. 1. The Script 2. The InfoSec Incident 3. Risk Management view on the incident 4. Controls with regard to Data

A critical view on DLP

Page 50: Can something be learned from the Lichtenstein tax affair? · 3. Agenda. 1. The Script 2. The InfoSec Incident 3. Risk Management view on the incident 4. Controls with regard to Data

50The Data went down the drain - Troopers 08

Some critical thoughts on DLP

Not yet mature – lots of false positives (think of early-days Intrusion Detection Systems)

Yet another agent with high privileges and a parsing-engine: susceptible to attack resulting in system compromise

Added complexity – contradicts “Keep It Simple” paradigm of InfoSec

One more log-source: Incident Management, Monitoring adversely affected

Page 51: Can something be learned from the Lichtenstein tax affair? · 3. Agenda. 1. The Script 2. The InfoSec Incident 3. Risk Management view on the incident 4. Controls with regard to Data

51The Data went down the drain - Troopers 08

More critical thoughts on DLP

One more Helpdesk-Problem: “I can’t mail that file!”

Doesn’t address the problem – it is just a fix to the symptoms (thinking of ‘nappies’ when hearing ‘leakage’?)

Needs working data classification – if classification already works, why do you need leak prevention?

How is encrypted traffic handled? With key escrow? (not again!)

Page 52: Can something be learned from the Lichtenstein tax affair? · 3. Agenda. 1. The Script 2. The InfoSec Incident 3. Risk Management view on the incident 4. Controls with regard to Data

52The Data went down the drain - Troopers 08

Agenda

1. The Script2. The InfoSec Incident3. Risk Management view on the incident4. Controls with regard to Data Leakage5. Technical Data Loss / Data Leak Prevention6. Could Lichtenstein have been prevented?7. Lessons Learned

Page 53: Can something be learned from the Lichtenstein tax affair? · 3. Agenda. 1. The Script 2. The InfoSec Incident 3. Risk Management view on the incident 4. Controls with regard to Data

Could the Lichtenstein Data Leak have been prevented?

Page 54: Can something be learned from the Lichtenstein tax affair? · 3. Agenda. 1. The Script 2. The InfoSec Incident 3. Risk Management view on the incident 4. Controls with regard to Data

54The Data went down the drain - Troopers 08

Prevention with DLP

Lichtenstein may have been preventable with a working DLP under the following circumstances:

When digitizing the paper, the files are DLP-treated before they are written to disk – which means it needs to integrate into the scanning-application, or run in kernel-space to intercept file-create-operations.

The DLP policy applies “copy/mail prevention” per default to the newly created files (maybe based on context, rather then content).

The DLP rights don’t collide with the access-control of the Document Management System (DMS) which is used to store the digitized data.

The DLP is able to enforce the protection within the used DMS.

Page 55: Can something be learned from the Lichtenstein tax affair? · 3. Agenda. 1. The Script 2. The InfoSec Incident 3. Risk Management view on the incident 4. Controls with regard to Data

55The Data went down the drain - Troopers 08

Prevention with Classical Controls

Policies would not have worked because the offender was a criminal – criminals don’t care about policies (policies are useful in other ways)Disabling USB support on the machine would have stopped the easy way of copyingDisabling Email support on the machine would have stopped the easy way of copyingAccess Control to copiers would have prevented making paper-copiesHR background screening would have prevented the offender being employed first hand (thereby eliminating the root cause of the leakage)

Page 56: Can something be learned from the Lichtenstein tax affair? · 3. Agenda. 1. The Script 2. The InfoSec Incident 3. Risk Management view on the incident 4. Controls with regard to Data

56The Data went down the drain - Troopers 08

Agenda

1. The Script2. The InfoSec Incident3. Risk Management view on the incident4. Controls with regard to Data Leakage5. Technical Data Loss / Data Leak Prevention6. Could Lichtenstein have been prevented?7. Lessons Learned

Page 57: Can something be learned from the Lichtenstein tax affair? · 3. Agenda. 1. The Script 2. The InfoSec Incident 3. Risk Management view on the incident 4. Controls with regard to Data

Lessons Learned

Page 58: Can something be learned from the Lichtenstein tax affair? · 3. Agenda. 1. The Script 2. The InfoSec Incident 3. Risk Management view on the incident 4. Controls with regard to Data

58The Data went down the drain - Troopers 08

More is less…

Even though DLP may have been able to prevent the Lichtenstein InfoSec incident…

It does not address the root cause (wrong people hired for the job)It addresses only some use-cases (what about non-digital data? What about encrypted data?)It adds another layer of complexity to security operationsIt requires another manageable agent with high privileges on the clients

Page 59: Can something be learned from the Lichtenstein tax affair? · 3. Agenda. 1. The Script 2. The InfoSec Incident 3. Risk Management view on the incident 4. Controls with regard to Data

59The Data went down the drain - Troopers 08

Less is more

Classical Controls would have been better suited, because…

They are able to address the root causeThey do not add more complexityThey apply to all dataThey mitigate risk beyond “Data Leakage” threats (e.g. USB enforcement also mitigates malware-infection threats)They are more mature and have a history of being manageable

Page 60: Can something be learned from the Lichtenstein tax affair? · 3. Agenda. 1. The Script 2. The InfoSec Incident 3. Risk Management view on the incident 4. Controls with regard to Data

60The Data went down the drain - Troopers 08

Lessons Learned

Information is a valuable asset – for outsiders too.

Data Leakage has happened, happens today and will happen in the future.

“Interested parties” are willing to spend $$$ to get information.

“Interested parties” include national intelligence agencies.

Page 61: Can something be learned from the Lichtenstein tax affair? · 3. Agenda. 1. The Script 2. The InfoSec Incident 3. Risk Management view on the incident 4. Controls with regard to Data

61The Data went down the drain - Troopers 08

Lessons Learned – continued

Offenders do not care about “legal restrictions”.

Risk analysis can help you to identify where the risks are.

HR is part of the overall security program – and needs to be made aware of that.

Classical Controls are usually still the better choice to get a grip on data leakage.

Technology (DLP) is not (yet) the answer.

Page 62: Can something be learned from the Lichtenstein tax affair? · 3. Agenda. 1. The Script 2. The InfoSec Incident 3. Risk Management view on the incident 4. Controls with regard to Data

Questions? And Answers

Page 63: Can something be learned from the Lichtenstein tax affair? · 3. Agenda. 1. The Script 2. The InfoSec Incident 3. Risk Management view on the incident 4. Controls with regard to Data

63The Data went down the drain - Troopers 08

Dror-John Röcher

Mobile: +49 (0) 172 2382946E-mail [email protected]

Thank you for listening…

Page 64: Can something be learned from the Lichtenstein tax affair? · 3. Agenda. 1. The Script 2. The InfoSec Incident 3. Risk Management view on the incident 4. Controls with regard to Data

References & QR-Codes

Page 65: Can something be learned from the Lichtenstein tax affair? · 3. Agenda. 1. The Script 2. The InfoSec Incident 3. Risk Management view on the incident 4. Controls with regard to Data

65The Data went down the drain - Troopers 08

References / URLs

[1]: http://diepresse.com/home/wirtschaft/economist/365681/index.do[2]: http://www.sueddeutsche.de/wirtschaft/special/674/159244/index.html/wirtschaft/artikel/523/161082/article.html[3]: http://www.focus.de/finanzen/steuern/steuerfahndung/steuer-skandal_aid_262655.html[4]: http://www.spiegel.de/wirtschaft/0,1518,537742,00.html[5]: http://www.landespolizei.li/News/Pressemitteilungen/tabid/850/articleType/ArticleView/articleId/263/ffentliche-Fahndung-nach-Heinrich-KIEBER.aspx[6]: http://www.heise.de/tp/r4/html/result.xhtml?url=/tp/r4/artikel/27/27381/1.html&words=LGT&T=LGT[7]: http://de.wikipedia.org/wiki/Heinrich_Kieber[8] http://www.handelsblatt.com/News/Recht-Steuern/Meldungen/_pv/_p/204872/_t/ft/_b/1395561/default.aspx/der-mann,-der-die-steuerdaten-klaute.html[9] http://en.wikipedia.org/wiki/Zune[10] http://securosis.com/publications/DLP-Whitepaper.pdf

Page 66: Can something be learned from the Lichtenstein tax affair? · 3. Agenda. 1. The Script 2. The InfoSec Incident 3. Risk Management view on the incident 4. Controls with regard to Data

66The Data went down the drain - Troopers 08

QR-Codes (ISO/IEC18004)

All referenced Web-sites are available as QR-Codes (visual tags).A tag-reader for your mobile devices can be downloaded here:

http://reader.kaywa.com/A tag-reader for your Windows-PC can be downloaded here:

http://www.bctester.de/

Page 67: Can something be learned from the Lichtenstein tax affair? · 3. Agenda. 1. The Script 2. The InfoSec Incident 3. Risk Management view on the incident 4. Controls with regard to Data

67The Data went down the drain - Troopers 08

URL QR-Codes[1] [2] [3]

[4] [5] [6]

Page 68: Can something be learned from the Lichtenstein tax affair? · 3. Agenda. 1. The Script 2. The InfoSec Incident 3. Risk Management view on the incident 4. Controls with regard to Data

68The Data went down the drain - Troopers 08

URL QR-Codes[7] [8] [9]

[10]


Neil lichtenstein, standardization

Lichtenstein 2015

Infosec Gateway

Roy Lichtenstein

Password threats - ISEA€¦ · For Virus Alerts, Incident & Vulnerability Reporting Handling Computer Security Incidents Be aware of Password Threats InfoSec Concept : 4

Roy Lichtenstein BiografÍa Roy Lichtenstein Nació En

Roy lichtenstein landscapes

Amy Lichtenstein

Lichtenstein Family Trust

Beazley InfoSec

Roy Lichtenstein Roy Lichtenstein 1923-1997

Lichtenstein Radars

Lichtenstein PROJECT

Lichtenstein--1 July 2016 ALEX LICHTENSTEIN Professor of History

WHO WAS ROY LICHTENSTEIN?nga.gov.au/Lichtenstein/PDF/NGA.LICHTENSTEIN ED CARDS.2.pdf · WHO WAS ROY LICHTENSTEIN? POP . ... Roy Lichtenstein using an electric hand tool to carve the

r aharon lichtenstein

Texas Department of Information Resources (DIR) InfoSec ... · EC-Council Certified Incident Handler Exam Prep Course 2025 • 2 Days The EC-Council Certified Incident Handler program

Cocconier Lichtenstein

Lichtenstein - Look Mickey - prefinaalstartwithart.org/onewebmedia/Lichtenstein - Look Mickey... · 2014. 1. 20. · Roy Lichtenstein Look Mickey is een kunstwerk van Roy Lichtenstein,

DOD INFOSEC Education, Training , Awareness & … INFOSEC 310 Windows NT Security for SAs (5 days) Training Materials (Po werpoint) l INFOSEC 201: ... 101 l INFOSEC inputs provided

Line like lichtenstein

Glossary InfoSec

National INFOSEC Organisations and INFOSEC Management in Hungary

Art Lesson 2 artist Roy Lichtenstein and home... · artist Roy Lichtenstein and create art work inspired by his style. Roy Lichtenstein Roy Lichtenstein was born in 1923 in America

Can something be learned from the Lichtenstein tax affair? 2008/The data went down th… · The Data went down the drain - Troopers 08 . 4. Agenda. 1. The Script 2. The InfoSec Incident

whoami Miguel Mota Veiga 29 years old; Infosec “Pro” since 2006; @Dognædis; Pen Testing, Security Audits, Forensic Analysis, Malware Analysis, Incident

Roy Lichtenstein præsentation

Lichtenstein v. Lichtenstein · [Cite as Lichtenstein v.Lichtenstein, 2020-Ohio-5080.] COURT OF APPEALS OF OHIO EIGHTH APPELLATE DISTRICT COUNTY OF CUYAHOGA RYAN LICHTENSTEIN, : Plaintiff-Appellee,